@intentius/chant-lexicon-aws 0.124.45 → 0.124.48

package/src/capabilities/mapping.json

@@ -0,0 +1,150 @@
+{
+  "lexicon": "aws",
+  "types": "kind",
+  "refs": "cloudformation",
+  "labels": {
+    "AWS::EC2::VPC": "Vpc",
+    "AWS::EC2::NetworkInterface": "NetworkInterface",
+    "AWS::EC2::Volume": "Volume",
+    "AWS::Lambda::Function": "Function",
+    "AWS::Lambda::Url": "FunctionUrl",
+    "AWS::IAM::InstanceProfile": "InstanceProfile",
+    "AWS::IAM::Role": "Role",
+    "AWS::IAM::Policy": "Policy",
+    "AWS::IAM::ManagedPolicy": "Policy",
+    "AWS::S3::BucketPolicy": "ResourcePolicy",
+    "AWS::SQS::QueuePolicy": "ResourcePolicy",
+    "AWS::S3::Bucket": "Bucket",
+    "AWS::DynamoDB::Table": "Table",
+    "AWS::DynamoDB::GlobalTable": "Table",
+    "AWS::RDS::DBInstance": "Database",
+    "AWS::RDS::DBCluster": "Database",
+    "AWS::SecretsManager::Secret": "Secret",
+    "AWS::SQS::Queue": "Queue",
+    "AWS::EFS::FileSystem": "FileSystem",
+    "AWS::SSM::Parameter": "Parameter",
+    "AWS::ECS::Service": "Service",
+    "AWS::ECS::TaskDefinition": "TaskDefinition",
+    "AWS::RDS::DBSubnetGroup": "SubnetGroup",
+    "AWS::EC2::NatGateway": "NatGateway",
+    "AWS::ElasticLoadBalancingV2::LoadBalancer": "LoadBalancer"
+  },
+  "edges": {
+    "Instance": {
+      "IamInstanceProfile": "profile",
+      "VpcId": "vpc"
+    },
+    "LaunchTemplate": {
+      "LaunchTemplateData": {
+        "InstanceProfile": "profile"
+      }
+    },
+    "Subnet": {
+      "VpcId": "vpc"
+    },
+    "SecurityGroup": {
+      "VpcId": "vpc"
+    },
+    "NetworkInterface": {
+      "SubnetId": "subnet",
+      "GroupSet": "sg"
+    },
+    "Database": {
+      "VPCSecurityGroups": "sg",
+      "VpcSecurityGroupIds": "sg",
+      "DBSubnetGroupName": "subnetGroup"
+    },
+    "Function": {
+      "Role": "role",
+      "VpcConfig": {
+        "SecurityGroup": "sg",
+        "Subnet": "subnet"
+      }
+    },
+    "FunctionUrl": {
+      "TargetFunctionArn": "function"
+    },
+    "InstanceProfile": {
+      "Roles": "role"
+    },
+    "Policy": {
+      "Roles": "attachedTo"
+    },
+    "Role": {
+      "ManagedPolicyArns": "-attachedTo"
+    },
+    "ResourcePolicy": {
+      "Bucket": "policyOf",
+      "Queues": "policyOf"
+    },
+    "Service": {
+      "TaskDefinition": "task",
+      "NetworkConfiguration": {
+        "SecurityGroup": "sg",
+        "Subnet": "subnet"
+      }
+    },
+    "TaskDefinition": {
+      "TaskRoleArn": "role"
+    },
+    "SubnetGroup": {
+      "SubnetIds": "subnet"
+    },
+    "NatGateway": {
+      "SubnetId": "subnet"
+    },
+    "LoadBalancer": {
+      "Subnets": "subnet",
+      "SecurityGroups": "sg"
+    }
+  },
+  "attrs": {
+    "FunctionUrl": {
+      "authType": "AuthType"
+    },
+    "Role": {
+      "name": "RoleName"
+    },
+    "Bucket": {
+      "name": "BucketName",
+      "acl": "AccessControl",
+      "blockPublicPolicy": "PublicAccessBlockConfiguration.BlockPublicPolicy"
+    },
+    "Table": {
+      "name": "TableName"
+    },
+    "Database": {
+      "encrypted": "StorageEncrypted"
+    },
+    "FileSystem": {
+      "encrypted": "Encrypted"
+    },
+    "Volume": {
+      "encrypted": "Encrypted"
+    },
+    "Parameter": {
+      "paramType": "Type"
+    },
+    "Vpc": {
+      "isDefault": "IsDefault"
+    }
+  },
+  "documents": {
+    "Role": {
+      "AssumeRolePolicyDocument": "trust",
+      "Policies[].PolicyDocument": "permission"
+    },
+    "Policy": {
+      "PolicyDocument": "permission"
+    },
+    "ResourcePolicy": {
+      "PolicyDocument": "resource"
+    }
+  },
+  "tags": [
+    "Tags"
+  ],
+  "classificationTags": [
+    "data-classification"
+  ]
+}

