@intentius/chant-lexicon-aws 0.124.32 → 0.124.34

package/dist/serializer.js

@@ -3,6 +3,7 @@ import { ownershipEntries } from "@intentius/chant/ownership";
 import { isEffectReceipt, receiptExpectation, referenceInputPaths, } from "@intentius/chant/effect-receipt";
 import { AWS_TAG_OWNERSHIP_KEYS, OWNERSHIP_METADATA_KEY } from "./ownership.js";
 import { AWS_EFFECT_RECEIPT_ENTITY_TYPE, EFFECT_RECEIPTS_METADATA_KEY, RECEIPT_UNRESOLVED_VALUE_NOTE, receiptParameterName, } from "./effect-receipt-row.js";
+import { sanitizeLogicalId } from "@intentius/chant/lexicon-output";
 import { walkValue } from "@intentius/chant/serializer-walker";
 import { isChildProject } from "@intentius/chant/child-project";
 import { isStackOutput } from "@intentius/chant/stack-output";
@@ -31,12 +32,34 @@ const PARAMETER_CONSTRAINT_KEYS = [
     ["maxValue", "MaxValue"],
     ["noEcho", "NoEcho"],
 ];
+/** Per template (keyed by its entity map): the foreign attributes its values read, by parameter name. */
+const foreignAttrs = new WeakMap();
+const namesIn = new WeakMap();
+function holds(entityNames, name) {
+    let names = namesIn.get(entityNames);
+    if (!names) {
+        names = new Set(entityNames.values());
+        namesIn.set(entityNames, names);
+    }
+    return names.has(name);
+}
 /**
  * CloudFormation-specific visitor for the generic serializer walker.
  */
 function cfnVisitor(entityNames) {
     return {
-        attrRef: (name, attr) => ({ "Fn::GetAtt": [name, attr] }),
+        attrRef: (name, attr) => {
+            if (holds(entityNames, name))
+                return { "Fn::GetAtt": [name, attr] };
+            const param = sanitizeLogicalId(name, attr);
+            let foreign = foreignAttrs.get(entityNames);
+            if (!foreign) {
+                foreign = new Map();
+                foreignAttrs.set(entityNames, foreign);
+            }
+            foreign.set(param, { entity: name, attribute: attr });
+            return { Ref: param };
+        },
         resourceRef: (name) => ({ Ref: name }),
         propertyDeclarable: (entity, walk) => {
             if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
@@ -152,7 +175,7 @@ function renderReceiptRows(receipts, ownership) {
 /**
  * Serialize a set of entities into a CFTemplate object (without JSON.stringify).
  */
-function serializeToTemplate(entities, outputs, extraParameters, extraOutputs, ownership, receiptRows) {
+function serializeToTemplate(entities, outputs, extraParameters, extraOutputs, ownership, receiptRows, warnings = []) {
     const template = {
         AWSTemplateFormatVersion: "2010-09-09",
         Resources: {},
@@ -435,6 +458,17 @@ function serializeToTemplate(entities, outputs, extraParameters, extraOutputs, o
     if (extraOutputs && Object.keys(extraOutputs).length > 0) {
         template.Outputs = { ...template.Outputs, ...extraOutputs };
     }
+    // Values read from resources this template doesn't hold become parameters.
+    for (const [param, ref] of foreignAttrs.get(entityNames) ?? []) {
+        if (template.Resources[param] || template.Parameters?.[param])
+            continue;
+        template.Parameters = template.Parameters ?? {};
+        template.Parameters[param] = {
+            Type: "String",
+            Description: `${ref.entity}.${ref.attribute}, from another lexicon's output "${param}"`,
+        };
+        warnings.push(`aws: "${ref.entity}" is not in this template, so its ${ref.attribute} is the parameter "${param}". Deploy "${ref.entity}" first and pass its output "${param}" in.`);
+    }
     refuseImportEnvelopes(template);
     return template;
 }
@@ -483,8 +517,10 @@ export const awsSerializer = {
         }
         // No nested stacks — use the simple path
         if (!hasChildProjects) {
-            const template = serializeToTemplate(entities, outputs, undefined, undefined, ownership, receiptRows);
-            return JSON.stringify(template, null, 2);
+            const warnings = [];
+            const template = serializeToTemplate(entities, outputs, undefined, undefined, ownership, receiptRows, warnings);
+            const primary = JSON.stringify(template, null, 2);
+            return warnings.length > 0 ? { primary, warnings } : primary;
         }
         // Has child projects — produce multi-file output
         const allFiles = {};
@@ -519,11 +555,13 @@ export const awsSerializer = {
             }
         }
         // Serialize the parent template (ChildProjectInstance entities become CF::Stack resources)
-        const parentTemplate = serializeToTemplate(entities, outputs, parentParams, undefined, ownership, receiptRows);
+        const warnings = [];
+        const parentTemplate = serializeToTemplate(entities, outputs, parentParams, undefined, ownership, receiptRows, warnings);
         const primary = JSON.stringify(parentTemplate, null, 2);
         return {
             primary,
             files: allFiles,
+            ...(warnings.length > 0 ? { warnings } : {}),
         };
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.124.32",
+  "version": "0.124.34",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,6 +80,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.32"
+    "@intentius/chant": "^0.124.34"
   }
 }

