@intentius/chant-lexicon-aws 0.124.30 → 0.124.32

package/dist/lint/post-synth/waw043.js

@@ -0,0 +1,51 @@
+/**
+ * WAW043: KMS Key Rotation Disabled
+ *
+ * Flags customer-managed KMS keys without EnableKeyRotation: true. Skips
+ * asymmetric/HMAC keys (a non-default KeySpec) — AWS does not support
+ * automatic rotation for those.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+function supportsRotation(props) {
+    const keySpec = props.KeySpec;
+    if (keySpec === undefined)
+        return true; // default is SYMMETRIC_DEFAULT
+    if (isIntrinsic(keySpec))
+        return false; // can't statically verify — don't guess
+    return keySpec === "SYMMETRIC_DEFAULT";
+}
+export function checkKmsKeyRotation(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::KMS::Key")
+                continue;
+            const props = resource.Properties ?? {};
+            if (!supportsRotation(props))
+                continue;
+            const rotation = props.EnableKeyRotation;
+            if (isIntrinsic(rotation))
+                continue;
+            if (rotation !== true) {
+                diagnostics.push({
+                    checkId: "WAW043",
+                    severity: "warning",
+                    message: `KMS key "${logicalId}" does not have EnableKeyRotation: true — enable automatic annual key rotation`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw043 = {
+    id: "WAW043",
+    description: "KMS customer-managed key does not have automatic key rotation enabled",
+    check(ctx) {
+        return checkKmsKeyRotation(ctx);
+    },
+};

package/dist/lint/post-synth/waw044.js

@@ -0,0 +1,64 @@
+/**
+ * WAW044: ALB HTTP Listener Not Redirecting To HTTPS (full tier)
+ *
+ * Flags load balancer Listener resources on Protocol: HTTP whose
+ * DefaultActions don't redirect to HTTPS — the listener serves plaintext
+ * traffic instead of upgrading it. Access logging is WAW024; this covers
+ * transport security on the listener itself.
+ *
+ * Tier-aware (#917), same seam as WAW040/WAW052 (#894): a relaxed "light"
+ * stack (local/Floci, or no --env/ownership.env set) only warns, since the
+ * light tier is intentionally HTTP-only with no ACM cert to redirect to; the
+ * strict "full"/production tier (ctx.env === "prod"/"production"/"full", the
+ * existing #201 env seam — see isFullTierEnv) fails the build.
+ */
+import { parseCFTemplate, isIntrinsic, isFullTierEnv } from "./cf-refs.js";
+function redirectsToHttps(actions) {
+    if (!Array.isArray(actions))
+        return false;
+    return actions.some((action) => {
+        if (typeof action !== "object" || action === null)
+            return false;
+        const a = action;
+        if (a.Type !== "redirect")
+            return false;
+        const redirectConfig = a.RedirectConfig;
+        if (typeof redirectConfig !== "object" || redirectConfig === null)
+            return false;
+        return redirectConfig.Protocol === "HTTPS";
+    });
+}
+export function checkAlbHttpRedirect(ctx) {
+    const diagnostics = [];
+    const severity = isFullTierEnv(ctx.env) ? "error" : "warning";
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ElasticLoadBalancingV2::Listener")
+                continue;
+            const props = resource.Properties ?? {};
+            const protocol = props.Protocol;
+            if (isIntrinsic(protocol) || protocol !== "HTTP")
+                continue;
+            if (!redirectsToHttps(props.DefaultActions)) {
+                diagnostics.push({
+                    checkId: "WAW044",
+                    severity,
+                    message: `Listener "${logicalId}" is HTTP and does not redirect to HTTPS — add a redirect DefaultAction (Protocol: HTTPS) on the full/production tier`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw044 = {
+    id: "WAW044",
+    description: "ALB HTTP listener does not redirect to HTTPS (full tier)",
+    check(ctx) {
+        return checkAlbHttpRedirect(ctx);
+    },
+};

