@intentius/chant-lexicon-aws 0.124.30 → 0.124.32

package/dist/lint/post-synth/waw032.js

@@ -0,0 +1,45 @@
+/**
+ * WAW032: EFS Transit Encryption Disabled
+ *
+ * Flags EFS volume configurations on Fargate task definitions where transit
+ * encryption has been explicitly disabled. FargateService defaults to ENABLED;
+ * this rule catches intentional opt-outs.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+export function checkEfsTransitEncryption(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECS::TaskDefinition")
+                continue;
+            const volumes = resource.Properties?.Volumes;
+            if (!Array.isArray(volumes))
+                continue;
+            for (const volume of volumes) {
+                const efsConfig = volume?.EFSVolumeConfiguration;
+                if (!efsConfig)
+                    continue;
+                if (efsConfig.TransitEncryption === "DISABLED") {
+                    diagnostics.push({
+                        checkId: "WAW032",
+                        severity: "warning",
+                        message: `EFS volume "${volume.Name ?? "unnamed"}" in task "${logicalId}" has transit encryption disabled — set TransitEncryption: ENABLED to protect data in transit`,
+                        entity: logicalId,
+                        lexicon: "aws",
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw032 = {
+    id: "WAW032",
+    description: "EFS volume on Fargate task has transit encryption disabled",
+    check(ctx) {
+        return checkEfsTransitEncryption(ctx);
+    },
+};

package/dist/lint/post-synth/waw033.js

@@ -0,0 +1,75 @@
+/**
+ * WAW033: Solr Heap Exceeds 50% of Container Memory
+ *
+ * When SOLR_HEAP is set on a Fargate task running a Solr image, validates that
+ * the heap does not exceed 50% of the task's allocated memory. Exceeding this
+ * leaves insufficient headroom for the OS file cache that Lucene MMap relies on,
+ * causing the OOM killer to terminate the container.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+/** Parse heap strings like "4g", "2048m", "2048" → megabytes */
+function parseHeapMb(value) {
+    const lower = value.trim().toLowerCase();
+    const gMatch = lower.match(/^(\d+(?:\.\d+)?)g$/);
+    if (gMatch)
+        return Math.round(parseFloat(gMatch[1]) * 1024);
+    const mMatch = lower.match(/^(\d+(?:\.\d+)?)m?$/);
+    if (mMatch)
+        return Math.round(parseFloat(mMatch[1]));
+    return null;
+}
+function isSolrImage(image) {
+    return typeof image === "string" && image.toLowerCase().includes("solr");
+}
+export function checkSolrHeapRatio(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECS::TaskDefinition")
+                continue;
+            const props = resource.Properties ?? {};
+            if (typeof props.Memory !== "string")
+                continue;
+            const taskMemoryMb = parseInt(props.Memory);
+            if (!taskMemoryMb)
+                continue;
+            const containers = Array.isArray(props.ContainerDefinitions)
+                ? props.ContainerDefinitions
+                : [];
+            for (const container of containers) {
+                if (typeof container !== "object" || container === null)
+                    continue;
+                const c = container;
+                if (!isSolrImage(c.Image))
+                    continue;
+                const envVars = Array.isArray(c.Environment) ? c.Environment : [];
+                const heapEntry = envVars.find((e) => typeof e === "object" && e !== null && e.Name === "SOLR_HEAP");
+                if (!heapEntry)
+                    continue; // WAW034 covers missing heap
+                const heapMb = parseHeapMb(String(heapEntry.Value ?? ""));
+                if (heapMb === null)
+                    continue;
+                if (heapMb > taskMemoryMb * 0.5) {
+                    diagnostics.push({
+                        checkId: "WAW033",
+                        severity: "error",
+                        message: `Solr container "${c.Name ?? "app"}" SOLR_HEAP (${heapMb}MB) exceeds 50% of task memory (${taskMemoryMb}MB) — risk of OOM kill; set SOLR_HEAP <= ${Math.floor(taskMemoryMb * 0.45)}m`,
+                        entity: logicalId,
+                        lexicon: "aws",
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw033 = {
+    id: "WAW033",
+    description: "Solr SOLR_HEAP exceeds 50% of Fargate task memory",
+    check(ctx) {
+        return checkSolrHeapRatio(ctx);
+    },
+};

