@intentius/behold 0.8.0 → 0.9.1

package/example-carve/legacy-tf/cdn.tf

@@ -0,0 +1,23 @@
+# The one module in the estate, so module scoring shows up on camera. A module
+# is opaque to the advisor: it is one node, ranked as a tier-2 composite, and
+# its internals (modules/cdn/) are never descended into.
+#
+# The `aliases` line is the bridge patch left over from last month's carve. That
+# hostname used to come from `aws_ssm_parameter.assets_cdn_domain` in this
+# directory; chant owns the parameter now (../app/src/carved.ts), and the
+# surviving Terraform reads it back through a data source. This is exactly the
+# rewrite `carve bridge` generates for every inbound edge a carve cuts, sitting
+# in the estate a month later and working.
+
+data "aws_ssm_parameter" "assets_cdn_domain" {
+  name = "/acme/platform/prod/assets-cdn-domain"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+
+  name_suffix        = random_pet.suffix.id
+  origin_domain_name = "assets.acme-platform.example.com"
+  aliases            = [data.aws_ssm_parameter.assets_cdn_domain.value]
+  price_class        = "PriceClass_100"
+}

package/example-carve/legacy-tf/compute.tf

@@ -0,0 +1,63 @@
+# The "next month" candidates.
+#
+# The lambda is a tier-2 map with five outbound references — the role, the
+# bucket, both subnets and the security group. None of them block a carve
+# (outbound edges become deferred deploy-time inputs, not immediate patches),
+# but five of them is real work, so it lands in the middle band honestly.
+#
+# The role is the mirror image: one inbound edge, from the lambda. That is what
+# an inbound edge costs, and it is why the role scores lower than the bucket
+# despite being just as small.
+
+resource "aws_iam_role" "api" {
+  name = "acme-platform-api-${random_pet.suffix.id}"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = "sts:AssumeRole"
+        Principal = {
+          Service = "lambda.amazonaws.com"
+        }
+      }
+    ]
+  })
+
+  managed_policy_arns = [
+    "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+    "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
+  ]
+
+  tags = {
+    Component = "api"
+  }
+}
+
+resource "aws_lambda_function" "api" {
+  function_name = "acme-platform-api"
+  role          = aws_iam_role.api.arn
+  handler       = "index.handler"
+  runtime       = "nodejs22.x"
+  filename      = "build/api.zip"
+  memory_size   = 512
+  timeout       = 15
+
+  environment {
+    variables = {
+      # The one edge into the bucket, and the only patch the carve needs.
+      ASSETS_BUCKET = aws_s3_bucket.assets.bucket
+      LOG_LEVEL     = "info"
+    }
+  }
+
+  vpc_config {
+    subnet_ids         = [aws_subnet.private_a.id, aws_subnet.private_b.id]
+    security_group_ids = [aws_security_group.lambda.id]
+  }
+
+  tags = {
+    Component = "api"
+  }
+}

package/example-carve/legacy-tf/floci-override.tf.disabled

@@ -0,0 +1,61 @@
+# Floci endpoints for the `--live` tier of the carve walkthrough (#254).
+#
+# INERT BY DEFAULT, and deliberately so. Terraform only loads files ending in
+# `.tf`, and `chant carve advise` only parses `.tf` files directly under the
+# estate directory — so as long as this file keeps its `.disabled` suffix it is
+# a text file and nothing more. The offline tier (synthetic terraform.tfstate,
+# zero dependencies beyond this directory) is unaffected by its presence.
+#
+# To arm it for the live tier, copy it into place next to the other .tf files:
+#
+#   cp floci-override.tf.disabled floci_override.tf
+#
+# Terraform merges any `*_override.tf` file over the base configuration, so the
+# `provider "aws"` block below replaces the one in versions.tf without editing
+# versions.tf. Remove `floci_override.tf` and the estate is offline again.
+#
+# WARNING: with this armed, `terraform apply` writes a real state file over
+# terraform.tfstate. Work on a copy of this directory, not the committed one —
+# the synthetic state is a fixture the offline tier depends on.
+#
+# The `--live` tier is bounded by what Floci emulates. S3 and CloudWatch Logs —
+# the two types the walkthrough actually carves — are covered (chant's
+# `just carve-emit-e2e` is the prior art). The VPC, lambda and CloudFront half
+# of this estate is scenery for the advisor's grey band; expect to apply the
+# carve targets with `-target` rather than the whole estate in one go, and see
+# ../README.md for which beats the live tier turns into footage.
+
+provider "aws" {
+  region = "us-east-2"
+
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  skip_requesting_account_id  = true
+  skip_region_validation      = true
+  s3_use_path_style           = true
+
+  default_tags {
+    tags = {
+      Environment = "prod"
+      ManagedBy   = "terraform"
+      Team        = "platform"
+    }
+  }
+
+  # Scratch Floci, booted by the demo and deleted after — never an existing
+  # `floci*` container. Port 4566 is the same endpoint behold's writes demo
+  # and chant's carve-emit e2e use.
+  endpoints {
+    cloudfront = "http://localhost:4566"
+    ec2        = "http://localhost:4566"
+    iam        = "http://localhost:4566"
+    lambda     = "http://localhost:4566"
+    logs       = "http://localhost:4566"
+    s3         = "http://localhost:4566"
+    ssm        = "http://localhost:4566"
+    sts        = "http://localhost:4566"
+  }
+}

