@intentius/chant-lexicon-aws 0.124.31 → 0.124.33

package/dist/lint/post-synth/waw056.js

@@ -0,0 +1,65 @@
+/**
+ * WAW056: SCP Guardrail Denies Nothing
+ *
+ * Flags SERVICE_CONTROL_POLICY resources whose document contains no Deny
+ * statement. SCPs never grant permissions — they only filter — so an SCP
+ * without a Deny is a no-op guardrail: the posture it appears to declare
+ * does not exist.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+function statementsOf(content) {
+    let doc = content;
+    if (typeof doc === "string") {
+        try {
+            doc = JSON.parse(doc);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (typeof doc !== "object" || doc === null)
+        return undefined;
+    const statement = doc.Statement;
+    if (Array.isArray(statement))
+        return statement;
+    if (typeof statement === "object" && statement !== null)
+        return [statement];
+    return [];
+}
+export function checkScpDeniesNothing(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::Organizations::Policy")
+                continue;
+            const props = resource.Properties ?? {};
+            if (props.Type !== "SERVICE_CONTROL_POLICY")
+                continue;
+            if (isIntrinsic(props.Content))
+                continue;
+            const statements = statementsOf(props.Content);
+            if (statements === undefined)
+                continue;
+            if (!statements.some((s) => s.Effect === "Deny")) {
+                diagnostics.push({
+                    checkId: "WAW056",
+                    severity: "error",
+                    message: `SCP "${logicalId}" has no Deny statement — SCPs only filter permissions, so a Deny-less SCP guards nothing`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw056 = {
+    id: "WAW056",
+    description: "SCP guardrail has no Deny statement — it constrains nothing",
+    check(ctx) {
+        return checkScpDeniesNothing(ctx);
+    },
+};

package/dist/lint/post-synth/waw057.js

@@ -0,0 +1,43 @@
+/**
+ * WAW057: SCP Guardrail Attached to No Targets
+ *
+ * Flags SERVICE_CONTROL_POLICY resources with no TargetIds. A defined but
+ * unattached SCP enforces nothing — the usual shape of a guardrail that was
+ * "kept" in a template while being detached from the root or its OUs.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkScpUnattached(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::Organizations::Policy")
+                continue;
+            const props = resource.Properties ?? {};
+            if (props.Type !== "SERVICE_CONTROL_POLICY")
+                continue;
+            const targets = props.TargetIds;
+            if (isIntrinsic(targets))
+                continue;
+            if (Array.isArray(targets) && targets.length > 0)
+                continue;
+            diagnostics.push({
+                checkId: "WAW057",
+                severity: "error",
+                message: `SCP "${logicalId}" is attached to no targets — a detached guardrail enforces nothing; attach it to the root or an OU via TargetIds`,
+                entity: logicalId,
+                lexicon: "aws",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const waw057 = {
+    id: "WAW057",
+    description: "SCP guardrail is attached to no targets — it enforces nothing",
+    check(ctx) {
+        return checkScpUnattached(ctx);
+    },
+};

