@dotzen/dotzen 0.0.1

package/dist/version/config.js

@@ -0,0 +1,66 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readDotzenJson = readDotzenJson;
+exports.enforceVersion = enforceVersion;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const result_1 = require("../result/result");
+const CANDIDATES = ['dotzen.json', path.join('.zen', 'dotzen.json')];
+function readDotzenJson(cwd) {
+    for (const rel of CANDIDATES) {
+        const p = path.join(cwd, rel);
+        if (fs.existsSync(p)) {
+            const parsed = JSON.parse(fs.readFileSync(p, 'utf8'));
+            return (0, result_1.ok)({ config: parsed, baseDir: path.dirname(p) });
+        }
+    }
+    return (0, result_1.err)({ kind: 'ConfigNotFound', path: path.join(cwd, 'dotzen.json') });
+}
+/**
+ * The first thing the CLI does. Refuse to run on a version mismatch
+ * (doc 03 / engine-dev skill). No pin configured => proceed.
+ */
+function enforceVersion(config, running) {
+    if (!config.version)
+        return (0, result_1.ok)(config);
+    if (config.version === running)
+        return (0, result_1.ok)(config);
+    return (0, result_1.err)({
+        kind: 'VersionMismatch',
+        required: config.version,
+        running,
+    });
+}

package/dist/vocabulary/azure.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Azure (azurerm) vocabulary. Kept in its own provider module — not merged
+ * into the AWS `AwsResource`/`AwsAttribute` enums — so each cloud's `spec.ts`
+ * reads in its own idiom and the enums stay small ("Prose as Code"). The
+ * shared `AnyResource`/`AnyAttribute` unions (in ./index) let the
+ * cloud-neutral engine accept every provider's vocabulary.
+ */
+export declare enum AzureResource {
+    NetworkSecurityGroup = "azurerm_network_security_group",
+    NetworkSecurityRule = "azurerm_network_security_rule",
+    StorageAccount = "azurerm_storage_account",
+    MssqlServer = "azurerm_mssql_server",
+    KeyVault = "azurerm_key_vault",
+    KubernetesCluster = "azurerm_kubernetes_cluster",
+    LinuxWebApp = "azurerm_linux_web_app",
+    WindowsWebApp = "azurerm_windows_web_app",
+    PostgresqlServer = "azurerm_postgresql_server",
+    MysqlServer = "azurerm_mysql_server",
+    ContainerRegistry = "azurerm_container_registry",
+    CosmosdbAccount = "azurerm_cosmosdb_account",
+    RoleDefinition = "azurerm_role_definition",
+    RoleAssignment = "azurerm_role_assignment",
+    ManagedDisk = "azurerm_managed_disk",
+    MonitorDiagnosticSetting = "azurerm_monitor_diagnostic_setting",
+    ApiManagement = "azurerm_api_management"
+}
+export declare enum AzureAttribute {
+    AllowNestedItemsToBePublic = "allow_nested_items_to_be_public",
+    MinTlsVersion = "min_tls_version",
+    PublicNetworkAccessEnabled = "public_network_access_enabled",
+    MinimumTlsVersion = "minimum_tls_version",
+    AdministratorLoginPassword = "administrator_login_password",
+    PurgeProtectionEnabled = "purge_protection_enabled",
+    PrivateClusterEnabled = "private_cluster_enabled",
+    LocalAccountDisabled = "local_account_disabled",
+    HttpsOnly = "https_only",
+    SslEnforcementEnabled = "ssl_enforcement_enabled",
+    AdminEnabled = "admin_enabled",
+    RoleActions = "permissions.actions",
+    RoleDefinitionName = "role_definition_name",
+    NetworkRulesDefaultAction = "network_rules.default_action",
+    NetworkAclsDefaultAction = "network_acls.default_action",
+    DiskEncryptionSetId = "disk_encryption_set_id",
+    TargetResourceId = "target_resource_id",
+    EnableFrontendTls10 = "security.enable_frontend_tls10",
+    EnableFrontendTls11 = "security.enable_frontend_tls11",
+    EnableBackendSsl30 = "security.enable_backend_ssl30"
+}
+export declare enum BuiltInRole {
+    Owner = "Owner",
+    Contributor = "Contributor"
+}
+export declare enum NetworkDefaultAction {
+    Deny = "Deny"
+}
+export declare enum StorageTlsVersion {
+    Tls12 = "TLS1_2"
+}
+export declare enum SqlTlsVersion {
+    V10 = "1.0",
+    V11 = "1.1",
+    V12 = "1.2"
+}

package/dist/vocabulary/azure.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * Azure (azurerm) vocabulary. Kept in its own provider module — not merged
+ * into the AWS `AwsResource`/`AwsAttribute` enums — so each cloud's `spec.ts`
+ * reads in its own idiom and the enums stay small ("Prose as Code"). The
+ * shared `AnyResource`/`AnyAttribute` unions (in ./index) let the
+ * cloud-neutral engine accept every provider's vocabulary.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SqlTlsVersion = exports.StorageTlsVersion = exports.NetworkDefaultAction = exports.BuiltInRole = exports.AzureAttribute = exports.AzureResource = void 0;
+var AzureResource;
+(function (AzureResource) {
+    AzureResource["NetworkSecurityGroup"] = "azurerm_network_security_group";
+    // Standalone NSG rule (the decomposed form of an inline `security_rule`).
