@intentius/chant-lexicon-aws 0.124.31 → 0.124.33

package/dist/intrinsics.js

@@ -0,0 +1,393 @@
+var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r;
+import { INTRINSIC_MARKER, resolveIntrinsicValue, isIntrinsic } from "@intentius/chant/intrinsic";
+import { buildInterpolatedString, defaultInterpolationSerializer } from "@intentius/chant/intrinsic-interpolation";
+import { getLogicalName } from "@intentius/chant/utils";
+import { conditionName, isCondition } from "./condition.js";
+import { isMapping, mappingName } from "./mapping.js";
+function resolveConditionOperand(operand) {
+    if (typeof operand === "string") {
+        return { Condition: operand };
+    }
+    if (isCondition(operand)) {
+        return { Condition: conditionName(operand) };
+    }
+    return resolveIntrinsicValue(operand);
+}
+/**
+ * Fn::Sub intrinsic function implementation
+ * Supports template string interpolation with AttrRefs, Declarables, and pseudo-parameters
+ */
+export class SubIntrinsic {
+    constructor(templateParts, values) {
+        this[_a] = true;
+        this.templateParts = templateParts;
+        this.values = values;
+    }
+    toJSON() {
+        const base = defaultInterpolationSerializer((name, attr) => `\${${name}.${attr}}`, (ref) => `\${${ref}}`);
+        // A GetAtt written by name (`GetAtt("Db", "Endpoint.Address")`) has the
+        // `${Db.Endpoint.Address}` form inside a Sub, like an attribute reference.
+        const serialize = (value) => value instanceof GetAttIntrinsic ? `\${${value.logicalName}.${value.attribute}}` : base(value);
+        return { "Fn::Sub": buildInterpolatedString(this.templateParts, this.values, serialize) };
+    }
+}
+_a = INTRINSIC_MARKER;
+/**
+ * Tagged template function for creating Fn::Sub intrinsics
+ * Usage: Sub`${AWS.StackName}-bucket` or Sub`${bucket.arn}`
+ */
+export function Sub(templateParts, ...values) {
+    return new SubIntrinsic([...templateParts], values);
+}
+/**
+ * Ref intrinsic function
+ * References a parameter or resource by logical name.
+ * Accepts either a string name or a Declarable entity (e.g. Parameter).
+ * When given a Declarable, the logical name is resolved at serialization time.
+ */
+export class RefIntrinsic {
+    constructor(target) {
+        this[_b] = true;
+        this.target = target;
+    }
+    toJSON() {
+        if (typeof this.target === "string") {
+            return { Ref: this.target };
+        }
+        return { Ref: getLogicalName(this.target) };
+    }
+}
+_b = INTRINSIC_MARKER;
+/**
+ * Create a Ref intrinsic.
+ * Pass a string for direct parameter/resource names, or a Declarable (e.g. Parameter) for type-safe references.
+ */
+export function Ref(target) {
+    return new RefIntrinsic(target);
+}
+/**
+ * Fn::GetAtt intrinsic function
+ * Gets an attribute from a resource
+ */
+export class GetAttIntrinsic {
+    constructor(logicalName, attribute) {
+        this[_c] = true;
+        this.logicalName = logicalName;
+        this.attribute = attribute;
+    }
+    toJSON() {
+        return { "Fn::GetAtt": [this.logicalName, this.attribute] };
+    }
+}
+_c = INTRINSIC_MARKER;
+/**
+ * Create a GetAtt intrinsic
+ */
+export function GetAtt(logicalName, attribute) {
+    return new GetAttIntrinsic(logicalName, attribute);
+}
+/**
+ * Fn::If intrinsic function
+ * Conditional value based on a condition
+ */
+export class IfIntrinsic {
+    constructor(conditionName, valueIfTrue, valueIfFalse) {
+        this[_d] = true;
+        this.conditionName = conditionName;
+        this.valueIfTrue = valueIfTrue;
+        this.valueIfFalse = valueIfFalse;
+    }
+    toJSON() {
+        const name = typeof this.conditionName === "string" ? this.conditionName : conditionName(this.conditionName);
+        return { "Fn::If": [name, resolveIntrinsicValue(this.valueIfTrue), resolveIntrinsicValue(this.valueIfFalse)] };
+    }
+}
+_d = INTRINSIC_MARKER;
+/**
+ * Create an If intrinsic. The condition is a name string, or the `Condition`
+ * declarable itself (resolved to its logical name at serialization, #2068).
+ */
+export function If(conditionName, valueIfTrue, valueIfFalse) {
+    return new IfIntrinsic(conditionName, valueIfTrue, valueIfFalse);
+}
+/**
+ * Fn::Equals condition intrinsic (#2068).