package/dist/lint/post-synth/waw034.js

@@ -0,0 +1,52 @@
+/**
+ * WAW034: Solr Container Undersized
+ *
+ * Fargate tasks running a Solr image with less than 2048MB of memory will
+ * fail under any real load — the JVM alone needs headroom for the heap plus
+ * OS file cache for Lucene MMap. 4096MB is the practical production minimum.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+function isSolrImage(image) {
+    return typeof image === "string" && image.toLowerCase().includes("solr");
+}
+export function checkSolrMemoryMinimum(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECS::TaskDefinition")
+                continue;
+            const props = resource.Properties ?? {};
+            if (typeof props.Memory !== "string")
+                continue;
+            const taskMemoryMb = parseInt(props.Memory);
+            if (!taskMemoryMb)
+                continue;
+            const containers = Array.isArray(props.ContainerDefinitions)
+                ? props.ContainerDefinitions
+                : [];
+            const hasSolr = containers.some((c) => typeof c === "object" && c !== null && isSolrImage(c.Image));
+            if (!hasSolr)
+                continue;
+            if (taskMemoryMb < 2048) {
+                diagnostics.push({
+                    checkId: "WAW034",
+                    severity: "warning",
+                    message: `Solr task "${logicalId}" has only ${taskMemoryMb}MB memory — Solr requires at least 2048MB; 4096MB recommended for production`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw034 = {
+    id: "WAW034",
+    description: "Fargate task running Solr has insufficient memory (< 2048MB)",
+    check(ctx) {
+        return checkSolrMemoryMinimum(ctx);
+    },
+};

package/dist/lint/post-synth/waw035.js

@@ -0,0 +1,56 @@
+/**
+ * WAW035: Solr Container Missing nofile Ulimit
+ *
+ * Solr opens a file descriptor for every shard replica, index file, log, and
+ * connection. Without a raised nofile limit the process hits the default kernel
+ * limit (~1024) under moderate load, causing "Too many open files" errors that
+ * bring the node down. The production minimum is 65535.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+const NOFILE_MIN = 65535;
+function isSolrImage(image) {
+    return typeof image === "string" && image.toLowerCase().includes("solr");
+}
+export function checkSolrUlimits(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECS::TaskDefinition")
+                continue;
+            const containers = Array.isArray(resource.Properties?.ContainerDefinitions)
+                ? resource.Properties.ContainerDefinitions
+                : [];
+            for (const container of containers) {
+                if (typeof container !== "object" || container === null)
+                    continue;
+                const c = container;
+                if (!isSolrImage(c.Image))
+                    continue;
+                const ulimits = Array.isArray(c.Ulimits) ? c.Ulimits : [];
+                const nofile = ulimits.find((u) => typeof u === "object" && u !== null && u.Name === "nofile");
+                const hardLimit = nofile ? Number(nofile.HardLimit ?? 0) : 0;
+                if (!nofile || hardLimit < NOFILE_MIN) {
+                    const current = nofile ? ` (current HardLimit: ${hardLimit})` : " (not set)";
+                    diagnostics.push({
+                        checkId: "WAW035",
+                        severity: "warning",
+                        message: `Solr container "${c.Name ?? "app"}" in task "${logicalId}" nofile ulimit${current} — set HardLimit >= ${NOFILE_MIN} to prevent "Too many open files" under load`,
+                        entity: logicalId,
+                        lexicon: "aws",
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw035 = {
+    id: "WAW035",
+    description: "Solr container missing nofile ulimit >= 65535",
+    check(ctx) {
+        return checkSolrUlimits(ctx);
+    },
+};