+    AzureResource["NetworkSecurityRule"] = "azurerm_network_security_rule";
+    AzureResource["StorageAccount"] = "azurerm_storage_account";
+    AzureResource["MssqlServer"] = "azurerm_mssql_server";
+    AzureResource["KeyVault"] = "azurerm_key_vault";
+    AzureResource["KubernetesCluster"] = "azurerm_kubernetes_cluster";
+    AzureResource["LinuxWebApp"] = "azurerm_linux_web_app";
+    AzureResource["WindowsWebApp"] = "azurerm_windows_web_app";
+    AzureResource["PostgresqlServer"] = "azurerm_postgresql_server";
+    AzureResource["MysqlServer"] = "azurerm_mysql_server";
+    AzureResource["ContainerRegistry"] = "azurerm_container_registry";
+    AzureResource["CosmosdbAccount"] = "azurerm_cosmosdb_account";
+    AzureResource["RoleDefinition"] = "azurerm_role_definition";
+    AzureResource["RoleAssignment"] = "azurerm_role_assignment";
+    AzureResource["ManagedDisk"] = "azurerm_managed_disk";
+    AzureResource["MonitorDiagnosticSetting"] = "azurerm_monitor_diagnostic_setting";
+    AzureResource["ApiManagement"] = "azurerm_api_management";
+})(AzureResource || (exports.AzureResource = AzureResource = {}));
+var AzureAttribute;
+(function (AzureAttribute) {
+    // Storage account
+    AzureAttribute["AllowNestedItemsToBePublic"] = "allow_nested_items_to_be_public";
+    AzureAttribute["MinTlsVersion"] = "min_tls_version";
+    AzureAttribute["PublicNetworkAccessEnabled"] = "public_network_access_enabled";
+    // MSSQL server
+    AzureAttribute["MinimumTlsVersion"] = "minimum_tls_version";
+    AzureAttribute["AdministratorLoginPassword"] = "administrator_login_password";
+    // Key Vault
+    AzureAttribute["PurgeProtectionEnabled"] = "purge_protection_enabled";
+    // AKS
+    AzureAttribute["PrivateClusterEnabled"] = "private_cluster_enabled";
+    AzureAttribute["LocalAccountDisabled"] = "local_account_disabled";
+    // App Service (Linux/Windows web app)
+    AzureAttribute["HttpsOnly"] = "https_only";
+    // PostgreSQL / MySQL single server
+    AzureAttribute["SslEnforcementEnabled"] = "ssl_enforcement_enabled";
+    // Container Registry
+    AzureAttribute["AdminEnabled"] = "admin_enabled";
+    // RBAC (role_definition permissions block flattens to a list)
+    AzureAttribute["RoleActions"] = "permissions.actions";
+    AzureAttribute["RoleDefinitionName"] = "role_definition_name";
+    // Network default-deny (nested) + CMK + diagnostic association
+    AzureAttribute["NetworkRulesDefaultAction"] = "network_rules.default_action";
+    AzureAttribute["NetworkAclsDefaultAction"] = "network_acls.default_action";
+    AzureAttribute["DiskEncryptionSetId"] = "disk_encryption_set_id";
+    AzureAttribute["TargetResourceId"] = "target_resource_id";
+    // API Management legacy protocol toggles (nested under `security`)
+    AzureAttribute["EnableFrontendTls10"] = "security.enable_frontend_tls10";
+    AzureAttribute["EnableFrontendTls11"] = "security.enable_frontend_tls11";
+    AzureAttribute["EnableBackendSsl30"] = "security.enable_backend_ssl30";
+})(AzureAttribute || (exports.AzureAttribute = AzureAttribute = {}));
+// Built-in Azure roles that grant broad control (for denyValue on an
+// azurerm_role_assignment).
