@intentius/chant-lexicon-aws 0.18.11 → 0.18.13

package/src/lint/post-synth/waw046.ts

@@ -0,0 +1,59 @@
+/**
+ * WAW046: ECS Secret-Looking Value In Plaintext Environment
+ *
+ * Flags ECS TaskDefinition container `Environment` entries whose name looks
+ * like a credential (password/secret/token/key/credential) — those values are
+ * visible in the task definition and console. They should be passed via
+ * `Secrets` (Secrets Manager / SSM Parameter Store) instead.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, getContainerDefinitions, isIntrinsic } from "./cf-refs";
+
+const SECRET_NAME_PATTERN = /password|secret|token|api[_-]?key|credential/i;
+
+export function checkEcsPlaintextSecrets(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ECS::TaskDefinition") continue;
+
+      for (const container of getContainerDefinitions(resource)) {
+        const env = container.Environment;
+        if (!Array.isArray(env)) continue;
+
+        for (const entry of env) {
+          if (typeof entry !== "object" || entry === null) continue;
+          const name = (entry as Record<string, unknown>).Name;
+          if (isIntrinsic(name) || typeof name !== "string") continue;
+
+          if (SECRET_NAME_PATTERN.test(name)) {
+            const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+            diagnostics.push({
+              checkId: "WAW046",
+              severity: "error",
+              message: `TaskDefinition "${logicalId}" container "${containerName}" passes "${name}" via plaintext Environment — use Secrets (Secrets Manager/SSM) instead`,
+              entity: logicalId,
+              lexicon: "aws",
+            });
+          }
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw046: PostSynthCheck = {
+  id: "WAW046",
+  description: "ECS container passes a secret-looking value via plaintext Environment instead of Secrets",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcsPlaintextSecrets(ctx);
+  },
+};

package/src/lint/post-synth/waw047.test.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw047, checkEcsPrivilegedContainer } from "./waw047";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW047: ECS Privileged Container", () => {
+  test("check metadata", () => {
+    expect(waw047.id).toBe("WAW047");
+    expect(waw047.description).toContain("privileged");
+  });
+
+  test("flags a container with Privileged: true", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [{ Name: "app", Privileged: true }],
+          },
+        },
+      },
+    });
+    const diags = checkEcsPrivilegedContainer(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW047");
+    expect(diags[0].message).toContain("app");
+  });
+
+  test("no diagnostic when Privileged is false or unset", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [{ Name: "app", Privileged: false }, { Name: "sidecar" }],
+          },
+        },
+      },
+    });
+    expect(checkEcsPrivilegedContainer(ctx)).toHaveLength(0);
+  });
+
+  test("skips intrinsic Privileged values", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: { ContainerDefinitions: [{ Name: "app", Privileged: { Ref: "PrivParam" } }] },
+        },
+      },
+    });
+    expect(checkEcsPrivilegedContainer(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for non-TaskDefinition resources", () => {
+    const ctx = makeCtx({
+      Resources: { MyBucket: { Type: "AWS::S3::Bucket", Properties: {} } },
+    });
+    expect(checkEcsPrivilegedContainer(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw047.ts

@@ -0,0 +1,50 @@
+/**
+ * WAW047: ECS Privileged Container
+ *
+ * Flags ECS TaskDefinition containers running with Privileged: true — the
+ * container gets elevated access to the host, equivalent to root on the EC2
+ * instance (and rejected outright on Fargate).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, getContainerDefinitions, isIntrinsic } from "./cf-refs";
+
+export function checkEcsPrivilegedContainer(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ECS::TaskDefinition") continue;
+
+      for (const container of getContainerDefinitions(resource)) {
+        const privileged = container.Privileged;
+        if (isIntrinsic(privileged)) continue;
+
+        if (privileged === true) {
+          const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+          diagnostics.push({
+            checkId: "WAW047",
+            severity: "error",
+            message: `TaskDefinition "${logicalId}" container "${containerName}" runs with Privileged: true — drop elevated host access`,
+            entity: logicalId,
+            lexicon: "aws",
+          });
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw047: PostSynthCheck = {
+  id: "WAW047",
+  description: "ECS container runs privileged — drop elevated host access",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcsPrivilegedContainer(ctx);
+  },
+};