package/dist/lint/post-synth/waw036.js

@@ -0,0 +1,79 @@
+/**
+ * WAW036: Non-ASCII Characters in EC2/IAM String Properties
+ *
+ * EC2, IAM, CloudWatch, and other AWS services only accept ASCII 0x20–0x7E in
+ * description, name, and label fields. Non-ASCII characters (em-dashes, curly
+ * quotes, accented letters, etc.) cause the changeset to fail at EarlyValidation
+ * with an opaque "Invalid parameter" error that doesn't name the offending property.
+ *
+ * Properties checked (all must be plain ASCII strings):
+ *   - AWS::EC2::SecurityGroup           GroupDescription
+ *   - AWS::EC2::LaunchTemplate          LaunchTemplateName
+ *   - AWS::IAM::Role                    RoleName
+ *   - AWS::Lambda::Function             FunctionName
+ *   - AWS::RDS::DBSubnetGroup           DBSubnetGroupDescription
+ *   - AWS::CloudWatch::Alarm            AlarmDescription, AlarmName
+ *   - AWS::AutoScaling::AutoScalingGroup AutoScalingGroupName
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+/** Map of CFN resource type → list of property names that must be ASCII-only. */
+const ASCII_REQUIRED = {
+    "AWS::EC2::SecurityGroup": ["GroupDescription"],
+    "AWS::EC2::LaunchTemplate": ["LaunchTemplateName"],
+    "AWS::IAM::Role": ["RoleName"],
+    "AWS::Lambda::Function": ["FunctionName"],
+    "AWS::RDS::DBSubnetGroup": ["DBSubnetGroupDescription"],
+    "AWS::CloudWatch::Alarm": ["AlarmDescription", "AlarmName"],
+    "AWS::AutoScaling::AutoScalingGroup": ["AutoScalingGroupName"],
+};
+/** Return true if the string contains any character outside ASCII printable range (0x20–0x7E). */
+function hasNonAscii(s) {
+    for (let i = 0; i < s.length; i++) {
+        const code = s.charCodeAt(i);
+        if (code < 0x20 || code > 0x7e)
+            return true;
+    }
+    return false;
+}
+export function checkNonAsciiProps(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            const propsToCheck = ASCII_REQUIRED[resource.Type];
+            if (!propsToCheck)
+                continue;
+            const props = resource.Properties ?? {};
+            for (const propName of propsToCheck) {
+                const value = props[propName];
+                if (typeof value !== "string")
+                    continue;
+                if (!hasNonAscii(value))
+                    continue;
+                // Find the specific offending characters for the message.
+                const badChars = [...new Set([...value].filter((c) => {
+                        const code = c.charCodeAt(0);
+                        return code < 0x20 || code > 0x7e;
+                    }))];
+                const charList = badChars.map((c) => `U+${c.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`).join(", ");
+                diagnostics.push({
+                    checkId: "WAW036",
+                    severity: "error",
+                    message: `${resource.Type} "${logicalId}" property "${propName}" contains non-ASCII characters (${charList}) — AWS rejects these at changeset validation time`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw036 = {
+    id: "WAW036",
+    description: "Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time",
+    check(ctx) {
+        return checkNonAsciiProps(ctx);
+    },
+};

package/dist/lint/post-synth/waw037.js

@@ -0,0 +1,67 @@
+/**
+ * WAW037: Null Values in CloudFormation Resource Properties
+ *
+ * `resource.PropName` where PropName is not a real GetAtt attribute returns null
+ * silently in chant's AttrRef system — the TypeScript types say `string` but the
+ * runtime value is null. This produces a template with literal null values that
+ * CloudFormation rejects at changeset time with an unhelpful "Invalid template"
+ * error.
+ *
+ * Common causes:
+ *   - `resource.SomeId` instead of `Ref(resource)` (use Ref for the primary identifier)
+ *   - `resource.SomeProp` where SomeProp is not listed in AWS CloudFormation GetAtt docs
+ *   - Typo in an attribute name (e.g. `resource.GroupName` vs `resource.GroupId`)
+ *
+ * This check scans every resource's Properties for null values at any depth and
+ * reports the logical resource ID and dotted property path.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+/** Recursively collect all paths where the value is null. */
+function collectNullPaths(value, path, results, logicalId) {
+    if (value === null) {
+        results.push({ logicalId, path });
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            collectNullPaths(value[i], `${path}[${i}]`, results, logicalId);
+        }
+        return;
+    }
+    if (typeof value === "object") {
+        for (const [k, v] of Object.entries(value)) {
+            collectNullPaths(v, path ? `${path}.${k}` : k, results, logicalId);
+        }
+    }
+}
+export function checkNullProperties(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (!resource.Properties)
+                continue;
+            const nullLocations = [];
+            collectNullPaths(resource.Properties, "", nullLocations, logicalId);
+            for (const loc of nullLocations) {
+                diagnostics.push({
+                    checkId: "WAW037",
+                    severity: "error",
+                    message: `${resource.Type} "${logicalId}" has a null value at Properties.${loc.path} — likely a .PropName AttrRef on a non-existent GetAtt attribute. Use Ref(resource) for the primary identifier, or check the attribute name.`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw037 = {
+    id: "WAW037",
+    description: "Null values in CFN resource properties — caused by invalid AttrRef (.PropName) usage",
+    check(ctx) {
+        return checkNullProperties(ctx);
+    },
+};

