@intentius/chant-lexicon-aws 0.18.11 → 0.18.13

package/src/lint/post-synth/waw042.ts

@@ -0,0 +1,87 @@
+/**
+ * WAW042: S3 Bucket Missing TLS-Only Policy
+ *
+ * Flags S3 buckets without a companion BucketPolicy that denies requests made
+ * over plaintext (a Deny statement keyed on `aws:SecureTransport` being
+ * false). Encryption at rest is WAW006; the public-access block is WAW018;
+ * this covers encryption in transit.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFResource } from "./cf-refs";
+
+function statementDeniesInsecureTransport(stmt: Record<string, unknown>): boolean {
+  if (stmt.Effect !== "Deny") return false;
+
+  const condition = stmt.Condition;
+  if (typeof condition !== "object" || condition === null) return false;
+
+  const cond = condition as Record<string, unknown>;
+  for (const operator of ["Bool", "NumericLessThan"]) {
+    const clause = cond[operator];
+    if (typeof clause !== "object" || clause === null) continue;
+    const value = (clause as Record<string, unknown>)["aws:SecureTransport"];
+    if (value === "false" || value === false) return true;
+  }
+  return false;
+}
+
+/** Logical ids of every bucket a BucketPolicy's `Bucket` property resolves to. */
+function bucketPolicyTargets(resource: CFResource): Set<string> {
+  const props = resource.Properties ?? {};
+  return findResourceRefs(props.Bucket);
+}
+
+export function checkS3TlsOnlyPolicy(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    const bucketsWithTlsPolicy = new Set<string>();
+
+    for (const resource of Object.values(template.Resources)) {
+      if (resource.Type !== "AWS::S3::BucketPolicy") continue;
+
+      const props = resource.Properties ?? {};
+      const policyDoc = props.PolicyDocument;
+      if (typeof policyDoc !== "object" || policyDoc === null) continue;
+      const statements = (policyDoc as Record<string, unknown>).Statement;
+      if (!Array.isArray(statements)) continue;
+
+      const hasTlsDeny = statements.some(
+        (stmt) => typeof stmt === "object" && stmt !== null && statementDeniesInsecureTransport(stmt as Record<string, unknown>),
+      );
+      if (!hasTlsDeny) continue;
+
+      for (const bucketId of bucketPolicyTargets(resource)) {
+        bucketsWithTlsPolicy.add(bucketId);
+      }
+    }
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::S3::Bucket") continue;
+      if (bucketsWithTlsPolicy.has(logicalId)) continue;
+
+      diagnostics.push({
+        checkId: "WAW042",
+        severity: "error",
+        message: `S3 bucket "${logicalId}" has no bucket policy denying non-TLS requests — add a Deny statement on aws:SecureTransport = false`,
+        entity: logicalId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw042: PostSynthCheck = {
+  id: "WAW042",
+  description: "S3 bucket missing a TLS-only bucket policy — deny requests over plaintext",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkS3TlsOnlyPolicy(ctx);
+  },
+};

package/src/lint/post-synth/waw043.test.ts

@@ -0,0 +1,84 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw043, checkKmsKeyRotation } from "./waw043";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW043: KMS Key Rotation Disabled", () => {
+  test("check metadata", () => {
+    expect(waw043.id).toBe("WAW043");
+    expect(waw043.description).toContain("rotation");
+  });
+
+  test("flags a key missing EnableKeyRotation", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyKey: { Type: "AWS::KMS::Key", Properties: { Description: "app key" } },
+      },
+    });
+    const diags = checkKmsKeyRotation(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW043");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("flags a key with EnableKeyRotation: false", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyKey: { Type: "AWS::KMS::Key", Properties: { EnableKeyRotation: false } },
+      },
+    });
+    expect(checkKmsKeyRotation(ctx)).toHaveLength(1);
+  });
+
+  test("no diagnostic when EnableKeyRotation: true", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyKey: { Type: "AWS::KMS::Key", Properties: { EnableKeyRotation: true } },
+      },
+    });
+    expect(checkKmsKeyRotation(ctx)).toHaveLength(0);
+  });
+
+  test("skips asymmetric keys (non-default KeySpec) even without rotation", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyKey: {
+          Type: "AWS::KMS::Key",
+          Properties: { KeySpec: "RSA_2048", KeyUsage: "SIGN_VERIFY" },
+        },
+      },
+    });
+    expect(checkKmsKeyRotation(ctx)).toHaveLength(0);
+  });
+
+  test("still flags an explicit SYMMETRIC_DEFAULT KeySpec without rotation", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyKey: {
+          Type: "AWS::KMS::Key",
+          Properties: { KeySpec: "SYMMETRIC_DEFAULT" },
+        },
+      },
+    });
+    expect(checkKmsKeyRotation(ctx)).toHaveLength(1);
+  });
+
+  test("skips intrinsic value for EnableKeyRotation", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyKey: { Type: "AWS::KMS::Key", Properties: { EnableKeyRotation: { Ref: "RotateParam" } } },
+      },
+    });
+    expect(checkKmsKeyRotation(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for non-KMS resources", () => {
+    const ctx = makeCtx({
+      Resources: { MyBucket: { Type: "AWS::S3::Bucket", Properties: {} } },
+    });
+    expect(checkKmsKeyRotation(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw043.ts

