@intentius/chant-lexicon-aws 0.124.31 → 0.124.33

package/dist/lint/post-synth/waw011.js

@@ -0,0 +1,41 @@
+/**
+ * WAW011: Deprecated Lambda Runtime
+ *
+ * Checks Lambda function resources for deprecated or approaching-EOL runtimes.
+ * Emits error for "deprecated" runtimes and warning for "approaching_eol".
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+import { lambdaRuntimeDeprecations } from "../../codegen/generate-lexicon.js";
+export const waw011 = {
+    id: "WAW011",
+    description: "Deprecated Lambda runtime — flags deprecated or approaching-EOL Lambda runtimes",
+    check(ctx) {
+        const diagnostics = [];
+        const deprecations = lambdaRuntimeDeprecations();
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseCFTemplate(output);
+            if (!template?.Resources)
+                continue;
+            for (const [logicalId, resource] of Object.entries(template.Resources)) {
+                if (resource.Type !== "AWS::Lambda::Function")
+                    continue;
+                const runtime = resource.Properties?.Runtime;
+                if (typeof runtime !== "string")
+                    continue;
+                const status = deprecations[runtime];
+                if (!status)
+                    continue;
+                const severity = status === "deprecated" ? "error" : "warning";
+                const label = status === "deprecated" ? "deprecated" : "approaching end-of-life";
+                diagnostics.push({
+                    checkId: "WAW011",
+                    severity,
+                    message: `Lambda "${logicalId}" uses ${label} runtime "${runtime}"`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/waw013.js

@@ -0,0 +1,38 @@
+/**
+ * WAW013: Child project has no stackOutput() exports
+ *
+ * When a parent uses nestedStack() to reference a child project, the child
+ * must declare at least one stackOutput() — otherwise the parent can't
+ * reference any of its values.
+ */
+import { isChildProject } from "@intentius/chant/child-project";
+import { isStackOutput } from "@intentius/chant/stack-output";
+export const waw013 = {
+    id: "WAW013",
+    description: "Child project has no stackOutput() exports — parent can't reference anything",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of ctx.entities) {
+            if (isChildProject(entity) && entity.buildResult) {
+                // Check if the child has any StackOutput entities
+                let hasOutputs = false;
+                for (const [, childEntity] of entity.buildResult.entities) {
+                    if (isStackOutput(childEntity)) {
+                        hasOutputs = true;
+                        break;
+                    }
+                }
+                if (!hasOutputs) {
+                    diagnostics.push({
+                        checkId: "WAW013",
+                        severity: "error",
+                        message: `Nested stack "${name}" child project has no stackOutput() exports — parent can't reference any values`,
+                        entity: name,
+                        lexicon: "aws",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/waw014.js

@@ -0,0 +1,42 @@
+/**
+ * WAW014: Nested stack outputs never referenced from parent
+ *
+ * Warns when a nestedStack() is declared but none of its outputs are
+ * referenced from the parent template. Could just be a separate build.
+ */
+import { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+import { isChildProject } from "@intentius/chant/child-project";
+export const waw014 = {
+    id: "WAW014",
+    description: "Nested stack outputs never referenced from parent — could just be a separate build",
+    check(ctx) {
+        const diagnostics = [];
+        // Collect child project names
+        const childProjectNames = new Set();
+        for (const [name, entity] of ctx.entities) {
+            if (isChildProject(entity)) {
+                childProjectNames.add(name);
+            }
+        }
+        if (childProjectNames.size === 0)
+            return diagnostics;
+        // Parse the primary template to check for Fn::GetAtt on nested stacks
+        for (const [_lexicon, output] of ctx.outputs) {
+            const json = getPrimaryOutput(output);
+            for (const stackName of childProjectNames) {
+                // Check if any Fn::GetAtt references this stack's outputs
+                const hasRef = json.includes(`"Fn::GetAtt"`) && json.includes(`"${stackName}"`);
+                if (!hasRef) {
+                    diagnostics.push({
+                        checkId: "WAW014",
+                        severity: "warning",
+                        message: `Nested stack "${stackName}" outputs are never referenced — consider building it separately`,
+                        entity: stackName,
+                        lexicon: "aws",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/waw015.js