+var BuiltInRole;
+(function (BuiltInRole) {
+    BuiltInRole["Owner"] = "Owner";
+    BuiltInRole["Contributor"] = "Contributor";
+})(BuiltInRole || (exports.BuiltInRole = BuiltInRole = {}));
+// The secure default_action for storage/key-vault network rules.
+var NetworkDefaultAction;
+(function (NetworkDefaultAction) {
+    NetworkDefaultAction["Deny"] = "Deny";
+})(NetworkDefaultAction || (exports.NetworkDefaultAction = NetworkDefaultAction = {}));
+// Storage account TLS floor (note the storage-specific `TLS1_2` spelling).
+var StorageTlsVersion;
+(function (StorageTlsVersion) {
+    StorageTlsVersion["Tls12"] = "TLS1_2";
+})(StorageTlsVersion || (exports.StorageTlsVersion = StorageTlsVersion = {}));
+// MSSQL server TLS versions (a bare numeric string, unlike storage).
+var SqlTlsVersion;
+(function (SqlTlsVersion) {
+    SqlTlsVersion["V10"] = "1.0";
+    SqlTlsVersion["V11"] = "1.1";
+    SqlTlsVersion["V12"] = "1.2";
+})(SqlTlsVersion || (exports.SqlTlsVersion = SqlTlsVersion = {}));

package/dist/vocabulary/gcp.d.ts

@@ -0,0 +1,57 @@
+/**
+ * GCP (google) vocabulary. Its own provider module, like Azure's — behind
+ * the shared `AnyResource`/`AnyAttribute` unions in ./index. Members drop
+ * the provider prefix (`GcpResource.StorageBucket`), matching AWS/Azure.
+ *
+ * Note the concept-not-parity mapping: GCP's public-exposure and
+ * over-permission risks live in IAM *members* (`allUsers`) and *primitive
+ * roles* (`roles/owner`), which are the analog of an AWS `Action:"*"`
+ * wildcard — expressed here with the generic `denyValue` condition.
+ */
+export declare enum GcpResource {
+    ComputeFirewall = "google_compute_firewall",
+    StorageBucket = "google_storage_bucket",
+    StorageBucketIamMember = "google_storage_bucket_iam_member",
+    ProjectIamMember = "google_project_iam_member",
+    ComputeInstance = "google_compute_instance",
+    SqlDatabaseInstance = "google_sql_database_instance",
+    ContainerCluster = "google_container_cluster",
+    KmsCryptoKey = "google_kms_crypto_key",
+    ComputeSubnetwork = "google_compute_subnetwork"
+}
+export declare enum GcpAttribute {
+    PublicAccessPrevention = "public_access_prevention",
+    UniformBucketLevelAccess = "uniform_bucket_level_access",
+    Member = "member",
+    Role = "role",
+    ServiceAccountScopes = "service_account.scopes",
+    RootPassword = "root_password",
+    Ipv4Enabled = "settings.ip_configuration.ipv4_enabled",
+    SslMode = "settings.ip_configuration.ssl_mode",
+    CanIpForward = "can_ip_forward",
+    EnableSecureBoot = "shielded_instance_config.enable_secure_boot",
+    EnableLegacyAbac = "enable_legacy_abac",
+    EnablePrivateNodes = "private_cluster_config.enable_private_nodes",
+    NetworkPolicyEnabled = "network_policy.enabled",
+    RotationPeriod = "rotation_period",
+    VersioningEnabled = "versioning.enabled"
+}
+export declare enum PublicAccessPreventionMode {
+    Enforced = "enforced"
+}
+export declare enum IamMember {
+    AllUsers = "allUsers",
+    AllAuthenticatedUsers = "allAuthenticatedUsers"
+}
+export declare enum PrimitiveRole {
+    Owner = "roles/owner",
+    Editor = "roles/editor"
+}
+export declare enum OauthScope {
+    CloudPlatform = "https://www.googleapis.com/auth/cloud-platform",
+    CloudPlatformAlias = "cloud-platform"
+}
+export declare enum SqlSslMode {
+    EncryptedOnly = "ENCRYPTED_ONLY",
+    TrustedClientCertRequired = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
+}

package/dist/vocabulary/gcp.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * GCP (google) vocabulary. Its own provider module, like Azure's — behind
+ * the shared `AnyResource`/`AnyAttribute` unions in ./index. Members drop
+ * the provider prefix (`GcpResource.StorageBucket`), matching AWS/Azure.
