Skip to content

CDK Guardrails: Dev vs Prod

Objective

Apply strong security controls in prod by default, while allowing dev to use restricted-access modes for safer testing.

This document provides a template pattern; adapt names to each repo's CDK structure.

Environment contract

Required environment variables:

  • ENVIRONMENT: dev or prod
  • DEV_ACCESS_MODE: allowlist or private (required in dev)
  • DEV_ALLOWED_CIDRS: comma-separated CIDRs (required when allowlist mode)

Validation helper (TypeScript sketch)

interface GuardrailConfig {
    environment: 'dev' | 'prod'
    devAccessMode?: 'allowlist' | 'private'
    devAllowedCidrs?: string[]
    isPublicIngressEnabled: boolean
}

export function validateGuardrails (cfg: GuardrailConfig): void {
    if (cfg.environment === 'prod') {
        if (cfg.isPublicIngressEnabled) {
            throw new Error(
                'Guardrail violation: prod cannot enable unrestricted public ingress',
            )
        }
        return
    }

    if (!cfg.devAccessMode) {
        throw new Error(
            'Guardrail violation: dev requires DEV_ACCESS_MODE=allowlist|private',
        )
    }

    if (cfg.devAccessMode === 'allowlist') {
        if (!cfg.devAllowedCidrs || cfg.devAllowedCidrs.length === 0) {
            throw new Error(
                'Guardrail violation: DEV_ALLOWED_CIDRS is required in allowlist mode',
            )
        }
    }
}

PROD

  • Keep current production architecture unchanged unless security is improved
  • No relaxed access flags
  • WAF and existing controls remain mandatory

DEV (allowlist mode)

  • Public entry allowed only with strict CIDR allowlist
  • Prefer VPN/office/jump-host CIDRs

DEV (private mode)

  • Use internal-only ALB/private networking
  • Access through VPN or bastion path

CI/CD checks

Add guardrail checks during synth/deploy:

  • Fail if ENVIRONMENT=prod with relaxed ingress
  • Fail if ENVIRONMENT=dev and DEV_ACCESS_MODE=allowlist but CIDRs missing
  • Fail if unknown environment values are passed

Suggested test matrix

  • dev + allowlist + cidrs -> pass
  • dev + allowlist + no cidrs -> fail
  • dev + private -> pass
  • prod + strict -> pass
  • prod + relaxed/open -> fail

Rollout note

Start guardrail validation in non-prod pipeline first, then enforce in prod after one release cycle of clean validation.