package/src/health.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from "vitest";
+import {
+  clusterOfServiceArn,
+  ecsServiceEntry,
+  healthCheckEntry,
+  observeHealthAws,
+  parseHealthCheckStatus,
+  type AwsHealthHttp,
+} from "./health";
+import type { AwsReadHttp } from "./api/read-client";
+import { awsPlugin } from "./plugin";
+
+const AT = "2026-10-20T21:00:00.000Z";
+const now = () => new Date(AT);
+
+function stackXml(members: Array<{ logical: string; type: string; physical: string }>): string {
+  const body = members
+    .map((m) => `<member><LogicalResourceId>${m.logical}</LogicalResourceId><ResourceType>${m.type}</ResourceType><PhysicalResourceId>${m.physical}</PhysicalResourceId><ResourceStatus>CREATE_COMPLETE</ResourceStatus></member>`)
+    .join("");
+  return `<DescribeStackResourcesResponse><DescribeStackResourcesResult><StackResources>${body}</StackResources></DescribeStackResourcesResult></DescribeStackResourcesResponse>`;
+}
+
+function statusXml(obs: Array<{ region: string; status: string; time: string }>): string {
+  const body = obs
+    .map((o) => `<HealthCheckObservation><Region>${o.region}</Region><IPAddress>1.2.3.4</IPAddress><StatusReport><Status>${o.status}</Status><CheckedTime>${o.time}</CheckedTime></StatusReport></HealthCheckObservation>`)
+    .join("");
+  return `<GetHealthCheckStatusResponse><HealthCheckObservations>${body}</HealthCheckObservations></GetHealthCheckStatusResponse>`;
+}
+
+const ENV = { AWS_ENDPOINT_URL: "http://localhost:4566" };
+
+describe("aws health (#4177)", () => {
+  test("parses checker observations", () => {
+    const obs = parseHealthCheckStatus(statusXml([{ region: "us-east-1", status: "Success: HTTP Status Code 200, OK", time: "2026-10-20T20:59:00Z" }]));
+    expect(obs).toEqual([{ region: "us-east-1", ipAddress: "1.2.3.4", status: "Success: HTTP Status Code 200, OK", checkedTime: "2026-10-20T20:59:00Z" }]);
+  });
+
+  test("a health check is healthy only when more than 18% of checkers say so", () => {
+    const mk = (ok: number, total: number) =>
+      Array.from({ length: total }, (_, i) => ({ status: i < ok ? "Success: HTTP 200" : "Failure: timed out", checkedTime: `2026-10-20T20:5${i}:00Z` }));
+    expect(healthCheckEntry(mk(2, 10), AT).state).toBe("healthy");
+    expect(healthCheckEntry(mk(1, 10), AT).state).toBe("unhealthy");
+    const e = healthCheckEntry(mk(2, 10), AT);
+    expect(e.detail).toBe("2/10 checkers healthy; last: Failure: timed out");
+    expect(e.checkedAt).toBe("2026-10-20T20:59:00Z");
+    expect(healthCheckEntry([], AT).state).toBe("unknown");
+  });
+
+  test("an ECS service is running against desired", () => {
+    expect(ecsServiceEntry({ status: "ACTIVE", desiredCount: 2, runningCount: 2 }, AT)).toMatchObject({ state: "healthy", detail: "2/2 running" });
+    expect(ecsServiceEntry({ status: "ACTIVE", desiredCount: 3, runningCount: 1, pendingCount: 2 }, AT)).toMatchObject({ state: "unhealthy", detail: "1/3 running, 2 pending" });
+    expect(ecsServiceEntry({ status: "ACTIVE", desiredCount: 0, runningCount: 0 }, AT).state).toBe("unknown");
+    expect(ecsServiceEntry({ status: "DRAINING", desiredCount: 1, runningCount: 1 }, AT).state).toBe("unhealthy");
+  });
+
+  test("the cluster comes from the service ARN", () => {
+    expect(clusterOfServiceArn("arn:aws:ecs:us-east-1:000000000000:service/app/web")).toBe("app");
+    expect(clusterOfServiceArn("arn:aws:ecs:us-east-1:000000000000:service/web")).toBe("default");
+  });
+
+  test("reads both kinds through the endpoint override, keyed by logical id", async () => {
+    const cfn: AwsReadHttp = async (url) => {
+      expect(url).toBe("http://localhost:4566/");
