@intentius/chant-lexicon-aws 0.18.11 → 0.18.13

package/src/lint/post-synth/waw038.test.ts

@@ -0,0 +1,78 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw038, checkRdsPubliclyAccessible } from "./waw038";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW038: RDS Publicly Accessible", () => {
+  test("check metadata", () => {
+    expect(waw038.id).toBe("WAW038");
+    expect(waw038.description).toContain("publicly accessible");
+  });
+
+  test("flags DBInstance with PubliclyAccessible: true", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { DBInstanceClass: "db.t3.micro", PubliclyAccessible: true },
+        },
+      },
+    });
+    const diags = checkRdsPubliclyAccessible(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW038");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("MyDB");
+  });
+
+  test("no diagnostic when PubliclyAccessible: false", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { DBInstanceClass: "db.t3.micro", PubliclyAccessible: false },
+        },
+      },
+    });
+    expect(checkRdsPubliclyAccessible(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic when PubliclyAccessible is unset", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { DBInstanceClass: "db.t3.micro" },
+        },
+      },
+    });
+    expect(checkRdsPubliclyAccessible(ctx)).toHaveLength(0);
+  });
+
+  test("does not apply to DBCluster (no PubliclyAccessible property)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::RDS::DBCluster",
+          Properties: { Engine: "aurora-mysql" },
+        },
+      },
+    });
+    expect(checkRdsPubliclyAccessible(ctx)).toHaveLength(0);
+  });
+
+  test("skips intrinsic value for PubliclyAccessible", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { PubliclyAccessible: { Ref: "PublicParam" } },
+        },
+      },
+    });
+    expect(checkRdsPubliclyAccessible(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw038.ts

@@ -0,0 +1,50 @@
+/**
+ * WAW038: RDS Publicly Accessible
+ *
+ * Flags RDS instances with PubliclyAccessible: true — the instance gets a
+ * public IP/DNS name reachable from the internet instead of staying inside
+ * the VPC. (DBCluster has no PubliclyAccessible property; that's set on the
+ * member DBInstance.)
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkRdsPubliclyAccessible(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::RDS::DBInstance") continue;
+
+      const props = resource.Properties ?? {};
+      const publiclyAccessible = props.PubliclyAccessible;
+
+      if (isIntrinsic(publiclyAccessible)) continue;
+
+      if (publiclyAccessible === true) {
+        diagnostics.push({
+          checkId: "WAW038",
+          severity: "error",
+          message: `RDS instance "${logicalId}" has PubliclyAccessible: true — keep the database inside the VPC, unreachable from the internet`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw038: PostSynthCheck = {
+  id: "WAW038",
+  description: "RDS instance is publicly accessible — keep databases inside the VPC",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkRdsPubliclyAccessible(ctx);
+  },
+};

package/src/lint/post-synth/waw039.test.ts

@@ -0,0 +1,72 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw039, checkRdsBackupRetention } from "./waw039";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW039: RDS Backup Retention Not Set", () => {
+  test("check metadata", () => {
+    expect(waw039.id).toBe("WAW039");
+    expect(waw039.description).toContain("backups");
+  });
+
+  test("flags DBInstance with BackupRetentionPeriod: 0", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { DBInstanceClass: "db.t3.micro", BackupRetentionPeriod: 0 },
+        },
+      },
+    });
+    const diags = checkRdsBackupRetention(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW039");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("flags DBCluster missing BackupRetentionPeriod", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyCluster: {
+          Type: "AWS::RDS::DBCluster",
+          Properties: { Engine: "aurora-mysql" },
+        },
+      },
+    });
+    expect(checkRdsBackupRetention(ctx)).toHaveLength(1);
+  });
+
+  test("no diagnostic with a positive BackupRetentionPeriod", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { BackupRetentionPeriod: 7 },
+        },
+      },
+    });
+    expect(checkRdsBackupRetention(ctx)).toHaveLength(0);
+  });
+
+  test("skips intrinsic value for BackupRetentionPeriod", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { BackupRetentionPeriod: { Ref: "RetentionParam" } },
+        },
+      },
+    });
+    expect(checkRdsBackupRetention(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for non-RDS resources", () => {
+    const ctx = makeCtx({
+      Resources: { MyBucket: { Type: "AWS::S3::Bucket", Properties: {} } },
+    });
+    expect(checkRdsBackupRetention(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw039.ts