@@ -0,0 +1,88 @@
+/**
+ * WAW015: Circular project references
+ *
+ * Detects when child projects form circular references through
+ * nestedStack() declarations. A → B → A would cause infinite recursion
+ * at build time.
+ *
+ * Note: The core build pipeline also detects this and emits a BuildError,
+ * but this lint check provides a clearer diagnostic message.
+ */
+import { isChildProject } from "@intentius/chant/child-project";
+export const waw015 = {
+    id: "WAW015",
+    description: "Circular dependency between nested stacks would cause infinite build recursion",
+    check(ctx) {
+        const diagnostics = [];
+        // Build a dependency graph: stackName → set of child project paths
+        const stacks = new Map();
+        for (const [name, entity] of ctx.entities) {
+            if (isChildProject(entity)) {
+                stacks.set(name, entity.projectPath);
+            }
+        }
+        if (stacks.size < 2)
+            return diagnostics;
+        // Check for cycles by looking at child build results for nested ChildProjectInstances
+        const deps = new Map();
+        for (const [name] of stacks) {
+            deps.set(name, new Set());
+        }
+        for (const [name, entity] of ctx.entities) {
+            if (isChildProject(entity) && entity.buildResult) {
+                for (const [, childEntity] of entity.buildResult.entities) {
+                    if (isChildProject(childEntity)) {
+                        // Check if the child references any of our known stacks
+                        for (const [stackName, stackPath] of stacks) {
+                            if (childEntity.projectPath === stackPath) {
+                                deps.get(name).add(stackName);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        // Detect cycles using DFS
+        const visited = new Set();
+        const inPath = new Set();
+        function dfs(node, path) {
+            if (inPath.has(node)) {
+                const cycleStart = path.indexOf(node);
+                return path.slice(cycleStart);
+            }
+            if (visited.has(node))
+                return null;
+            visited.add(node);
+            inPath.add(node);
+            path.push(node);
+            for (const dep of deps.get(node) ?? []) {
+                const cycle = dfs(dep, path);
+                if (cycle)
+                    return cycle;
+            }
+            path.pop();
+            inPath.delete(node);
+            return null;
+        }
+        const reportedCycles = new Set();
+        for (const [name] of stacks) {
+            if (!visited.has(name)) {
+                const cycle = dfs(name, []);
+                if (cycle) {
+                    const cycleKey = [...cycle].sort().join(",");
+                    if (!reportedCycles.has(cycleKey)) {
+                        reportedCycles.add(cycleKey);
+                        diagnostics.push({
+                            checkId: "WAW015",
+                            severity: "error",
+                            message: `Circular dependency between nested stacks: ${cycle.join(" → ")} → ${cycle[0]}`,
+                            entity: cycle[0],
+                            lexicon: "aws",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/waw016.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"waw016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw016.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AA6DvD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACrD,mBAAmB,EAAE,CAmCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}
+{"version":3,"file":"waw016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw016.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AA4DvD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACrD,mBAAmB,EAAE,CAmCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw016.js