+      return {
+        status: 200,
+        text: stackXml([
+          { logical: "web", type: "AWS::ECS::Service", physical: "arn:aws:ecs:us-east-1:000000000000:service/app/web" },
+          { logical: "webCheck", type: "AWS::Route53::HealthCheck", physical: "abc-123" },
+        ]),
+      };
+    };
+    const calls: string[] = [];
+    const http: AwsHealthHttp = async (method, url, init) => {
+      calls.push(`${method} ${url}`);
+      if (url.includes("/healthcheck/")) {
+        return { status: 200, text: statusXml([{ region: "us-east-1", status: "Success: HTTP 200", time: "2026-10-20T20:58:00Z" }]) };
+      }
+      expect(JSON.parse(init.body!)).toEqual({ cluster: "app", services: ["arn:aws:ecs:us-east-1:000000000000:service/app/web"] });
+      return {
+        status: 200,
+        text: JSON.stringify({ services: [{ serviceArn: "arn:aws:ecs:us-east-1:000000000000:service/app/web", status: "ACTIVE", desiredCount: 2, runningCount: 2 }], failures: [] }),
+      };
+    };
+    const r = await observeHealthAws({
+      environment: "dev",
+      buildOutput: "",
+      entities: new Map([
+        ["web", { entityType: "AWS::ECS::Service", props: {} }],
+        ["webCheck", { entityType: "AWS::Route53::HealthCheck", props: {} }],
+        ["later", { entityType: "AWS::ECS::Service", props: {} }],
+      ]),
+      http,
+      client: { http: cfn, env: ENV },
+      now,
+    });
+    expect(r.entities.web).toMatchObject({ state: "healthy", observedAt: AT });
+    expect(r.entities.webCheck).toMatchObject({ state: "healthy", checkedAt: "2026-10-20T20:58:00Z" });
+    expect(r.absent).toEqual(["later"]);
+    expect(calls).toContain("GET http://localhost:4566/2013-04-01/healthcheck/abc-123/status");
+  });
+
+  test("a missing stack is absent; a failed stack read is a hole for every entity", async () => {
+    const entities = new Map([["web", { entityType: "AWS::ECS::Service", props: {} }]]);
+    const missing: AwsReadHttp = async () => ({
+      status: 400,
+      text: "<ErrorResponse><Error><Code>ValidationError</Code><Message>Stack with id dev does not exist</Message></Error></ErrorResponse>",
+    });
+    const gone = await observeHealthAws({ environment: "dev", buildOutput: "", entities, client: { http: missing, env: ENV } });
+    expect(gone.absent).toEqual(["web"]);
+
+    const broken: AwsReadHttp = async () => {
+      throw new Error("connect ECONNREFUSED");
+    };
+    const hole = await observeHealthAws({ environment: "dev", buildOutput: "", entities, client: { http: broken, env: ENV } });
+    expect(hole.entities).toEqual({});
+    expect(hole.unobserved.web?.reason).toBe("read-failed");
+  });
+
+  test("a failed service read is a hole, never unhealthy", async () => {
+    const cfn: AwsReadHttp = async () => ({ status: 200, text: stackXml([{ logical: "web", type: "AWS::ECS::Service", physical: "arn:aws:ecs:us-east-1:0:service/app/web" }]) });
+    const http: AwsHealthHttp = async () => ({ status: 400, text: JSON.stringify({ __type: "ClusterNotFoundException", message: "Cluster not found." }) });
+    const r = await observeHealthAws({
+      environment: "dev",
+      buildOutput: "",
+      entities: new Map([["web", { entityType: "AWS::ECS::Service", props: {} }]]),
+      http,
+      client: { http: cfn, env: ENV },
+    });
+    expect(r.unobserved.web).toMatchObject({ reason: "read-failed", detail: "ClusterNotFoundException: Cluster not found." });
+  });
+
+  test("the plugin names the types it reads", () => {
+    expect(awsPlugin.healthTypes).toEqual(["AWS::Route53::HealthCheck", "AWS::ECS::Service"]);
+    expect(typeof awsPlugin.observeHealth).toBe("function");
+  });
+});