@@ -0,0 +1,51 @@
+/**
+ * WAW039: RDS Backup Retention Not Set
+ *
+ * Flags RDS instances and clusters without a positive BackupRetentionPeriod —
+ * a retention of 0 (or an unset property on a resource that otherwise pins
+ * every other property explicitly) disables automated backups entirely.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+const RDS_TYPES = new Set(["AWS::RDS::DBInstance", "AWS::RDS::DBCluster"]);
+
+export function checkRdsBackupRetention(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (!RDS_TYPES.has(resource.Type)) continue;
+
+      const props = resource.Properties ?? {};
+      const retention = props.BackupRetentionPeriod;
+
+      if (isIntrinsic(retention)) continue;
+
+      if (retention === undefined || retention === 0) {
+        diagnostics.push({
+          checkId: "WAW039",
+          severity: "error",
+          message: `RDS resource "${logicalId}" (${resource.Type}) does not have a positive BackupRetentionPeriod — automated backups are disabled`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw039: PostSynthCheck = {
+  id: "WAW039",
+  description: "RDS instance or cluster has automated backups disabled — set a positive BackupRetentionPeriod",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkRdsBackupRetention(ctx);
+  },
+};

package/src/lint/post-synth/waw040.test.ts

@@ -0,0 +1,71 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw040, checkRdsDeletionProtection } from "./waw040";
+
+function makeCtx(template: object, env?: string) {
+  return { ...createPostSynthContext({ aws: template }), env };
+}
+
+describe("WAW040: RDS Deletion Protection Disabled (full tier)", () => {
+  test("check metadata", () => {
+    expect(waw040.id).toBe("WAW040");
+    expect(waw040.description).toContain("DeletionProtection");
+  });
+
+  const template = {
+    Resources: {
+      MyDB: {
+        Type: "AWS::RDS::DBInstance",
+        Properties: { DBInstanceClass: "db.t3.micro" },
+      },
+    },
+  };
+
+  test("warns (not errors) on the light tier — no env set", () => {
+    const diags = checkRdsDeletionProtection(makeCtx(template));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW040");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("warns on a non-production env", () => {
+    const diags = checkRdsDeletionProtection(makeCtx(template, "dev"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("errors on the full/production tier", () => {
+    const diags = checkRdsDeletionProtection(makeCtx(template, "prod"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("errors on env: full", () => {
+    const diags = checkRdsDeletionProtection(makeCtx(template, "full"));
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("no diagnostic when DeletionProtection: true, even in prod", () => {
+    const protectedTemplate = {
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { DeletionProtection: true },
+        },
+      },
+    };
+    expect(checkRdsDeletionProtection(makeCtx(protectedTemplate, "prod"))).toHaveLength(0);
+  });
+
+  test("skips intrinsic value for DeletionProtection", () => {
+    const paramTemplate = {
+      Resources: {
+        MyDB: {
+          Type: "AWS::RDS::DBInstance",
+          Properties: { DeletionProtection: { Ref: "ProtectParam" } },
+        },
+      },
+    };
+    expect(checkRdsDeletionProtection(makeCtx(paramTemplate, "prod"))).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw040.ts

@@ -0,0 +1,54 @@
+/**
+ * WAW040: RDS Deletion Protection Disabled (full tier)
+ *
+ * Flags RDS instances and clusters without DeletionProtection: true. Tier-aware
+ * (#894): a relaxed "light" stack (local/Floci, or no --env/ownership.env set)
+ * only warns, since local/dev databases are routinely torn down on purpose; the
+ * strict "full"/production tier (ctx.env === "prod"/"production"/"full", the
+ * existing #201 env seam — see isFullTierEnv) fails the build.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic, isFullTierEnv } from "./cf-refs";
+
+const RDS_TYPES = new Set(["AWS::RDS::DBInstance", "AWS::RDS::DBCluster"]);
+
+export function checkRdsDeletionProtection(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+  const severity = isFullTierEnv(ctx.env) ? "error" : "warning";
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (!RDS_TYPES.has(resource.Type)) continue;
+
+      const props = resource.Properties ?? {};
+      const deletionProtection = props.DeletionProtection;
+
+      if (isIntrinsic(deletionProtection)) continue;
+
+      if (deletionProtection !== true) {
+        diagnostics.push({
+          checkId: "WAW040",
+          severity,
+          message: `RDS resource "${logicalId}" (${resource.Type}) does not have DeletionProtection: true — enable it on the full/production tier`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw040: PostSynthCheck = {
+  id: "WAW040",
+  description: "RDS instance or cluster does not have DeletionProtection enabled (full tier)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkRdsDeletionProtection(ctx);
+  },
+};

package/src/lint/post-synth/waw041.test.ts

@@ -0,0 +1,72 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw041, checkDbProxyTls } from "./waw041";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW041: RDS Proxy TLS Not Required", () => {
+  test("check metadata", () => {
+    expect(waw041.id).toBe("WAW041");
+    expect(waw041.description).toContain("TLS");
+  });
+
+  test("flags DBProxy missing RequireTLS", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyProxy: {
+          Type: "AWS::RDS::DBProxy",
+          Properties: { DBProxyName: "my-proxy" },
+        },
+      },
+    });
+    const diags = checkDbProxyTls(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW041");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("flags DBProxy with RequireTLS: false", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyProxy: {
+          Type: "AWS::RDS::DBProxy",
+          Properties: { RequireTLS: false },
+        },
+      },
+    });
+    expect(checkDbProxyTls(ctx)).toHaveLength(1);
+  });
+
+  test("no diagnostic when RequireTLS: true", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyProxy: {
+          Type: "AWS::RDS::DBProxy",
+          Properties: { RequireTLS: true },
+        },
+      },
+    });
+    expect(checkDbProxyTls(ctx)).toHaveLength(0);
+  });
+
+  test("skips intrinsic value for RequireTLS", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyProxy: {
+          Type: "AWS::RDS::DBProxy",
+          Properties: { RequireTLS: { Ref: "TlsParam" } },
+        },
+      },
+    });
+    expect(checkDbProxyTls(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for non-DBProxy resources", () => {
+    const ctx = makeCtx({
+      Resources: { MyDB: { Type: "AWS::RDS::DBInstance", Properties: {} } },
+    });
+    expect(checkDbProxyTls(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw041.ts