package/dist/lint/post-synth/waw058.js

@@ -0,0 +1,61 @@
+/**
+ * WAW058: Organization Audit Trail Dropped or Scoped Down
+ *
+ * The audit-sink posture regressions on AWS: a trail with logging switched
+ * off, an organization trail narrowed to a single region, or an organization
+ * declared with no CloudTrail trail at all. Audit evidence is the layer the
+ * other guardrails depend on, so losing it is merge-worthy.
+ */
+import { parseCFTemplate, isIntrinsic } from "./cf-refs.js";
+export function checkAuditTrailPosture(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        let declaresOrganization = false;
+        let trailCount = 0;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type === "AWS::Organizations::Organization")
+                declaresOrganization = true;
+            if (resource.Type !== "AWS::CloudTrail::Trail")
+                continue;
+            trailCount++;
+            const props = resource.Properties ?? {};
+            if (!isIntrinsic(props.IsLogging) && props.IsLogging === false) {
+                diagnostics.push({
+                    checkId: "WAW058",
+                    severity: "error",
+                    message: `Trail "${logicalId}" has IsLogging: false — the audit sink is declared but delivers nothing`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+            if (props.IsOrganizationTrail === true && !isIntrinsic(props.IsMultiRegionTrail) && props.IsMultiRegionTrail !== true) {
+                diagnostics.push({
+                    checkId: "WAW058",
+                    severity: "error",
+                    message: `Organization trail "${logicalId}" is not multi-region — audit evidence is scoped down to a single region`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+        if (declaresOrganization && trailCount === 0) {
+            diagnostics.push({
+                checkId: "WAW058",
+                severity: "error",
+                message: "Template creates an AWS::Organizations::Organization with no CloudTrail trail — the landing zone has no audit sink",
+                lexicon: "aws",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const waw058 = {
+    id: "WAW058",
+    description: "Organization audit trail missing, not logging, or scoped down to a single region",
+    check(ctx) {
+        return checkAuditTrailPosture(ctx);
+    },
+};

