@intentius/chant-lexicon-aws 0.124.31 → 0.124.32

package/dist/lint/post-synth/cf-refs.js

@@ -0,0 +1,247 @@
+/**
+ * Shared utility for extracting CloudFormation resource references
+ * from template properties.
+ *
+ * Used by WAW010 (redundant DependsOn) and COR020 (circular deps).
+ */
+/**
+ * Parse a serialized CloudFormation template from build output.
+ * Accepts either a raw string or a SerializerResult (extracts primary).
+ */
+export function parseCFTemplate(output) {
+    const raw = typeof output === "string" ? output : output.primary;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "object" && parsed !== null) {
+            return parsed;
+        }
+    }
+    catch {
+        // Not valid JSON
+    }
+    return null;
+}
+/**
+ * Recursively walk a CloudFormation property value and extract all logical IDs
+ * referenced via Ref and Fn::GetAtt.
+ *
+ * Skips pseudo-parameters (those starting with "AWS::").
+ */
+export function findResourceRefs(value) {
+    const refs = new Set();
+    walkValue(value, refs);
+    return refs;
+}
+/**
+ * Build the reverse of `findResourceRefs` for a whole template: logical id →
+ * the set of logical ids whose Properties reference it via Ref/Fn::GetAtt.
+ * Lets a check walk the graph consumer-ward (who uses this role?) instead of
+ * dependency-ward. Used by WAW059.
+ */
+export function buildReverseRefIndex(template) {
+    const index = new Map();
+    for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+        for (const target of findResourceRefs(resource.Properties)) {
+            if (target === logicalId)
+                continue;
+            let consumers = index.get(target);
+            if (!consumers) {
+                consumers = new Set();
+                index.set(target, consumers);
+            }
+            consumers.add(logicalId);
+        }
+    }
+    return index;
+}
+/**
+ * Check if a value is a CloudFormation intrinsic function (Ref, Fn::*, etc.)
+ * that cannot be statically evaluated.
+ */
+export function isIntrinsic(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const obj = value;
+    return "Ref" in obj || Object.keys(obj).some((k) => k.startsWith("Fn::"));
+}
+/**
+ * Walk IAM policy statements from a resource's properties.
+ * Handles IAM::Policy, IAM::Role, and IAM::ManagedPolicy layouts.
+ */
+export function walkPolicyStatements(resource) {
+    const statements = [];
+    const props = resource.Properties ?? {};
+    // PolicyDocument.Statement (IAM::Policy, IAM::ManagedPolicy)
+    collectStatements(props.PolicyDocument, statements);
+    // AssumeRolePolicyDocument.Statement (IAM::Role)
+    collectStatements(props.AssumeRolePolicyDocument, statements);
+    // Policies[].PolicyDocument.Statement (IAM::Role inline policies)
+    if (Array.isArray(props.Policies)) {
+        for (const policy of props.Policies) {
+            if (typeof policy === "object" && policy !== null) {
+                collectStatements(policy.PolicyDocument, statements);
+            }
+        }
+    }
+    return statements;
+}
+function collectStatements(policyDoc, out) {
+    if (typeof policyDoc !== "object" || policyDoc === null)
+        return;
+    const doc = policyDoc;
+    if (Array.isArray(doc.Statement)) {
+        for (const stmt of doc.Statement) {
+            if (typeof stmt === "object" && stmt !== null) {
+                out.push(stmt);
+            }
+        }
+    }
+}
+/**
+ * Normalize security group ingress rules from inline SecurityGroupIngress
+ * property and standalone SecurityGroupIngress resources.
+ */
+export function getSecurityGroupIngress(resource) {
+    const rules = [];
+    const props = resource.Properties ?? {};
+    if (Array.isArray(props.SecurityGroupIngress)) {
+        for (const rule of props.SecurityGroupIngress) {
+            if (typeof rule === "object" && rule !== null) {
+                rules.push(rule);
+            }
+        }
+    }
+    return rules;
+}
+/**
+ * Extract an ECS TaskDefinition's container definitions (shared by the
+ * WAW046/047/048 ECS checks).