package/src/capabilities/pack.ts

@@ -0,0 +1,9 @@
+/**
+ * The aws lexicon's capability pack (#4375): its mapping of CloudFormation
+ * kinds onto the lexicon-neutral view the capability rules read. All data;
+ * CloudFormation policy documents are JSON already, so no adapter code.
+ */
+import type { CapabilityMapping, CapabilityPack } from "@intentius/chant/capabilities/view";
+import mapping from "./mapping.json" with { type: "json" };
+
+export const awsCapabilityPack: CapabilityPack = { mapping: mapping as CapabilityMapping };

package/src/capabilities.test.ts

@@ -0,0 +1,182 @@
+/**
+ * The capability catalog over CloudFormation kinds (#4375).
+ *
+ * `testdata/capabilities-ledger/estate.ts` is the CloudFormation form of the
+ * estate chant#4361 measured the rule language on. Its hand-checked answers
+ * are identity reach 13, exfiltration 3 and blast radius 15, the same as the
+ * Terraform form's (lexicons/terraform/src/capabilities.test.ts).
+ *
+ * Three of those pairs are proved only by a reference inside a `Sub`
+ * (``Sub`${assets.Arn}/*` ``), which the graph carries as `{ $sub }` since
+ * chant#4373.
+ */
+
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { discover } from "@intentius/chant/discovery/index";
+import { buildGraphIr, type GraphIR } from "@intentius/chant/graph-ir";
+import { enrichEffectiveTopology } from "@intentius/chant/graph-effective";
+import { CapabilityEngine } from "@intentius/chant/capabilities/matcher";
+import { buildView, displayName } from "@intentius/chant/capabilities/view";
+import { lexiconSupport, resolvePacks, shippedRules, isPublic } from "@intentius/chant/capabilities/catalog";
+import { awsCapabilityPack } from "./capabilities/pack";
+
+const LEDGER = join(import.meta.dirname, "testdata", "capabilities-ledger");
+
+const engineFor = (g: GraphIR) => new CapabilityEngine(buildView(g, resolvePacks([awsCapabilityPack])), shippedRules().rules);
+
+const ir: GraphIR = buildGraphIr((await discover(LEDGER)).entities, LEDGER);
+const engine = engineFor(ir);
+
+const set = (e: CapabilityEngine, name: string, args: unknown[] = []) =>
+  [...e.set(name, e.bind(name, args as never)).keys()].map(displayName).sort();
+const pairs = (e: CapabilityEngine, name: string, args: unknown[] = []) =>
+  [...e.relation(name, e.bind(name, args as never)).out].flatMap(([a, m]) => [...m.keys()].map((b) => `${displayName(a)} ${displayName(b)}`)).sort();
+
+const REACH = [
+  "auditRole ordersTable",
+  "batchRole auditRole",
+  "batchRole ordersTable",
+  "deployRole customerData",
+  "deployRole dbSecret",
+  "reporterRole customerData",
+  "webRole assets",
+  "webRole customerData",
+  "webRole dbSecret",
+  "webRole deployRole",
+  "workerRole assets",
+  "workerRole dbSecret",
+  "workerRole ordersTable",
+];
+const EXFIL = ["reporter customerData", "webServer customerData", "webServer dbSecret"];
+const BLAST_STARTS = ["webServer", "reporter", "batch"];
+const BLAST = [
+  ...["webRole", "assets", "deployRole", "customerData", "dbSecret", "worker", "adminBox", "workerRole", "ordersTable", "customersDb"].map((x) => `webServer ${x}`),
+  "reporter reporterRole",
+  "reporter customerData",
+  "batch batchRole",
+  "batch auditRole",
+  "batch ordersTable",
+].sort();
+/** The pairs only a `Sub` reference proves (chant#4373). */
+const NEEDS_SUB = {
+  reach: ["reporterRole customerData", "webRole assets", "workerRole assets"],
+  exfil: ["reporter customerData"],
+  blast: ["reporter customerData", "webServer assets"],
+};
+const blastOf = (e: CapabilityEngine) => pairs(e, "blast").filter((p) => BLAST_STARTS.includes(p.split(" ")[0]));
+
+describe("the ledger's hand-checked answers on the CloudFormation form", () => {
+  it("identity reach 13, exfiltration 3, blast radius 15, three of them proved only by a Sub reference (chant#4373)", () => {
+    expect(pairs(engine, "reaches")).toEqual(REACH);
+    expect(pairs(engine, "exfiltrates")).toEqual(EXFIL);
+    expect(blastOf(engine)).toEqual(BLAST);
+  });
+
+  it("leaves no statement's resource unresolved", () => {
+    const unresolved = [...engine.view.nodes.values()].filter((n) => n.label === "Statement" && n.attrs.unresolved);
+    expect(unresolved.map((n) => n.id)).toEqual([]);
+  });
+
+  it("finds the Sub-only pairs through the Sub's own reference", () => {
+    for (const p of NEEDS_SUB.reach) expect(pairs(engine, "reaches")).toContain(p);
+    const ev = engine.relation("reaches").out.get("reporterRole")!.get("customerData")!;
+    expect(ev.hops.at(-1)).toMatchObject({ to: "customerData", toAttr: "Arn", edge: "resource" });
+  });
+});
+
+describe("each capability on CloudFormation kinds", () => {
+  it("internet-facing, open-ingress and internet-reachable, the open group reached only through a launch template", () => {
+    expect(set(engine, "internet-facing")).toEqual(["adminBox", "webServer"]);