+ * Compares two values; each may be a literal or a value intrinsic (Ref etc.).
+ */
+export class EqualsIntrinsic {
+    constructor(left, right) {
+        this[_e] = true;
+        this.left = left;
+        this.right = right;
+    }
+    toJSON() {
+        return { "Fn::Equals": [resolveIntrinsicValue(this.left), resolveIntrinsicValue(this.right)] };
+    }
+}
+_e = INTRINSIC_MARKER;
+/**
+ * Create an Equals condition intrinsic: `Equals(Ref(cutover), "true")`.
+ */
+export function Equals(left, right) {
+    return new EqualsIntrinsic(left, right);
+}
+/**
+ * Fn::And condition intrinsic (#2068).
+ */
+export class AndIntrinsic {
+    constructor(conditions) {
+        this[_f] = true;
+        this.conditions = conditions;
+    }
+    toJSON() {
+        return { "Fn::And": this.conditions.map(resolveConditionOperand) };
+    }
+}
+_f = INTRINSIC_MARKER;
+/**
+ * Create an And condition intrinsic over 2–10 operands, each a nested
+ * condition intrinsic, a `Condition` declarable, or a condition name.
+ */
+export function And(...conditions) {
+    if (conditions.length < 2 || conditions.length > 10) {
+        throw new Error("And(...conditions): Fn::And takes between 2 and 10 conditions");
+    }
+    return new AndIntrinsic(conditions);
+}
+/**
+ * Fn::Or condition intrinsic (#2068).
+ */
+export class OrIntrinsic {
+    constructor(conditions) {
+        this[_g] = true;
+        this.conditions = conditions;
+    }
+    toJSON() {
+        return { "Fn::Or": this.conditions.map(resolveConditionOperand) };
+    }
+}
+_g = INTRINSIC_MARKER;
+/**
+ * Create an Or condition intrinsic over 2–10 operands, each a nested
+ * condition intrinsic, a `Condition` declarable, or a condition name.
+ */
+export function Or(...conditions) {
+    if (conditions.length < 2 || conditions.length > 10) {
+        throw new Error("Or(...conditions): Fn::Or takes between 2 and 10 conditions");
+    }
+    return new OrIntrinsic(conditions);
+}
+/**
+ * Fn::Not condition intrinsic (#2068).
+ */
+export class NotIntrinsic {
+    constructor(condition) {
+        this[_h] = true;
+        this.condition = condition;
+    }
+    toJSON() {
+        return { "Fn::Not": [resolveConditionOperand(this.condition)] };
+    }
+}
+_h = INTRINSIC_MARKER;
+/**
+ * Create a Not condition intrinsic over a nested condition intrinsic, a
+ * `Condition` declarable, or a condition name.
+ */
+export function Not(condition) {
+    return new NotIntrinsic(condition);
+}
+/**
+ * Fn::Join intrinsic function
+ * Joins values with a delimiter
+ */
+export class JoinIntrinsic {
+    constructor(delimiter, values) {
+        this[_j] = true;
+        this.delimiter = delimiter;
+        this.values = values;
+    }
+    toJSON() {
+        // Fn::Join's second arg is either a literal list of values OR a single
+        // list-returning intrinsic (GetAtt of a list attr, Split, Ref to a List<>
+        // param). Only the array form gets `.map`; a lone intrinsic is emitted as-is
+        // (#517 — mapping over it dereferenced undefined and crashed the build).
+        const list = Array.isArray(this.values)
+            ? this.values.map(resolveIntrinsicValue)
+            : resolveIntrinsicValue(this.values);
+        return { "Fn::Join": [this.delimiter, list] };
+    }
+}
+_j = INTRINSIC_MARKER;
+/**
+ * Create a Join intrinsic. `values` is a literal array, or a single
+ * list-returning intrinsic (e.g. `Join(",", zone.NameServers)`).
+ */
+export function Join(delimiter, values) {
+    if (!Array.isArray(values) && !isIntrinsic(values)) {
+        throw new Error("Join(delimiter, values): values must be an array or a list-returning intrinsic (GetAtt/Split/Ref to a List)");
+    }
+    return new JoinIntrinsic(delimiter, values);
+}
+/**
+ * Fn::Select intrinsic function
+ * Selects a value from a list by index
+ */
+export class SelectIntrinsic {
+    constructor(index, values) {
+        this[_k] = true;
+        this.index = index;
+        this.values = values;
+    }
+    toJSON() {
+        const resolvedValues = Array.isArray(this.values)
+            ? this.values.map(resolveIntrinsicValue)
+            : resolveIntrinsicValue(this.values);
+        return { "Fn::Select": [this.index, resolvedValues] };
+    }
+}
+_k = INTRINSIC_MARKER;
+/**
+ * Create a Select intrinsic. The index is emitted as written: CloudFormation
+ * accepts `0` and `"0"`.
