@intentius/chant-lexicon-aws 0.0.14 → 0.0.15

package/dist/rules/waw030.ts

@@ -10,6 +10,8 @@
  * - API Gateway V2 Deployment with no DependsOn on any Route
  * - DynamoDB ScalableTarget with no DependsOn on the Table
  * - ECS ScalableTarget with no DependsOn on the ECS Service
+ * - EKS Addon with hardcoded ClusterName but no DependsOn on the Cluster or Nodegroup
+ * - EKS Nodegroup with hardcoded ClusterName but no DependsOn on the Cluster
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
@@ -34,6 +36,9 @@ export function checkMissingDependsOn(ctx: PostSynthContext): PostSynthDiagnosti
     const dynamoTableIds: string[] = [];
     const ecsServiceIds: string[] = [];
     const scalableTargetEntries: { logicalId: string; namespace: string }[] = [];
+    const eksClusterIds: string[] = [];
+    const eksNodegroupIds: string[] = [];
+    const eksAddonIds: string[] = [];
 
     for (const [logicalId, resource] of Object.entries(resources)) {
       if (resource.Type === "AWS::ElasticLoadBalancingV2::Listener") {
@@ -60,6 +65,15 @@ export function checkMissingDependsOn(ctx: PostSynthContext): PostSynthDiagnosti
       if (resource.Type === "AWS::ECS::Service") {
         ecsServiceIds.push(logicalId);
       }
+      if (resource.Type === "AWS::EKS::Cluster") {
+        eksClusterIds.push(logicalId);
+      }
+      if (resource.Type === "AWS::EKS::Nodegroup") {
+        eksNodegroupIds.push(logicalId);
+      }
+      if (resource.Type === "AWS::EKS::Addon") {
+        eksAddonIds.push(logicalId);
+      }
       if (resource.Type === "AWS::ApplicationAutoScaling::ScalableTarget") {
         const props = resource.Properties ?? {};
         const ns = inferScalingNamespace(props);
@@ -144,6 +158,47 @@ export function checkMissingDependsOn(ctx: PostSynthContext): PostSynthDiagnosti
       }
     }
 
+    // Pattern 7: EKS Addon with hardcoded ClusterName but no dependency on Cluster or Nodegroup
+    for (const addonId of eksAddonIds) {
+      const resource = resources[addonId];
+      const deps = getDependsOnSet(resource);
+      const propRefs = collectPropertyRefs(resource);
+      const allClusterAndNodeDeps = [...eksClusterIds, ...eksNodegroupIds];
+
+      const hasClusterDep = allClusterAndNodeDeps.some((id) => deps.has(id));
+      const hasClusterRef = allClusterAndNodeDeps.some((id) => propRefs.has(id));
+
+      if (!hasClusterDep && !hasClusterRef && eksClusterIds.length > 0) {
+        diagnostics.push({
+          checkId: "WAW030",
+          severity: "warning",
+          message: `EKS Addon "${addonId}" has no dependency on the Cluster or Nodegroup — the addon may fail if the cluster or nodes aren't ready yet. Add DependsOn.`,
+          entity: addonId,
+          lexicon: "aws",
+        });
+      }
+    }
+
+    // Pattern 8: EKS Nodegroup with hardcoded ClusterName but no dependency on Cluster
+    for (const ngId of eksNodegroupIds) {
+      const resource = resources[ngId];
+      const deps = getDependsOnSet(resource);
+      const propRefs = collectPropertyRefs(resource);
+
+      const hasClusterDep = eksClusterIds.some((id) => deps.has(id));
+      const hasClusterRef = eksClusterIds.some((id) => propRefs.has(id));
+
+      if (!hasClusterDep && !hasClusterRef && eksClusterIds.length > 0) {
+        diagnostics.push({
+          checkId: "WAW030",
+          severity: "warning",
+          message: `EKS Nodegroup "${ngId}" has no dependency on the Cluster — the node group may fail if the cluster isn't ready yet. Add DependsOn.`,
+          entity: ngId,
+          lexicon: "aws",
+        });
+      }
+    }
+
     // Pattern 5 & 6: ScalableTarget with no DependsOn on the target resource
     for (const entry of scalableTargetEntries) {
       const resource = resources[entry.logicalId];

package/dist/rules/waw031.ts

@@ -0,0 +1,66 @@
+/**
+ * WAW031: EKS Addon Missing ServiceAccountRoleArn
+ *
+ * Certain EKS addons require a ServiceAccountRoleArn (IRSA role) to function.
+ * Without one, the addon pods can't authenticate to AWS APIs and the addon
+ * hangs in CREATING status indefinitely.
+ *
+ * Known addons that require IRSA:
+ * - aws-ebs-csi-driver (needs EBS API access)
+ * - aws-efs-csi-driver (needs EFS API access)
+ * - adot (needs CloudWatch/X-Ray access)
+ * - amazon-cloudwatch-observability (needs CloudWatch access)
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate } from "./cf-refs";
+
+/** Addons that are known to require a ServiceAccountRoleArn to function. */
+const ADDONS_REQUIRING_IRSA: Record<string, string> = {
+  "aws-ebs-csi-driver": "EBS API access to manage volumes",
+  "aws-efs-csi-driver": "EFS API access to manage file systems",
+  "adot": "CloudWatch/X-Ray access for metrics and traces",
+  "amazon-cloudwatch-observability": "CloudWatch access for logs and metrics",
+};
+
+export function checkAddonMissingRole(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::EKS::Addon") continue;
+
+      const props = resource.Properties ?? {};
+      const addonName = typeof props.AddonName === "string" ? props.AddonName : null;
+      if (!addonName) continue;
+
+      const reason = ADDONS_REQUIRING_IRSA[addonName];
+      if (!reason) continue;
+
+      // Check if ServiceAccountRoleArn is set (could be a string, Ref, or GetAtt)
+      if (!props.ServiceAccountRoleArn) {
+        diagnostics.push({
+          checkId: "WAW031",
+          severity: "warning",
+          message: `EKS Addon "${logicalId}" (${addonName}) has no ServiceAccountRoleArn — it needs an IRSA role for ${reason}. Without it, the addon will hang in CREATING status.`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw031: PostSynthCheck = {
+  id: "WAW031",
+  description: "EKS Addon missing ServiceAccountRoleArn for addons that require IRSA",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkAddonMissingRole(ctx);
+  },
+};