package/dist/lint/post-synth/waw038.js

@@ -0,0 +1,42 @@
+/**
+ * WAW038: RDS Publicly Accessible
+ *
+ * Flags RDS instances with PubliclyAccessible: true — the instance gets a
+ * public IP/DNS name reachable from the internet instead of staying inside
+ * the VPC. (DBCluster has no PubliclyAccessible property; that's set on the
+ * member DBInstance.)
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkRdsPubliclyAccessible(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::RDS::DBInstance")
+                continue;
+            const props = resource.Properties ?? {};
+            const publiclyAccessible = props.PubliclyAccessible;
+            if (isIntrinsic(publiclyAccessible))
+                continue;
+            if (publiclyAccessible === true) {
+                diagnostics.push({
+                    checkId: "WAW038",
+                    severity: "error",
+                    message: `RDS instance "${logicalId}" has PubliclyAccessible: true — keep the database inside the VPC, unreachable from the internet`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw038 = {
+    id: "WAW038",
+    description: "RDS instance is publicly accessible — keep databases inside the VPC",
+    check(ctx) {
+        return checkRdsPubliclyAccessible(ctx);
+    },
+};

package/dist/lint/post-synth/waw039.js

@@ -0,0 +1,42 @@
+/**
+ * WAW039: RDS Backup Retention Not Set
+ *
+ * Flags RDS instances and clusters without a positive BackupRetentionPeriod —
+ * a retention of 0 (or an unset property on a resource that otherwise pins
+ * every other property explicitly) disables automated backups entirely.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+const RDS_TYPES = new Set(["AWS::RDS::DBInstance", "AWS::RDS::DBCluster"]);
+export function checkRdsBackupRetention(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (!RDS_TYPES.has(resource.Type))
+                continue;
+            const props = resource.Properties ?? {};
+            const retention = props.BackupRetentionPeriod;
+            if (isIntrinsic(retention))
+                continue;
+            if (retention === undefined || retention === 0) {
+                diagnostics.push({
+                    checkId: "WAW039",
+                    severity: "error",
+                    message: `RDS resource "${logicalId}" (${resource.Type}) does not have a positive BackupRetentionPeriod — automated backups are disabled`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw039 = {
+    id: "WAW039",
+    description: "RDS instance or cluster has automated backups disabled — set a positive BackupRetentionPeriod",
+    check(ctx) {
+        return checkRdsBackupRetention(ctx);
+    },
+};

package/dist/lint/post-synth/waw040.js

@@ -0,0 +1,45 @@
+/**
+ * WAW040: RDS Deletion Protection Disabled (full tier)
+ *
+ * Flags RDS instances and clusters without DeletionProtection: true. Tier-aware
+ * (#894): a relaxed "light" stack (local/Floci, or no --env/ownership.env set)
+ * only warns, since local/dev databases are routinely torn down on purpose; the
+ * strict "full"/production tier (ctx.env === "prod"/"production"/"full", the
+ * existing #201 env seam — see isFullTierEnv) fails the build.
+ */
+import { parseCFTemplate, isIntrinsic, isFullTierEnv } from "./cf-refs.js";
+const RDS_TYPES = new Set(["AWS::RDS::DBInstance", "AWS::RDS::DBCluster"]);
+export function checkRdsDeletionProtection(ctx) {
+    const diagnostics = [];
+    const severity = isFullTierEnv(ctx.env) ? "error" : "warning";
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (!RDS_TYPES.has(resource.Type))
+                continue;
+            const props = resource.Properties ?? {};
+            const deletionProtection = props.DeletionProtection;
+            if (isIntrinsic(deletionProtection))
+                continue;
+            if (deletionProtection !== true) {
+                diagnostics.push({
+                    checkId: "WAW040",
+                    severity,
+                    message: `RDS resource "${logicalId}" (${resource.Type}) does not have DeletionProtection: true — enable it on the full/production tier`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw040 = {
+    id: "WAW040",
+    description: "RDS instance or cluster does not have DeletionProtection enabled (full tier)",
+    check(ctx) {
+        return checkRdsDeletionProtection(ctx);
+    },
+};

