@intentius/chant-lexicon-aws 0.124.31 → 0.124.32

package/dist/lint/post-synth/waw064.js

@@ -0,0 +1,45 @@
+/**
+ * WAW064: Transit Gateway Route Table Declares A Blackhole Route
+ *
+ * `AWS::EC2::TransitGatewayRoute` with `Blackhole: true` silently drops any
+ * traffic matching its destination CIDR instead of forwarding it —
+ * CloudFormation deploys this without complaint, and the packet loss only
+ * surfaces downstream as unreachable hosts or a timeout nobody can explain
+ * from the template alone. A blackhole route is sometimes deliberate — an
+ * explicit deny for a CIDR range, or a placeholder pending real
+ * infrastructure — but it is also exactly what a copy-pasted route table or
+ * a forgotten cleanup step leaves behind. Warn so it stays a conscious
+ * choice rather than a silent accident.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+export function checkTgwBlackholeRoute(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::EC2::TransitGatewayRoute")
+                continue;
+            const props = resource.Properties ?? {};
+            if (props.Blackhole !== true)
+                continue;
+            const cidr = typeof props.DestinationCidrBlock === "string" ? props.DestinationCidrBlock : "(unknown destination)";
+            diagnostics.push({
+                checkId: "WAW064",
+                severity: "warning",
+                message: `TransitGatewayRoute "${logicalId}" declares Blackhole: true for destination ${cidr} — traffic matching this route is silently dropped; confirm this is intentional`,
+                entity: logicalId,
+                lexicon: "aws",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const waw064 = {
+    id: "WAW064",
+    description: "Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident",
+    check(ctx) {
+        return checkTgwBlackholeRoute(ctx);
+    },
+};

package/dist/lint/post-synth/waw065.js

@@ -0,0 +1,104 @@
+/**
+ * WAW065: Transit Gateway Route Table Wiring Is Incomplete
+ *
+ * A Transit Gateway route table only does anything once two independent
+ * pieces are both wired up: an `AWS::EC2::TransitGatewayRouteTableAssociation`
+ * (which attachment's traffic is evaluated against this table) and an
+ * `AWS::EC2::TransitGatewayRouteTablePropagation` (which attachments' routes
+ * populate it). CloudFormation is happy to deploy a route table with one but
+ * not the other — the stack succeeds, and the gap only shows up as traffic
+ * that can't find a route. Two patterns, both "declared but half-wired":
+ *
+ *  - a route table has one or more associations but zero propagations — the
+ *    associated attachment's traffic is evaluated against this table, but
+ *    nothing ever populates it with routes;
+ *  - a declared attachment (VPC/VPN/peering, or the generic
+ *    TransitGatewayAttachment) is referenced by neither an association nor
+ *    a propagation anywhere in the template — it hangs off the transit
+ *    gateway with no route table wiring at all.
+ */
+import { parseCFTemplate, findResourceRefs } from "./cf-refs.js";
+const ATTACHMENT_TYPES = new Set([
+    "AWS::EC2::TransitGatewayAttachment",
+    "AWS::EC2::TransitGatewayVpcAttachment",
+    "AWS::EC2::TransitGatewayVpnAttachment",
+    "AWS::EC2::TransitGatewayPeeringAttachment",
+]);
+export function checkTgwRouteTableWiring(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        const resources = template.Resources;
