cdk-nag v3 Moves Security Checks into CDK Policy Validation and Changes Exceptions

cdk-nag, the AWS CDK security checking library from cdklabs, was released as version 3.0.0 on June 12, 2026, with the current version at 3.0.2. The rewrite replaces its earlier Aspect-based rule packs with the CDK's built-in policy validation framework, so simply upgrading the version typically causes build errors. Exceptions now use Validations.of(construct).acknowledge() with a required reason instead of NagSuppressions, and wildcard findings must be acknowledged individually. The article demonstrates setup, exception handling, and Vitest-based testing with validateScope() using a fictional bike rental application, and explains how to write a custom rule pack.