package/src/health.ts

@@ -0,0 +1,281 @@
+/**
+ * Runtime health for AWS (#4177): Route 53 health checks and ECS services.
+ *
+ * The stack's own resource list maps each logical id (the graph's node id) to
+ * the physical id the health APIs take. A stack that does not exist yet means
+ * nothing is deployed, so every entity is absent. Any other stack failure is a
+ * hole for every entity, never `unhealthy`.
+ *
+ * - `AWS::Route53::HealthCheck`: `GetHealthCheckStatus`, aggregated as Route 53
+ *   does: healthy when more than 18% of the checkers report healthy.
+ * - `AWS::ECS::Service`: `DescribeServices`, `runningCount` against
+ *   `desiredCount`.
+ *
+ * Both go through the read transport's endpoint rule, so `AWS_ENDPOINT_URL`
+ * (Floci) answers them.
+ */
+
+import type { HealthEntry, HealthReadOptions, HealthReadResult, UnobservedEntity } from "@intentius/chant/lexicon";
+import {
+  AwsReadError,
+  describeStackResources,
+  requestHeaders,
+  serviceUrl,
+  withChainCredentials,
+  withEndpointOverride,
+  xmlError,
+  xmlLeaves,
+  type AwsReadClientOptions,
+} from "./api/read-client";
+import { resolveCredentials, signRequest } from "./api/sigv4";
+import { stackDoesNotExist } from "./stack-errors";
+
+export const AWS_HEALTH_TYPES = ["AWS::Route53::HealthCheck", "AWS::ECS::Service"] as const;
+
+/** Injectable HTTP for both calls, so tests never reach the network. */
+export type AwsHealthHttp = (
+  method: "GET" | "POST",
+  url: string,
+  init: { headers: Record<string, string>; body?: string },
+) => Promise<{ status: number; text: string }>;
+
+const defaultHttp: AwsHealthHttp = async (method, url, init) => {
+  const res = await fetch(url, { method, headers: init.headers, ...(init.body !== undefined ? { body: init.body } : {}) });
+  return { status: res.status, text: await res.text() };
+};
+
+export interface AwsHealthOptions extends HealthReadOptions {
+  http?: AwsHealthHttp;
+  /** Read client for the stack list and the signing decision. Tests inject `http` and `env` here. */
+  client?: AwsReadClientOptions;
+  now?: () => Date;
+}
+
+/** Route 53 treats an endpoint as healthy when more than this share of checkers says so. */
+const ROUTE53_HEALTHY_SHARE = 0.18;
+
+/** One checker's report, as `GetHealthCheckStatus` returns it. */
+export interface CheckerObservation {
+  region?: string;
+  ipAddress?: string;
+  status: string;
+  checkedTime?: string;
+}
+
+/** Parse `GetHealthCheckStatusResponse`'s observations. */
+export function parseHealthCheckStatus(xml: string): CheckerObservation[] {
+  const out: CheckerObservation[] = [];
+  for (const m of xml.matchAll(/<HealthCheckObservation>([\s\S]*?)<\/HealthCheckObservation>/g)) {
+    const body = m[1] ?? "";
+    const report = xmlLeaves(body.match(/<StatusReport>([\s\S]*?)<\/StatusReport>/)?.[1] ?? "");
+    const top = xmlLeaves(body.replace(/<StatusReport>[\s\S]*?<\/StatusReport>/, ""));
+    out.push({
+      ...(top.Region ? { region: top.Region } : {}),
+      ...(top.IPAddress ? { ipAddress: top.IPAddress } : {}),
+      status: report.Status ?? "",
+      ...(report.CheckedTime ? { checkedTime: report.CheckedTime } : {}),
+    });
+  }
+  return out;
+}
+
+/** A checker's status text starts with `Success` when it found the endpoint healthy. */
+function checkerHealthy(o: CheckerObservation): boolean {
+  return /^success/i.test(o.status.trim());
+}
+
+/** Route 53's verdict over its checkers' observations. */
+export function healthCheckEntry(observations: CheckerObservation[], observedAt: string): HealthEntry {
+  const type = "AWS::Route53::HealthCheck";
+  if (observations.length === 0) {
+    return { type, state: "unknown", detail: "no checker has reported yet", observedAt };
+  }
+  const healthy = observations.filter(checkerHealthy).length;
+  const latest = [...observations].sort((a, b) => (b.checkedTime ?? "").localeCompare(a.checkedTime ?? ""))[0]!;
+  const state = healthy / observations.length > ROUTE53_HEALTHY_SHARE ? "healthy" : "unhealthy";
+  return {
+    type,
+    state,
+    detail: `${healthy}/${observations.length} checkers healthy; last: ${latest.status}`,
+    observedAt,
+    ...(latest.checkedTime ? { checkedAt: latest.checkedTime } : {}),
+  };
+}
+