+ */
+export function Select(index, values) {
+    return new SelectIntrinsic(index, values);
+}
+/**
+ * Fn::Split intrinsic function
+ * Splits a string by delimiter
+ */
+export class SplitIntrinsic {
+    constructor(delimiter, source) {
+        this[_l] = true;
+        this.delimiter = delimiter;
+        this.source = source;
+    }
+    toJSON() {
+        const sourceValue = typeof this.source === "string"
+            ? this.source
+            : this.source.toJSON();
+        return { "Fn::Split": [this.delimiter, sourceValue] };
+    }
+}
+_l = INTRINSIC_MARKER;
+/**
+ * Create a Split intrinsic
+ */
+export function Split(delimiter, source) {
+    return new SplitIntrinsic(delimiter, source);
+}
+/**
+ * Fn::Base64 intrinsic function
+ * Encodes a string to Base64
+ */
+export class Base64Intrinsic {
+    constructor(value) {
+        this[_m] = true;
+        this.value = value;
+    }
+    toJSON() {
+        const innerValue = typeof this.value === "string"
+            ? this.value
+            : this.value.toJSON();
+        return { "Fn::Base64": innerValue };
+    }
+}
+_m = INTRINSIC_MARKER;
+/**
+ * Create a Base64 intrinsic
+ */
+export function Base64(value) {
+    return new Base64Intrinsic(value);
+}
+/**
+ * Fn::GetAZs intrinsic function
+ * Returns a list of Availability Zones for a region
+ */
+export class GetAZsIntrinsic {
+    constructor(region = "") {
+        this[_o] = true;
+        this.region = region;
+    }
+    toJSON() {
+        const regionValue = typeof this.region === "string"
+            ? this.region
+            : this.region.toJSON();
+        return { "Fn::GetAZs": regionValue };
+    }
+}
+_o = INTRINSIC_MARKER;
+/**
+ * Create a GetAZs intrinsic
+ */
+export function GetAZs(region) {
+    return new GetAZsIntrinsic(region);
+}
+/**
+ * Fn::FindInMap intrinsic function
+ * Reads the value under two keys of a declared mapping.
+ */
+export class FindInMapIntrinsic {
+    constructor(mapName, topLevelKey, secondLevelKey) {
+        this[_p] = true;
+        this.mapName = mapName;
+        this.topLevelKey = topLevelKey;
+        this.secondLevelKey = secondLevelKey;
+    }
+    toJSON() {
+        const name = isMapping(this.mapName) ? mappingName(this.mapName) : this.mapName;
+        return {
+            "Fn::FindInMap": [name, resolveIntrinsicValue(this.topLevelKey), resolveIntrinsicValue(this.secondLevelKey)],
+        };
+    }
+}
+_p = INTRINSIC_MARKER;
+/**
+ * Create a FindInMap intrinsic. The mapping is the `Mapping` declarable, or
+ * its name. Either key may be a literal or a value intrinsic
+ * (`FindInMap(regionMap, AWS.Region, "AMI")`).
+ */
+export function FindInMap(mapName, topLevelKey, secondLevelKey) {
+    return new FindInMapIntrinsic(mapName, topLevelKey, secondLevelKey);
+}
+/**
+ * Fn::ImportValue intrinsic function
+ * Reads a value another stack exports.
+ */
+export class ImportValueIntrinsic {
+    constructor(sharedValue) {
+        this[_q] = true;
+        this.sharedValue = sharedValue;
+    }
+    toJSON() {
+        return { "Fn::ImportValue": resolveIntrinsicValue(this.sharedValue) };
+    }
+}
+_q = INTRINSIC_MARKER;
+/** Create an ImportValue intrinsic. The export name is a string or a value intrinsic (`Sub`). */
+export function ImportValue(sharedValue) {
+    return new ImportValueIntrinsic(sharedValue);
+}
+/**
+ * Fn::Cidr intrinsic function
+ * Splits an address block into `count` CIDR blocks of `cidrBits` host bits.
+ */
+export class CidrIntrinsic {
+    constructor(ipBlock, count, cidrBits) {
+        this[_r] = true;
+        this.ipBlock = ipBlock;
+        this.count = count;
+        this.cidrBits = cidrBits;
+    }
+    toJSON() {
+        return {
+            "Fn::Cidr": [resolveIntrinsicValue(this.ipBlock), resolveIntrinsicValue(this.count), resolveIntrinsicValue(this.cidrBits)],
+        };
+    }
+}
+_r = INTRINSIC_MARKER;
+/** Create a Cidr intrinsic. Each argument is a literal or a value intrinsic, written as the template writes it. */
+export function Cidr(ipBlock, count, cidrBits) {
+    return new CidrIntrinsic(ipBlock, count, cidrBits);
+}

package/dist/lint/audit-catalog.js

@@ -0,0 +1,87 @@
+/**
+ * The aws lexicon's `chant audit` catalog — metadata (title/tier/fix/authority/
+ * category) for the WAW* CloudFormation post-synth rules this lexicon ships.