package/dist/lint/post-synth/waw045.js

@@ -0,0 +1,49 @@
+/**
+ * WAW045: ALB Weak Or Missing TLS Policy
+ *
+ * Flags HTTPS/TLS listeners without a modern SslPolicy (TLS 1.2+). The
+ * account-wide default (`ELBSecurityPolicy-2016-08`) still allows TLS 1.0, so
+ * a missing SslPolicy is flagged the same as an explicit legacy one.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+const SECURE_PROTOCOLS = new Set(["HTTPS", "TLS"]);
+/** AWS's predefined TLS 1.2+ policies all carry a "-1-2-" or "-1-3-" segment (FS/TLS13 variants included). */
+function isModernTlsPolicy(policy) {
+    return /-1-2-|-1-3-/.test(policy);
+}
+export function checkAlbTlsPolicy(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ElasticLoadBalancingV2::Listener")
+                continue;
+            const props = resource.Properties ?? {};
+            const protocol = props.Protocol;
+            if (isIntrinsic(protocol) || typeof protocol !== "string" || !SECURE_PROTOCOLS.has(protocol))
+                continue;
+            const sslPolicy = props.SslPolicy;
+            if (isIntrinsic(sslPolicy))
+                continue;
+            if (typeof sslPolicy !== "string" || !isModernTlsPolicy(sslPolicy)) {
+                diagnostics.push({
+                    checkId: "WAW045",
+                    severity: "error",
+                    message: `Listener "${logicalId}" (${protocol}) ${sslPolicy ? `uses SslPolicy "${sslPolicy}"` : "has no SslPolicy set"} — use a TLS 1.2+ predefined policy (e.g. ELBSecurityPolicy-TLS13-1-2-2021-06)`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw045 = {
+    id: "WAW045",
+    description: "ALB HTTPS/TLS listener does not use a modern (TLS 1.2+) SslPolicy",
+    check(ctx) {
+        return checkAlbTlsPolicy(ctx);
+    },
+};

package/dist/lint/post-synth/waw046.js

@@ -0,0 +1,52 @@
+/**
+ * WAW046: ECS Secret-Looking Value In Plaintext Environment
+ *
+ * Flags ECS TaskDefinition container `Environment` entries whose name looks
+ * like a credential (password/secret/token/key/credential) — those values are
+ * visible in the task definition and console. They should be passed via
+ * `Secrets` (Secrets Manager / SSM Parameter Store) instead.
+ */
+import { parseCFTemplate, getContainerDefinitions, isIntrinsic } from "./cf-refs.js";
+const SECRET_NAME_PATTERN = /password|secret|token|api[_-]?key|credential/i;
+export function checkEcsPlaintextSecrets(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECS::TaskDefinition")
+                continue;
+            for (const container of getContainerDefinitions(resource)) {
+                const env = container.Environment;
+                if (!Array.isArray(env))
+                    continue;
+                for (const entry of env) {
+                    if (typeof entry !== "object" || entry === null)
+                        continue;
+                    const name = entry.Name;
+                    if (isIntrinsic(name) || typeof name !== "string")
+                        continue;
+                    if (SECRET_NAME_PATTERN.test(name)) {
+                        const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+                        diagnostics.push({
+                            checkId: "WAW046",
+                            severity: "error",
+                            message: `TaskDefinition "${logicalId}" container "${containerName}" passes "${name}" via plaintext Environment — use Secrets (Secrets Manager/SSM) instead`,
+                            entity: logicalId,
+                            lexicon: "aws",
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw046 = {
+    id: "WAW046",
+    description: "ECS container passes a secret-looking value via plaintext Environment instead of Secrets",
+    check(ctx) {
+        return checkEcsPlaintextSecrets(ctx);
+    },
+};

package/dist/lint/post-synth/waw047.js

@@ -0,0 +1,43 @@
+/**
+ * WAW047: ECS Privileged Container
+ *
+ * Flags ECS TaskDefinition containers running with Privileged: true — the
+ * container gets elevated access to the host, equivalent to root on the EC2
+ * instance (and rejected outright on Fargate).
+ */
+import { parseCFTemplate, getContainerDefinitions, isIntrinsic } from "./cf-refs.js";
+export function checkEcsPrivilegedContainer(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECS::TaskDefinition")
+                continue;
+            for (const container of getContainerDefinitions(resource)) {
+                const privileged = container.Privileged;
+                if (isIntrinsic(privileged))
+                    continue;
+                if (privileged === true) {
+                    const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+                    diagnostics.push({
+                        checkId: "WAW047",
+                        severity: "error",
+                        message: `TaskDefinition "${logicalId}" container "${containerName}" runs with Privileged: true — drop elevated host access`,
+                        entity: logicalId,
+                        lexicon: "aws",
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw047 = {
+    id: "WAW047",
+    description: "ECS container runs privileged — drop elevated host access",
+    check(ctx) {
+        return checkEcsPrivilegedContainer(ctx);
+    },
+};