package/dist/lint/post-synth/waw059.js

@@ -0,0 +1,338 @@
+/**
+ * WAW059: Wildcard Resource where the declared graph enumerates the touched set
+ *
+ * An identity policy that allows resource-scopable actions on `Resource: "*"`
+ * (or a service-wide ARN pattern) when every consumer of the attached role
+ * only touches resources declared in the same template. In that case the
+ * declared graph already enumerates the touched set, so the statement can be
+ * tightened to the `Fn::GetAtt` Arn list of those declared entities.
+ *
+ * Deliberately narrow (#1225). Fires only when ALL of these hold:
+ * - the statement is an `Effect: Allow` identity-policy statement (role inline
+ *   policy, IAM::Policy, IAM::ManagedPolicy) — trust policies carry a
+ *   Principal and are skipped, resource policies live on other types;
+ * - no Condition/NotAction/NotResource and no intrinsics in Action/Resource;
+ * - `Resource` is `"*"` or a service-wide ARN pattern;
+ * - every Action is in the curated resource-scopable table (s3, dynamodb,
+ *   sqs) — actions that genuinely need `"*"` (s3:ListAllMyBuckets,
+ *   dynamodb:ListTables, sqs:ListQueues) are not in the table;
+ * - the attached principal resolves to declared roles only, those roles have
+ *   consumers in the template, and no consumer carries a foreign edge (a
+ *   literal ARN of the service) or an intrinsic edge (Fn::ImportValue) that
+ *   would put resources outside the declared graph in reach.
+ *
+ * Anything the static graph cannot prove stays quiet.
+ */
+import { parseCFTemplate, walkPolicyStatements, findResourceRefs, buildReverseRefIndex, isIntrinsic, } from "./cf-refs.js";
+/**
+ * Curated table of actions that support resource-level permissions, per
+ * service. Lower-cased (IAM action matching is case-insensitive). An action
+ * outside this table gates the whole statement off — it may legitimately
+ * require `Resource: "*"`.
+ */
+export const RESOURCE_SCOPABLE_ACTIONS = {
+    s3: new Set([
+        "getobject",
+        "getobjectversion",
+        "getobjectacl",
+        "getobjecttagging",
+        "putobject",
+        "putobjectacl",
+        "putobjecttagging",
+        "deleteobject",
+        "deleteobjectversion",
+        "listbucket",
+        "listbucketversions",
+        "listbucketmultipartuploads",
+        "listmultipartuploadparts",
+        "abortmultipartupload",
+        "getbucketlocation",
+    ]),
+    dynamodb: new Set([
+        "getitem",
+        "batchgetitem",
+        "query",
+        "scan",
+        "putitem",
+        "updateitem",
+        "deleteitem",
+        "batchwriteitem",
+        "conditioncheckitem",
+        "describetable",
+        "getrecords",
+        "getsharditerator",
+        "describestream",
+    ]),
+    sqs: new Set([
+        "sendmessage",
+        "sendmessagebatch",
+        "receivemessage",
+        "deletemessage",
+        "deletemessagebatch",
+        "changemessagevisibility",
+        "changemessagevisibilitybatch",
+        "getqueueattributes",
+        "getqueueurl",
+        "purgequeue",
+    ]),
+};
+/** CloudFormation types that declare an entity of each curated service. */
+const SERVICE_RESOURCE_TYPES = {
+    s3: new Set(["AWS::S3::Bucket"]),
+    dynamodb: new Set(["AWS::DynamoDB::Table", "AWS::DynamoDB::GlobalTable"]),
+    sqs: new Set(["AWS::SQS::Queue"]),
+};
+/**
+ * ARN resource segments that make an ARN service-wide rather than
+ * entity-scoped. `arn:aws:s3:::my-bucket/*` is bucket-scoped and NOT here.
+ */
+const SERVICE_WIDE_REST = {
+    s3: new Set(["*"]),
+    dynamodb: new Set(["*", "table/*"]),
+    sqs: new Set(["*"]),
+};
+const IAM_TYPES = new Set(["AWS::IAM::Policy", "AWS::IAM::Role", "AWS::IAM::ManagedPolicy"]);
+const ARN_SERVICE_RE = /arn:[^:\s]*:([a-z0-9-]+):/g;
+function asStringArray(value) {
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+        return value;
+    }
+    return null;
+}
+/** `"*"`, or an ARN whose service is in `services` and whose resource segment is service-wide. */
+function isServiceWideResource(value, services) {
+    if (value === "*")
+        return true;
+    const m = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(value);
+    if (!m)
+        return false;
+    const [, service, rest] = m;
+    if (!services.has(service))
+        return false;
+    return SERVICE_WIDE_REST[service]?.has(rest) ?? false;
+}
+/**
+ * The services an Allow statement touches, if every action lands in the
+ * curated resource-scopable table. Null when any action is outside it
+ * (or malformed / an action-name wildcard).
+ */
+function curatedServices(actions) {
+    const services = new Set();
+    for (const action of actions) {
+        const m = /^([a-z0-9-]+):([A-Za-z0-9]+)$/.exec(action);
+        if (!m)
+            return null;
+        const [, service, name] = m;
+        const table = RESOURCE_SCOPABLE_ACTIONS[service];
+        if (!table || !table.has(name.toLowerCase()))
+            return null;
+        services.add(service);
+    }
+    return services.size > 0 ? services : null;
+}
+/**
+ * Resolve which declared roles a policy resource is attached to. Null means
+ * "cannot prove" (users/groups, literal role names, no roles at all).
+ */
+function attachedRoles(logicalId, resource, template) {
+    const resources = template.Resources ?? {};
+    if (resource.Type === "AWS::IAM::Role")
+        return new Set([logicalId]);
+    const props = resource.Properties ?? {};
+    // Users/groups have no consumers in the resource graph — untraceable.
+    if (Array.isArray(props.Users) && props.Users.length > 0)
+        return null;
+    if (Array.isArray(props.Groups) && props.Groups.length > 0)
+        return null;
+    const roles = new Set();
+    if (props.Roles !== undefined) {
+        if (!Array.isArray(props.Roles))
+            return null;
+        for (const entry of props.Roles) {
+            // A literal role name points outside the declared graph.
+            if (typeof entry === "string")
+                return null;
+            const refs = findResourceRefs(entry);
+            if (refs.size !== 1)
+                return null;
+            const [id] = refs;
+            if (resources[id]?.Type !== "AWS::IAM::Role")
+                return null;
+            roles.add(id);
+        }
+    }
+    // A managed policy can also be attached from the role side (ManagedPolicyArns).
+    if (resource.Type === "AWS::IAM::ManagedPolicy") {
+        for (const [roleId, candidate] of Object.entries(resources)) {
+            if (candidate.Type !== "AWS::IAM::Role")
+                continue;