+ * Contributed to core's aggregate via `awsPlugin.auditCatalog()` (#687, epic
+ * #350); core keeps only the generic catalog machinery + cross-cutting ids.
+ */
+import { auditRule, applyLineage } from "@intentius/chant/audit/catalog";
+import { awsAuditLineage } from "./audit-lineage.js";
+/** AWS Well-Architected Security Pillar — the authority chant cites for AWS security findings. */
+const AWS_SEC = {
+    name: "AWS — Security Pillar (Well-Architected)",
+    url: "https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html",
+};
+/** Every WAW* audit rule's catalog entry. */
+export const awsAuditCatalog = {
+    WAW010: auditRule("WAW010", "report-only", "guidance", "Redundant DependsOn", "Remove DependsOn already implied by a Ref/GetAtt.", { category: "best-practice" }),
+    WAW011: auditRule("WAW011", "report-only", "guidance", "Deprecated Lambda runtime", "Upgrade to a supported Lambda runtime.", { category: "best-practice" }),
+    WAW013: auditRule("WAW013", "merge-worthy", "guidance", "Child stack exports nothing", "Add stackOutput() exports the parent can reference.", { category: "correctness" }),
+    WAW014: auditRule("WAW014", "report-only", "guidance", "Nested stack outputs never referenced", "Reference the outputs or split into a separate build.", { category: "best-practice" }),
+    WAW015: auditRule("WAW015", "merge-worthy", "guidance", "Circular dependency between nested stacks", "Break the cycle between nested stacks.", { category: "correctness" }),
+    WAW016: auditRule("WAW016", "report-only", "guidance", "Deprecated property", "Replace the deprecated CloudFormation property.", { category: "best-practice" }),
+    WAW017: auditRule("WAW017", "report-only", "guidance", "Missing tags on a taggable resource", "Add tags for cost allocation and compliance.", { category: "best-practice" }),
+    WAW018: auditRule("WAW018", "merge-worthy", "guidance", "S3 bucket missing public access block", "Add a PublicAccessBlockConfiguration blocking all public access.", { authority: [AWS_SEC] }),
+    WAW019: auditRule("WAW019", "merge-worthy", "guidance", "Security group allows unrestricted ingress on a sensitive port", "Restrict the CIDR on SSH/RDP/database ports to known sources.", { authority: [AWS_SEC] }),
+    WAW020: auditRule("WAW020", "merge-worthy", "guidance", "IAM policy uses a wildcard Action", "Scope the policy to specific actions (least privilege).", { authority: [AWS_SEC] }),
+    WAW021: auditRule("WAW021", "merge-worthy", "guidance", "RDS storage not encrypted", "Enable StorageEncrypted for encryption at rest.", { authority: [AWS_SEC] }),
+    WAW022: auditRule("WAW022", "report-only", "guidance", "Lambda has no VpcConfig", "Consider a VpcConfig for network isolation if the function needs VPC resources.", { category: "best-practice" }),
+    WAW023: auditRule("WAW023", "report-only", "guidance", "CloudFront has no WAF web ACL", "Consider attaching a WAF web ACL.", { category: "best-practice" }),
+    WAW024: auditRule("WAW024", "report-only", "guidance", "ALB access logging disabled", "Enable access logging for audit trails.", { category: "best-practice" }),
+    WAW025: auditRule("WAW025", "merge-worthy", "guidance", "SNS topic not encrypted", "Set KmsMasterKeyId for encryption at rest.", { authority: [AWS_SEC] }),
+    WAW026: auditRule("WAW026", "merge-worthy", "guidance", "SQS queue not encrypted", "Enable SqsManagedSseEnabled or set KmsMasterKeyId.", { authority: [AWS_SEC] }),
+    WAW027: auditRule("WAW027", "report-only", "guidance", "DynamoDB point-in-time recovery disabled", "Enable PITR for recovery.", { category: "best-practice" }),
+    WAW028: auditRule("WAW028", "merge-worthy", "guidance", "EBS volume not encrypted", "Enable encryption at rest.", { authority: [AWS_SEC] }),
+    WAW029: auditRule("WAW029", "merge-worthy", "guidance", "Invalid DependsOn target", "Fix the dangling/self DependsOn reference.", { category: "correctness" }),
+    WAW030: auditRule("WAW030", "report-only", "guidance", "Missing DependsOn for a known ordering pattern", "Add the DependsOn the pattern requires.", { category: "best-practice" }),
+    WAW031: auditRule("WAW031", "report-only", "guidance", "EKS Addon missing ServiceAccountRoleArn", "Set ServiceAccountRoleArn (IRSA) for addons that need it.", { category: "best-practice" }),
+    WAW032: auditRule("WAW032", "merge-worthy", "guidance", "EFS transit encryption disabled on Fargate", "Enable transit encryption for the EFS volume.", { authority: [AWS_SEC] }),