+        const routeTableIds = new Set();
+        const attachmentIds = new Set();
+        for (const [logicalId, resource] of Object.entries(resources)) {
+            if (resource.Type === "AWS::EC2::TransitGatewayRouteTable")
+                routeTableIds.add(logicalId);
+            if (ATTACHMENT_TYPES.has(resource.Type))
+                attachmentIds.add(logicalId);
+        }
+        if (routeTableIds.size === 0 && attachmentIds.size === 0)
+            continue;
+        const associationsByTable = new Map();
+        const propagationsByTable = new Map();
+        const referencedAttachments = new Set();
+        for (const resource of Object.values(resources)) {
+            let bucket = null;
+            if (resource.Type === "AWS::EC2::TransitGatewayRouteTableAssociation")
+                bucket = associationsByTable;
+            if (resource.Type === "AWS::EC2::TransitGatewayRouteTablePropagation")
+                bucket = propagationsByTable;
+            if (!bucket)
+                continue;
+            const props = resource.Properties ?? {};
+            const attachmentRefs = findResourceRefs(props.TransitGatewayAttachmentId);
+            for (const attId of attachmentRefs)
+                referencedAttachments.add(attId);
+            for (const rtId of findResourceRefs(props.TransitGatewayRouteTableId)) {
+                let attSet = bucket.get(rtId);
+                if (!attSet) {
+                    attSet = new Set();
+                    bucket.set(rtId, attSet);
+                }
+                for (const attId of attachmentRefs)
+                    attSet.add(attId);
+            }
+        }
+        // Pattern A: associated but never propagated.
+        for (const rtId of routeTableIds) {
+            const associations = associationsByTable.get(rtId);
+            const propagations = propagationsByTable.get(rtId);
+            if (associations && associations.size > 0 && (!propagations || propagations.size === 0)) {
+                diagnostics.push({
+                    checkId: "WAW065",
+                    severity: "warning",
+                    message: `TransitGatewayRouteTable "${rtId}" has ${associations.size} association(s) but no route propagations — the associated attachment's routes never populate this table, likely incomplete wiring`,
+                    entity: rtId,
+                    lexicon: "aws",
+                });
+            }
+        }
+        // Pattern B: a declared attachment wired into no route table at all.
+        for (const attId of attachmentIds) {
+            if (!referencedAttachments.has(attId)) {
+                diagnostics.push({
+                    checkId: "WAW065",
+                    severity: "warning",
+                    message: `Transit Gateway attachment "${attId}" is referenced by no TransitGatewayRouteTableAssociation or TransitGatewayRouteTablePropagation — it has no route table wiring, so nothing can route to or from it`,
+                    entity: attId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw065 = {
+    id: "WAW065",
+    description: "Transit Gateway route table has associations but no propagations, or an attachment wired into no route table",
+    check(ctx) {
+        return checkTgwRouteTableWiring(ctx);
+    },
+};