+            if (findResourceRefs(candidate.Properties?.ManagedPolicyArns).has(logicalId)) {
+                roles.add(roleId);
+            }
+        }
+    }
+    return roles.size > 0 ? roles : null;
+}
+/**
+ * The non-IAM resources that reference any of the roles (the role's
+ * consumers). An IAM::InstanceProfile is a pass-through hop: its own
+ * consumers count instead.
+ */
+function consumersOf(roleIds, reverseIndex, template) {
+    const resources = template.Resources ?? {};
+    const seen = new Set();
+    const queue = [...roleIds].flatMap((id) => [...(reverseIndex.get(id) ?? [])]);
+    const consumers = [];
+    while (queue.length > 0) {
+        const id = queue.shift();
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const resource = resources[id];
+        if (!resource)
+            continue;
+        if (resource.Type === "AWS::IAM::InstanceProfile") {
+            queue.push(...(reverseIndex.get(id) ?? []));
+            continue;
+        }
+        if (resource.Type.startsWith("AWS::IAM::"))
+            continue; // attachment, not consumption
+        consumers.push([id, resource]);
+    }
+    return consumers;
+}
+/**
+ * A consumer edge the declared graph cannot enumerate: a literal ARN of one
+ * of the statement's services (a foreign, undeclared entity) or an
+ * Fn::ImportValue anywhere in the consumer (a cross-stack edge).
+ */
+function hasForeignOrIntrinsicEdge(value, services) {
+    if (value === null || value === undefined)
+        return false;
+    if (typeof value === "string") {
+        for (const m of value.matchAll(ARN_SERVICE_RE)) {
+            if (services.has(m[1]))
+                return true;
+        }
+        return false;
+    }
+    if (typeof value !== "object")
+        return false;
+    if (Array.isArray(value)) {
+        return value.some((item) => hasForeignOrIntrinsicEdge(item, services));
+    }
+    const obj = value;
+    if ("Fn::ImportValue" in obj)
+        return true;
+    return Object.values(obj).some((v) => hasForeignOrIntrinsicEdge(v, services));
+}
+const S3_OBJECT_ACTIONS = new Set([
+    "getobject",
+    "getobjectversion",
+    "getobjectacl",
+    "getobjecttagging",
+    "putobject",
+    "putobjectacl",
+    "putobjecttagging",
+    "deleteobject",
+    "deleteobjectversion",
+    "listmultipartuploadparts",
+    "abortmultipartupload",
+]);
+function policyKind(type) {
+    if (type === "AWS::IAM::Role")
+        return "role";
+    if (type === "AWS::IAM::ManagedPolicy")
+        return "managed policy";
+    return "policy";
+}
+export function checkWildcardResourceEnumerable(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        const reverseIndex = buildReverseRefIndex(template);
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (!IAM_TYPES.has(resource.Type))
+                continue;
+            // walkPolicyStatements also yields a role's AssumeRolePolicyDocument
+            // statements; those always carry a Principal and are gated off below.
+            for (const stmt of walkPolicyStatements(resource)) {
+                if (stmt.Effect !== "Allow")
+                    continue;
+                if ("Condition" in stmt || "NotAction" in stmt || "NotResource" in stmt)
+                    continue;
+                if ("Principal" in stmt || "NotPrincipal" in stmt)
+                    continue;
+                if (isIntrinsic(stmt.Action) || isIntrinsic(stmt.Resource))
+                    continue;
+                const actions = asStringArray(stmt.Action);
+                const resources = asStringArray(stmt.Resource);
+                if (!actions || !resources || actions.length === 0 || resources.length === 0)
+                    continue;
+                const services = curatedServices(actions);
+                if (!services)
+                    continue;
+                if (!resources.every((r) => isServiceWideResource(r, services)))
+                    continue;
+                const roles = attachedRoles(logicalId, resource, template);
+                if (!roles)
+                    continue;
+                const consumers = consumersOf(roles, reverseIndex, template);
+                if (consumers.length === 0)
+                    continue;
+                // Every consumer edge must stay inside the declared graph.
+                if (consumers.some(([, c]) => hasForeignOrIntrinsicEdge(c.Properties, services)))
+                    continue;
+                // The declared entities of each granted service the consumers touch.
+                const touched = new Set();
+                let enumerable = true;
+                for (const service of services) {
+                    const types = SERVICE_RESOURCE_TYPES[service];
+                    const serviceTouched = new Set();
+                    for (const [, consumer] of consumers) {
+                        for (const ref of findResourceRefs(consumer.Properties)) {
+                            if (types.has(template.Resources[ref]?.Type ?? ""))
+                                serviceTouched.add(ref);
+                        }
+                    }
+                    if (serviceTouched.size === 0) {
+                        enumerable = false;
+                        break;
+                    }
+                    for (const id of serviceTouched)
+                        touched.add(id);
+                }
+                if (!enumerable)
+                    continue;
+                const suggestion = JSON.stringify([...touched].sort().map((id) => ({ "Fn::GetAtt": [id, "Arn"] })));
+                const objectHint = actions.some((a) => {
+                    const [service, name] = a.split(":");
+                    return service === "s3" && S3_OBJECT_ACTIONS.has(name.toLowerCase());
+                })
+                    ? ' (s3 object-level actions also need the "/*" object suffix on the bucket Arn)'
+                    : "";
+                diagnostics.push({
+                    checkId: "WAW059",
+                    severity: "warning",
+                    message: `IAM ${policyKind(resource.Type)} "${logicalId}" allows ${actions.join(", ")} on ` +
+                        `Resource ${JSON.stringify(stmt.Resource)}, but the declared graph enumerates the touched set — ` +
+                        `tighten Resource to ${suggestion}${objectHint}`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw059 = {
+    id: "WAW059",
+    description: "Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns",
+    check(ctx) {
+        return checkWildcardResourceEnumerable(ctx);
+    },
+};