+ */
+export function getContainerDefinitions(resource) {
+    const props = resource.Properties ?? {};
+    const defs = props.ContainerDefinitions;
+    if (!Array.isArray(defs))
+        return [];
+    return defs.filter((d) => typeof d === "object" && d !== null);
+}
+/**
+ * Whether a build's `env` (from `--env` or the project's `ownership.env`, see
+ * PostSynthContext#env and #201) should be treated as the strict "full"/
+ * production tier for tier-gated checks, vs a relaxed "light" tier acceptable
+ * for local/Floci-style stacks. Reuses the existing `ctx.env` seam — no new
+ * tier field. An undefined or unrecognized env is treated as non-strict so a
+ * project that never sets `--env`/`ownership.env` isn't unexpectedly hard-failed.
+ */
+export function isFullTierEnv(env) {
+    return env === "prod" || env === "production" || env === "full";
+}
+/**
+ * Parse an IPv4 CIDR literal ("10.0.0.0/16") into its numeric base address
+ * and prefix length. Returns null for anything that isn't a plain IPv4 CIDR
+ * (IPv6, malformed octets, out-of-range prefix) — callers treat that as
+ * "can't prove statically" rather than an error.
+ */
+export function parseIpv4Cidr(cidr) {
+    const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(cidr.trim());
+    if (!m)
+        return null;
+    const octets = m.slice(1, 5).map(Number);
+    if (octets.some((o) => o < 0 || o > 255))
+        return null;
+    const prefix = Number(m[5]);
+    if (prefix < 0 || prefix > 32)
+        return null;
+    const base = ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
+    return { base, prefix };
+}
+/** [networkAddress, broadcastAddress] for a parsed IPv4 CIDR block. */
+function ipv4Range(cidr) {
+    const maskBits = cidr.prefix === 0 ? 0 : (0xffffffff << (32 - cidr.prefix)) >>> 0;
+    const network = (cidr.base & maskBits) >>> 0;
+    const broadcast = (network | (~maskBits >>> 0)) >>> 0;
+    return [network, broadcast];
+}
+/**
+ * Whether `inner` (an IPv4 CIDR literal) falls entirely within `outer`.
+ * Returns null — not false — when either literal isn't a plain, parseable
+ * IPv4 CIDR (e.g. IPv6, or a CloudFormation intrinsic already stringified
+ * elsewhere); a null means "statically unprovable", not "violation".
+ */
+export function ipv4CidrContains(outer, inner) {
+    const outerCidr = parseIpv4Cidr(outer);
+    const innerCidr = parseIpv4Cidr(inner);
+    if (!outerCidr || !innerCidr)
+        return null;
+    const [oStart, oEnd] = ipv4Range(outerCidr);
+    const [iStart, iEnd] = ipv4Range(innerCidr);
+    return iStart >= oStart && iEnd <= oEnd;
+}
+/**
+ * A port as a number. CloudFormation accepts `"80"` as well as `80`, so a
+ * string of digits counts; anything else reads as -1, which means all ports.