package/dist/lint/post-synth/waw066.js

@@ -0,0 +1,145 @@
+/**
+ * WAW066: Private Subnet Route Table Has No Working Default Route
+ *
+ * Cross-resource join: a subnet's outbound path depends on a chain of three
+ * independently-declared resources — the `AWS::EC2::SubnetRouteTableAssociation`
+ * that pins it to a route table, the `AWS::EC2::Route` on that table for
+ * `0.0.0.0/0`, and the gateway that route names. CloudFormation validates
+ * none of this end-to-end: a subnet can be wired to a route table with no
+ * default route at all, or with a default route whose NAT gateway / Transit
+ * Gateway target was renamed or removed elsewhere in the template, and the
+ * stack still deploys clean. The subnet is black-holed — every deploy
+ * succeeds, and the only symptom is a workload with no outbound connectivity.
+ *
+ * A route table with a default route to an `AWS::EC2::InternetGateway` is
+ * treated as a public subnet and is out of scope for this check — this rule
+ * only flags the private case: no default route, or one whose target
+ * (`NatGatewayId` / `TransitGatewayId` / etc.) does not resolve to a
+ * resource declared in the same template. A route naming a target that
+ * exists in the template resolves cleanly and is never flagged, per the
+ * cross-resource contract.
+ */
+import { parseCFTemplate, findResourceRefs } from "./cf-refs.js";
+const OTHER_TARGET_KEYS = [
+    "NatGatewayId",
+    "TransitGatewayId",
+    "VpcPeeringConnectionId",
+    "EgressOnlyInternetGatewayId",
+    "LocalGatewayId",
+    "CarrierGatewayId",
+    "NetworkInterfaceId",
+    "InstanceId",
+];
+/** Classify a `0.0.0.0/0` Route's target. A target Ref that exists always resolves. */
+function classifyDefaultRoute(route, resources) {
+    const props = route.Properties ?? {};
+    if (props.GatewayId !== undefined) {
+        if (typeof props.GatewayId === "string") {
+            return props.GatewayId.startsWith("igw-") ? "public" : "resolved";
+        }
+        const refs = findResourceRefs(props.GatewayId);
+        if (refs.size !== 1)
+            return "resolved"; // unprovable intrinsic — stay quiet
+        const [id] = refs;
+        if (!resources[id])
+            return "dangling";
+        return resources[id].Type === "AWS::EC2::InternetGateway" ? "public" : "resolved";
+    }
+    for (const key of OTHER_TARGET_KEYS) {
+        const value = props[key];
+        if (value === undefined)
+            continue;
+        if (typeof value === "string")
+            return "resolved"; // literal id from outside the template
+        const refs = findResourceRefs(value);
+        if (refs.size !== 1)
+            return "resolved";
+        const [id] = refs;
+        return resources[id] ? "resolved" : "dangling";
+    }
+    return "resolved"; // no recognized target key — can't classify, stay quiet
+}
+function isDefaultRoute(route) {
+    return route.Properties?.DestinationCidrBlock === "0.0.0.0/0";
+}
+export function checkPrivateSubnetDefaultRoute(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        const resources = template.Resources;
+        // subnetId -> Set<routeTableId>, from explicit associations only.
+        const subnetRouteTables = new Map();
+        for (const resource of Object.values(resources)) {
+            if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation")
+                continue;
+            const props = resource.Properties ?? {};
+            const subnetRefs = findResourceRefs(props.SubnetId);
+            const rtRefs = findResourceRefs(props.RouteTableId);
+            for (const subnetId of subnetRefs) {
+                let set = subnetRouteTables.get(subnetId);
+                if (!set) {
+                    set = new Set();
+                    subnetRouteTables.set(subnetId, set);
+                }
+                for (const rtId of rtRefs)
+                    set.add(rtId);
+            }
+        }
+        // routeTableId -> Route resources targeting it.
+        const routesByTable = new Map();
+        for (const resource of Object.values(resources)) {
+            if (resource.Type !== "AWS::EC2::Route")
+                continue;
+            for (const rtId of findResourceRefs(resource.Properties?.RouteTableId)) {
+                let list = routesByTable.get(rtId);
+                if (!list) {
+                    list = [];
+                    routesByTable.set(rtId, list);
+                }
+                list.push(resource);
+            }
+        }
+        for (const [subnetId, rtIds] of subnetRouteTables) {
+            if (resources[subnetId]?.Type !== "AWS::EC2::Subnet")
+                continue;
+            for (const rtId of rtIds) {
+                if (resources[rtId]?.Type !== "AWS::EC2::RouteTable")
+                    continue;
+                const routes = routesByTable.get(rtId) ?? [];
+                const defaultRoutes = routes.filter(isDefaultRoute);
+                if (defaultRoutes.length === 0) {
+                    diagnostics.push({
+                        checkId: "WAW066",
+                        severity: "warning",
+                        message: `Subnet "${subnetId}" is associated with route table "${rtId}", which has no default route (0.0.0.0/0) — outbound traffic from this subnet has no path out, black-holed by omission`,
+                        entity: subnetId,
+                        lexicon: "aws",
+                    });
+                    continue;
+                }
+                const classes = defaultRoutes.map((route) => classifyDefaultRoute(route, resources));
+                if (classes.includes("public"))
+                    continue; // has a real IGW default route — public subnet, out of scope
+                if (classes.every((c) => c === "dangling")) {
+                    diagnostics.push({
+                        checkId: "WAW066",
+                        severity: "error",
+                        message: `Subnet "${subnetId}"'s route table "${rtId}" has a default route (0.0.0.0/0) whose target does not exist in this template — outbound traffic from this subnet is black-holed`,
+                        entity: subnetId,
+                        lexicon: "aws",
+                    });
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw066 = {
+    id: "WAW066",
+    description: "Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template",
+    check(ctx) {
+        return checkPrivateSubnetDefaultRoute(ctx);
+    },
+};

