bug/docs: CDK-Pipeline children cannot be suppressed without first running buildPipeline()

[a-bigelow]

What is the problem?

NOTE: This could easily be considered a documentation problem, but for the sake of thoroughness I'm filing it as a bug.

When attempting to suppress elements of a CDK Pipeline, specifically one from the aws-cdk-lib/pipelines package, an error is thrown unless .buildPipeline() is called before the suppressions are applied.

Reproduction Steps

Clone this example repo and attempt to yarn cdk synth.

You should receive this error:

Error: Suppression path "/example-cdk-pipeline/DummyPipeline/Pipeline/ArtifactsBucket/Resource" did not match any resource. This can occur when a resource does not exist or if a suppression is applied before a resource is created.

The fix is simple: uncomment the dummyPipeline.buildPipeline() call in src/Pipeline/DummyPipeline.ts. After this, it will suppress as intended.

What did you expect to happen?

I was expecting the suppressions to be applied as expected.

What actually happened?

This error is thrown:

Error: Suppression path "/example-cdk-pipeline/DummyPipeline/Pipeline/ArtifactsBucket/Resource" did not match any resource. This can occur when a resource does not exist or if a suppression is applied before a resource is created.

cdk-nag version

2.14.46

Language

Typescript

Other information

I don't necessarily think it's on Cdk-Nag to fix this "issue", but adding a more helpful annotation and/or section to the readme on what exactly is meant by the below text snippet would be very helpful.

This can occur when a resource does not exist or if a suppression is applied before a resource is created.

I was stuck on this for a little bit until someone else who happened to know about .buildPipeline() came along and pointed out the issue.

[dontirun]

For context, this is related to aws/aws-cdk#18440.

Happy to take a PR for improving the documentation!

[a-bigelow]

@dontirun I'll try and take stab this week!