package/dist/lint/post-synth/waw048.js

@@ -0,0 +1,40 @@
+/**
+ * WAW048: ECS Missing Log Configuration
+ *
+ * Flags ECS TaskDefinition containers with no LogConfiguration — container
+ * stdout/stderr is discarded, leaving no audit trail. Mirrors WAW024 (ALB
+ * access logging): advisory, not a hard block.
+ */
+import { parseCFTemplate, getContainerDefinitions } from "./cf-refs.js";
+export function checkEcsLogConfiguration(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECS::TaskDefinition")
+                continue;
+            for (const container of getContainerDefinitions(resource)) {
+                if (container.LogConfiguration === undefined) {
+                    const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+                    diagnostics.push({
+                        checkId: "WAW048",
+                        severity: "warning",
+                        message: `TaskDefinition "${logicalId}" container "${containerName}" has no LogConfiguration — container output is discarded`,
+                        entity: logicalId,
+                        lexicon: "aws",
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw048 = {
+    id: "WAW048",
+    description: "ECS container does not have a LogConfiguration — enable logging for audit trails",
+    check(ctx) {
+        return checkEcsLogConfiguration(ctx);
+    },
+};

package/dist/lint/post-synth/waw049.js

@@ -0,0 +1,78 @@
+/**
+ * WAW049: Security Group Broad Ingress (any port, except ALB:80/443)
+ *
+ * Generalizes WAW019 beyond the four named sensitive ports (SSH/RDP/MySQL/
+ * Postgres): flags 0.0.0.0/0 or ::/0 ingress on *any* port, with a carve-out
+ * for the conventional public ALB listener ports (exactly 80 or 443).
+ *
+ * Port 80 is exempt unconditionally, not just on a relaxed tier (#917): a
+ * public ALB's HTTP listener is meant to be internet-facing on every tier —
+ * on the full/production tier it still needs an SG rule open to 0.0.0.0/0 so
+ * clients can reach the listener that redirects them to HTTPS (WAW044 is the
+ * rule that enforces the redirect actually happens; this rule only judges the
+ * SG's shape). The "light" tier serves plaintext HTTP straight off that same
+ * port instead of redirecting, which doesn't change the SG's exposure at all.
+ * A genuinely over-broad rule (all ports, SSH, etc.) still errors regardless
+ * of tier.
+ */
+import { parseCFTemplate, getSecurityGroupIngress, isIntrinsic } from "./cf-refs.js";
+const OPEN_CIDRS = new Set(["0.0.0.0/0", "::/0"]);
+const ALB_LISTENER_PORTS = new Set([80, 443]);
+function isAlbListenerException(rule) {
+    return (typeof rule.FromPort === "number" &&
+        rule.FromPort === rule.ToPort &&
+        ALB_LISTENER_PORTS.has(rule.FromPort));
+}
+function checkIngressRule(rule, logicalId, diagnostics) {
+    const cidrIp = rule.CidrIp;
+    const cidrIpv6 = rule.CidrIpv6;
+    const hasOpenCidr = (typeof cidrIp === "string" && OPEN_CIDRS.has(cidrIp)) ||
+        (typeof cidrIpv6 === "string" && OPEN_CIDRS.has(cidrIpv6));
+    if (!hasOpenCidr)
+        return;
+    // Can't statically verify a port pinned by an intrinsic — don't guess.
+    if (isIntrinsic(rule.FromPort) || isIntrinsic(rule.ToPort))
+        return;
+    if (isAlbListenerException(rule))
+        return;
+    const cidr = typeof cidrIp === "string" && OPEN_CIDRS.has(cidrIp) ? cidrIp : cidrIpv6;
+    const fromPort = rule.FromPort;
+    const toPort = rule.ToPort;
+    const portDesc = fromPort !== undefined && toPort !== undefined ? ` on ports ${fromPort}-${toPort}` : " on all ports";
+    diagnostics.push({
+        checkId: "WAW049",
+        severity: "error",
+        message: `Security group "${logicalId}" allows unrestricted ingress from ${cidr}${portDesc} — restrict to specific CIDR ranges (only ALB:80/443 is exempt)`,
+        entity: logicalId,
+        lexicon: "aws",
+    });
+}
+export function checkBroadIngress(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type === "AWS::EC2::SecurityGroup") {
+                for (const rule of getSecurityGroupIngress(resource)) {
+                    checkIngressRule(rule, logicalId, diagnostics);
+                }
+            }
+            if (resource.Type === "AWS::EC2::SecurityGroupIngress") {
+                const props = resource.Properties ?? {};
+                if (!isIntrinsic(props)) {
+                    checkIngressRule(props, logicalId, diagnostics);
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw049 = {
+    id: "WAW049",
+    description: "Security group allows unrestricted ingress on a port other than ALB:80/443",
+    check(ctx) {
+        return checkBroadIngress(ctx);
+    },
+};