@@ -0,0 +1,48 @@
+/**
+ * WAW041: RDS Proxy TLS Not Required
+ *
+ * Flags RDS Proxy resources without RequireTLS: true — without it, a client
+ * can connect to the proxy over plaintext.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkDbProxyTls(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::RDS::DBProxy") continue;
+
+      const props = resource.Properties ?? {};
+      const requireTls = props.RequireTLS;
+
+      if (isIntrinsic(requireTls)) continue;
+
+      if (requireTls !== true) {
+        diagnostics.push({
+          checkId: "WAW041",
+          severity: "error",
+          message: `RDS Proxy "${logicalId}" does not have RequireTLS: true — clients can connect over plaintext`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw041: PostSynthCheck = {
+  id: "WAW041",
+  description: "RDS Proxy does not require TLS for client connections",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkDbProxyTls(ctx);
+  },
+};

package/src/lint/post-synth/waw042.test.ts

@@ -0,0 +1,138 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw042, checkS3TlsOnlyPolicy } from "./waw042";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+const secureTransportDeny = {
+  Effect: "Deny",
+  Principal: "*",
+  Action: "s3:*",
+  Condition: { Bool: { "aws:SecureTransport": "false" } },
+};
+
+describe("WAW042: S3 Bucket Missing TLS-Only Policy", () => {
+  test("check metadata", () => {
+    expect(waw042.id).toBe("WAW042");
+    expect(waw042.description).toContain("TLS");
+  });
+
+  test("flags a bucket with no BucketPolicy at all", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+      },
+    });
+    const diags = checkS3TlsOnlyPolicy(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW042");
+    expect(diags[0].entity).toBe("MyBucket");
+  });
+
+  test("flags a bucket whose BucketPolicy has no SecureTransport deny", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+        MyBucketPolicy: {
+          Type: "AWS::S3::BucketPolicy",
+          Properties: {
+            Bucket: { Ref: "MyBucket" },
+            PolicyDocument: {
+              Statement: [{ Effect: "Allow", Principal: "*", Action: "s3:GetObject" }],
+            },
+          },
+        },
+      },
+    });
+    expect(checkS3TlsOnlyPolicy(ctx)).toHaveLength(1);
+  });
+
+  test("no diagnostic when the BucketPolicy denies non-TLS requests (Ref)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+        MyBucketPolicy: {
+          Type: "AWS::S3::BucketPolicy",
+          Properties: {
+            Bucket: { Ref: "MyBucket" },
+            PolicyDocument: { Statement: [secureTransportDeny] },
+          },
+        },
+      },
+    });
+    expect(checkS3TlsOnlyPolicy(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic when the BucketPolicy targets the bucket via Fn::GetAtt", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+        MyBucketPolicy: {
+          Type: "AWS::S3::BucketPolicy",
+          Properties: {
+            Bucket: { "Fn::GetAtt": ["MyBucket", "Arn"] },
+            PolicyDocument: { Statement: [secureTransportDeny] },
+          },
+        },
+      },
+    });
+    expect(checkS3TlsOnlyPolicy(ctx)).toHaveLength(0);
+  });
+
+  test("a boolean (non-string) SecureTransport condition also satisfies the check", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+        MyBucketPolicy: {
+          Type: "AWS::S3::BucketPolicy",
+          Properties: {
+            Bucket: { Ref: "MyBucket" },
+            PolicyDocument: {
+              Statement: [{ Effect: "Deny", Condition: { Bool: { "aws:SecureTransport": false } } }],
+            },
+          },
+        },
+      },
+    });
+    expect(checkS3TlsOnlyPolicy(ctx)).toHaveLength(0);
+  });
+
+  test("does not credit an Allow statement's SecureTransport condition", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+        MyBucketPolicy: {
+          Type: "AWS::S3::BucketPolicy",
+          Properties: {
+            Bucket: { Ref: "MyBucket" },
+            PolicyDocument: {
+              Statement: [{ Effect: "Allow", Condition: { Bool: { "aws:SecureTransport": "false" } } }],
+            },
+          },
+        },
+      },
+    });
+    expect(checkS3TlsOnlyPolicy(ctx)).toHaveLength(1);
+  });
+
+  test("a policy covering a different bucket does not clear this one", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+        OtherBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+        OtherBucketPolicy: {
+          Type: "AWS::S3::BucketPolicy",
+          Properties: {
+            Bucket: { Ref: "OtherBucket" },
+            PolicyDocument: { Statement: [secureTransportDeny] },
+          },
+        },
+      },
+    });
+    const diags = checkS3TlsOnlyPolicy(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("MyBucket");
+  });
+});