+    WAW033: auditRule("WAW033", "merge-worthy", "guidance", "Solr heap exceeds Fargate task memory", "Lower SOLR_HEAP or raise task memory.", { category: "correctness" }),
+    WAW034: auditRule("WAW034", "report-only", "guidance", "Fargate Solr task under-provisioned", "Allocate >= 2048MB for the Solr task.", { category: "best-practice" }),
+    WAW035: auditRule("WAW035", "report-only", "guidance", "Solr container missing nofile ulimit", "Set a nofile ulimit >= 65535.", { category: "best-practice" }),
+    WAW036: auditRule("WAW036", "merge-worthy", "guidance", "Non-ASCII characters in resource properties", "Remove non-ASCII characters rejected at changeset time.", { category: "correctness" }),
+    WAW037: auditRule("WAW037", "merge-worthy", "guidance", "Null values in resource properties", "Fix the invalid AttrRef producing null property values.", { category: "correctness" }),
+    // #894 — production-hardening rules (RDS/S3/KMS/ALB/ECS/SG/Cognito/ECR/Logs).
+    WAW038: auditRule("WAW038", "merge-worthy", "guidance", "RDS instance is publicly accessible", "Set PubliclyAccessible: false and reach the database through the VPC.", { authority: [AWS_SEC] }),
+    WAW039: auditRule("WAW039", "merge-worthy", "guidance", "RDS automated backups disabled", "Set a positive BackupRetentionPeriod.", { category: "best-practice" }),
+    WAW040: auditRule("WAW040", "merge-worthy", "guidance", "RDS deletion protection disabled (full tier)", "Set DeletionProtection: true on the full/production tier.", { category: "best-practice" }),
+    WAW041: auditRule("WAW041", "merge-worthy", "guidance", "RDS Proxy does not require TLS", "Set RequireTLS: true on the DB proxy.", { authority: [AWS_SEC] }),
+    WAW042: auditRule("WAW042", "merge-worthy", "guidance", "S3 bucket missing a TLS-only bucket policy", "Add a Deny statement keyed on aws:SecureTransport = false.", { authority: [AWS_SEC] }),
+    WAW043: auditRule("WAW043", "merge-worthy", "guidance", "KMS key rotation disabled", "Set EnableKeyRotation: true on the customer-managed key.", { authority: [AWS_SEC] }),
+    WAW044: auditRule("WAW044", "merge-worthy", "guidance", "ALB HTTP listener does not redirect to HTTPS (full tier)", "Add a redirect DefaultAction (Protocol: HTTPS) to the HTTP listener on the full/production tier.", { authority: [AWS_SEC] }),
+    WAW045: auditRule("WAW045", "merge-worthy", "guidance", "ALB listener uses a weak or missing TLS policy", "Set SslPolicy to a TLS 1.2+ predefined policy.", { authority: [AWS_SEC] }),
+    WAW046: auditRule("WAW046", "merge-worthy", "guidance", "ECS container passes a secret via plaintext Environment", "Move the value to Secrets (Secrets Manager/SSM Parameter Store).", { authority: [AWS_SEC] }),
+    WAW047: auditRule("WAW047", "merge-worthy", "guidance", "ECS container runs privileged", "Remove Privileged: true from the container definition.", { authority: [AWS_SEC] }),
+    WAW048: auditRule("WAW048", "report-only", "guidance", "ECS container missing log configuration", "Add a LogConfiguration (e.g. awslogs) to the container.", { category: "best-practice" }),
+    WAW049: auditRule("WAW049", "merge-worthy", "guidance", "Security group allows unrestricted ingress on a non-ALB port", "Restrict the CIDR; only ALB:80/443 is exempt from this rule.", { authority: [AWS_SEC] }),
+    WAW050: auditRule("WAW050", "merge-worthy", "guidance", "Cognito advanced security disabled", "Set UserPoolAddOns.AdvancedSecurityMode to AUDIT or ENFORCED.", { authority: [AWS_SEC] }),
+    WAW051: auditRule("WAW051", "merge-worthy", "guidance", "Cognito UserPoolClient allows the implicit OAuth grant", "Drop \"implicit\" from AllowedOAuthFlows; use the code grant.", { authority: [AWS_SEC] }),
+    WAW052: auditRule("WAW052", "merge-worthy", "guidance", "Cognito MFA not required (full tier)", "Set MfaConfiguration: ON on the full/production tier.", { authority: [AWS_SEC] }),
+    WAW053: auditRule("WAW053", "merge-worthy", "guidance", "ECR repository does not scan images on push", "Set ImageScanningConfiguration.ScanOnPush: true.", { authority: [AWS_SEC] }),
+    WAW054: auditRule("WAW054", "merge-worthy", "guidance", "ECR repository allows mutable image tags", "Set ImageTagMutability: IMMUTABLE.", { authority: [AWS_SEC] }),
+    WAW055: auditRule("WAW055", "report-only", "guidance", "CloudWatch Logs log group has no retention period", "Set an explicit RetentionInDays.", { category: "best-practice" }),
+    // governance posture regressions.
