@intentius/chant-lexicon-aws 0.0.13 → 0.0.15

package/src/lint/post-synth/waw030.test.ts

@@ -761,16 +761,30 @@ describe("WAW030: Missing DependsOn for Known Patterns", () => {
             ResourceId: "service/c/s",
           },
         },
+        EksCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        EksNodegroup: {
+          Type: "AWS::EKS::Nodegroup",
+          Properties: { ClusterName: "my-cluster" },
+        },
+        EksAddon: {
+          Type: "AWS::EKS::Addon",
+          Properties: { AddonName: "vpc-cni", ClusterName: "my-cluster" },
+        },
       },
     });
     const diags = checkMissingDependsOn(ctx);
-    expect(diags).toHaveLength(6);
+    expect(diags).toHaveLength(8);
     const entities = diags.map((d) => d.entity).sort();
     expect(entities).toEqual([
       "ApiDeployment",
       "DynamoTarget",
       "EcsService",
       "EcsTarget",
+      "EksAddon",
+      "EksNodegroup",
       "Route",
       "V2Deployment",
     ]);
@@ -797,4 +811,198 @@ describe("WAW030: Missing DependsOn for Known Patterns", () => {
     expect(diags[0].entity).toBe("MyTarget");
     expect(diags[0].message).toContain("DynamoDB");
   });
+
+  // --- EKS Addon + Cluster/Nodegroup pattern ---
+
+  test("EKS Addon with hardcoded ClusterName, no DependsOn on Cluster → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        MyNodegroup: {
+          Type: "AWS::EKS::Nodegroup",
+          DependsOn: "MyCluster",
+          Properties: { ClusterName: "my-cluster" },
+        },
+        VpcCni: {
+          Type: "AWS::EKS::Addon",
+          Properties: { AddonName: "vpc-cni", ClusterName: "my-cluster" },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW030");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].message).toContain("VpcCni");
+    expect(diags[0].message).toContain("Addon");
+    expect(diags[0].entity).toBe("VpcCni");
+  });
+
+  test("EKS Addon with DependsOn on Cluster → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        VpcCni: {
+          Type: "AWS::EKS::Addon",
+          DependsOn: "MyCluster",
+          Properties: { AddonName: "vpc-cni", ClusterName: "my-cluster" },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("EKS Addon with DependsOn on Nodegroup → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        MyNodegroup: {
+          Type: "AWS::EKS::Nodegroup",
+          DependsOn: "MyCluster",
+          Properties: { ClusterName: "my-cluster" },
+        },
+        VpcCni: {
+          Type: "AWS::EKS::Addon",
+          DependsOn: ["MyCluster", "MyNodegroup"],
+          Properties: { AddonName: "vpc-cni", ClusterName: "my-cluster" },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("EKS Addon with Ref to Cluster in ClusterName → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        VpcCni: {
+          Type: "AWS::EKS::Addon",
+          Properties: { AddonName: "vpc-cni", ClusterName: { Ref: "MyCluster" } },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("EKS Addon without Cluster in template → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        VpcCni: {
+          Type: "AWS::EKS::Addon",
+          Properties: { AddonName: "vpc-cni", ClusterName: "external-cluster" },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  // --- EKS Nodegroup + Cluster pattern ---
+
+  test("EKS Nodegroup with hardcoded ClusterName, no DependsOn on Cluster → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        MyNodegroup: {
+          Type: "AWS::EKS::Nodegroup",
+          Properties: { ClusterName: "my-cluster" },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW030");
+    expect(diags[0].message).toContain("MyNodegroup");
+    expect(diags[0].message).toContain("Nodegroup");
+    expect(diags[0].entity).toBe("MyNodegroup");
+  });
+
+  test("EKS Nodegroup with DependsOn on Cluster → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        MyNodegroup: {
+          Type: "AWS::EKS::Nodegroup",
+          DependsOn: "MyCluster",
+          Properties: { ClusterName: "my-cluster" },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("EKS Nodegroup with Ref to Cluster → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        MyNodegroup: {
+          Type: "AWS::EKS::Nodegroup",
+          Properties: { ClusterName: { Ref: "MyCluster" } },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("EKS Nodegroup without Cluster in template → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyNodegroup: {
+          Type: "AWS::EKS::Nodegroup",
+          Properties: { ClusterName: "external-cluster" },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("multiple EKS Addons — only flags those missing DependsOn", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+        GoodAddon: {
+          Type: "AWS::EKS::Addon",
+          DependsOn: "MyCluster",
+          Properties: { AddonName: "vpc-cni", ClusterName: "my-cluster" },
+        },
+        BadAddon: {
+          Type: "AWS::EKS::Addon",
+          Properties: { AddonName: "coredns", ClusterName: "my-cluster" },
+        },
+      },
+    });
+    const diags = checkMissingDependsOn(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("BadAddon");
+  });
 });