@@ -0,0 +1,116 @@
+/**
+ * WAW016: Deprecated Property Usage
+ *
+ * Flags properties marked as deprecated in the CloudFormation Registry.
+ *
+ * Two bases feed this, and the finding says which one it stands on (#1701).
+ * A `declared` name comes from the Registry schema's own `deprecatedProperties`
+ * array. An `inferred` name comes from a regex over the property description,
+ * which also matches descriptions that mention the deprecation of a sibling
+ * property, an enum value, or the thing the property configures. Declared is a
+ * warning; inferred is reported at info and worded as a guess.
+ *
+ * A declared name is a flattened Registry pointer path (#1988), so most of them
+ * are nested — `Tags/TagKey`, `Source/Decryption/Url`. The template is walked
+ * along that path; matching top-level keys reached fewer than half of them.
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { parseCFTemplate } from "./cf-refs.js";
+/**
+ * Load deprecated properties per resource type from the lexicon JSON, each
+ * tagged with the basis it was classified on.
+ */
+function loadDeprecatedProperties() {
+    const map = new Map();
+    try {
+        const lexiconPath = join(moduleSourceDir(import.meta.url), "..", "..", "generated", "lexicon-aws.json");
+        const content = readFileSync(lexiconPath, "utf-8");
+        const data = JSON.parse(content);
+        for (const [_name, entry] of Object.entries(data)) {
+            if (entry.kind !== "resource" || !entry.resourceType)
+                continue;
+            if (!entry.deprecatedProperties?.length)
+                continue;
+            const inferred = new Set(entry.inferredDeprecations ?? []);
+            const byProp = new Map();
+            for (const propName of entry.deprecatedProperties) {
+                byProp.set(propName, inferred.has(propName) ? "inferred" : "declared");
+            }
+            map.set(entry.resourceType, byProp);
+        }
+    }
+    catch {
+        // Lexicon not available — skip
+    }
+    return map;
+}
+/**
+ * True when `value` expresses `segments` — the flattened Registry pointer path
+ * (#1988), which is a single key for a top-level property and `/`-joined for a
+ * nested one.
+ *
+ * An array met where the pointer named a property is descended anyway: the
+ * Registry elides the wildcard in some schemas, so `Tags/TagKey` addresses a
+ * key inside the Tags array's items.
+ */
+function expressesPath(value, segments) {
+    if (segments.length === 0)
+        return true;
+    if (Array.isArray(value)) {
+        const rest = segments[0] === "*" ? segments.slice(1) : segments;
+        return value.some((item) => expressesPath(item, rest));
+    }
+    if (segments[0] === "*")
+        return false;
+    if (typeof value !== "object" || value === null)
+        return false;
+    const obj = value;
+    if (!Object.prototype.hasOwnProperty.call(obj, segments[0]))
+        return false;
+    return expressesPath(obj[segments[0]], segments.slice(1));
+}
+/**
+ * Core detection logic — exported for direct testing with synthetic data.
+ */
+export function checkDeprecatedProperties(ctx, deprecated) {
+    if (deprecated.size === 0)
+        return [];
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            const deprProps = deprecated.get(resource.Type);
+            if (!deprProps)
+                continue;
+            const props = resource.Properties ?? {};
+            // Walk each declared path into the template, rather than matching
+            // top-level template keys: over half the declared names are nested
+            // (#1988), and a key comparison could never reach them.
+            for (const [propName, basis] of deprProps) {
+                if (!expressesPath(props, propName.split("/")))
+                    continue;
+                diagnostics.push({
+                    checkId: "WAW016",
+                    severity: basis === "declared" ? "warning" : "info",
+                    message: basis === "declared"
+                        ? `Resource "${logicalId}" (${resource.Type}) uses deprecated property "${propName}" — consider alternatives`
+                        : `Resource "${logicalId}" (${resource.Type}) uses property "${propName}", whose description reads as deprecated — the CloudFormation Registry does not declare it deprecated, so confirm before changing it`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw016 = {
+    id: "WAW016",
+    description: "Deprecated property usage — flags properties marked as deprecated in the CloudFormation Registry",
+    check(ctx) {
+        return checkDeprecatedProperties(ctx, loadDeprecatedProperties());
+    },
+};

package/dist/lint/post-synth/waw017.js

@@ -0,0 +1,43 @@
+/**
+ * WAW017: Missing Tags on Taggable Resource
+ *
+ * Flags taggable resources that have no Tags property set.
+ * Encourages adding tags for cost allocation and compliance.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+import { loadTaggableResources } from "../../taggable.js";
+/**
+ * Core detection logic — exported for direct testing with synthetic data.
+ */
+export function checkMissingTags(ctx, taggable) {
+    if (taggable.size === 0)
+        return [];
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (!taggable.has(resource.Type))
+                continue;
+            const props = resource.Properties ?? {};
+            if (!("Tags" in props)) {
+                diagnostics.push({
+                    checkId: "WAW017",
+                    severity: "warning",
+                    message: `Resource "${logicalId}" (${resource.Type}) supports tagging but has no Tags — consider adding tags for cost allocation and compliance`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw017 = {
+    id: "WAW017",
+    description: "Missing tags on taggable resource — suggests adding tags for cost allocation and compliance",
+    check(ctx) {
+        return checkMissingTags(ctx, loadTaggableResources());
+    },
+};