package/dist/lint/post-synth/waw067.js

@@ -0,0 +1,115 @@
+/**
+ * WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets
+ *
+ * Cross-resource join across four resource kinds: a NAT gateway lives in one
+ * subnet, which lives in one Availability Zone; a route table's default
+ * route names the NAT gateway it forwards to; a subnet is pinned to a route
+ * table by an `AWS::EC2::SubnetRouteTableAssociation`. Follow that chain and
+ * a common reliability gap falls out — private subnets in two or more AZs
+ * all defaulting to the *same* NAT gateway. CloudFormation has no opinion on
+ * this; it deploys cleanly. But a NAT gateway lives entirely inside one AZ,
+ * so if that AZ has an outage, every subnet depending on it loses egress —
+ * including the subnets in AZs that were otherwise healthy. The
+ * Well-Architected fix is one NAT gateway per AZ, each serving only its own
+ * AZ's subnets.
+ *
+ * Only fires when the Availability Zones involved are literal strings —
+ * an `Fn::GetAZs`/`Fn::Select`-derived AZ can't be compared statically, so a
+ * subnet without a literal `AvailabilityZone` is silently excluded rather
+ * than guessed at.
+ */
+import { parseCFTemplate, findResourceRefs } from "./cf-refs.js";
+export function checkNatGatewaySingleAz(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        const resources = template.Resources;
+        // NAT gateway id -> its own subnet's literal AZ.
+        const natGatewayAz = new Map();
+        for (const [logicalId, resource] of Object.entries(resources)) {
+            if (resource.Type !== "AWS::EC2::NatGateway")
+                continue;
+            const subnetRefs = findResourceRefs(resource.Properties?.SubnetId);
+            if (subnetRefs.size !== 1)
+                continue;
+            const [subnetId] = subnetRefs;
+            const az = resources[subnetId]?.Properties?.AvailabilityZone;
+            if (typeof az === "string")
+                natGatewayAz.set(logicalId, az);
+        }
+        if (natGatewayAz.size === 0)
+            continue;
+        // route table id -> the NAT gateway its default route forwards to.
+        const routeTableNatTarget = new Map();
+        for (const resource of Object.values(resources)) {
+            if (resource.Type !== "AWS::EC2::Route")
+                continue;
+            const props = resource.Properties ?? {};
+            if (props.DestinationCidrBlock !== "0.0.0.0/0")
+                continue;
+            const natRefs = findResourceRefs(props.NatGatewayId);
+            if (natRefs.size !== 1)
+                continue;
+            const [natId] = natRefs;
+            if (!natGatewayAz.has(natId))
+                continue;
+            for (const rtId of findResourceRefs(props.RouteTableId)) {
+                routeTableNatTarget.set(rtId, natId);
+            }
+        }
+        // subnet id -> route table id, from explicit associations only.
+        const subnetRouteTable = new Map();
+        for (const resource of Object.values(resources)) {
+            if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation")
+                continue;
+            const props = resource.Properties ?? {};
+            const subnetRefs = findResourceRefs(props.SubnetId);
+            const rtRefs = findResourceRefs(props.RouteTableId);
+            if (subnetRefs.size !== 1 || rtRefs.size !== 1)
+                continue;
+            const [subnetId] = subnetRefs;
+            const [rtId] = rtRefs;
+            subnetRouteTable.set(subnetId, rtId);
+        }
+        // NAT gateway id -> the set of subnets that default-route through it.
+        const servedSubnets = new Map();
+        for (const [subnetId, rtId] of subnetRouteTable) {
+            const natId = routeTableNatTarget.get(rtId);
+            if (!natId)
+                continue;
+            let set = servedSubnets.get(natId);
+            if (!set) {
+                set = new Set();
+                servedSubnets.set(natId, set);
+            }
+            set.add(subnetId);
+        }
+        for (const [natId, subnetIds] of servedSubnets) {
+            const azs = new Set();
+            for (const subnetId of subnetIds) {
+                const az = resources[subnetId]?.Properties?.AvailabilityZone;
+                if (typeof az === "string")
+                    azs.add(az);
+            }
+            if (azs.size > 1) {
+                diagnostics.push({
+                    checkId: "WAW067",
+                    severity: "warning",
+                    message: `NAT Gateway "${natId}" (in ${natGatewayAz.get(natId)}) is the default-route egress for private subnets across ${azs.size} Availability Zones (${[...azs].sort().join(", ")}) — a single-AZ NAT gateway is a single point of failure for cross-AZ egress; add one NAT gateway per AZ`,
+                    entity: natId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw067 = {
+    id: "WAW067",
+    description: "A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress",
+    check(ctx) {
+        return checkNatGatewaySingleAz(ctx);
+    },
+};