+/** The parts of an ECS service `DescribeServices` returns that decide health. */
+export interface EcsServiceState {
+  status?: string;
+  desiredCount?: number;
+  runningCount?: number;
+  pendingCount?: number;
+  deployments?: Array<{ rolloutState?: string; updatedAt?: number | string }>;
+}
+
+/** Running against desired. Scaled to zero is `unknown`: nothing is serving, by choice. */
+export function ecsServiceEntry(service: EcsServiceState, observedAt: string): HealthEntry {
+  const type = "AWS::ECS::Service";
+  const desired = service.desiredCount ?? 0;
+  const running = service.runningCount ?? 0;
+  const pending = service.pendingCount ?? 0;
+  const counts = `${running}/${desired} running${pending > 0 ? `, ${pending} pending` : ""}`;
+  const rollout = service.deployments?.find((d) => d.rolloutState)?.rolloutState;
+  const detail = `${counts}${rollout ? `, rollout ${rollout}` : ""}`;
+  if (service.status && service.status !== "ACTIVE") {
+    return { type, state: "unhealthy", detail: `service is ${service.status}; ${detail}`, observedAt };
+  }
+  if (desired === 0) return { type, state: "unknown", detail: `desired count is 0; ${detail}`, observedAt };
+  return { type, state: running >= desired ? "healthy" : "unhealthy", detail, observedAt };
+}
+
+/** The cluster a service ARN names: `service/<cluster>/<name>`, or the default cluster for the old `service/<name>` form. */
+export function clusterOfServiceArn(arn: string): string {
+  const resource = arn.split(":").slice(5).join(":");
+  const parts = resource.split("/");
+  return parts.length >= 3 ? parts[1]! : "default";
+}
+
+function holeFrom(type: string, err: unknown): UnobservedEntity {
+  const detail = err instanceof AwsReadError && err.code ? `${err.code}: ${err.message}` : err instanceof Error ? err.message : String(err);
+  const reason = /credential|token|expired|AccessDenied|not authorized|Unauthorized/i.test(detail) ? "no-credentials" : "read-failed";
+  return { type, reason, detail: detail.slice(0, 200) };
+}
+
+async function getHealthCheckStatus(
+  id: string,
+  client: AwsReadClientOptions,
+  http: AwsHealthHttp,
+): Promise<CheckerObservation[]> {
+  const options = await withChainCredentials(withEndpointOverride("route53", client));
+  // Route 53 is global: one host, signed in us-east-1.
+  const base = (options.endpoint ?? "https://route53.amazonaws.com").replace(/\/$/, "");
+  const url = `${base}/2013-04-01/healthcheck/${encodeURIComponent(id)}/status`;
+  const env = options.env ?? process.env;
+  const credentials = resolveCredentials(options.credentials, env);
+  const signable = credentials && (!options.endpoint || options.signEndpointOverride === true);
+  const headers = signable
+    ? signRequest({ method: "GET", url, headers: {}, body: "", service: "route53", region: "us-east-1", credentials, ...(options.now ? { now: options.now } : {}) })
+    : {};
+  const res = await http("GET", url, { headers });
+  const err = xmlError(res.text);
+  if (err || res.status >= 400) {
+    throw new AwsReadError(err?.message ?? `GetHealthCheckStatus failed with HTTP ${res.status}`, res.status, err?.code);
+  }
+  return parseHealthCheckStatus(res.text);
+}
+
+async function describeServices(
+  cluster: string,
+  arns: string[],
+  client: AwsReadClientOptions,
+  http: AwsHealthHttp,
+): Promise<{ services: Array<EcsServiceState & { serviceArn?: string }>; failures: Array<{ arn?: string; reason?: string }> }> {
+  const options = await withChainCredentials(withEndpointOverride("ecs", client));
+  const url = serviceUrl("ecs", options.endpoint, options.region);
+  const body = JSON.stringify({ cluster, services: arns });
+  const headers = requestHeaders(
+    "ecs",
+    url,
+    body,
+    { "content-type": "application/x-amz-json-1.1", "x-amz-target": "AmazonEC2ContainerServiceV20141113.DescribeServices" },
+    options,
+  );
+  const res = await http("POST", url, { headers, body });
+  let parsed: Record<string, unknown> = {};
+  try {
+    const value: unknown = JSON.parse(res.text);
+    if (value && typeof value === "object" && !Array.isArray(value)) parsed = value as Record<string, unknown>;
+  } catch {
+    throw new AwsReadError("unparseable DescribeServices response", res.status);