package/dist/lint/post-synth/waw018.js

@@ -0,0 +1,61 @@
+/**
+ * WAW018: S3 Public Access Not Blocked
+ *
+ * Flags S3 buckets missing PublicAccessBlockConfiguration or with any flag set to false.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+const REQUIRED_FLAGS = [
+    "BlockPublicAcls",
+    "BlockPublicPolicy",
+    "IgnorePublicAcls",
+    "RestrictPublicBuckets",
+];
+export function checkS3PublicAccess(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::S3::Bucket")
+                continue;
+            const props = resource.Properties ?? {};
+            const pab = props.PublicAccessBlockConfiguration;
+            if (!pab) {
+                diagnostics.push({
+                    checkId: "WAW018",
+                    severity: "error",
+                    message: `S3 bucket "${logicalId}" is missing PublicAccessBlockConfiguration — all public access should be blocked`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+                continue;
+            }
+            if (isIntrinsic(pab))
+                continue;
+            if (typeof pab === "object" && pab !== null) {
+                const config = pab;
+                for (const flag of REQUIRED_FLAGS) {
+                    const value = config[flag];
+                    if (value === false) {
+                        diagnostics.push({
+                            checkId: "WAW018",
+                            severity: "error",
+                            message: `S3 bucket "${logicalId}" has ${flag} set to false — all public access should be blocked`,
+                            entity: logicalId,
+                            lexicon: "aws",
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw018 = {
+    id: "WAW018",
+    description: "S3 bucket missing public access block — all public access should be blocked",
+    check(ctx) {
+        return checkS3PublicAccess(ctx);
+    },
+};

package/dist/lint/post-synth/waw019.js

@@ -0,0 +1,64 @@
+/**
+ * WAW019: Security Group Unrestricted Ingress
+ *
+ * Flags security groups with 0.0.0.0/0 or ::/0 ingress on sensitive ports
+ * (SSH 22, RDP 3389, MySQL 3306, PostgreSQL 5432).
+ */
+import { parseCFTemplate, getSecurityGroupIngress, portRangeContainsSensitive, isIntrinsic } from "./cf-refs.js";
+const SENSITIVE_PORTS = [22, 3389, 3306, 5432];
+const OPEN_CIDRS = new Set(["0.0.0.0/0", "::/0"]);
+function checkIngressRule(rule, logicalId, diagnostics) {
+    const cidrIp = rule.CidrIp;
+    const cidrIpv6 = rule.CidrIpv6;
+    const hasOpenCidr = (typeof cidrIp === "string" && OPEN_CIDRS.has(cidrIp)) ||
+        (typeof cidrIpv6 === "string" && OPEN_CIDRS.has(cidrIpv6));
+    if (!hasOpenCidr)
+        return;
+    if (portRangeContainsSensitive(rule.FromPort, rule.ToPort, SENSITIVE_PORTS)) {
+        const cidr = typeof cidrIp === "string" && OPEN_CIDRS.has(cidrIp) ? cidrIp : cidrIpv6;
+        const fromPort = rule.FromPort;
+        const toPort = rule.ToPort;
+        const portDesc = fromPort !== undefined && toPort !== undefined
+            ? ` on ports ${fromPort}-${toPort}`
+            : " on all ports";
+        diagnostics.push({
+            checkId: "WAW019",
+            severity: "error",
+            message: `Security group "${logicalId}" allows unrestricted ingress from ${cidr}${portDesc} — restrict to specific CIDR ranges`,
+            entity: logicalId,
+            lexicon: "aws",
+        });
+    }
+}
+export function checkUnrestrictedIngress(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            // Check inline SecurityGroupIngress on EC2::SecurityGroup
+            if (resource.Type === "AWS::EC2::SecurityGroup") {
+                const rules = getSecurityGroupIngress(resource);
+                for (const rule of rules) {
+                    checkIngressRule(rule, logicalId, diagnostics);
+                }
+            }
+            // Check standalone SecurityGroupIngress resources
+            if (resource.Type === "AWS::EC2::SecurityGroupIngress") {
+                const props = resource.Properties ?? {};
+                if (!isIntrinsic(props)) {
+                    checkIngressRule(props, logicalId, diagnostics);
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw019 = {
+    id: "WAW019",
+    description: "Security group allows unrestricted ingress on sensitive ports (SSH, RDP, database)",
+    check(ctx) {
+        return checkUnrestrictedIngress(ctx);
+    },
+};