package/src/lint/post-synth/waw030.ts

@@ -10,6 +10,8 @@
  * - API Gateway V2 Deployment with no DependsOn on any Route
  * - DynamoDB ScalableTarget with no DependsOn on the Table
  * - ECS ScalableTarget with no DependsOn on the ECS Service
+ * - EKS Addon with hardcoded ClusterName but no DependsOn on the Cluster or Nodegroup
+ * - EKS Nodegroup with hardcoded ClusterName but no DependsOn on the Cluster
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
@@ -34,6 +36,9 @@ export function checkMissingDependsOn(ctx: PostSynthContext): PostSynthDiagnosti
     const dynamoTableIds: string[] = [];
     const ecsServiceIds: string[] = [];
     const scalableTargetEntries: { logicalId: string; namespace: string }[] = [];
+    const eksClusterIds: string[] = [];
+    const eksNodegroupIds: string[] = [];
+    const eksAddonIds: string[] = [];
 
     for (const [logicalId, resource] of Object.entries(resources)) {
       if (resource.Type === "AWS::ElasticLoadBalancingV2::Listener") {
@@ -60,6 +65,15 @@ export function checkMissingDependsOn(ctx: PostSynthContext): PostSynthDiagnosti
       if (resource.Type === "AWS::ECS::Service") {
         ecsServiceIds.push(logicalId);
       }
+      if (resource.Type === "AWS::EKS::Cluster") {
+        eksClusterIds.push(logicalId);
+      }
+      if (resource.Type === "AWS::EKS::Nodegroup") {
+        eksNodegroupIds.push(logicalId);
+      }
+      if (resource.Type === "AWS::EKS::Addon") {
+        eksAddonIds.push(logicalId);
+      }
       if (resource.Type === "AWS::ApplicationAutoScaling::ScalableTarget") {
         const props = resource.Properties ?? {};
         const ns = inferScalingNamespace(props);
@@ -144,6 +158,47 @@ export function checkMissingDependsOn(ctx: PostSynthContext): PostSynthDiagnosti
       }
     }
 