package/dist/lint/post-synth/waw050.js

@@ -0,0 +1,44 @@
+/**
+ * WAW050: Cognito Advanced Security Disabled
+ *
+ * Flags Cognito UserPools without UserPoolAddOns.AdvancedSecurityMode set to
+ * AUDIT or ENFORCED — without it, Cognito does not evaluate risk (compromised
+ * credentials, adaptive auth) on sign-in/sign-up.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkCognitoAdvancedSecurity(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::Cognito::UserPool")
+                continue;
+            const props = resource.Properties ?? {};
+            const addOns = props.UserPoolAddOns;
+            if (isIntrinsic(addOns))
+                continue;
+            const mode = typeof addOns === "object" && addOns !== null ? addOns.AdvancedSecurityMode : undefined;
+            if (isIntrinsic(mode))
+                continue;
+            if (mode !== "AUDIT" && mode !== "ENFORCED") {
+                diagnostics.push({
+                    checkId: "WAW050",
+                    severity: "error",
+                    message: `Cognito UserPool "${logicalId}" does not have advanced security enabled — set UserPoolAddOns.AdvancedSecurityMode to AUDIT or ENFORCED`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw050 = {
+    id: "WAW050",
+    description: "Cognito UserPool does not have advanced security (risk-based auth) enabled",
+    check(ctx) {
+        return checkCognitoAdvancedSecurity(ctx);
+    },
+};

package/dist/lint/post-synth/waw051.js

@@ -0,0 +1,41 @@
+/**
+ * WAW051: Cognito Implicit OAuth Grant Allowed
+ *
+ * Flags UserPoolClients whose AllowedOAuthFlows include the deprecated
+ * "implicit" grant — it returns tokens directly in the redirect URL (exposed
+ * in browser history/referrer headers) instead of via a code exchange.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkCognitoImplicitGrant(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::Cognito::UserPoolClient")
+                continue;
+            const props = resource.Properties ?? {};
+            const flows = props.AllowedOAuthFlows;
+            if (isIntrinsic(flows) || !Array.isArray(flows))
+                continue;
+            if (flows.some((f) => f === "implicit")) {
+                diagnostics.push({
+                    checkId: "WAW051",
+                    severity: "error",
+                    message: `Cognito UserPoolClient "${logicalId}" allows the implicit OAuth grant — use the authorization code grant instead`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw051 = {
+    id: "WAW051",
+    description: "Cognito UserPoolClient allows the deprecated implicit OAuth grant",
+    check(ctx) {
+        return checkCognitoImplicitGrant(ctx);
+    },
+};