+  }
+  const errType = typeof parsed.__type === "string" ? parsed.__type.split("#").pop() : undefined;
+  if (errType || res.status >= 400) {
+    const message = typeof parsed.message === "string" ? parsed.message : `DescribeServices failed with HTTP ${res.status}`;
+    throw new AwsReadError(message, res.status, errType);
+  }
+  return {
+    services: Array.isArray(parsed.services) ? (parsed.services as Array<EcsServiceState & { serviceArn?: string }>) : [],
+    failures: Array.isArray(parsed.failures) ? (parsed.failures as Array<{ arn?: string; reason?: string }>) : [],
+  };
+}
+
+export async function observeHealthAws(options: AwsHealthOptions): Promise<HealthReadResult> {
+  const http = options.http ?? defaultHttp;
+  const observedAt = (options.now?.() ?? new Date()).toISOString();
+  const client: AwsReadClientOptions = { ...(options.client ?? {}), ...(options.region ? { region: options.region } : {}) };
+  const entities: Record<string, HealthEntry> = {};
+  const unobserved: Record<string, UnobservedEntity> = {};
+  const absent: string[] = [];
+  if (options.entities.size === 0) return { entities, unobserved, absent };
+
+  const stackName = options.stack ?? options.environment;
+  let physical: Map<string, string>;
+  try {
+    const resources = await describeStackResources(stackName, client);
+    physical = new Map(resources.filter((r) => r.physicalId).map((r) => [r.logicalId, r.physicalId!]));
+  } catch (err) {
+    if (err instanceof AwsReadError && stackDoesNotExist(err.message)) return { entities, unobserved, absent: [...options.entities.keys()] };
+    for (const [name, { entityType }] of options.entities) {
+      unobserved[name] = holeFrom(entityType, err);
+      unobserved[name]!.detail = `DescribeStackResources failed for stack "${stackName}": ${unobserved[name]!.detail}`;
+    }
+    return { entities, unobserved, absent };
+  }
+
+  const services = new Map<string, Array<{ name: string; arn: string }>>();
+  const checks: Array<{ name: string; id: string }> = [];
+  for (const [name, { entityType }] of options.entities) {
+    const id = physical.get(name);
+    if (!id) {
+      absent.push(name);
+      continue;
+    }
+    if (entityType === "AWS::ECS::Service") {
+      const cluster = clusterOfServiceArn(id);
+      const list = services.get(cluster) ?? [];
+      list.push({ name, arn: id });
+      services.set(cluster, list);
+    } else if (entityType === "AWS::Route53::HealthCheck") {
+      checks.push({ name, id });
+    }
+  }
+
+  await Promise.all(
+    checks.map(async ({ name, id }) => {
+      try {
+        entities[name] = healthCheckEntry(await getHealthCheckStatus(id, client, http), observedAt);
+      } catch (err) {
+        if (err instanceof AwsReadError && err.code === "NoSuchHealthCheck") absent.push(name);
+        else unobserved[name] = holeFrom("AWS::Route53::HealthCheck", err);
+      }
+    }),
+  );
+
+  await Promise.all(
+    [...services].map(async ([cluster, members]) => {
+      // DescribeServices takes at most ten services per call.
+      for (let i = 0; i < members.length; i += 10) {
+        const batch = members.slice(i, i + 10);
+        try {
+          const { services: found, failures } = await describeServices(cluster, batch.map((m) => m.arn), client, http);
+          for (const member of batch) {
+            const service = found.find((s) => s.serviceArn === member.arn || s.serviceArn?.endsWith(`/${member.arn.split("/").pop()}`));
+            const failure = failures.find((f) => f.arn === member.arn);
+            if (service) entities[member.name] = ecsServiceEntry(service, observedAt);
+            else if (failure?.reason === "MISSING") absent.push(member.name);
+            else {
+              unobserved[member.name] = {
+                type: "AWS::ECS::Service",
+                reason: "read-failed",
+                detail: failure?.reason ? `DescribeServices: ${failure.reason}` : "DescribeServices did not return the service",
+              };
+            }
+          }
+        } catch (err) {
+          for (const member of batch) unobserved[member.name] = holeFrom("AWS::ECS::Service", err);
+        }
+      }
+    }),
+  );
+
+  return { entities, unobserved, absent };
+}

