idea open to discussion: CDK for building and maintaining big threat models

[klahnen]

The YAML file can grow very fast when while you add more details to your threat model.

It will be great to:

• Add an import feature for having complementary YAML files that can be added to the main YAML file. YAML by default does not support imports.

Or

• Create a CDK to define our model as code.

[hupe1980]

I had also thought of CDK and gave it a shot:

• cdk-threagile

[fuzolan]

Both would be nice. At first sight, the work of @hupe1980 looks good!

[ezavgorodniy]

In 2023 it was implemented by @joreiche to be able to include other yamls. So for example one of threat model which I build looks like

includes:
  - common.yaml
  - data-assets.yaml
  - technical-assets.yaml
  - boundaries.yaml
  - risk-tracking.yaml

And inside this yaml files I have usual threagile yaml definitions.

Current implementation is based on merging fields and one file may unpredictably overwrite other file though.