package/dist/lint/post-synth/waw068.js

@@ -0,0 +1,69 @@
+/**
+ * WAW068: VPN Gateway Has A Single VPN Connection
+ *
+ * An `AWS::EC2::VPNConnection` always gets two tunnels from AWS, but that
+ * redundancy only covers the tunnel pair inside one connection — it does
+ * nothing if the connection's Customer Gateway, on-prem device, or the
+ * single site it terminates at goes down. The reliability boundary that
+ * matters is the connection itself: a `AWS::EC2::VPNGateway` (or a Transit
+ * Gateway used for VPN attachment) with only one `VPNConnection` attached
+ * has no fallback path for hybrid connectivity if that connection's
+ * Customer Gateway or on-prem side fails.
+ *
+ * Cross-resource join: group every declared `VPNConnection` by the gateway
+ * (`VpnGatewayId` or `TransitGatewayId`) it attaches to, and flag any
+ * gateway left with exactly one.
+ */
+import { parseCFTemplate, findResourceRefs } from "./cf-refs.js";
+export function checkVpnGatewayRedundancy(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        const resources = template.Resources;
+        // gateway logical id -> the VPNConnection logical ids attached to it.
+        const connectionsByGateway = new Map();
+        for (const [logicalId, resource] of Object.entries(resources)) {
+            if (resource.Type !== "AWS::EC2::VPNConnection")
+                continue;
+            const props = resource.Properties ?? {};
+            const gatewayProp = props.VpnGatewayId !== undefined ? props.VpnGatewayId : props.TransitGatewayId;
+            if (gatewayProp === undefined)
+                continue; // no declared gateway target — can't group, stay quiet
+            const gwRefs = findResourceRefs(gatewayProp);
+            if (gwRefs.size !== 1)
+                continue;
+            const [gwId] = gwRefs;
+            const gw = resources[gwId];
+            if (!gw || (gw.Type !== "AWS::EC2::VPNGateway" && gw.Type !== "AWS::EC2::TransitGateway"))
+                continue;
+            let list = connectionsByGateway.get(gwId);
+            if (!list) {
+                list = [];
+                connectionsByGateway.set(gwId, list);
+            }
+            list.push(logicalId);
+        }
+        for (const [gwId, connectionIds] of connectionsByGateway) {
+            if (connectionIds.length !== 1)
+                continue;
+            const kind = resources[gwId].Type === "AWS::EC2::VPNGateway" ? "VPN Gateway" : "Transit Gateway";
+            diagnostics.push({
+                checkId: "WAW068",
+                severity: "warning",
+                message: `${kind} "${gwId}" has only one VPN connection ("${connectionIds[0]}") attached — no redundant path if this connection, its tunnels, or its Customer Gateway fail; attach a second VPNConnection (ideally to a separate Customer Gateway) for hybrid-connectivity redundancy`,
+                entity: gwId,
+                lexicon: "aws",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const waw068 = {
+    id: "WAW068",
+    description: "VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity",
+    check(ctx) {
+        return checkVpnGatewayRedundancy(ctx);
+    },
+};

package/dist/lint/rules/hardcoded-region.js

@@ -0,0 +1,38 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WAW001: Hardcoded AWS Region
+ *
+ * Detects hardcoded AWS region strings in code.
+ * Regions should use AWS.Region pseudo-parameter instead.
+ */
+export const hardcodedRegionRule = {
+    id: "WAW001",
+    severity: "warning",
+    category: "security",
+    description: "Detects hardcoded AWS region strings — use AWS.Region pseudo-parameter instead",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        // Common AWS region patterns
+        const regionPattern = /^(us|eu|ap|sa|ca|me|af|cn)-(north|south|east|west|central|northeast|southeast)-\d$/;
+        function visit(node) {
+            if (ts.isStringLiteral(node)) {
+                const value = node.text;
+                if (regionPattern.test(value)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "WAW001",
+                        severity: "warning",
+                        message: `Hardcoded region "${value}" detected. Use AWS.Region pseudo-parameter instead.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/iam-wildcard.js