package/src/lint/audit-catalog.ts

@@ -90,6 +90,7 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
   WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
   WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
+  WAW070: auditRule("WAW070", "merge-worthy", "guidance", "Ref or Fn::GetAtt names something the template doesn't declare", "Reference a resource or parameter in this template. A value from another lexicon's resource arrives as a parameter.", { category: "correctness" }),
 };
 
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).

package/src/lint/audit-lineage.ts

@@ -156,4 +156,8 @@ export const awsAuditLineage: Record<string, Lineage[]> = {
   WAW069: [
     { tool: "cfn-lint", rule: "E8002", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E8002", relation: "equivalent" },
   ],
+  WAW070: [
+    { tool: "cfn-lint", rule: "E1012", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1012", relation: "equivalent" },
+    { tool: "cfn-lint", rule: "E1010", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1010", relation: "overlaps" },
+  ],
 };

package/src/lint/post-synth/index.ts

@@ -61,6 +61,7 @@ import { waw066 } from "./waw066";
 import { waw067 } from "./waw067";
 import { waw068 } from "./waw068";
 import { waw069 } from "./waw069";
+import { waw070 } from "./waw070";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -124,4 +125,5 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw067,
   waw068,
   waw069,
+  waw070,
 ];

package/src/lint/post-synth/waw070.test.ts

@@ -0,0 +1,59 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw070, checkDanglingRefs } from "./waw070";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW070: Ref or Fn::GetAtt names something the template doesn't declare", () => {
+  test("check metadata", () => {
+    expect(waw070.id).toBe("WAW070");
+  });
+
+  test("Fn::GetAtt to a resource not in the template → error", () => {
+    const diags = checkDanglingRefs(makeCtx({
+      Resources: {
+        Record: { Type: "AWS::Route53::RecordSet", Properties: { ResourceRecords: [{ "Fn::GetAtt": ["app", "id"] }] } },
+      },
+    }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain('Fn::GetAtt "app"');
+    expect(diags[0].entity).toBe("Record");
+  });
+
+  test("Ref to something undeclared in an output → error", () => {
+    const diags = checkDanglingRefs(makeCtx({
+      Resources: { Bucket: { Type: "AWS::S3::Bucket" } },
+      Outputs: { Name: { Value: { Ref: "Missing" } } },
+    }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('Output "Name" has Ref "Missing"');
+  });
+
+  test("resources, parameters, pseudo-parameters and the string GetAtt form are fine", () => {
+    const diags = checkDanglingRefs(makeCtx({
+      Parameters: { AppFqdn: { Type: "String" } },
+      Resources: {
+        Bucket: { Type: "AWS::S3::Bucket" },
+        Record: {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            ResourceRecords: [{ Ref: "AppFqdn" }],
+            Comment: { "Fn::Join": ["", [{ Ref: "AWS::Region" }, { "Fn::GetAtt": "Bucket.Arn" }, { Ref: "Bucket" }]] },
+          },
+        },
+      },
+    }));
+    expect(diags).toEqual([]);
+  });
+
+  test("Fn::GetAtt to a parameter → error", () => {
+    const diags = checkDanglingRefs(makeCtx({
+      Parameters: { P: { Type: "String" } },
+      Resources: { R: { Type: "AWS::SNS::Topic", Properties: { TopicName: { "Fn::GetAtt": ["P", "X"] } } } },
+    }));
+    expect(diags).toHaveLength(1);
+  });
+});