package/src/lint/post-synth/waw048.test.ts

@@ -0,0 +1,77 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw048, checkEcsLogConfiguration } from "./waw048";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW048: ECS Missing Log Configuration", () => {
+  test("check metadata", () => {
+    expect(waw048.id).toBe("WAW048");
+    expect(waw048.description).toContain("LogConfiguration");
+  });
+
+  test("flags a container without LogConfiguration", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: { ContainerDefinitions: [{ Name: "app" }] },
+        },
+      },
+    });
+    const diags = checkEcsLogConfiguration(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW048");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("no diagnostic when LogConfiguration is present", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [
+              {
+                Name: "app",
+                LogConfiguration: {
+                  LogDriver: "awslogs",
+                  Options: { "awslogs-group": "/ecs/app", "awslogs-region": "us-east-1", "awslogs-stream-prefix": "app" },
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+    expect(checkEcsLogConfiguration(ctx)).toHaveLength(0);
+  });
+
+  test("flags each container in a multi-container task independently", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyTask: {
+          Type: "AWS::ECS::TaskDefinition",
+          Properties: {
+            ContainerDefinitions: [
+              { Name: "app", LogConfiguration: { LogDriver: "awslogs" } },
+              { Name: "sidecar" },
+            ],
+          },
+        },
+      },
+    });
+    const diags = checkEcsLogConfiguration(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("sidecar");
+  });
+
+  test("no diagnostic for non-TaskDefinition resources", () => {
+    const ctx = makeCtx({
+      Resources: { MyBucket: { Type: "AWS::S3::Bucket", Properties: {} } },
+    });
+    expect(checkEcsLogConfiguration(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw048.ts

@@ -0,0 +1,47 @@
+/**
+ * WAW048: ECS Missing Log Configuration
+ *
+ * Flags ECS TaskDefinition containers with no LogConfiguration — container
+ * stdout/stderr is discarded, leaving no audit trail. Mirrors WAW024 (ALB
+ * access logging): advisory, not a hard block.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, getContainerDefinitions } from "./cf-refs";
+
+export function checkEcsLogConfiguration(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ECS::TaskDefinition") continue;
+
+      for (const container of getContainerDefinitions(resource)) {
+        if (container.LogConfiguration === undefined) {
+          const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+          diagnostics.push({
+            checkId: "WAW048",
+            severity: "warning",
+            message: `TaskDefinition "${logicalId}" container "${containerName}" has no LogConfiguration — container output is discarded`,
+            entity: logicalId,
+            lexicon: "aws",
+          });
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw048: PostSynthCheck = {
+  id: "WAW048",
+  description: "ECS container does not have a LogConfiguration — enable logging for audit trails",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcsLogConfiguration(ctx);
+  },
+};

package/src/lint/post-synth/waw049.test.ts

@@ -0,0 +1,139 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw049, checkBroadIngress } from "./waw049";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW049: Security Group Broad Ingress (any port, except ALB:80/443)", () => {
+  test("check metadata", () => {
+    expect(waw049.id).toBe("WAW049");
+    expect(waw049.description).toContain("443");
+  });
+
+  test("flags 0.0.0.0/0 ingress on an arbitrary app port (8080)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: {
+            SecurityGroupIngress: [{ CidrIp: "0.0.0.0/0", IpProtocol: "tcp", FromPort: 8080, ToPort: 8080 }],
+          },
+        },
+      },
+    });
+    const diags = checkBroadIngress(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW049");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("allows 0.0.0.0/0 ingress on exactly port 443 (ALB exception)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: {
+            SecurityGroupIngress: [{ CidrIp: "0.0.0.0/0", IpProtocol: "tcp", FromPort: 443, ToPort: 443 }],
+          },
+        },
+      },
+    });
+    expect(checkBroadIngress(ctx)).toHaveLength(0);
+  });
+
+  test("allows 0.0.0.0/0 ingress on exactly port 80 (light-tier public HTTP ALB, #917)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: {
+            SecurityGroupIngress: [{ CidrIp: "0.0.0.0/0", IpProtocol: "tcp", FromPort: 80, ToPort: 80 }],
+          },
+        },
+      },
+    });
+    expect(checkBroadIngress(ctx)).toHaveLength(0);
+  });
+
+  test("still flags 0.0.0.0/0 on SSH (22) — generalizes beyond WAW019's named ports too", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: {
+            SecurityGroupIngress: [{ CidrIp: "0.0.0.0/0", IpProtocol: "tcp", FromPort: 22, ToPort: 22 }],
+          },
+        },
+      },
+    });
+    expect(checkBroadIngress(ctx)).toHaveLength(1);
+  });
+
+  test("flags a port range that includes but isn't exactly 443", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: {
+            SecurityGroupIngress: [{ CidrIp: "0.0.0.0/0", IpProtocol: "tcp", FromPort: 0, ToPort: 65535 }],
+          },
+        },
+      },
+    });
+    expect(checkBroadIngress(ctx)).toHaveLength(1);
+  });
+
+  test("flags a rule with no port range (all ports) as unrestricted", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: { SecurityGroupIngress: [{ CidrIp: "0.0.0.0/0", IpProtocol: "-1" }] },
+        },
+      },
+    });
+    expect(checkBroadIngress(ctx)).toHaveLength(1);
+  });
+
+  test("no diagnostic for a restricted CIDR", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: {
+            SecurityGroupIngress: [{ CidrIp: "10.0.0.0/16", IpProtocol: "tcp", FromPort: 8080, ToPort: 8080 }],
+          },
+        },
+      },
+    });
+    expect(checkBroadIngress(ctx)).toHaveLength(0);
+  });
+
+  test("checks standalone SecurityGroupIngress resources too", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyIngress: {
+          Type: "AWS::EC2::SecurityGroupIngress",
+          Properties: { GroupId: "sg-123", CidrIp: "0.0.0.0/0", FromPort: 3000, ToPort: 3000 },
+        },
+      },
+    });
+    expect(checkBroadIngress(ctx)).toHaveLength(1);
+  });
+
+  test("skips intrinsic port values (can't verify it's the 443 exception)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: {
+            SecurityGroupIngress: [{ CidrIp: "0.0.0.0/0", FromPort: { Ref: "PortParam" }, ToPort: { Ref: "PortParam" } }],
+          },
+        },
+      },
+    });
+    expect(checkBroadIngress(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw049.ts