package/example-carve/legacy-tf/modules/cdn/main.tf

@@ -0,0 +1,72 @@
+# A deliberately small local module, so `module.cdn` resolves without a registry
+# download and `terraform init` works offline. The advisor never reads this file:
+# `carve advise --from ../..` lists only the `.tf` files directly under the
+# estate directory, which is the same scoping Terraform itself uses for a module.
+
+variable "name_suffix" {
+  type        = string
+  description = "Shared random suffix, so the distribution comment matches the rest of the estate."
+}
+
+variable "origin_domain_name" {
+  type        = string
+  description = "Hostname the distribution pulls assets from."
+}
+
+variable "aliases" {
+  type        = list(string)
+  description = "Public hostnames the distribution answers on."
+}
+
+variable "price_class" {
+  type    = string
+  default = "PriceClass_100"
+}
+
+resource "aws_cloudfront_distribution" "this" {
+  enabled     = true
+  comment     = "acme-platform-assets-${var.name_suffix}"
+  aliases     = var.aliases
+  price_class = var.price_class
+
+  origin {
+    origin_id   = "assets"
+    domain_name = var.origin_domain_name
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      origin_protocol_policy = "https-only"
+      origin_ssl_protocols   = ["TLSv1.2"]
+    }
+  }
+
+  default_cache_behavior {
+    target_origin_id       = "assets"
+    viewer_protocol_policy = "redirect-to-https"
+    allowed_methods        = ["GET", "HEAD"]
+    cached_methods         = ["GET", "HEAD"]
+
+    forwarded_values {
+      query_string = false
+
+      cookies {
+        forward = "none"
+      }
+    }
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}
+
+output "domain_name" {
+  value = aws_cloudfront_distribution.this.domain_name
+}

package/example-carve/legacy-tf/naming.tf

@@ -0,0 +1,10 @@
+# The long tail. `random_pet` is not an AWS resource at all, so there is nothing
+# for it to map to and the advisor scores it 0 without inventing a story. Half
+# the estate's names hang off it, which is the honest punchline of the demo:
+# some Terraform stays Terraform indefinitely, and a migration that cannot say
+# that out loud is selling something.
+
+resource "random_pet" "suffix" {
+  length    = 2
+  separator = "-"
+}