package/dist/lint/post-synth/waw060.js

@@ -0,0 +1,83 @@
+/**
+ * WAW060: IAM Policy Attached to No Principal
+ *
+ * Flags AWS::IAM::Policy / AWS::IAM::ManagedPolicy resources with empty or
+ * absent Roles, Users, and Groups that no other part of the template
+ * references. A policy attached to no principal grants nothing — the same
+ * detached-guardrail shape WAW057 catches for SCPs. Any Ref/GetAtt edge to
+ * the policy (a role's ManagedPolicyArns, an attachment-style resource, a
+ * stack Output exporting it for another stack to attach) keeps it quiet;
+ * plain AWS-managed ARN strings elsewhere are not references to the
+ * template's own policy.
+ */
+import { parseCFTemplate, findResourceRefs, isIntrinsic } from "./cf-refs.js";
+const POLICY_TYPES = new Set(["AWS::IAM::Policy", "AWS::IAM::ManagedPolicy"]);
+const PRINCIPAL_PROPS = ["Roles", "Users", "Groups"];
+/**
+ * Collect every logical id referenced via Ref/Fn::GetAtt from anywhere in the
+ * template except the policy resources themselves — other resources'
+ * properties and the Outputs section. An Output edge counts as attachment
+ * evidence: the policy may be exported for a consuming stack to attach.
+ */
+function collectExternalRefs(template, excludeIds) {
+    const refs = new Set();
+    for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+        if (excludeIds.has(logicalId))
+            continue;
+        for (const ref of findResourceRefs(resource))
+            refs.add(ref);
+    }
+    for (const ref of findResourceRefs(template.Outputs))
+        refs.add(ref);
+    return refs;
+}
+export function checkPolicyUnattached(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        const policyIds = new Set(Object.entries(template.Resources)
+            .filter(([, resource]) => POLICY_TYPES.has(resource.Type))
+            .map(([logicalId]) => logicalId));
+        if (policyIds.size === 0)
+            continue;
+        const externalRefs = collectExternalRefs(template, policyIds);
+        for (const logicalId of policyIds) {
+            const resource = template.Resources[logicalId];
+            const props = resource.Properties ?? {};
+            // Any declared principal list keeps the policy quiet. An intrinsic
+            // can't be statically evaluated, so it counts as attached.
+            let attached = false;
+            for (const prop of PRINCIPAL_PROPS) {
+                const value = props[prop];
+                if (isIntrinsic(value))
+                    attached = true;
+                else if (Array.isArray(value) && value.length > 0)
+                    attached = true;
+            }
+            if (attached)
+                continue;
+            // Reverse lookup: anything else in the template holding a Ref/GetAtt
+            // edge to this policy attaches (or exports) it.
+            if (externalRefs.has(logicalId))
+                continue;
+            const kind = resource.Type === "AWS::IAM::ManagedPolicy" ? "Managed policy" : "Policy";
+            diagnostics.push({
+                checkId: "WAW060",
+                severity: "warning",
+                message: `${kind} "${logicalId}" is attached to no principal — no Roles/Users/Groups and nothing in the template references it; an unattached policy grants nothing`,
+                entity: logicalId,
+                lexicon: "aws",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const waw060 = {
+    id: "WAW060",
+    description: "IAM policy attached to no principal — it grants nothing",
+    check(ctx) {
+        return checkPolicyUnattached(ctx);
+    },
+};

