Repository: cdklabs/cdk-validator-cfnguard (language: python)

Issue:
Configuration error in disabling CT rules
Hi Team, 

Thank you for the update to Guard 3.0 and adding additional Control Tower(CT) rules, 

I am trying to test this plugin against a S3 bucket. I am successful in my test on July 10th (should be using [v0.0.51] release based on date), and I am failing using the latest release to disable certain CT rules, which I believe is a bug. 

My procedure as follow, using Cloud9 environment on t3.small: 
1. Create CDK app
```
mkdir CdkApp && cd CdkApp
cdk init app --language typescript   
```
2. Replace the contents of the lib/cdk_app-stack.ts with the following code.
```
import { Stack, StackProps, Duration } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Bucket, BlockPublicAccess, BucketEncryption, StorageClass} from 'aws-cdk-lib/aws-s3';
 
export class CdkAppStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
   super(scope, id, props);
   const bucket = new Bucket(this, 'Bucket',{
     blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
     encryption: BucketEncryption.S3_MANAGED,
     lifecycleRules: [{
       transitions: [{
         storageClass: StorageClass.GLACIER,
         transitionAfter: Duration.days(90),
       }]
     }]
   });
 }
}
```
3. Replace the contents in bin/cdk_app.ts with the following code
```
#!/usr/bin/env node
import 'source-map-support/register';
import { App } from 'aws-cdk-lib';
import { CdkAppStack } from '../lib/cdk_app-stack';
import { CfnGuardValidator } from '@cdklabs/cdk-validator-cfnguard';

const app = new App({
  policyValidationBeta1: [
    new CfnGuardValidator({
      disabledRules: [
        'ct-s3-pr-2',  /* s3 access logging */
        'ct-s3-pr-4',  /* s3 event notification */
        'ct-s3-pr-9',  /* s3 object lock */
        'ct-s3-pr-10',  /* s3 SSE-KMS encryption */
        'ct-s3-pr-11'  /* s3 versioning */
      ]
    })
  ]});

new CdkAppStack(app, 'CdkAppStack');
```

After installing dependencies and run “cdk synth” disabled S3 rules still kicks in as part of the evaluation. 

Thank you!




Discussion / hints:
I think this is because of 

https://github.com/cdklabs/cdk-validator-cfnguard/blob/62bd1551a212b9b288c0bbf75653a9b33ab525b9/src/plugin.ts#L147

It needs to be 
```ts
...this.getRules(config.rulePaths).flatMap(rule => ['--rules', rule]), 
```

Fix patch:
diff --git a/src/plugin.ts b/src/plugin.ts
index a61ddf8..5a4275c 100644
--- a/src/plugin.ts
+++ b/src/plugin.ts
@@ -144,7 +144,7 @@ export class CfnGuardValidator implements IPolicyValidationPluginBeta1 {
   private execGuard(config: GuardExecutionConfig): Pick<PolicyValidationPluginReportBeta1, 'success' | 'violations'> {
     const flags = [
       'validate',
-      ...config.rulePaths.flatMap(rule => ['--rules', rule]),
+      ...this.getRules(config.rulePaths).flatMap(rule => ['--rules', rule]),
       ...config.templatePaths.flatMap(template => ['--data', template]),
       '--output-format', 'json',
       '--show-summary', 'none',


Test patch:
diff --git a/test/plugin.test.ts b/test/plugin.test.ts
index 637bbe9..ea95d66 100644
--- a/test/plugin.test.ts
+++ b/test/plugin.test.ts
@@ -156,10 +156,14 @@ describe('CfnGuardPlugin', () => {
     expect(execMock).toHaveBeenCalledTimes(1);
     expect(execMock).toHaveBeenCalledWith(expect.arrayContaining([
       '--rules',
-      path.join(__dirname, '../rules/control-tower/cfn-guard'),
+      path.join(__dirname, '../rules/control-tower/cfn-guard/efs'),
       '--data',
       'template.json',
     ]), { json: true });
+    expect(execMock).toHaveBeenCalledWith(expect.arrayContaining([
+      '--rules',
+      expect.not.stringContaining('s3'),
+    ]), { json: true });
   });
 
   test('additional rules can be provided', () => {