+    expect(set(engine, "open-ingress", [22])).toEqual(["webServer"]);
+    expect(set(engine, "internet-reachable")).toEqual(["reporter", "webServer"]);
+  });
+
+  it("network reads the standalone SecurityGroupIngress resource as well as inline rules", () => {
+    expect(pairs(engine, "network")).toEqual([
+      "adminBox customersDb",
+      "webServer adminBox",
+      "webServer worker",
+      "worker customersDb",
+    ]);
+  });
+
+  it("stores-data, holds-secret (by data-classification tag) and encrypted-at-rest", () => {
+    expect(set(engine, "stores-data")).toEqual(["assets", "customerData", "customersDb", "dbSecret", "ordersTable"]);
+    expect(set(engine, "holds-secret")).toEqual(["customerData", "customersDb", "dbSecret"]);
+    expect(set(engine, "encrypted-at-rest")).toEqual(["assets", "customerData", "customersDb", "dbSecret", "ordersTable"]);
+  });
+
+  it("runs-as, can-assume (by reference and by ARN naming a declared role) and grants", () => {
+    expect(pairs(engine, "runs-as")).toEqual([
+      "adminBox workerRole",
+      "batch batchRole",
+      "reporter reporterRole",
+      "webServer webRole",
+      "worker workerRole",
+    ]);
+    expect(pairs(engine, "can-assume")).toEqual(["batchRole auditRole", "webRole deployRole"]);
+    expect(pairs(engine, "grants", ["dynamodb:Scan"])).toEqual(["auditRole ordersTable"]);
+  });
+
+  it("attached-to-nothing and publicly-readable hold for nothing in the ledger, and for what a small graph declares", () => {
+    expect(set(engine, "attached-to-nothing")).toEqual([]);
+    expect(set(engine, "publicly-readable")).toEqual([]);
+    const g: GraphIR = {
+      nodes: [
+        { id: "sg", kind: "AWS::EC2::SecurityGroup", lexicon: "aws", attrs: {} },
+        { id: "open", kind: "AWS::S3::Bucket", lexicon: "aws", attrs: {} },
+        { id: "openPolicy", kind: "AWS::S3::BucketPolicy", lexicon: "aws", attrs: { Bucket: { $ref: "open" }, PolicyDocument: { Statement: [{ Effect: "Allow", Principal: "*", Action: "s3:GetObject" }] } } },
+        { id: "blocked", kind: "AWS::S3::Bucket", lexicon: "aws", attrs: { PublicAccessBlockConfiguration: { BlockPublicPolicy: true } } },
+        { id: "blockedPolicy", kind: "AWS::S3::BucketPolicy", lexicon: "aws", attrs: { Bucket: { $ref: "blocked" }, PolicyDocument: { Statement: [{ Effect: "Allow", Principal: { AWS: "*" }, Action: "s3:GetObject" }] } } },
+      ] as never,
+      edges: [
+        { from: "openPolicy", to: "open", viaAttr: "Bucket" },
+        { from: "blockedPolicy", to: "blocked", viaAttr: "Bucket" },
+      ] as never,
+      groups: {},
+    };
+    const e = engineFor(g);
+    expect(set(e, "attached-to-nothing")).toEqual(["sg"]);
+    expect(set(e, "publicly-readable")).toEqual(["open"]);
+  });
+
+  it("in-default-vpc reads a live VPC's IsDefault, through the instance's VpcId or its subnet", () => {
+    const g: GraphIR = {
+      nodes: [
+        { id: "east::vpc-default", kind: "AWS::EC2::VPC", lexicon: "aws", attrs: { IsDefault: true } },
+        { id: "east::vpc-main", kind: "AWS::EC2::VPC", lexicon: "aws", attrs: { IsDefault: false } },
+        { id: "east::subnet-a", kind: "AWS::EC2::Subnet", lexicon: "aws", attrs: {} },
+        { id: "east::i-old", kind: "AWS::EC2::Instance", lexicon: "aws", attrs: {} },
+        { id: "east::i-new", kind: "AWS::EC2::Instance", lexicon: "aws", attrs: {} },
+        { id: "east::i-sub", kind: "AWS::EC2::Instance", lexicon: "aws", attrs: {} },
+      ] as never,
+      edges: [
+        { from: "east::i-old", to: "east::vpc-default", viaAttr: "VpcId" },
+        { from: "east::i-new", to: "east::vpc-main", viaAttr: "VpcId" },
+        { from: "east::i-sub", to: "east::subnet-a", viaAttr: "SubnetId" },
+        { from: "east::subnet-a", to: "east::vpc-default", viaAttr: "VpcId" },
+      ] as never,
+      groups: {},
+    };
+    expect(set(engineFor(g), "in-default-vpc")).toEqual(["i-old", "i-sub", "subnet-a"]);
+  });
+
+  it("the aws mapping supplies every capability", () => {
+    for (const rule of shippedRules().rules.filter(isPublic)) {
+      expect(lexiconSupport(rule, awsCapabilityPack.mapping, "aws"), rule.name).toBe("supported");
+    }
+  });
+});
+
+describe("the effective-topology fold over the same graph", () => {
+  it("reads the standalone ingress resource too, naming its source group", () => {
+    const enriched = enrichEffectiveTopology(ir);
+    const attrs = (id: string) => enriched.nodes.find((n) => n.id === id)!.attrs as Record<string, unknown>;
+    expect(attrs("webServer").effectiveIngress).toEqual(["tcp:443:0.0.0.0/0", "tcp:22:0.0.0.0/0"]);
+    expect(attrs("webServer").internetFacing).toBe(true);
+    expect(attrs("webServer").internetFacingVia).toBe("publicRt → igw");
+    expect(attrs("worker").effectiveIngress).toEqual(["tcp:8080:sg:webSg"]);
+    expect(attrs("worker").internetFacing).toBe(false);
+  });
+});

