in src/cdknag.ts [16:19]
static securityGroup(construct: cdk.Construct, rulesToSuppress: ruleToSuppress[]) {
const cfnResource = construct?.node.defaultChild as ec2.CfnSecurityGroup;
cfnResource?.addMetadata('cdk_nag', { rules_to_suppress: rulesToSuppress });
}