The Security Group allows for 0.0.0.0/0 or ::/0 inbound access. in CDK

[Harshitha2401]

What is the problem?

Though the ports are specifically mentioned for inbound getting the error as "The Security Group allows for 0.0.0.0/0 or ::/0 inbound access." with the warning compliance as UNKNOWN.
Trying to suppress the warning is also not working

Reproduction Steps

NA

What did you expect to happen?

When the suppression code is written the error compliance to be changed to Suppressed.

What actually happened?

Compliance of the error remains as UNKNOWN even after suppression logic added in the code

cdk-nag version

2.28.3

Language

Python

Other information

No response

[dontirun]

You should be able to suppress the validation error. Can you provide a snippet to reproduce the issue?

[Harshitha2401]

Unable to provide complete code
PFB sample code
ec2_security_group = ec2.SecurityGroup(
scope=self,
id=construct_id ,
vpc=vpc,
security_group_name="securitygroup",
allow_all_outbound=False,
description="Restricting traffic",
disable_inline_rules=False,
)

    ec2_security_group.add_ingress_rule(
        peer=ec2.Peer.ipv4(vpc.vpc_cidr_block),
        connection=ec2.Port(
            protocol=ec2.Protocol("TCP"),
            string_representation="TCP port for ingress from worker nodes",
            from_port=3546,
            to_port=3546,
        ),
    )

Suprresion code:
suppression_rule=cdk_nag.NagPackSuppression(
id= <warning_Id>,
reason= "",
)

cdk_nag.NagSuppressions.add_resource_suppressions(
construct= self,
suppressions= [suppression_rule],
apply_to_children= False
)

cdk_nag.NagSuppressions.add_resource_suppressions_by_path(self,"<Resource_Path>",[suppression_rule])

[dontirun]

Unfortunately that's not enough to reproduce the issue you are having with suppressions.

What is the exact error message you are getting? What does your suppression look like?

[Harshitha2401]

There's no error
But the error status needs to change to "suppressed" which is not happening. Error status remains UNKNOWN

[dontirun]

The line should show up as suppressed in the report if the CdkNagValidationFailure warning message is suppressed