@@ -0,0 +1,60 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WAW009: IAM Wildcard Resource
+ *
+ * Detects IAM policies with wildcard (*) resources.
+ * Policies should specify explicit resources for better security.
+ */
+export const iamWildcardRule = {
+    id: "WAW009",
+    severity: "warning",
+    category: "security",
+    description: "Detects IAM policies with wildcard (*) resources — specify explicit resource ARNs for better security",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for Resource: "*" in object literals
+            if (ts.isPropertyAssignment(node)) {
+                const name = node.name;
+                if (ts.isIdentifier(name) || ts.isStringLiteral(name)) {
+                    const propName = ts.isIdentifier(name) ? name.text : name.text;
+                    // Check for Resource or Resources property
+                    if (propName.toLowerCase() === "resource" || propName.toLowerCase() === "resources") {
+                        // Check if value is "*"
+                        if (ts.isStringLiteral(node.initializer) && node.initializer.text === "*") {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "WAW009",
+                                severity: "warning",
+                                message: "IAM policy uses wildcard (*) resource. Specify explicit resource ARNs for better security.",
+                            });
+                        }
+                        // Check if array contains "*"
+                        else if (ts.isArrayLiteralExpression(node.initializer)) {
+                            for (const element of node.initializer.elements) {
+                                if (ts.isStringLiteral(element) && element.text === "*") {
+                                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(element.getStart());
+                                    diagnostics.push({
+                                        file: sourceFile.fileName,
+                                        line: line + 1,
+                                        column: character + 1,
+                                        ruleId: "WAW009",
+                                        severity: "warning",
+                                        message: "IAM policy uses wildcard (*) resource. Specify explicit resource ARNs for better security.",
+                                    });
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/index.js

@@ -0,0 +1,6 @@
+/**
+ * AWS-specific lint rules for chant projects
+ */
+export { hardcodedRegionRule } from "./hardcoded-region.js";
+export { s3EncryptionRule } from "./s3-encryption.js";
+export { iamWildcardRule } from "./iam-wildcard.js";

package/dist/lint/rules/s3-encryption.js

@@ -0,0 +1,60 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WAW006: S3 Bucket Encryption
+ *
+ * Detects S3 Bucket creation without encryption configuration.
+ * All S3 buckets should have server-side encryption enabled.
+ */
+export const s3EncryptionRule = {
+    id: "WAW006",
+    severity: "warning",
+    category: "security",
+    description: "Detects S3 Bucket creation without encryption configuration — all buckets should have server-side encryption enabled",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for `new Bucket(...)` or `new aws.s3.Bucket(...)`
+            if (ts.isNewExpression(node)) {
+                const expression = node.expression;
+                let isBucket = false;
+                // Check for `new Bucket(...)`
+                if (ts.isIdentifier(expression) && expression.text === "Bucket") {
+                    isBucket = true;
+                }
+                // Check for `new s3.Bucket(...)` or `new aws.s3.Bucket(...)`
+                else if (ts.isPropertyAccessExpression(expression)) {
+                    if (expression.name.text === "Bucket") {
+                        isBucket = true;
+                    }
+                }
+                if (isBucket && node.arguments && node.arguments.length > 0) {
+                    const props = node.arguments[0];
+                    if (ts.isObjectLiteralExpression(props)) {
+                        const hasEncryption = props.properties.some((prop) => {
+                            if (ts.isPropertyAssignment(prop) && ts.isIdentifier(prop.name)) {
+                                return prop.name.text === "BucketEncryption" ||
+                                    prop.name.text === "ServerSideEncryptionConfiguration";
+                            }
+                            return false;
+                        });
+                        if (!hasEncryption) {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "WAW006",
+                                severity: "warning",
+                                message: "S3 Bucket created without encryption configuration. Enable server-side encryption.",
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};