+ */
+function portNumber(port) {
+    if (typeof port === "number")
+        return port;
+    if (typeof port === "string" && /^-?\d+$/.test(port.trim()))
+        return Number(port);
+    return -1;
+}
+/**
+ * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
+ */
+export function portRangeContainsSensitive(fromPort, toPort, sensitivePorts) {
+    // Missing ports means all ports
+    if (fromPort === undefined && toPort === undefined)
+        return true;
+    const from = portNumber(fromPort);
+    const to = portNumber(toPort);
+    // If either is an intrinsic, we can't statically verify
+    if (isIntrinsic(fromPort) || isIntrinsic(toPort))
+        return false;
+    if (from === -1 && to === -1)
+        return true;
+    for (const port of sensitivePorts) {
+        if (from <= port && port <= to)
+            return true;
+    }
+    return false;
+}
+function walkValue(value, refs) {
+    if (value === null || value === undefined)
+        return;
+    if (typeof value !== "object")
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            walkValue(item, refs);
+        }
+        return;
+    }
+    const obj = value;
+    // Check for Ref
+    if ("Ref" in obj && typeof obj.Ref === "string") {
+        if (!obj.Ref.startsWith("AWS::")) {
+            refs.add(obj.Ref);
+        }
+    }
+    // Check for Fn::GetAtt
+    if ("Fn::GetAtt" in obj) {
+        const getAtt = obj["Fn::GetAtt"];
+        if (Array.isArray(getAtt) && getAtt.length >= 1 && typeof getAtt[0] === "string") {
+            refs.add(getAtt[0]);
+        }
+        else if (typeof getAtt === "string") {
+            // Dot-delimited form: "LogicalId.Attribute"
+            const logicalId = getAtt.split(".")[0];
+            if (logicalId)
+                refs.add(logicalId);
+        }
+    }
+    // Recurse into all object values (including intrinsic function arguments)
+    for (const val of Object.values(obj)) {
+        if (typeof val === "object" && val !== null) {
+            walkValue(val, refs);
+        }
+    }
+}

package/dist/lint/post-synth/cor020.js

@@ -0,0 +1,60 @@
+/**
+ * COR020: Circular Resource Dependencies
+ *
+ * Builds a directed dependency graph from Ref, Fn::GetAtt, and DependsOn
+ * entries in the synthesized CloudFormation template. Detects cycles using
+ * DFS with three-color marking (white/gray/black).
+ */
+import { detectCycles } from "@intentius/chant/discovery/cycles";
+import { parseCFTemplate, findResourceRefs } from "./cf-refs.js";
+export const cor020 = {
+    id: "COR020",
+    description: "Circular resource dependency — detects cycles in the resource dependency graph",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseCFTemplate(output);
+            if (!template?.Resources)
+                continue;
+            const resourceIds = new Set(Object.keys(template.Resources));
+            // Build adjacency list: resource → set of resources it depends on
+            const graph = new Map();
+            for (const [logicalId, resource] of Object.entries(template.Resources)) {
+                const deps = new Set();
+                // Refs from Properties
+                const propertyRefs = findResourceRefs(resource.Properties);
+                for (const ref of propertyRefs) {
+                    if (resourceIds.has(ref) && ref !== logicalId) {
+                        deps.add(ref);
+                    }
+                }
+                // Explicit DependsOn
+                if (resource.DependsOn) {
+                    const dependsOn = Array.isArray(resource.DependsOn)
+                        ? resource.DependsOn
+                        : [resource.DependsOn];
+                    for (const target of dependsOn) {
+                        if (resourceIds.has(target) && target !== logicalId) {
+                            deps.add(target);
+                        }
+                    }
+                }
+                graph.set(logicalId, deps);
+            }
+            // Detect cycles
+            const cycles = detectCycles(graph);
+            for (const cycle of cycles) {
+                // Add trailing node for display: "A -> B -> C -> A"
+                const chain = [...cycle, cycle[0]].join(" -> ");
+                diagnostics.push({
+                    checkId: "COR020",
+                    severity: "error",
+                    message: `Circular resource dependency: ${chain}`,
+                    entity: cycle[0],
+                    lexicon: "aws",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/ext001.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ext001.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ext001.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,GAAG,oBAAoB,GAAG,aAAa,GAAG,cAAc,CAAC;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAgLD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,GAChD,mBAAmB,EAAE,CAkBvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}
+{"version":3,"file":"ext001.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ext001.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,GAAG,oBAAoB,GAAG,aAAa,GAAG,cAAc,CAAC;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA+KD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,GAChD,mBAAmB,EAAE,CAkBvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/ext001.js

@@ -0,0 +1,197 @@
+/**
+ * EXT001: Extension Constraint Violation
+ *
+ * Validates CloudFormation resource properties against cross-property
+ * constraints from cfn-lint extension schemas.