@@ -0,0 +1,57 @@
+/**
+ * WAW043: KMS Key Rotation Disabled
+ *
+ * Flags customer-managed KMS keys without EnableKeyRotation: true. Skips
+ * asymmetric/HMAC keys (a non-default KeySpec) — AWS does not support
+ * automatic rotation for those.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+function supportsRotation(props: Record<string, unknown>): boolean {
+  const keySpec = props.KeySpec;
+  if (keySpec === undefined) return true; // default is SYMMETRIC_DEFAULT
+  if (isIntrinsic(keySpec)) return false; // can't statically verify — don't guess
+  return keySpec === "SYMMETRIC_DEFAULT";
+}
+
+export function checkKmsKeyRotation(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::KMS::Key") continue;
+
+      const props = resource.Properties ?? {};
+      if (!supportsRotation(props)) continue;
+
+      const rotation = props.EnableKeyRotation;
+      if (isIntrinsic(rotation)) continue;
+
+      if (rotation !== true) {
+        diagnostics.push({
+          checkId: "WAW043",
+          severity: "warning",
+          message: `KMS key "${logicalId}" does not have EnableKeyRotation: true — enable automatic annual key rotation`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw043: PostSynthCheck = {
+  id: "WAW043",
+  description: "KMS customer-managed key does not have automatic key rotation enabled",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkKmsKeyRotation(ctx);
+  },
+};

package/src/lint/post-synth/waw044.test.ts

@@ -0,0 +1,112 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw044, checkAlbHttpRedirect } from "./waw044";
+
+function makeCtx(template: object, env?: string) {
+  return { ...createPostSynthContext({ aws: template }), env };
+}
+
+describe("WAW044: ALB HTTP Listener Not Redirecting To HTTPS (full tier)", () => {
+  test("check metadata", () => {
+    expect(waw044.id).toBe("WAW044");
+    expect(waw044.description).toContain("HTTPS");
+  });
+
+  const template = {
+    Resources: {
+      HttpListener: {
+        Type: "AWS::ElasticLoadBalancingV2::Listener",
+        Properties: {
+          Protocol: "HTTP",
+          Port: 80,
+          DefaultActions: [{ Type: "forward", TargetGroupArn: "arn:aws:...:tg" }],
+        },
+      },
+    },
+  };
+
+  test("warns (not errors) on the light tier — no env set", () => {
+    const diags = checkAlbHttpRedirect(makeCtx(template));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW044");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("warns on a non-production env", () => {
+    const diags = checkAlbHttpRedirect(makeCtx(template, "dev"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("errors on the full/production tier", () => {
+    const diags = checkAlbHttpRedirect(makeCtx(template, "prod"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("errors on env: production", () => {
+    const diags = checkAlbHttpRedirect(makeCtx(template, "production"));
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("errors on env: full", () => {
+    const diags = checkAlbHttpRedirect(makeCtx(template, "full"));
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("no diagnostic when the HTTP listener redirects to HTTPS, even in prod", () => {
+    const ctx = makeCtx(
+      {
+        Resources: {
+          HttpListener: {
+            Type: "AWS::ElasticLoadBalancingV2::Listener",
+            Properties: {
+              Protocol: "HTTP",
+              Port: 80,
+              DefaultActions: [
+                { Type: "redirect", RedirectConfig: { Protocol: "HTTPS", Port: "443", StatusCode: "HTTP_301" } },
+              ],
+            },
+          },
+        },
+      },
+      "prod",
+    );
+    expect(checkAlbHttpRedirect(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for an HTTPS listener", () => {
+    const ctx = makeCtx({
+      Resources: {
+        HttpsListener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: {
+            Protocol: "HTTPS",
+            Port: 443,
+            DefaultActions: [{ Type: "forward", TargetGroupArn: "arn:aws:...:tg" }],
+          },
+        },
+      },
+    });
+    expect(checkAlbHttpRedirect(ctx)).toHaveLength(0);
+  });
+
+  test("skips intrinsic Protocol values", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Listener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: { Protocol: { Ref: "ProtocolParam" }, DefaultActions: [] },
+        },
+      },
+    });
+    expect(checkAlbHttpRedirect(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for non-Listener resources", () => {
+    const ctx = makeCtx({
+      Resources: { MyLb: { Type: "AWS::ElasticLoadBalancingV2::LoadBalancer", Properties: {} } },
+    });
+    expect(checkAlbHttpRedirect(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw044.ts