package/dist/lint/post-synth/waw041.js

@@ -0,0 +1,40 @@
+/**
+ * WAW041: RDS Proxy TLS Not Required
+ *
+ * Flags RDS Proxy resources without RequireTLS: true — without it, a client
+ * can connect to the proxy over plaintext.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkDbProxyTls(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::RDS::DBProxy")
+                continue;
+            const props = resource.Properties ?? {};
+            const requireTls = props.RequireTLS;
+            if (isIntrinsic(requireTls))
+                continue;
+            if (requireTls !== true) {
+                diagnostics.push({
+                    checkId: "WAW041",
+                    severity: "error",
+                    message: `RDS Proxy "${logicalId}" does not have RequireTLS: true — clients can connect over plaintext`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw041 = {
+    id: "WAW041",
+    description: "RDS Proxy does not require TLS for client connections",
+    check(ctx) {
+        return checkDbProxyTls(ctx);
+    },
+};

package/dist/lint/post-synth/waw042.js

@@ -0,0 +1,99 @@
+/**
+ * WAW042: S3 Bucket Missing TLS-Only Policy
+ *
+ * Flags S3 buckets without a companion BucketPolicy that denies requests made
+ * over plaintext (a Deny statement keyed on `aws:SecureTransport` being
+ * false). Encryption at rest is WAW006; the public-access block is WAW018;
+ * this covers encryption in transit.
+ */
+import { parseCFTemplate, findResourceRefs } from "./cf-refs.js";
+function statementDeniesInsecureTransport(stmt) {
+    if (stmt.Effect !== "Deny")
+        return false;
+    const condition = stmt.Condition;
+    if (typeof condition !== "object" || condition === null)
+        return false;
+    const cond = condition;
+    for (const operator of ["Bool", "NumericLessThan"]) {
+        const clause = cond[operator];
+        if (typeof clause !== "object" || clause === null)
+            continue;
+        const value = clause["aws:SecureTransport"];
+        if (value === "false" || value === false)
+            return true;
+    }
+    return false;
+}
+/** A value as JSON with its object keys sorted, for comparing two values. */
+function canonical(value) {
+    return JSON.stringify(value, (_key, v) => v && typeof v === "object" && !Array.isArray(v)
+        ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, v[k]]))
+        : v);
+}
+/**
+ * Logical ids of every bucket a BucketPolicy's `Bucket` property resolves to:
+ * a bucket it references (`Ref`, `GetAtt`), or a bucket whose `BucketName`
+ * is the same value (`Fn::Sub: "${AppName}-${AWS::Region}"` on both).
+ */
+function bucketPolicyTargets(resource, resources) {
+    const props = resource.Properties ?? {};
+    const targets = findResourceRefs(props.Bucket);
+    if (props.Bucket === undefined)
+        return targets;
+    const policyBucket = canonical(props.Bucket);
+    for (const [logicalId, other] of Object.entries(resources)) {
+        if (other.Type !== "AWS::S3::Bucket")
+            continue;
+        const name = other.Properties?.BucketName;
+        if (name !== undefined && canonical(name) === policyBucket)
+            targets.add(logicalId);
+    }
+    return targets;
+}
+export function checkS3TlsOnlyPolicy(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        const bucketsWithTlsPolicy = new Set();
+        for (const resource of Object.values(template.Resources)) {
+            if (resource.Type !== "AWS::S3::BucketPolicy")
+                continue;
+            const props = resource.Properties ?? {};
+            const policyDoc = props.PolicyDocument;
+            if (typeof policyDoc !== "object" || policyDoc === null)
+                continue;
+            const statements = policyDoc.Statement;
+            if (!Array.isArray(statements))
+                continue;
+            const hasTlsDeny = statements.some((stmt) => typeof stmt === "object" && stmt !== null && statementDeniesInsecureTransport(stmt));
+            if (!hasTlsDeny)
+                continue;
+            for (const bucketId of bucketPolicyTargets(resource, template.Resources)) {
+                bucketsWithTlsPolicy.add(bucketId);
+            }
+        }
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::S3::Bucket")
+                continue;
+            if (bucketsWithTlsPolicy.has(logicalId))
+                continue;
+            diagnostics.push({
+                checkId: "WAW042",
+                severity: "error",
+                message: `S3 bucket "${logicalId}" has no bucket policy denying non-TLS requests — add a Deny statement on aws:SecureTransport = false`,
+                entity: logicalId,
+                lexicon: "aws",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const waw042 = {
+    id: "WAW042",
+    description: "S3 bucket missing a TLS-only bucket policy — deny requests over plaintext",
+    check(ctx) {
+        return checkS3TlsOnlyPolicy(ctx);
+    },
+};