+    WAW056: auditRule("WAW056", "merge-worthy", "guidance", "SCP guardrail has no Deny statement", "Add a Deny statement — SCPs only filter permissions, so a Deny-less SCP guards nothing.", { authority: [AWS_SEC] }),
+    WAW057: auditRule("WAW057", "merge-worthy", "guidance", "SCP guardrail attached to no targets", "Attach the SCP to the organization root or an OU via TargetIds.", { authority: [AWS_SEC] }),
+    WAW058: auditRule("WAW058", "merge-worthy", "guidance", "Organization audit trail dropped or scoped down", "Keep an organization CloudTrail with IsLogging: true and IsMultiRegionTrail: true.", { authority: [AWS_SEC] }),
+    // #1225 — least-privilege tightening the declared graph can prove. Report-only,
+    // so no authority citation (those are reserved for merge-worthy entries).
+    WAW059: auditRule("WAW059", "report-only", "guidance", "Wildcard Resource where the declared graph enumerates the touched set", "Tighten Resource from \"*\" to the Fn::GetAtt Arn list of the declared resources the role's consumers touch.", { category: "security" }),
+    WAW060: auditRule("WAW060", "report-only", "guidance", "IAM policy attached to no principal", "Attach the policy via Roles/Users/Groups or reference it from a principal's ManagedPolicyArns — unattached it grants nothing.", { category: "security" }),
+    // #1140 — error-injection benchmark family (companion to epic #1139): static
+    // catches for the deploy-time/runtime failure class stock CDK can't see pre-synth.
+    WAW061: auditRule("WAW061", "merge-worthy", "guidance", "Subnet CidrBlock not contained in its VPC's CidrBlock", "Fix the subnet's CidrBlock so it falls within the VPC's CidrBlock range.", { category: "correctness" }),
+    WAW062: auditRule("WAW062", "merge-worthy", "guidance", "Duplicate export name or explicit resource name within a template", "Give each duplicated Export/name a distinct literal value.", { category: "correctness" }),
+    WAW063: auditRule("WAW063", "merge-worthy", "guidance", "IAM policy denies an action another attached policy on the same role allows", "Remove or narrow the Deny, or move the Allow off this role — the explicit Deny always wins.", { category: "correctness" }),
+    // #826 — network-topology resiliency (Well-Architected Reliability Pillar):
+    // TGW route hygiene, private-subnet and NAT-gateway cross-resource joins,
+    // VPN redundancy. No live state needed — all determinable from the
+    // declared template.