@@ -0,0 +1,68 @@
+/**
+ * WAW044: ALB HTTP Listener Not Redirecting To HTTPS (full tier)
+ *
+ * Flags load balancer Listener resources on Protocol: HTTP whose
+ * DefaultActions don't redirect to HTTPS — the listener serves plaintext
+ * traffic instead of upgrading it. Access logging is WAW024; this covers
+ * transport security on the listener itself.
+ *
+ * Tier-aware (#917), same seam as WAW040/WAW052 (#894): a relaxed "light"
+ * stack (local/Floci, or no --env/ownership.env set) only warns, since the
+ * light tier is intentionally HTTP-only with no ACM cert to redirect to; the
+ * strict "full"/production tier (ctx.env === "prod"/"production"/"full", the
+ * existing #201 env seam — see isFullTierEnv) fails the build.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic, isFullTierEnv } from "./cf-refs";
+
+function redirectsToHttps(actions: unknown): boolean {
+  if (!Array.isArray(actions)) return false;
+  return actions.some((action) => {
+    if (typeof action !== "object" || action === null) return false;
+    const a = action as Record<string, unknown>;
+    if (a.Type !== "redirect") return false;
+    const redirectConfig = a.RedirectConfig;
+    if (typeof redirectConfig !== "object" || redirectConfig === null) return false;
+    return (redirectConfig as Record<string, unknown>).Protocol === "HTTPS";
+  });
+}
+
+export function checkAlbHttpRedirect(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+  const severity = isFullTierEnv(ctx.env) ? "error" : "warning";
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ElasticLoadBalancingV2::Listener") continue;
+
+      const props = resource.Properties ?? {};
+      const protocol = props.Protocol;
+      if (isIntrinsic(protocol) || protocol !== "HTTP") continue;
+
+      if (!redirectsToHttps(props.DefaultActions)) {
+        diagnostics.push({
+          checkId: "WAW044",
+          severity,
+          message: `Listener "${logicalId}" is HTTP and does not redirect to HTTPS — add a redirect DefaultAction (Protocol: HTTPS) on the full/production tier`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw044: PostSynthCheck = {
+  id: "WAW044",
+  description: "ALB HTTP listener does not redirect to HTTPS (full tier)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkAlbHttpRedirect(ctx);
+  },
+};

package/src/lint/post-synth/waw045.test.ts

@@ -0,0 +1,101 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw045, checkAlbTlsPolicy } from "./waw045";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW045: ALB Weak Or Missing TLS Policy", () => {
+  test("check metadata", () => {
+    expect(waw045.id).toBe("WAW045");
+    expect(waw045.description).toContain("TLS");
+  });
+
+  test("flags an HTTPS listener with no SslPolicy", () => {
+    const ctx = makeCtx({
+      Resources: {
+        HttpsListener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: { Protocol: "HTTPS", Port: 443 },
+        },
+      },
+    });
+    const diags = checkAlbTlsPolicy(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW045");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("flags a legacy SslPolicy (TLS 1.0 default)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        HttpsListener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: { Protocol: "HTTPS", SslPolicy: "ELBSecurityPolicy-2016-08" },
+        },
+      },
+    });
+    expect(checkAlbTlsPolicy(ctx)).toHaveLength(1);
+  });
+
+  test("flags an explicit TLS 1.1 policy", () => {
+    const ctx = makeCtx({
+      Resources: {
+        HttpsListener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: { Protocol: "HTTPS", SslPolicy: "ELBSecurityPolicy-TLS-1-1-2017-01" },
+        },
+      },
+    });
+    expect(checkAlbTlsPolicy(ctx)).toHaveLength(1);
+  });
+
+  test("no diagnostic for a modern TLS 1.2 policy", () => {
+    const ctx = makeCtx({
+      Resources: {
+        HttpsListener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: { Protocol: "HTTPS", SslPolicy: "ELBSecurityPolicy-TLS-1-2-2017-01" },
+        },
+      },
+    });
+    expect(checkAlbTlsPolicy(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for a modern TLS13 policy on a TLS (NLB) listener", () => {
+    const ctx = makeCtx({
+      Resources: {
+        TlsListener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: { Protocol: "TLS", SslPolicy: "ELBSecurityPolicy-TLS13-1-2-2021-06" },
+        },
+      },
+    });
+    expect(checkAlbTlsPolicy(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for a plain HTTP listener (not in scope)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        HttpListener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: { Protocol: "HTTP" },
+        },
+      },
+    });
+    expect(checkAlbTlsPolicy(ctx)).toHaveLength(0);
+  });
+
+  test("skips intrinsic SslPolicy values", () => {
+    const ctx = makeCtx({
+      Resources: {
+        HttpsListener: {
+          Type: "AWS::ElasticLoadBalancingV2::Listener",
+          Properties: { Protocol: "HTTPS", SslPolicy: { Ref: "PolicyParam" } },
+        },
+      },
+    });
+    expect(checkAlbTlsPolicy(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw045.ts