+ *
+ * Note the concept-not-parity mapping: GCP's public-exposure and
+ * over-permission risks live in IAM *members* (`allUsers`) and *primitive
+ * roles* (`roles/owner`), which are the analog of an AWS `Action:"*"`
+ * wildcard — expressed here with the generic `denyValue` condition.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SqlSslMode = exports.OauthScope = exports.PrimitiveRole = exports.IamMember = exports.PublicAccessPreventionMode = exports.GcpAttribute = exports.GcpResource = void 0;
+var GcpResource;
+(function (GcpResource) {
+    GcpResource["ComputeFirewall"] = "google_compute_firewall";
+    GcpResource["StorageBucket"] = "google_storage_bucket";
+    GcpResource["StorageBucketIamMember"] = "google_storage_bucket_iam_member";
+    GcpResource["ProjectIamMember"] = "google_project_iam_member";
+    GcpResource["ComputeInstance"] = "google_compute_instance";
+    GcpResource["SqlDatabaseInstance"] = "google_sql_database_instance";
+    GcpResource["ContainerCluster"] = "google_container_cluster";
+    GcpResource["KmsCryptoKey"] = "google_kms_crypto_key";
+    GcpResource["ComputeSubnetwork"] = "google_compute_subnetwork";
+})(GcpResource || (exports.GcpResource = GcpResource = {}));
+var GcpAttribute;
+(function (GcpAttribute) {
+    // Storage bucket
+    GcpAttribute["PublicAccessPrevention"] = "public_access_prevention";
+    GcpAttribute["UniformBucketLevelAccess"] = "uniform_bucket_level_access";
+    // IAM member (bucket + project)
+    GcpAttribute["Member"] = "member";
+    GcpAttribute["Role"] = "role";
+    // Compute instance (nested → dotted)
+    GcpAttribute["ServiceAccountScopes"] = "service_account.scopes";
+    // Cloud SQL
+    GcpAttribute["RootPassword"] = "root_password";
+    GcpAttribute["Ipv4Enabled"] = "settings.ip_configuration.ipv4_enabled";
+    GcpAttribute["SslMode"] = "settings.ip_configuration.ssl_mode";
+    // Compute instance hardening
+    GcpAttribute["CanIpForward"] = "can_ip_forward";
+    GcpAttribute["EnableSecureBoot"] = "shielded_instance_config.enable_secure_boot";
+    // GKE (google_container_cluster)
+    GcpAttribute["EnableLegacyAbac"] = "enable_legacy_abac";
+    GcpAttribute["EnablePrivateNodes"] = "private_cluster_config.enable_private_nodes";
+    GcpAttribute["NetworkPolicyEnabled"] = "network_policy.enabled";
+    // KMS
+    GcpAttribute["RotationPeriod"] = "rotation_period";
+    // Storage bucket hardening
+    GcpAttribute["VersioningEnabled"] = "versioning.enabled";
+})(GcpAttribute || (exports.GcpAttribute = GcpAttribute = {}));
+var PublicAccessPreventionMode;
+(function (PublicAccessPreventionMode) {
+    PublicAccessPreventionMode["Enforced"] = "enforced";
+})(PublicAccessPreventionMode || (exports.PublicAccessPreventionMode = PublicAccessPreventionMode = {}));
+// Public IAM principals — the GCP "public exposure" anti-pattern.
+var IamMember;
+(function (IamMember) {
+    IamMember["AllUsers"] = "allUsers";
+    IamMember["AllAuthenticatedUsers"] = "allAuthenticatedUsers";
+})(IamMember || (exports.IamMember = IamMember = {}));
+// Primitive roles — the GCP over-permission anti-pattern (analog of `*`).
+var PrimitiveRole;
+(function (PrimitiveRole) {
+    PrimitiveRole["Owner"] = "roles/owner";
+    PrimitiveRole["Editor"] = "roles/editor";
+})(PrimitiveRole || (exports.PrimitiveRole = PrimitiveRole = {}));
+// Broad OAuth scopes on an instance service account (both alias + full URL).