+    WAW064: auditRule("WAW064", "report-only", "guidance", "Transit Gateway route table declares a Blackhole route", "Confirm the traffic drop is intentional; remove the route if it isn't.", { category: "best-practice" }),
+    WAW065: auditRule("WAW065", "report-only", "guidance", "Transit Gateway route table wiring is incomplete", "Add the missing TransitGatewayRouteTablePropagation, or wire the orphaned attachment into a route table.", { category: "best-practice" }),
+    WAW066: auditRule("WAW066", "merge-worthy", "guidance", "Private subnet's route table has no working default route", "Add a 0.0.0.0/0 route to a NAT gateway/Transit Gateway that exists in the template.", { category: "correctness" }),
+    WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
+    WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
+    WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(awsAuditCatalog, awsAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,150 @@
+export const awsAuditLineage = {
+    WAW010: [
+        { tool: "cfn-lint", rule: "W3005", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#W3005", relation: "equivalent" },
+    ],
+    WAW011: [
+        { tool: "cfn-lint", rule: "W2531", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#W2531", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_363", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    ],
+    WAW017: [
+        { tool: "kics", rule: "Lambda Function Without Tags", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/8df8e857-bd59-44fa-9f4c-d77594b95b46/", relation: "extends" },
+        { tool: "kics", rule: "EFS Without Tags", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/08e39832-5e42-4304-98a0-aa5b43393162/", relation: "extends" },
+    ],
+    WAW018: [
+        { tool: "guard-rules-registry", rule: "S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_s3/s3_bucket_level_public_access_prohibited.guard", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_53", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
+        { tool: "checkov", rule: "CKV_AWS_56", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
+    ],
+    WAW019: [
+        { tool: "guard-rules-registry", rule: "RESTRICTED_INCOMING_TRAFFIC", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/restricted_common_ports.guard", relation: "overlaps" },
+        { tool: "kics", rule: "EC2 Sensitive Port Is Publicly Exposed", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/494b03d3-bf40-4464-8524-7c56ad0700ed/", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_AWS_24", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
+    ],
+    WAW020: [
+        { tool: "checkov", rule: "CKV_AWS_63", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "cfn-nag", rule: "F4", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamPolicyWildcardActionRule.rb", relation: "overlaps" },
+        { tool: "guard-rules-registry", rule: "IAM_ROLE_NO_WILDCARD_ACTIONS_ON_PERMISSIONS", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/iam/iam_role_no_wildcard_actions_on_permissions.guard", relation: "overlaps" },
+    ],
+    WAW021: [
+        { tool: "cfn-nag", rule: "F27", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSDBInstanceStorageEncryptedRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_16", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "RDS_STORAGE_ENCRYPTED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/rds_storage_encrypted.guard", relation: "equivalent" },
+    ],
+    WAW022: [
+        { tool: "cfn-nag", rule: "W89", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/LambdaFunctionInsideVPCRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_117", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "LAMBDA_INSIDE_VPC", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/lambda/lambda_inside_vpc.guard", relation: "equivalent" },
+    ],
+    WAW023: [
+        { tool: "checkov", rule: "CKV_AWS_68", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "kics", rule: "CloudFront Without WAF", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/0f139403-303f-467c-96bd-e717e6cfd62d/", relation: "equivalent" },
+    ],
+    WAW024: [
+        { tool: "cfn-nag", rule: "W52", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2AccessLoggingRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_91", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "kics", rule: "ELBv2 ALB Access Log Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/c62e8b7d-1fdf-4050-ac4c-76ba9e1d9621/", relation: "equivalent" },
+    ],
+    WAW025: [
+        { tool: "cfn-nag", rule: "W47", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SnsTopicKmsMasterKeyIdRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_26", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "SNS_ENCRYPTED_KMS", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_sns/sns_encrypted_kms.guard", relation: "equivalent" },
+    ],
+    WAW026: [
+        { tool: "checkov", rule: "CKV_AWS_27", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "kics", rule: "SQS With SSE Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/12726829-93ed-4d51-9cbe-13423f4299e1/", relation: "equivalent" },
+        { tool: "cfn-nag", rule: "W48", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SqsQueueKmsMasterKeyIdRule.rb", relation: "overlaps" },
+    ],
+    WAW027: [
+        { tool: "cfn-nag", rule: "W78", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/DynamoDBBackupRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_28", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "DYNAMODB_PITR_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/dynamodb/dynamodb_pitr_enabled.guard", relation: "equivalent" },
+    ],
+    WAW028: [
+        { tool: "cfn-nag", rule: "F1", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/EbsVolumeHasSseRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_3", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "ENCRYPTED_VOLUMES", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/encrypted_volumes.guard", relation: "equivalent" },
+    ],
+    WAW029: [
+        { tool: "cfn-lint", rule: "E3005", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3005", relation: "equivalent" },
+    ],
+    WAW032: [
+        { tool: "checkov", rule: "CKV_AWS_97", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "kics", rule: "EFS Volume With Disabled Transit Encryption", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/c1282e03-b285-4637-aee7-eefe3a7bb658/", relation: "equivalent" },
+    ],
+    WAW038: [