package/dist/lint/post-synth/waw061.js

@@ -0,0 +1,60 @@
+/**
+ * WAW061: Subnet CIDR Not Contained In VPC CIDR
+ *
+ * A subnet's CidrBlock must fall entirely inside its VPC's CidrBlock.
+ * Stock CDK does not check this — CloudFormation accepts the template and
+ * only fails the `AWS::EC2::Subnet` resource at deploy time
+ * ("The CIDR ... is invalid" / "does not fall within the CIDR range of the
+ * VPC"), after the rest of the stack may have already started rolling out.
+ * This is a cheap static graph check: follow the subnet's VpcId Ref to a
+ * declared VPC in the same template and do IPv4 CIDR-range math.
+ *
+ * Stays quiet whenever the graph can't prove it: intrinsic CIDR blocks,
+ * IPv6, a VpcId that isn't a simple Ref to a declared AWS::EC2::VPC, or a
+ * VPC whose own CidrBlock isn't a literal string.
+ */
+import { parseCFTemplate, findResourceRefs, ipv4CidrContains } from "./cf-refs.js";
+export function checkSubnetCidrContainment(ctx) {
+    const diagnostics = [];
+    for (const [_lexicon, output] of ctx.outputs) {
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            if (resource.Type !== "AWS::EC2::Subnet")
+                continue;
+            const props = resource.Properties ?? {};
+            const subnetCidr = props.CidrBlock;
+            if (typeof subnetCidr !== "string")
+                continue;
+            const vpcRefs = findResourceRefs(props.VpcId);
+            if (vpcRefs.size !== 1)
+                continue;
+            const [vpcId] = vpcRefs;
+            const vpc = template.Resources[vpcId];
+            if (!vpc || vpc.Type !== "AWS::EC2::VPC")
+                continue;
+            const vpcCidr = vpc.Properties?.CidrBlock;
+            if (typeof vpcCidr !== "string")
+                continue;
+            const contained = ipv4CidrContains(vpcCidr, subnetCidr);
+            if (contained === false) {
+                diagnostics.push({
+                    checkId: "WAW061",
+                    severity: "error",
+                    message: `Subnet "${logicalId}" CidrBlock ${subnetCidr} is not contained within VPC "${vpcId}"'s CidrBlock ${vpcCidr} — CloudFormation rejects this at deploy time`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw061 = {
+    id: "WAW061",
+    description: "Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time",
+    check(ctx) {
+        return checkSubnetCidrContainment(ctx);
+    },
+};