package/example-carve/legacy-tf/network.tf

@@ -0,0 +1,119 @@
+# The grey anchor.
+#
+# Five surviving resources point at the VPC, so carving it would mean patching
+# five references in one go — the advisor bands it "leave in Terraform" and it
+# is right. The subnets and the security group sit just under the line for the
+# same reason, plus a data-source lookup each. This block stays in Terraform,
+# and that is the correct answer, not a failure of the tool.
+
+resource "aws_vpc" "main" {
+  cidr_block           = "10.42.0.0/16"
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = {
+    Name = "acme-platform-${random_pet.suffix.id}"
+  }
+}
+
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+resource "aws_subnet" "private_a" {
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = "10.42.1.0/24"
+  availability_zone = data.aws_availability_zones.available.names[0]
+
+  tags = {
+    Name = "acme-platform-private-a-${random_pet.suffix.id}"
+    Tier = "private"
+  }
+}
+
+resource "aws_subnet" "private_b" {
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = "10.42.2.0/24"
+  availability_zone = data.aws_availability_zones.available.names[1]
+
+  tags = {
+    Name = "acme-platform-private-b-${random_pet.suffix.id}"
+    Tier = "private"
+  }
+}
+
+# The managed prefix list for S3 in this region — how the lambda reaches the
+# assets bucket without leaving the VPC.
+data "aws_prefix_list" "s3" {
+  name = "com.amazonaws.us-east-2.s3"
+}
+
+resource "aws_security_group" "lambda" {
+  name        = "acme-platform-lambda-${random_pet.suffix.id}"
+  description = "Egress-only group for the acme-platform API lambda"
+  vpc_id      = aws_vpc.main.id
+
+  egress {
+    description     = "S3 via the regional gateway prefix list"
+    from_port       = 443
+    to_port         = 443
+    protocol        = "tcp"
+    prefix_list_ids = [data.aws_prefix_list.s3.id]
+  }
+
+  egress {
+    description = "SSM interface endpoint, inside the VPC"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["10.42.0.0/16"]
+  }
+
+  tags = {
+    Name = "acme-platform-lambda"
+  }
+}
+
+# The API lambda reads /acme/platform/prod/* out of Parameter Store over this
+# endpoint rather than the public SSM API.
+resource "aws_vpc_endpoint" "ssm" {
+  vpc_id              = aws_vpc.main.id
+  service_name        = "com.amazonaws.us-east-2.ssm"
+  vpc_endpoint_type   = "Interface"
+  subnet_ids          = [aws_subnet.private_a.id, aws_subnet.private_b.id]
+  security_group_ids  = [aws_security_group.lambda.id]
+  private_dns_enabled = true
+
+  tags = {
+    Name = "acme-platform-ssm"
+  }
+}
+
+# No native mapping at all — the advisor scores it 0 and says so rather than
+# guessing. The second half of the long tail, next to random_pet below.
+resource "aws_network_acl" "private" {
+  vpc_id     = aws_vpc.main.id
+  subnet_ids = [aws_subnet.private_a.id, aws_subnet.private_b.id]
+
+  ingress {
+    protocol   = "tcp"
+    rule_no    = 100
+    action     = "allow"
+    cidr_block = "10.42.0.0/16"
+    from_port  = 0
+    to_port    = 65535
+  }
+
+  egress {
+    protocol   = "-1"
+    rule_no    = 100
+    action     = "allow"
+    cidr_block = "0.0.0.0/0"
+    from_port  = 0
+    to_port    = 0
+  }
+
+  tags = {
+    Name = "acme-platform-private"
+  }
+}

package/example-carve/legacy-tf/observability.tf

@@ -0,0 +1,18 @@
+# The free first move. Nothing references it and it references nothing, so the
+# advisor scores it 100 — a clean tier-1 map with an empty boundary. The
+# walkthrough names it and then carves the bucket instead: there is always a
+# zero-cost resource to start with, and starting there proves nothing more than
+# that the machinery runs.
+#
+# (The API lambda's own log group is not here any more — it was carved into
+# ../app/src/carved.ts last month.)
+
+resource "aws_cloudwatch_log_group" "worker" {
+  name              = "/acme/platform/worker"
+  retention_in_days = 30
+
+  tags = {
+    Name      = "acme-platform-worker"
+    Component = "worker"
+  }
+}

package/example-carve/legacy-tf/outputs.tf

@@ -0,0 +1,21 @@
+# Outputs are boundary edges now (chant#1638): `chant carve advise` reads
+# `output` blocks and scores each one a survivor reads across the cut, at -4,
+# `bridge: "tf-output-rewrite"`. `assets_bucket` is deliberate — a downstream
+# consumer of this state reads the bucket name today, so the carve has to
+# rewrite that output the same way it rewrites `cdn.tf`'s data source.
+
+output "assets_bucket" {
+  value = aws_s3_bucket.assets.bucket
+}
+
+output "api_function_name" {
+  value = aws_lambda_function.api.function_name
+}
+
+output "vpc_id" {
+  value = aws_vpc.main.id
+}
+
+output "private_subnet_ids" {
+  value = [aws_subnet.private_a.id, aws_subnet.private_b.id]
+}

package/example-carve/legacy-tf/storage.tf

@@ -0,0 +1,33 @@
+# The star of the walkthrough.
+#
+# One inbound edge: the API lambda reads the bucket name out of its environment.
+# That single reference is the whole cut — one `data "aws_s3_bucket"` block in
+# the surviving Terraform and the carve is bridged. The two sub-resources below
+# share the bucket's name, so the advisor folds them into its carve set and
+# inlines them rather than counting them as boundary work.
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "acme-platform-assets-prod"
+
+  tags = {
+    Name    = "acme-platform-assets"
+    Purpose = "static-assets"
+  }
+}
+
+resource "aws_s3_bucket_versioning" "assets" {
+  bucket = aws_s3_bucket.assets.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "assets" {
+  bucket = aws_s3_bucket.assets.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}