package/dist/lint/post-synth/waw020.js

@@ -0,0 +1,56 @@
+/**
+ * WAW020: IAM Wildcard Action
+ *
+ * Flags IAM policies with Action: "*" in any statement.
+ * Checks IAM::Policy, IAM::Role, and IAM::ManagedPolicy resource types.
+ */
+import { parseCFTemplate, walkPolicyStatements, isIntrinsic } from "./cf-refs.js";
+const IAM_TYPES = new Set([
+    "AWS::IAM::Policy",
+    "AWS::IAM::Role",
+    "AWS::IAM::ManagedPolicy",
+]);
+function hasWildcardAction(statement) {
+    const action = statement.Action;
+    if (action === "*")
+        return true;
+    if (Array.isArray(action)) {
+        return action.some((a) => a === "*");
+    }
+    return false;
+}
+export function checkIamWildcardAction(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (!IAM_TYPES.has(resource.Type))
+                continue;
+            const statements = walkPolicyStatements(resource);
+            for (const stmt of statements) {
+                if (isIntrinsic(stmt.Action))
+                    continue;
+                if (hasWildcardAction(stmt)) {
+                    diagnostics.push({
+                        checkId: "WAW020",
+                        severity: "warning",
+                        message: `IAM resource "${logicalId}" has a policy statement with Action: "*" — use specific actions following least privilege`,
+                        entity: logicalId,
+                        lexicon: "aws",
+                    });
+                    break; // One diagnostic per resource
+                }
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw020 = {
+    id: "WAW020",
+    description: "IAM policy uses wildcard Action — use specific actions following least privilege",
+    check(ctx) {
+        return checkIamWildcardAction(ctx);
+    },
+};

package/dist/lint/post-synth/waw021.js

@@ -0,0 +1,44 @@
+/**
+ * WAW021: RDS Storage Not Encrypted
+ *
+ * Flags RDS instances and clusters without StorageEncrypted: true.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+const RDS_TYPES = new Set([
+    "AWS::RDS::DBInstance",
+    "AWS::RDS::DBCluster",
+]);
+export function checkRdsEncryption(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (!RDS_TYPES.has(resource.Type))
+                continue;
+            const props = resource.Properties ?? {};
+            const encrypted = props.StorageEncrypted;
+            // Skip if it's an intrinsic (can't statically verify)
+            if (isIntrinsic(encrypted))
+                continue;
+            if (encrypted !== true) {
+                diagnostics.push({
+                    checkId: "WAW021",
+                    severity: "error",
+                    message: `RDS resource "${logicalId}" (${resource.Type}) does not have StorageEncrypted: true — enable encryption at rest`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw021 = {
+    id: "WAW021",
+    description: "RDS instance or cluster storage is not encrypted — enable encryption at rest",
+    check(ctx) {
+        return checkRdsEncryption(ctx);
+    },
+};

package/dist/lint/post-synth/waw022.js

@@ -0,0 +1,36 @@
+/**
+ * WAW022: Lambda Not in VPC
+ *
+ * Flags Lambda functions without VpcConfig.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+export function checkLambdaVpc(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::Lambda::Function")
+                continue;
+            const props = resource.Properties ?? {};
+            if (!("VpcConfig" in props)) {
+                diagnostics.push({
+                    checkId: "WAW022",
+                    severity: "warning",
+                    message: `Lambda function "${logicalId}" is not configured with a VPC — consider adding VpcConfig for network isolation`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw022 = {
+    id: "WAW022",
+    description: "Lambda function is not configured with a VPC — consider adding VpcConfig for network isolation",
+    check(ctx) {
+        return checkLambdaVpc(ctx);
+    },
+};