fix: use proper nag suppression reasoning

Author: weklund

modules/sagemaker/sagemaker-model-cicd/lib/utils/pipeline-artifacts-bucket.ts

@@ -48,7 +48,7 @@ export function createPipelineArtifactsBucket(
     NagSuppressions.addResourceSuppressions(pipelineArtifactsBucket, [
       {
         id: 'AwsSolutions-S1',
-        reason: 'The bucket stores pipeline artifacts, no logging required.',
+        reason: 'S3 access logging is optional and was not configured for this deployment.',
       },
     ]);
   }

modules/sagemaker/sagemaker-model-cicd/test/__snapshots__/mlops-code-pipeline-stack.test.ts.snap

@@ -1661,7 +1661,7 @@ exports[`MLOpsCodePipelineStack to match snapshot 1`] = `
           "rules_to_suppress": [
             {
               "id": "AwsSolutions-S1",
-              "reason": "The bucket stores pipeline artifacts, no logging required.",
+              "reason": "S3 access logging is optional and was not configured for this deployment.",
             },
           ],
         },

modules/sagemaker/sagemaker-model-cicd/test/__snapshots__/model-build-code-pipeline-stack.test.ts.snap

@@ -971,7 +971,7 @@ exports[`ModelBuildCodePipelineStack to match snapshot 1`] = `
           "rules_to_suppress": [
             {
               "id": "AwsSolutions-S1",
-              "reason": "The bucket stores pipeline artifacts, no logging required.",
+              "reason": "S3 access logging is optional and was not configured for this deployment.",
             },
           ],
         },

modules/sagemaker/sagemaker-model-cicd/test/__snapshots__/model-deploy-code-pipeline-stack.test.ts.snap

@@ -367,7 +367,7 @@ exports[`ModelDeployCodePipelineStack to match snapshot 1`] = `
           "rules_to_suppress": [
             {
               "id": "AwsSolutions-S1",
-              "reason": "The bucket stores pipeline artifacts, no logging required.",
+              "reason": "S3 access logging is optional and was not configured for this deployment.",
             },
           ],
         },

modules/sagemaker/sagemaker-templates/templates/batch_inference/product_stack.py

@@ -97,10 +97,7 @@ def __init__(
                 [
                     {
                         "id": "AwsSolutions-S1",
-                        "reason": (
-                            "S3 access logs are not required for CI/CD pipeline artifact buckets "
-                            "as they contain build artifacts, not user access data."
-                        ),
+                        "reason": "S3 access logging is optional and was not configured for this deployment.",
                     }
                 ],
             )

modules/sagemaker/sagemaker-templates/templates/xgboost_abalone/product_stack.py

@@ -260,10 +260,7 @@ def __init__(
                 [
                     {
                         "id": "AwsSolutions-S1",
-                        "reason": (
-                            "S3 access logs are not required for ML model artifact buckets as "
-                            "they contain training artifacts and models, not user access data."
-                        ),
+                        "reason": "S3 access logging is optional and was not configured for this deployment.",
                     }
                 ],
             )
@@ -272,10 +269,7 @@ def __init__(
                 [
                     {
                         "id": "AwsSolutions-S1",
-                        "reason": (
-                            "S3 access logs are not required for CI/CD pipeline artifact buckets "
-                            "as they contain build artifacts, not user access data."
-                        ),
+                        "reason": "S3 access logging is optional and was not configured for this deployment.",
                     }
                 ],
             )