+ *
+ * Constraint types:
+ * - if_then: if condition properties match, then requirement must hold
+ * - dependent_excluded: if property A exists, property B must not
+ * - required_or: at least one of the listed properties must exist
+ * - required_xor: exactly one of the listed properties must exist
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { parseCFTemplate } from "./cf-refs.js";
+/**
+ * Load lexicon JSON to get constraints per resource type.
+ */
+function loadLexiconConstraints() {
+    const map = new Map();
+    try {
+        // From src/lint/post-synth/ (or its compiled twin under dist/) to src/generated/
+        const lexiconPath = join(moduleSourceDir(import.meta.url), "..", "..", "generated", "lexicon-aws.json");
+        const content = readFileSync(lexiconPath, "utf-8");
+        const data = JSON.parse(content);
+        for (const [_name, entry] of Object.entries(data)) {
+            if (entry.kind === "resource" && entry.resourceType && entry.constraints && entry.constraints.length > 0) {
+                map.set(entry.resourceType, entry.constraints);
+            }
+        }
+    }
+    catch {
+        // Lexicon not available — skip constraint checking
+    }
+    return map;
+}
+/**
+ * Check if a JSON schema "if" condition matches resource properties.
+ */
+function matchesCondition(condition, properties) {
+    if (!condition || typeof condition !== "object")
+        return false;
+    const cond = condition;
+    // { properties: { PropName: { const: value } } }
+    if (cond.properties && typeof cond.properties === "object") {
+        const condProps = cond.properties;
+        for (const [propName, schema] of Object.entries(condProps)) {
+            if (!schema || typeof schema !== "object")
+                continue;
+            const s = schema;
+            if ("const" in s) {
+                if (properties[propName] !== s.const)
+                    return false;
+            }
+            if ("enum" in s && Array.isArray(s.enum)) {
+                if (!s.enum.includes(properties[propName]))
+                    return false;
+            }
+            if ("pattern" in s && typeof s.pattern === "string") {
+                const val = properties[propName];
+                if (typeof val !== "string" || !new RegExp(s.pattern).test(val))
+                    return false;
+            }
+        }
+    }
+    // { required: ["PropName"] } — check the properties exist
+    if (Array.isArray(cond.required)) {
+        for (const req of cond.required) {
+            if (!(req in properties))
+                return false;
+        }
+    }
+    return true;
+}
+/**
+ * Check if a JSON schema "then" requirement holds for resource properties.
+ */
+function checkRequirement(requirement, properties) {
+    if (!requirement || typeof requirement !== "object")
+        return null;
+    const req = requirement;
+    // { required: ["PropName"] }
+    if (Array.isArray(req.required)) {
+        const missing = req.required.filter((r) => !(r in properties));
+        if (missing.length > 0) {
+            return `missing required properties: ${missing.join(", ")}`;
+        }
+    }
+    return null;
+}
+function validateResource(logicalId, resource, constraints) {
+    const diagnostics = [];
+    const props = resource.Properties ?? {};
+    for (const constraint of constraints) {
+        switch (constraint.type) {
+            case "if_then": {
+                if (matchesCondition(constraint.condition, props)) {
+                    const error = checkRequirement(constraint.requirement, props);
+                    if (error) {
+                        diagnostics.push({
+                            checkId: "EXT001",
+                            severity: "error",
+                            message: `Resource "${logicalId}" (${resource.Type}): constraint "${constraint.name}" violated — ${error}`,
+                            entity: logicalId,
+                            lexicon: "aws",
+                        });
+                    }
+                }
+                break;
+            }
+            case "dependent_excluded": {
+                // { PropA: ["PropB", "PropC"] } — if PropA exists, PropB and PropC must not