package/dist/lint/post-synth/waw052.js

@@ -0,0 +1,43 @@
+/**
+ * WAW052: Cognito MFA Not Required (full tier)
+ *
+ * Flags UserPools without MfaConfiguration: ON. Tier-aware (#894), same
+ * seam as WAW040: a relaxed "light" stack (local/Floci, or no --env/
+ * ownership.env set) only warns; the strict "full"/production tier
+ * (ctx.env === "prod"/"production"/"full") fails the build.
+ */
+import { parseCFTemplate, isIntrinsic, isFullTierEnv } from "./cf-refs.js";
+export function checkCognitoMfaRequired(ctx) {
+    const diagnostics = [];
+    const severity = isFullTierEnv(ctx.env) ? "error" : "warning";
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::Cognito::UserPool")
+                continue;
+            const props = resource.Properties ?? {};
+            const mfaConfiguration = props.MfaConfiguration;
+            if (isIntrinsic(mfaConfiguration))
+                continue;
+            if (mfaConfiguration !== "ON") {
+                diagnostics.push({
+                    checkId: "WAW052",
+                    severity,
+                    message: `Cognito UserPool "${logicalId}" does not require MFA (MfaConfiguration: ON) — require it on the full/production tier`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw052 = {
+    id: "WAW052",
+    description: "Cognito UserPool does not require MFA (full tier)",
+    check(ctx) {
+        return checkCognitoMfaRequired(ctx);
+    },
+};

package/dist/lint/post-synth/waw053.js

@@ -0,0 +1,43 @@
+/**
+ * WAW053: ECR Image Scanning Disabled
+ *
+ * Flags ECR repositories without ImageScanningConfiguration.ScanOnPush: true
+ * — pushed images aren't scanned for known CVEs.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkEcrScanOnPush(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECR::Repository")
+                continue;
+            const props = resource.Properties ?? {};
+            const scanConfig = props.ImageScanningConfiguration;
+            if (isIntrinsic(scanConfig))
+                continue;
+            const scanOnPush = typeof scanConfig === "object" && scanConfig !== null ? scanConfig.ScanOnPush : undefined;
+            if (isIntrinsic(scanOnPush))
+                continue;
+            if (scanOnPush !== true) {
+                diagnostics.push({
+                    checkId: "WAW053",
+                    severity: "error",
+                    message: `ECR repository "${logicalId}" does not have ImageScanningConfiguration.ScanOnPush: true — pushed images aren't scanned for vulnerabilities`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw053 = {
+    id: "WAW053",
+    description: "ECR repository does not scan images on push",
+    check(ctx) {
+        return checkEcrScanOnPush(ctx);
+    },
+};

package/dist/lint/post-synth/waw054.js

@@ -0,0 +1,41 @@
+/**
+ * WAW054: ECR Tag Mutability Not Immutable
+ *
+ * Flags ECR repositories without ImageTagMutability: IMMUTABLE — mutable tags
+ * let a previously deployed/scanned/signed tag (e.g. "prod") silently point at
+ * different image content later.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkEcrTagImmutability(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::ECR::Repository")
+                continue;
+            const props = resource.Properties ?? {};
+            const mutability = props.ImageTagMutability;
+            if (isIntrinsic(mutability))
+                continue;
+            if (mutability !== "IMMUTABLE") {
+                diagnostics.push({
+                    checkId: "WAW054",
+                    severity: "error",
+                    message: `ECR repository "${logicalId}" does not have ImageTagMutability: IMMUTABLE — a tag can silently be repointed at different image content`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw054 = {
+    id: "WAW054",
+    description: "ECR repository does not have immutable image tags",
+    check(ctx) {
+        return checkEcrTagImmutability(ctx);
+    },
+};

package/dist/lint/post-synth/waw055.js

@@ -0,0 +1,41 @@
+/**
+ * WAW055: CloudWatch Logs Retention Not Set
+ *
+ * Flags Logs::LogGroup resources without RetentionInDays — an unset
+ * retention means "Never expire," which is rarely the intended cost/
+ * compliance posture.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkLogsRetention(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::Logs::LogGroup")
+                continue;
+            const props = resource.Properties ?? {};
+            const retention = props.RetentionInDays;
+            if (isIntrinsic(retention))
+                continue;
+            if (retention === undefined) {
+                diagnostics.push({
+                    checkId: "WAW055",
+                    severity: "warning",
+                    message: `Log group "${logicalId}" has no RetentionInDays set — logs are kept forever by default; set an explicit retention period`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw055 = {
+    id: "WAW055",
+    description: "CloudWatch Logs log group has no retention period set",
+    check(ctx) {
+        return checkLogsRetention(ctx);
+    },
+};