@@ -0,0 +1,58 @@
+/**
+ * WAW045: ALB Weak Or Missing TLS Policy
+ *
+ * Flags HTTPS/TLS listeners without a modern SslPolicy (TLS 1.2+). The
+ * account-wide default (`ELBSecurityPolicy-2016-08`) still allows TLS 1.0, so
+ * a missing SslPolicy is flagged the same as an explicit legacy one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+const SECURE_PROTOCOLS = new Set(["HTTPS", "TLS"]);
+
+/** AWS's predefined TLS 1.2+ policies all carry a "-1-2-" or "-1-3-" segment (FS/TLS13 variants included). */
+function isModernTlsPolicy(policy: string): boolean {
+  return /-1-2-|-1-3-/.test(policy);
+}
+
+export function checkAlbTlsPolicy(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ElasticLoadBalancingV2::Listener") continue;
+
+      const props = resource.Properties ?? {};
+      const protocol = props.Protocol;
+      if (isIntrinsic(protocol) || typeof protocol !== "string" || !SECURE_PROTOCOLS.has(protocol)) continue;
+
+      const sslPolicy = props.SslPolicy;
+      if (isIntrinsic(sslPolicy)) continue;
+
+      if (typeof sslPolicy !== "string" || !isModernTlsPolicy(sslPolicy)) {
+        diagnostics.push({
+          checkId: "WAW045",
+          severity: "error",
+          message: `Listener "${logicalId}" (${protocol}) ${sslPolicy ? `uses SslPolicy "${sslPolicy}"` : "has no SslPolicy set"} — use a TLS 1.2+ predefined policy (e.g. ELBSecurityPolicy-TLS13-1-2-2021-06)`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw045: PostSynthCheck = {
+  id: "WAW045",
+  description: "ALB HTTPS/TLS listener does not use a modern (TLS 1.2+) SslPolicy",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkAlbTlsPolicy(ctx);
+  },
+};

package/src/lint/post-synth/waw046.test.ts

@@ -0,0 +1,112 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw046, checkEcsPlaintextSecrets } from "./waw046";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW046: ECS Secret-Looking Value In Plaintext Environment", () => {
+  test("check metadata", () => {
+    expect(waw046.id).toBe("WAW046");
+    expect(waw046.description).toContain("Secrets");
+  });
+
+  test("flags a DB_PASSWORD environment variable", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [
+              { Name: "app", Environment: [{ Name: "DB_PASSWORD", Value: "hunter2" }] },
+            ],
+          },
+        },
+      },
+    });
+    const diags = checkEcsPlaintextSecrets(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW046");
+    expect(diags[0].message).toContain("DB_PASSWORD");
+  });
+
+  test("flags API_KEY, TOKEN, and CREDENTIAL variants", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [
+              {
+                Name: "app",
+                Environment: [
+                  { Name: "STRIPE_API_KEY", Value: "sk_live_x" },
+                  { Name: "AUTH_TOKEN", Value: "x" },
+                  { Name: "AWS_CREDENTIAL_BLOB", Value: "x" },
+                ],
+              },
+            ],
+          },
+        },
+      },
+    });
+    expect(checkEcsPlaintextSecrets(ctx)).toHaveLength(3);
+  });
+
+  test("no diagnostic for non-secret-looking environment names", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [
+              { Name: "app", Environment: [{ Name: "LOG_LEVEL", Value: "info" }] },
+            ],
+          },
+        },
+      },
+    });
+    expect(checkEcsPlaintextSecrets(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic when the secret is passed via Secrets instead", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [
+              {
+                Name: "app",
+                Secrets: [{ Name: "DB_PASSWORD", ValueFrom: "arn:aws:secretsmanager:...:secret:db-pw" }],
+              },
+            ],
+          },
+        },
+      },
+    });
+    expect(checkEcsPlaintextSecrets(ctx)).toHaveLength(0);
+  });
+
+  test("skips intrinsic Name values", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [{ Name: "app", Environment: [{ Name: { Ref: "NameParam" }, Value: "x" }] }],
+          },
+        },
+      },
+    });
+    expect(checkEcsPlaintextSecrets(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for non-TaskDefinition resources", () => {
+    const ctx = makeCtx({
+      Resources: { MyBucket: { Type: "AWS::S3::Bucket", Properties: {} } },
+    });
+    expect(checkEcsPlaintextSecrets(ctx)).toHaveLength(0);
+  });
+});