+                const req = constraint.requirement;
+                if (req) {
+                    for (const [propName, excluded] of Object.entries(req)) {
+                        if (propName in props) {
+                            const present = excluded.filter((e) => e in props);
+                            if (present.length > 0) {
+                                diagnostics.push({
+                                    checkId: "EXT001",
+                                    severity: "error",
+                                    message: `Resource "${logicalId}" (${resource.Type}): "${propName}" excludes [${present.join(", ")}] but both are present`,
+                                    entity: logicalId,
+                                    lexicon: "aws",
+                                });
+                            }
+                        }
+                    }
+                }
+                break;
+            }
+            case "required_or": {
+                // ["PropA", "PropB"] — at least one must exist
+                const required = constraint.requirement;
+                if (required && Array.isArray(required)) {
+                    const present = required.filter((r) => r in props);
+                    if (present.length === 0) {
+                        diagnostics.push({
+                            checkId: "EXT001",
+                            severity: "error",
+                            message: `Resource "${logicalId}" (${resource.Type}): at least one of [${required.join(", ")}] must be specified`,
+                            entity: logicalId,
+                            lexicon: "aws",
+                        });
+                    }
+                }
+                break;
+            }
+            case "required_xor": {
+                // ["PropA", "PropB"] — exactly one must exist
+                const required = constraint.requirement;
+                if (required && Array.isArray(required)) {
+                    const present = required.filter((r) => r in props);
+                    if (present.length !== 1) {
+                        diagnostics.push({
+                            checkId: "EXT001",
+                            severity: "error",
+                            message: `Resource "${logicalId}" (${resource.Type}): exactly one of [${required.join(", ")}] must be specified (found ${present.length})`,
+                            entity: logicalId,
+                            lexicon: "aws",
+                        });
+                    }
+                }
+                break;
+            }
+        }
+    }
+    return diagnostics;
+}
+/**
+ * Core detection logic — exported for direct testing with synthetic data.
+ */
+export function checkExtensionConstraints(ctx, constraintMap) {
+    if (constraintMap.size === 0)
+        return [];
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            const constraints = constraintMap.get(resource.Type);
+            if (!constraints)
+                continue;
+            diagnostics.push(...validateResource(logicalId, resource, constraints));
+        }
+    }
+    return diagnostics;
+}
+export const ext001 = {
+    id: "EXT001",
+    description: "Extension constraint violation — cross-property validation from cfn-lint extension schemas",
+    check(ctx) {
+        return checkExtensionConstraints(ctx, loadLexiconConstraints());
+    },
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,124 @@
+import { cor020 } from "./cor020.js";
+import { ext001 } from "./ext001.js";
+import { waw010 } from "./waw010.js";
+import { waw011 } from "./waw011.js";
+import { waw013 } from "./waw013.js";
+import { waw014 } from "./waw014.js";
+import { waw015 } from "./waw015.js";
+import { waw016 } from "./waw016.js";
+import { waw017 } from "./waw017.js";
+import { waw018 } from "./waw018.js";
+import { waw019 } from "./waw019.js";
+import { waw020 } from "./waw020.js";
+import { waw021 } from "./waw021.js";
+import { waw022 } from "./waw022.js";
+import { waw023 } from "./waw023.js";
+import { waw024 } from "./waw024.js";
+import { waw025 } from "./waw025.js";