+var OauthScope;
+(function (OauthScope) {
+    OauthScope["CloudPlatform"] = "https://www.googleapis.com/auth/cloud-platform";
+    OauthScope["CloudPlatformAlias"] = "cloud-platform";
+})(OauthScope || (exports.OauthScope = OauthScope = {}));
+// Cloud SQL SSL modes considered secure (the insecure default is
+// ALLOW_UNENCRYPTED_AND_ENCRYPTED). Use with `mustBeOneOf`.
+var SqlSslMode;
+(function (SqlSslMode) {
+    SqlSslMode["EncryptedOnly"] = "ENCRYPTED_ONLY";
+    SqlSslMode["TrustedClientCertRequired"] = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED";
+})(SqlSslMode || (exports.SqlSslMode = SqlSslMode = {}));

package/dist/vocabulary/index.d.ts

@@ -0,0 +1,174 @@
+import { AzureResource, AzureAttribute } from './azure';
+import { GcpResource, GcpAttribute } from './gcp';
+/**
+ * Closed vocabulary for every domain value (doc 02). No bare strings.
+ *
+ * NOTE: doc 02 specifies `const enum`. We use regular `enum` here because
+ * `const enum` cannot be inlined across files by the esbuild/Vitest
+ * transpiler under `isolatedModules`. Regular `enum` gives the identical
+ * typo-safety (a misspelled member is a compile error); only cross-file
+ * inlining differs, which is irrelevant here. See doc 02 note.
+ */
+export declare enum AwsResource {
+    SecurityGroup = "aws_security_group",
+    VpcSecurityGroupIngressRule = "aws_vpc_security_group_ingress_rule",
+    DbInstance = "aws_db_instance",
+    S3Bucket = "aws_s3_bucket",
+    S3BucketAcl = "aws_s3_bucket_acl",
+    S3BucketPublicAccessBlock = "aws_s3_bucket_public_access_block",
+    S3BucketPolicy = "aws_s3_bucket_policy",
+    EbsVolume = "aws_ebs_volume",
+    EfsFileSystem = "aws_efs_file_system",
+    KmsKey = "aws_kms_key",
+    Instance = "aws_instance",
+    DynamodbTable = "aws_dynamodb_table",
+    EcrRepository = "aws_ecr_repository",
+    IamPolicy = "aws_iam_policy",
+    IamRolePolicy = "aws_iam_role_policy",
+    EcsService = "aws_ecs_service",
+    EksCluster = "aws_eks_cluster",
+    Lb = "aws_lb",
+    LbListener = "aws_lb_listener",
+    EcsTaskDefinition = "aws_ecs_task_definition",
+    SecretsmanagerSecretVersion = "aws_secretsmanager_secret_version",
+    RdsCluster = "aws_rds_cluster",
+    RedshiftCluster = "aws_redshift_cluster",
+    ElasticacheReplicationGroup = "aws_elasticache_replication_group",
+    S3BucketServerSideEncryptionConfiguration = "aws_s3_bucket_server_side_encryption_configuration",
+    S3BucketVersioning = "aws_s3_bucket_versioning",
+    SecretsmanagerSecret = "aws_secretsmanager_secret",
+    SecretsmanagerSecretRotation = "aws_secretsmanager_secret_rotation",
+    Vpc = "aws_vpc",
+    FlowLog = "aws_flow_log",
+    Subnet = "aws_subnet",
+    Cloudtrail = "aws_cloudtrail",
+    IamAccountPasswordPolicy = "aws_iam_account_password_policy",
+    ApiGatewayMethod = "aws_api_gateway_method",
+    ApiGatewayStage = "aws_api_gateway_stage",
+    Apigatewayv2Stage = "aws_apigatewayv2_stage"
+}
+export declare enum Block {
+    EncryptionConfig = "encryption_config",
+    NetworkInterfaceAccessConfig = "network_interface.access_config",
+    LogConfig = "log_config",
+    Logging = "logging",
+    AccessLogSettings = "access_log_settings"
+}
+export declare enum Wildcard {
+    All = "*"
+}
+export declare enum ApiGatewayAuthorization {
+    None = "NONE"
+}
+export { AzureResource, AzureAttribute, StorageTlsVersion, SqlTlsVersion, BuiltInRole, NetworkDefaultAction, } from './azure';
+export { GcpResource, GcpAttribute, PublicAccessPreventionMode, IamMember, PrimitiveRole, OauthScope, SqlSslMode, } from './gcp';
+export type AnyResource = AwsResource | AzureResource | GcpResource;
+export type AnyAttribute = AwsAttribute | AzureAttribute | GcpAttribute;
+export declare enum Port {
+    SSH = 22,