+    // Pattern 7: EKS Addon with hardcoded ClusterName but no dependency on Cluster or Nodegroup
+    for (const addonId of eksAddonIds) {
+      const resource = resources[addonId];
+      const deps = getDependsOnSet(resource);
+      const propRefs = collectPropertyRefs(resource);
+      const allClusterAndNodeDeps = [...eksClusterIds, ...eksNodegroupIds];
+
+      const hasClusterDep = allClusterAndNodeDeps.some((id) => deps.has(id));
+      const hasClusterRef = allClusterAndNodeDeps.some((id) => propRefs.has(id));
+
+      if (!hasClusterDep && !hasClusterRef && eksClusterIds.length > 0) {
+        diagnostics.push({
+          checkId: "WAW030",
+          severity: "warning",
+          message: `EKS Addon "${addonId}" has no dependency on the Cluster or Nodegroup — the addon may fail if the cluster or nodes aren't ready yet. Add DependsOn.`,
+          entity: addonId,
+          lexicon: "aws",
+        });
+      }
+    }
+
+    // Pattern 8: EKS Nodegroup with hardcoded ClusterName but no dependency on Cluster
+    for (const ngId of eksNodegroupIds) {
+      const resource = resources[ngId];
+      const deps = getDependsOnSet(resource);
+      const propRefs = collectPropertyRefs(resource);
+
+      const hasClusterDep = eksClusterIds.some((id) => deps.has(id));
+      const hasClusterRef = eksClusterIds.some((id) => propRefs.has(id));
+
+      if (!hasClusterDep && !hasClusterRef && eksClusterIds.length > 0) {
+        diagnostics.push({
+          checkId: "WAW030",
+          severity: "warning",
+          message: `EKS Nodegroup "${ngId}" has no dependency on the Cluster — the node group may fail if the cluster isn't ready yet. Add DependsOn.`,
+          entity: ngId,
+          lexicon: "aws",
+        });
+      }
+    }
+
     // Pattern 5 & 6: ScalableTarget with no DependsOn on the target resource
     for (const entry of scalableTargetEntries) {
       const resource = resources[entry.logicalId];

package/src/lint/post-synth/waw031.test.ts

@@ -0,0 +1,273 @@
+import { describe, test, expect } from "bun:test";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw031, checkAddonMissingRole } from "./waw031";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW031: EKS Addon Missing ServiceAccountRoleArn", () => {
+  test("check metadata", () => {
+    expect(waw031.id).toBe("WAW031");
+    expect(waw031.description).toContain("ServiceAccountRoleArn");
+  });
+
+  // --- aws-ebs-csi-driver ---
+
+  test("EBS CSI addon without ServiceAccountRoleArn → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        EbsCsi: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "aws-ebs-csi-driver",
+            ClusterName: "my-cluster",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW031");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].message).toContain("EbsCsi");
+    expect(diags[0].message).toContain("aws-ebs-csi-driver");
+    expect(diags[0].message).toContain("IRSA");
+    expect(diags[0].entity).toBe("EbsCsi");
+    expect(diags[0].lexicon).toBe("aws");
+  });
+
+  test("EBS CSI addon with ServiceAccountRoleArn string → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        EbsCsi: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "aws-ebs-csi-driver",
+            ClusterName: "my-cluster",
+            ServiceAccountRoleArn: "arn:aws:iam::123456789012:role/ebs-csi-role",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("EBS CSI addon with ServiceAccountRoleArn via GetAtt → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        EbsCsi: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "aws-ebs-csi-driver",
+            ClusterName: "my-cluster",
+            ServiceAccountRoleArn: { "Fn::GetAtt": ["EbsCsiRole", "Arn"] },
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  // --- aws-efs-csi-driver ---
+
+  test("EFS CSI addon without ServiceAccountRoleArn → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        EfsCsi: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "aws-efs-csi-driver",
+            ClusterName: "my-cluster",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("aws-efs-csi-driver");
+    expect(diags[0].entity).toBe("EfsCsi");
+  });
+
+  // --- adot ---
+
+  test("ADOT addon without ServiceAccountRoleArn → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Adot: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "adot",
+            ClusterName: "my-cluster",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("adot");
+    expect(diags[0].entity).toBe("Adot");
+  });
+
+  test("ADOT addon with ServiceAccountRoleArn → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Adot: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "adot",
+            ClusterName: "my-cluster",
+            ServiceAccountRoleArn: "arn:aws:iam::123456789012:role/adot-role",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  // --- amazon-cloudwatch-observability ---
+
+  test("CloudWatch observability addon without ServiceAccountRoleArn → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        CwObs: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "amazon-cloudwatch-observability",
+            ClusterName: "my-cluster",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("amazon-cloudwatch-observability");
+    expect(diags[0].entity).toBe("CwObs");
+  });
+
+  test("CloudWatch observability addon with ServiceAccountRoleArn → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        CwObs: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "amazon-cloudwatch-observability",
+            ClusterName: "my-cluster",
+            ServiceAccountRoleArn: { "Fn::GetAtt": ["CwObsRole", "Arn"] },
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  // --- Addons that don't require IRSA ---
+
+  test("vpc-cni addon without ServiceAccountRoleArn → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        VpcCni: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "vpc-cni",
+            ClusterName: "my-cluster",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("coredns addon without ServiceAccountRoleArn → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        CoreDns: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "coredns",
+            ClusterName: "my-cluster",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("kube-proxy addon without ServiceAccountRoleArn → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        KubeProxy: {
+          Type: "AWS::EKS::Addon",
+          Properties: {
+            AddonName: "kube-proxy",
+            ClusterName: "my-cluster",
+          },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  // --- Edge cases ---
+
+  test("multiple addons — only flags those requiring IRSA", () => {
+    const ctx = makeCtx({
+      Resources: {
+        VpcCni: {
+          Type: "AWS::EKS::Addon",
+          Properties: { AddonName: "vpc-cni", ClusterName: "c" },
+        },
+        EbsCsi: {
+          Type: "AWS::EKS::Addon",
+          Properties: { AddonName: "aws-ebs-csi-driver", ClusterName: "c" },
+        },
+        CoreDns: {
+          Type: "AWS::EKS::Addon",
+          Properties: { AddonName: "coredns", ClusterName: "c" },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("EbsCsi");
+  });
+
+  test("addon without AddonName property → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Mystery: {
+          Type: "AWS::EKS::Addon",
+          Properties: { ClusterName: "c" },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("non-addon resource → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::EKS::Cluster",
+          Properties: { Name: "my-cluster" },
+        },
+      },
+    });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("empty Resources → no diagnostic", () => {
+    const ctx = makeCtx({ Resources: {} });
+    const diags = checkAddonMissingRole(ctx);
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw031.ts