@@ -0,0 +1,100 @@
+/**
+ * WAW049: Security Group Broad Ingress (any port, except ALB:80/443)
+ *
+ * Generalizes WAW019 beyond the four named sensitive ports (SSH/RDP/MySQL/
+ * Postgres): flags 0.0.0.0/0 or ::/0 ingress on *any* port, with a carve-out
+ * for the conventional public ALB listener ports (exactly 80 or 443).
+ *
+ * Port 80 is exempt unconditionally, not just on a relaxed tier (#917): a
+ * public ALB's HTTP listener is meant to be internet-facing on every tier —
+ * on the full/production tier it still needs an SG rule open to 0.0.0.0/0 so
+ * clients can reach the listener that redirects them to HTTPS (WAW044 is the
+ * rule that enforces the redirect actually happens; this rule only judges the
+ * SG's shape). The "light" tier serves plaintext HTTP straight off that same
+ * port instead of redirecting, which doesn't change the SG's exposure at all.
+ * A genuinely over-broad rule (all ports, SSH, etc.) still errors regardless
+ * of tier.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, getSecurityGroupIngress, isIntrinsic } from "./cf-refs";
+
+const OPEN_CIDRS = new Set(["0.0.0.0/0", "::/0"]);
+const ALB_LISTENER_PORTS = new Set([80, 443]);
+
+function isAlbListenerException(rule: Record<string, unknown>): boolean {
+  return (
+    typeof rule.FromPort === "number" &&
+    rule.FromPort === rule.ToPort &&
+    ALB_LISTENER_PORTS.has(rule.FromPort)
+  );
+}
+
+function checkIngressRule(
+  rule: Record<string, unknown>,
+  logicalId: string,
+  diagnostics: PostSynthDiagnostic[],
+): void {
+  const cidrIp = rule.CidrIp;
+  const cidrIpv6 = rule.CidrIpv6;
+
+  const hasOpenCidr =
+    (typeof cidrIp === "string" && OPEN_CIDRS.has(cidrIp)) ||
+    (typeof cidrIpv6 === "string" && OPEN_CIDRS.has(cidrIpv6));
+
+  if (!hasOpenCidr) return;
+
+  // Can't statically verify a port pinned by an intrinsic — don't guess.
+  if (isIntrinsic(rule.FromPort) || isIntrinsic(rule.ToPort)) return;
+
+  if (isAlbListenerException(rule)) return;
+
+  const cidr = typeof cidrIp === "string" && OPEN_CIDRS.has(cidrIp) ? cidrIp : cidrIpv6;
+  const fromPort = rule.FromPort;
+  const toPort = rule.ToPort;
+  const portDesc =
+    fromPort !== undefined && toPort !== undefined ? ` on ports ${fromPort}-${toPort}` : " on all ports";
+
+  diagnostics.push({
+    checkId: "WAW049",
+    severity: "error",
+    message: `Security group "${logicalId}" allows unrestricted ingress from ${cidr}${portDesc} — restrict to specific CIDR ranges (only ALB:80/443 is exempt)`,
+    entity: logicalId,
+    lexicon: "aws",
+  });
+}
+
+export function checkBroadIngress(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type === "AWS::EC2::SecurityGroup") {
+        for (const rule of getSecurityGroupIngress(resource)) {
+          checkIngressRule(rule, logicalId, diagnostics);
+        }
+      }
+
+      if (resource.Type === "AWS::EC2::SecurityGroupIngress") {
+        const props = resource.Properties ?? {};
+        if (!isIntrinsic(props)) {
+          checkIngressRule(props as Record<string, unknown>, logicalId, diagnostics);
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw049: PostSynthCheck = {
+  id: "WAW049",
+  description: "Security group allows unrestricted ingress on a port other than ALB:80/443",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkBroadIngress(ctx);
+  },
+};