+    RDP = 3389,
+    Postgres = 5432,
+    MySQL = 3306
+}
+export declare enum Cidr {
+    Internet = "0.0.0.0/0",
+    InternetV6 = "::/0"
+}
+export declare enum Effect {
+    Block = "block",
+    Warn = "warn",
+    RequireApproval = "require_approval"
+}
+export declare enum Tag {
+    Team = "team",
+    CostCenter = "cost_center",
+    Environment = "environment",
+    DataClassification = "data_classification"
+}
+export declare enum AwsAttribute {
+    StorageEncrypted = "storage_encrypted",
+    PubliclyAccessible = "publicly_accessible",
+    MultiAz = "multi_az",
+    DeletionProtection = "deletion_protection",
+    IamDatabaseAuthenticationEnabled = "iam_database_authentication_enabled",
+    Encrypted = "encrypted",
+    EnableKeyRotation = "enable_key_rotation",
+    BlockPublicAcls = "block_public_acls",
+    BlockPublicPolicy = "block_public_policy",
+    IgnorePublicAcls = "ignore_public_acls",
+    RestrictPublicBuckets = "restrict_public_buckets",
+    BackupRetentionPeriod = "backup_retention_period",
+    HttpTokens = "metadata_options.http_tokens",
+    ServerSideEncryptionEnabled = "server_side_encryption.enabled",
+    PointInTimeRecoveryEnabled = "point_in_time_recovery.enabled",
+    ImageScanOnPush = "image_scanning_configuration.scan_on_push",
+    RootBlockDeviceEncrypted = "root_block_device.encrypted",
+    AssociatePublicIpAddress = "associate_public_ip_address",
+    AssignPublicIp = "network_configuration.assign_public_ip",
+    EndpointPublicAccess = "vpc_config.endpoint_public_access",
+    AccessLogsEnabled = "access_logs.enabled",
+    DropInvalidHeaderFields = "drop_invalid_header_fields",
+    PublicAccessCidrs = "vpc_config.public_access_cidrs",
+    EnabledClusterLogTypes = "enabled_cluster_log_types",
+    SslPolicy = "ssl_policy",
+    Protocol = "protocol",
+    SecretString = "secret_string",
+    Password = "password",
+    MasterPassword = "master_password",
+    AuthToken = "auth_token",
+    Bucket = "bucket",
+    SecretId = "secret_id",
+    VpcId = "vpc_id",
+    MapPublicIpOnLaunch = "map_public_ip_on_launch",
+    AssignIpv6AddressOnCreation = "assign_ipv6_address_on_creation",
+    IsMultiRegionTrail = "is_multi_region_trail",
+    EnableLogFileValidation = "enable_log_file_validation",
+    KmsKeyId = "kms_key_id",
+    MinimumPasswordLength = "minimum_password_length",
+    RequireSymbols = "require_symbols",
+    RequireNumbers = "require_numbers",
+    RequireUppercaseCharacters = "require_uppercase_characters",
+    RequireLowercaseCharacters = "require_lowercase_characters",
+    PasswordReusePrevention = "password_reuse_prevention",
+    MaxPasswordAge = "max_password_age",
+    Authorization = "authorization",
+    XrayTracingEnabled = "xray_tracing_enabled"
+}
+export declare enum TlsPolicy {
+    Legacy2015 = "ELBSecurityPolicy-2015-05",
+    Tls10 = "ELBSecurityPolicy-TLS-1-0-2015-04",
+    Tls11 = "ELBSecurityPolicy-TLS-1-1-2017-01"
+}
+export declare enum Protocol {
+    Http = "HTTP",
+    Https = "HTTPS",
+    Tcp = "TCP",
+    Tls = "TLS"
+}
+export declare enum EksLogType {
+    Api = "api",
+    Audit = "audit",
+    Authenticator = "authenticator",
+    ControllerManager = "controllerManager",
+    Scheduler = "scheduler"
+}
+export declare enum HttpTokens {
+    Optional = "optional",
+    Required = "required"
+}
+export declare enum Acl {
+    Private = "private",
+    PublicRead = "public-read",
+    PublicReadWrite = "public-read-write"
+}
+export declare enum Environment {
+    Development = "development",
+    Staging = "staging",
+    Production = "production"
+}
+export declare enum Approver {
+    PlatformTeam = "platform-team",
+    SecurityArchitect = "security-architect",
+    FinOps = "finops",
+    SRE = "sre"
+}