package/src/components/capability-plugin.ts

@@ -11,7 +11,7 @@
 import type { Capability } from "@intentius/chant/components/capability";
 import { ownPackageVersion, type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
 
-import { publishImageCapability, loadImageOnHostCapability, publishArtifactCapability } from "./publish";
+import { ecrRegistryBackend, s3StorageBackend, loadImageOnHostCapability } from "./publish";
 import { extractConfigBomCapability } from "./config-bom";
 import {
   cfnDeployCapability,
@@ -30,7 +30,9 @@ import { snapshotBeforeCapability, rollbackPreviousCapability } from "./safety";
 export const AWS_VERB_FAMILIES = {
   // `extract-config-bom` parses a synthesized CloudFormation template (#684).
   sbom: ["extract-config-bom"],
-  publish: ["publish-image", "load-image-on-host", "publish-artifact"],
+  // `publish-image` is core's verb (#3142, #3143); aws contributes its ECR login as a registry backend.
+  // `publish-artifact` is core's verb (#4408); aws contributes S3 as a storage backend.
+  publish: ["load-image-on-host"],
   apply: ["cfn-deploy", "ecs-update-service", "lambda-deploy", "s3-sync", "cdn-invalidate", "run-migration"],
   jobSubmission: ["emr-start-job-run", "emr-submit-step"],
   hostDelivery: ["code-deploy", "copy-to-host", "remote-exec"],
@@ -42,9 +44,7 @@ export const AWS_VERB_FAMILIES = {
 function awsCapabilities(): Array<Capability<never, unknown>> {
   return [
     extractConfigBomCapability,
-    publishImageCapability,
     loadImageOnHostCapability,
-    publishArtifactCapability,
     cfnDeployCapability,
     ecsUpdateServiceCapability,
     lambdaDeployCapability,
@@ -75,5 +75,7 @@ export const awsCapabilityPlugin: CapabilityPlugin = {
     return ownPackageVersion(import.meta.url);
   },
   capabilities: awsCapabilities,
+  registryBackends: () => [ecrRegistryBackend],
+  storageBackends: () => [s3StorageBackend],
   families: () => AWS_VERB_FAMILIES,
 };