Does your stack do what you meant?
Paste any CDK — hand-written, generated, or inherited. It runs through a real synth, every cdk-nag rule, and intent checks that compare the stack against what it was supposed to do. Nothing is deployed, no credentials, no account.
Press Run. The stack loaded here fails in a way worth seeing.
Or start from a stack that fails interestingly
The single most common AI-generated CDK mistake: a bucket left open to the world.
SSH open to the entire internet — the classic copy-paste ingress rule.
Website hosting straight off a bucket — no CDN, no TLS, no access logging.
A database with storage encryption off and backups barely configured.
Action "*" on Resource "*" — the permission grant that ends incident reviews.
A REST API wired to Lambda, wide open, with no access logging.
Fast to write, impossible to restore — no PITR, no encryption choice.
A CDN that will happily serve your site unencrypted, with no logging.
A queue with no server-side encryption and no dead-letter queue.
Network traffic no one can reconstruct after the fact.
Six characters, no symbols, no MFA — defaults nobody revisited.
The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.
What actually runs
Your TypeScript is compiled and synthesized in an isolated sandbox with no network and no permissions. If it can't produce a CloudFormation template, you find out here.
Every AwsSolutions rule runs against the synthesized template — the same ruleset teams use in CI, not a subset chosen to look impressive.
Checks declared in cloudsynth.intent.yml — the same file cloudsynth verify reads in CI — compare the stack against what it was supposed to do. A VPC with no flow logs synthesizes perfectly and passes every linter; only stated intent catches it.
Why the third stage is the point
Infrastructure code is usually syntactically fine — whoever, or whatever, wrote it. It compiles, it synthesizes, and most linters pass it. What it gets wrong is subtler: a bucket that is public when it should not be, a role with a wildcard nobody enumerated, a database with no way back from a bad write. Those are not syntax errors. They are the stack quietly not being what you asked for.
The playground runs the same engine that grades CloudSynth’s projects — there, it checks your work against a brief, checkpoint by checkpoint.
Browse projects — the first checkpoint is free →