+import { waw026 } from "./waw026.js";
+import { waw027 } from "./waw027.js";
+import { waw028 } from "./waw028.js";
+import { waw029 } from "./waw029.js";
+import { waw030 } from "./waw030.js";
+import { waw031 } from "./waw031.js";
+import { waw032 } from "./waw032.js";
+import { waw033 } from "./waw033.js";
+import { waw034 } from "./waw034.js";
+import { waw035 } from "./waw035.js";
+import { waw036 } from "./waw036.js";
+import { waw037 } from "./waw037.js";
+import { waw038 } from "./waw038.js";
+import { waw039 } from "./waw039.js";
+import { waw040 } from "./waw040.js";
+import { waw041 } from "./waw041.js";
+import { waw042 } from "./waw042.js";
+import { waw043 } from "./waw043.js";
+import { waw044 } from "./waw044.js";
+import { waw045 } from "./waw045.js";
+import { waw046 } from "./waw046.js";
+import { waw047 } from "./waw047.js";
+import { waw048 } from "./waw048.js";
+import { waw049 } from "./waw049.js";
+import { waw050 } from "./waw050.js";
+import { waw051 } from "./waw051.js";
+import { waw052 } from "./waw052.js";
+import { waw053 } from "./waw053.js";
+import { waw054 } from "./waw054.js";
+import { waw055 } from "./waw055.js";
+import { waw056 } from "./waw056.js";
+import { waw057 } from "./waw057.js";
+import { waw058 } from "./waw058.js";
+import { waw059 } from "./waw059.js";
+import { waw060 } from "./waw060.js";
+import { waw061 } from "./waw061.js";
+import { waw062 } from "./waw062.js";
+import { waw063 } from "./waw063.js";
+import { waw064 } from "./waw064.js";
+import { waw065 } from "./waw065.js";
+import { waw066 } from "./waw066.js";
+import { waw067 } from "./waw067.js";
+import { waw068 } from "./waw068.js";
+import { waw069 } from "./waw069.js";
+export const postSynthChecks = [
+    cor020,
+    ext001,
+    waw010,
+    waw011,
+    waw013,
+    waw014,
+    waw015,
+    waw016,
+    waw017,
+    waw018,
+    waw019,
+    waw020,
+    waw021,
+    waw022,
+    waw023,
+    waw024,
+    waw025,
+    waw026,
+    waw027,
+    waw028,
+    waw029,
+    waw030,
+    waw031,
+    waw032,
+    waw033,
+    waw034,
+    waw035,
+    waw036,
+    waw037,
+    waw038,
+    waw039,
+    waw040,
+    waw041,
+    waw042,
+    waw043,
+    waw044,
+    waw045,
+    waw046,
+    waw047,
+    waw048,
+    waw049,
+    waw050,
+    waw051,
+    waw052,
+    waw053,
+    waw054,
+    waw055,
+    waw056,
+    waw057,
+    waw058,
+    waw059,
+    waw060,
+    waw061,
+    waw062,
+    waw063,
+    waw064,
+    waw065,
+    waw066,
+    waw067,
+    waw068,
+    waw069,
+];

package/dist/lint/post-synth/waw010.js

@@ -0,0 +1,41 @@
+/**
+ * WAW010: Redundant DependsOn
+ *
+ * Detects DependsOn entries that are already implied by Ref or Fn::GetAtt
+ * references in the resource's Properties. CloudFormation automatically
+ * creates dependencies for these references, making explicit DependsOn redundant.
+ */
+import { parseCFTemplate, findResourceRefs } from "./cf-refs.js";
+export const waw010 = {
+    id: "WAW010",
+    description: "Redundant DependsOn — target is already referenced via Ref or Fn::GetAtt in Properties",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseCFTemplate(output);
+            if (!template?.Resources)
+                continue;
+            for (const [logicalId, resource] of Object.entries(template.Resources)) {
+                if (!resource.DependsOn)
+                    continue;
+                const dependsOn = Array.isArray(resource.DependsOn)
+                    ? resource.DependsOn
+                    : [resource.DependsOn];
+                // Find all refs in Properties
+                const propertyRefs = findResourceRefs(resource.Properties);
+                for (const target of dependsOn) {
+                    if (propertyRefs.has(target)) {
+                        diagnostics.push({
+                            checkId: "WAW010",
+                            severity: "warning",
+                            message: `Resource "${logicalId}" has redundant DependsOn "${target}" — already referenced in Properties`,
+                            entity: logicalId,
+                            lexicon: "aws",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};