package/src/lint/post-synth/waw050.test.ts

@@ -0,0 +1,75 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw050, checkCognitoAdvancedSecurity } from "./waw050";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW050: Cognito Advanced Security Disabled", () => {
+  test("check metadata", () => {
+    expect(waw050.id).toBe("WAW050");
+    expect(waw050.description).toContain("advanced security");
+  });
+
+  test("flags a pool with no UserPoolAddOns", () => {
+    const ctx = makeCtx({
+      Resources: { MyPool: { Type: "AWS::Cognito::UserPool", Properties: { UserPoolName: "app" } } },
+    });
+    const diags = checkCognitoAdvancedSecurity(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW050");
+  });
+
+  test("flags AdvancedSecurityMode: OFF", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyPool: {
+          Type: "AWS::Cognito::UserPool",
+          Properties: { UserPoolAddOns: { AdvancedSecurityMode: "OFF" } },
+        },
+      },
+    });
+    expect(checkCognitoAdvancedSecurity(ctx)).toHaveLength(1);
+  });
+
+  test("no diagnostic for AUDIT mode", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyPool: {
+          Type: "AWS::Cognito::UserPool",
+          Properties: { UserPoolAddOns: { AdvancedSecurityMode: "AUDIT" } },
+        },
+      },
+    });
+    expect(checkCognitoAdvancedSecurity(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for ENFORCED mode", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyPool: {
+          Type: "AWS::Cognito::UserPool",
+          Properties: { UserPoolAddOns: { AdvancedSecurityMode: "ENFORCED" } },
+        },
+      },
+    });
+    expect(checkCognitoAdvancedSecurity(ctx)).toHaveLength(0);
+  });
+
+  test("skips intrinsic UserPoolAddOns/AdvancedSecurityMode values", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyPool: { Type: "AWS::Cognito::UserPool", Properties: { UserPoolAddOns: { Ref: "AddOnsParam" } } },
+      },
+    });
+    expect(checkCognitoAdvancedSecurity(ctx)).toHaveLength(0);
+  });
+
+  test("no diagnostic for non-UserPool resources", () => {
+    const ctx = makeCtx({
+      Resources: { MyBucket: { Type: "AWS::S3::Bucket", Properties: {} } },
+    });
+    expect(checkCognitoAdvancedSecurity(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw050.ts

@@ -0,0 +1,54 @@
+/**
+ * WAW050: Cognito Advanced Security Disabled
+ *
+ * Flags Cognito UserPools without UserPoolAddOns.AdvancedSecurityMode set to
+ * AUDIT or ENFORCED — without it, Cognito does not evaluate risk (compromised
+ * credentials, adaptive auth) on sign-in/sign-up.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkCognitoAdvancedSecurity(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::Cognito::UserPool") continue;
+
+      const props = resource.Properties ?? {};
+      const addOns = props.UserPoolAddOns;
+
+      if (isIntrinsic(addOns)) continue;
+
+      const mode =
+        typeof addOns === "object" && addOns !== null ? (addOns as Record<string, unknown>).AdvancedSecurityMode : undefined;
+
+      if (isIntrinsic(mode)) continue;
+
+      if (mode !== "AUDIT" && mode !== "ENFORCED") {
+        diagnostics.push({
+          checkId: "WAW050",
+          severity: "error",
+          message: `Cognito UserPool "${logicalId}" does not have advanced security enabled — set UserPoolAddOns.AdvancedSecurityMode to AUDIT or ENFORCED`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw050: PostSynthCheck = {
+  id: "WAW050",
+  description: "Cognito UserPool does not have advanced security (risk-based auth) enabled",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkCognitoAdvancedSecurity(ctx);
+  },
+};