+        { tool: "cfn-nag", rule: "F22", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstancePubliclyAccessibleRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_17", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "kics", rule: "RDS DB Instance Publicly Accessible", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/de38e1d5-54cb-4111-a868-6f7722695007/", relation: "equivalent" },
+    ],
+    WAW039: [
+        { tool: "cfn-nag", rule: "W75", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstanceBackupRetentionPeriodRule.rb", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "DB_INSTANCE_BACKUP_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/db_instance_backup_enabled.guard", relation: "equivalent" },
+        { tool: "kics", rule: "RDS With Backup Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/8c415f6f-7b90-4a27-a44a-51047e1506f9/", relation: "equivalent" },
+    ],
+    WAW040: [
+        { tool: "cfn-nag", rule: "F80", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstanceDeletionProtectionRule.rb", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "RDS_INSTANCE_DELETION_PROTECTION_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/rds_instance_deletion_protection_enabled.guard", relation: "equivalent" },
+        { tool: "kics", rule: "RDS DB Instance With Deletion Protection Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/2c161e58-cb52-454f-abea-6470c37b5e6e/", relation: "equivalent" },
+    ],
+    WAW042: [
+        { tool: "guard-rules-registry", rule: "S3_BUCKET_SSL_REQUESTS_ONLY", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_s3/s3_bucket_ssl_requests_only.guard", relation: "equivalent" },
+        { tool: "kics", rule: "S3 Bucket Without SSL In Write Actions", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/38c64e76-c71e-4d92-a337-60174d1de1c9/", relation: "overlaps" },
+    ],
+    WAW043: [
+        { tool: "cfn-nag", rule: "F19", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/KMSKeyRotationRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_7", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "CMK_BACKING_KEY_ROTATION_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_kms/cmk_backing_key_rotation_enabled.guard", relation: "equivalent" },
+    ],
+    WAW044: [
+        { tool: "checkov", rule: "CKV_AWS_2", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "overlaps" },
+        { tool: "cfn-nag", rule: "W56", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerProtocolRule.rb", relation: "overlaps" },
+    ],
+    WAW045: [
+        { tool: "cfn-nag", rule: "W55", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerSslPolicyRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_103", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "ELBV2_LISTENER_SSL_POLICY_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/elastic_load_balancing_v2/elbv2_listener_ssl_policy_rule.guard", relation: "equivalent" },
+    ],
+    WAW049: [
+        { tool: "cfn-nag", rule: "W2", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb", relation: "overlaps" },
+        { tool: "guard-rules-registry", rule: "EC2_SECURITY_GROUP_INGRESS_OPEN_TO_WORLD_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/ec2_security_group_ingress_open_to_world_rule.guard", relation: "overlaps" },
+        { tool: "kics", rule: "Unrestricted Security Group Ingress", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/4a1e6b34-1008-4e61-a5f2-1f7c276f8d14/", relation: "overlaps" },
+    ],
+    WAW052: [
+        { tool: "cfn-nag", rule: "F78", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/CognitoUserPoolMfaConfigurationOnorOptionalRule.rb", relation: "overlaps" },
+        { tool: "guard-rules-registry", rule: "COGNITO_USER_POOL_MFA_CONFIGURATION_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_cognito/cognito_user_pool_mfa_configuration_rule.guard", relation: "overlaps" },
+        { tool: "kics", rule: "Cognito UserPool Without MFA", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/74a18d1a-cf02-4a31-8791-ed0967ad7fdc/", relation: "overlaps" },
+    ],
+    WAW053: [
+        { tool: "cfn-nag", rule: "W79", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ECRRepositoryScanOnPushRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_163", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "ECR_REPO_SCAN_ON_PUSH", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_ecr/ecr_repo_scan_on_push_rule.guard", relation: "equivalent" },
+    ],
+    WAW054: [
+        { tool: "checkov", rule: "CKV_AWS_51", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "kics", rule: "ECR Image Tag Not Immutable", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/33f41d31-86b1-46a4-81f7-9c9a671f59ac/", relation: "equivalent" },
+    ],
+    WAW055: [
+        { tool: "cfn-nag", rule: "W86", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/LogsLogGroupRetentionRule.rb", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_66", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+        { tool: "guard-rules-registry", rule: "CW_LOGGROUP_RETENTION_PERIOD_CHECK", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/cloudwatch/cw_loggroup_retention_period_check.guard", relation: "equivalent" },
+    ],
+    WAW058: [
+        { tool: "guard-rules-registry", rule: "MULTI_REGION_CLOUD_TRAIL_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/cloudtrail/multi_region_cloud_trail_enabled.guard", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_AWS_67", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "overlaps" },
+        { tool: "kics", rule: "CloudTrail Logging Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/5c0b06d5-b7a4-484c-aeb0-75a836269ff0/", relation: "overlaps" },
+    ],
+    WAW059: [
+        { tool: "cfn-nag", rule: "W12", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamPolicyWildcardResourceRule.rb", relation: "overlaps" },
+        { tool: "cfn-nag", rule: "W11", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb", relation: "overlaps" },
+        { tool: "guard-rules-registry", rule: "IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/iam/iam_policydocument_no_wildcard_resource.guard", relation: "overlaps" },
+    ],
+    WAW061: [
+        { tool: "cfn-lint", rule: "E3059", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3059", relation: "equivalent" },
+    ],
+    WAW062: [
+        { tool: "cfn-lint", rule: "E3019", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3019", relation: "overlaps" },
+    ],
+    WAW069: [
+        { tool: "cfn-lint", rule: "E8002", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E8002", relation: "equivalent" },
+    ],
+};