@@ -0,0 +1,66 @@
+/**
+ * WAW031: EKS Addon Missing ServiceAccountRoleArn
+ *
+ * Certain EKS addons require a ServiceAccountRoleArn (IRSA role) to function.
+ * Without one, the addon pods can't authenticate to AWS APIs and the addon
+ * hangs in CREATING status indefinitely.
+ *
+ * Known addons that require IRSA:
+ * - aws-ebs-csi-driver (needs EBS API access)
+ * - aws-efs-csi-driver (needs EFS API access)
+ * - adot (needs CloudWatch/X-Ray access)
+ * - amazon-cloudwatch-observability (needs CloudWatch access)
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate } from "./cf-refs";
+
+/** Addons that are known to require a ServiceAccountRoleArn to function. */
+const ADDONS_REQUIRING_IRSA: Record<string, string> = {
+  "aws-ebs-csi-driver": "EBS API access to manage volumes",
+  "aws-efs-csi-driver": "EFS API access to manage file systems",
+  "adot": "CloudWatch/X-Ray access for metrics and traces",
+  "amazon-cloudwatch-observability": "CloudWatch access for logs and metrics",
+};
+
+export function checkAddonMissingRole(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::EKS::Addon") continue;
+
+      const props = resource.Properties ?? {};
+      const addonName = typeof props.AddonName === "string" ? props.AddonName : null;
+      if (!addonName) continue;
+
+      const reason = ADDONS_REQUIRING_IRSA[addonName];
+      if (!reason) continue;
+
+      // Check if ServiceAccountRoleArn is set (could be a string, Ref, or GetAtt)
+      if (!props.ServiceAccountRoleArn) {
+        diagnostics.push({
+          checkId: "WAW031",
+          severity: "warning",
+          message: `EKS Addon "${logicalId}" (${addonName}) has no ServiceAccountRoleArn — it needs an IRSA role for ${reason}. Without it, the addon will hang in CREATING status.`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw031: PostSynthCheck = {
+  id: "WAW031",
+  description: "EKS Addon missing ServiceAccountRoleArn for addons that require IRSA",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkAddonMissingRole(ctx);
+  },
+};