fix: isAcknowledged() misses acknowledgments on aws-cdk-lib >=2.262.1 due to prefix casing

[ben-buitendijk]

NagPack.isAcknowledged() strips a synthetic prefix that aws-cdk-lib's Validations.acknowledge() adds to bare (non-namespaced) rule IDs before writing them to construct metadata, so the stripped key can be compared against the real rule ID (e.g. AwsSolutions-S1).

Through aws-cdk-lib@2.261.0, that prefix was always lowercase annotation::, matching the regex here:

const ids = Object.keys(entry.data as Record<string, string>).map(
  (k) => k.replace(/^annotation::/, '')
);

As of aws-cdk-lib@2.262.1, Validations.qualifyId() was refactored to reuse a new shared constant, AnnotationPlugin.RULE_PREFIX = "Annotation" (capitalized), instead of its own internal lowercase constant. The prefix written to metadata is now Annotation::AwsSolutions-S1 instead of annotation::AwsSolutions-S1.

The regex above only matches the lowercase form, so on aws-cdk-lib >=2.262.1 the prefix is never stripped, the key never reduces to the bare rule ID, and Validations.of(construct).acknowledge({ id: "AwsSolutions-S1", ... }) silently stops suppressing anything — no error, the finding just reappears as if never acknowledged.

Compound rule IDs that embed their own :: (e.g. AwsSolutions-IAM5[Action::s3:GetBucket*]) are unaffected — qualifyId() passes those through unqualified because they don't hit the "add a prefix" branch, so this only breaks acknowledgment of simple, colon-free rule IDs like AwsSolutions-S1 or AwsSolutions-IAM4.

Here is a link to the commit that introduced the change in aws-cdk-lib: aws/aws-cdk@75893d9

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-04 10:02 UTC · Rule: default · triggered by rule Automatic merge on approval and successful build
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-08-04 10:03 UTC · at 287d596b1ac2fdd5e3d14e28bd50f4d10e55c5a6 · squash

This pull request spent 25 seconds in the queue, including 4 seconds running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub branch protection]
  • fix: isAcknowledged() misses acknowledgments on aws-cdk-lib >=2.262.1 due to prefix casing #2362
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build