@intentius/chant-lexicon-aws 0.18.12 → 0.18.13

package/dist/lint/post-synth/waw051.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW051: Cognito Implicit OAuth Grant Allowed
+ *
+ * Flags UserPoolClients whose AllowedOAuthFlows include the deprecated
+ * "implicit" grant — it returns tokens directly in the redirect URL (exposed
+ * in browser history/referrer headers) instead of via a code exchange.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkCognitoImplicitGrant(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw051: PostSynthCheck;
+//# sourceMappingURL=waw051.d.ts.map

package/dist/lint/post-synth/waw051.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw051.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw051.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4BtF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw052.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WAW052: Cognito MFA Not Required (full tier)
+ *
+ * Flags UserPools without MfaConfiguration: ON. Tier-aware (#894), same
+ * seam as WAW040: a relaxed "light" stack (local/Floci, or no --env/
+ * ownership.env set) only warns; the strict "full"/production tier
+ * (ctx.env === "prod"/"production"/"full") fails the build.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkCognitoMfaRequired(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw052: PostSynthCheck;
+//# sourceMappingURL=waw052.d.ts.map

package/dist/lint/post-synth/waw052.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw052.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw052.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA6BpF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw053.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WAW053: ECR Image Scanning Disabled
+ *
+ * Flags ECR repositories without ImageScanningConfiguration.ScanOnPush: true
+ * — pushed images aren't scanned for known CVEs.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkEcrScanOnPush(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw053: PostSynthCheck;
+//# sourceMappingURL=waw053.d.ts.map

package/dist/lint/post-synth/waw053.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw053.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw053.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAiC/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw054.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW054: ECR Tag Mutability Not Immutable
+ *
+ * Flags ECR repositories without ImageTagMutability: IMMUTABLE — mutable tags
+ * let a previously deployed/scanned/signed tag (e.g. "prod") silently point at
+ * different image content later.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkEcrTagImmutability(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw054: PostSynthCheck;
+//# sourceMappingURL=waw054.d.ts.map

package/dist/lint/post-synth/waw054.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw054.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw054.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4BpF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw055.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW055: CloudWatch Logs Retention Not Set
+ *
+ * Flags Logs::LogGroup resources without RetentionInDays — an unset
+ * retention means "Never expire," which is rarely the intended cost/
+ * compliance posture.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkLogsRetention(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw055: PostSynthCheck;
+//# sourceMappingURL=waw055.d.ts.map

package/dist/lint/post-synth/waw055.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw055.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw055.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4B/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.18.12",
+  "version": "0.18.13",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/op/activities/floci.d.ts

@@ -1,3 +1,4 @@
+import { type EmulatorSpec, type EmulatorCapability } from "@intentius/chant/op";
 export interface FlociUpArgs {
     /** Container name. Default: `chant-floci`. */
     name?: string;
@@ -24,6 +25,11 @@ export interface FlociDownArgs {
 export declare function isFlociReady(healthBody: string, service: string): boolean;
 /** The AWS env vars that point the `aws` CLI / SDK at a local Floci endpoint. */
 export declare function flociEnv(port: number, region: string): Record<string, string>;
+/** The Floci emulator spec — the aws plugin's `emulator` capability (#920). */
+export declare const FLOCI_SPEC: EmulatorSpec;
+/** The aws plugin's emulator capability (#920): Floci + the AWS env that points
+ * the SDK / `chant graph --live` / a triggered Op at it. */
+export declare const FLOCI_EMULATOR: EmulatorCapability;
 export declare const flociExistsCommand: (name: string) => string;
 export declare const flociRmCommand: (name: string) => string;
 export declare const flociHealthUrl: (port: number) => string;

package/dist/op/activities/floci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAgBD,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAO9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBzG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F"}
+{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASpG,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAaD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,EAAE,YAAkD,CAAC;AAE5E;4DAC4D;AAC5D,eAAO,MAAM,cAAc,EAAE,kBAQ5B,CAAC;AAMF,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAO9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBzG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAuF,MAAM,0BAA0B,CAAC;AAsBnJ;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,aAwqBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAuF,MAAM,0BAA0B,CAAC;AAuBnJ;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,aA0qBvB,CAAC"}

package/dist/rules/cf-refs.ts

@@ -124,6 +124,29 @@ export function getSecurityGroupIngress(
   return rules;
 }
 
+/**
+ * Extract an ECS TaskDefinition's container definitions (shared by the
+ * WAW046/047/048 ECS checks).
+ */
+export function getContainerDefinitions(resource: CFResource): Array<Record<string, unknown>> {
+  const props = resource.Properties ?? {};
+  const defs = props.ContainerDefinitions;
+  if (!Array.isArray(defs)) return [];
+  return defs.filter((d): d is Record<string, unknown> => typeof d === "object" && d !== null);
+}
+
+/**
+ * Whether a build's `env` (from `--env` or the project's `ownership.env`, see
+ * PostSynthContext#env and #201) should be treated as the strict "full"/
+ * production tier for tier-gated checks, vs a relaxed "light" tier acceptable
+ * for local/Floci-style stacks. Reuses the existing `ctx.env` seam — no new
+ * tier field. An undefined or unrecognized env is treated as non-strict so a
+ * project that never sets `--env`/`ownership.env` isn't unexpectedly hard-failed.
+ */
+export function isFullTierEnv(env: string | undefined): boolean {
+  return env === "prod" || env === "production" || env === "full";
+}
+
 /**
  * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
  */

package/dist/rules/waw038.ts

@@ -0,0 +1,50 @@
+/**
+ * WAW038: RDS Publicly Accessible
+ *
+ * Flags RDS instances with PubliclyAccessible: true — the instance gets a
+ * public IP/DNS name reachable from the internet instead of staying inside
+ * the VPC. (DBCluster has no PubliclyAccessible property; that's set on the
+ * member DBInstance.)
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkRdsPubliclyAccessible(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::RDS::DBInstance") continue;
+
+      const props = resource.Properties ?? {};
+      const publiclyAccessible = props.PubliclyAccessible;
+
+      if (isIntrinsic(publiclyAccessible)) continue;
+
+      if (publiclyAccessible === true) {
+        diagnostics.push({
+          checkId: "WAW038",
+          severity: "error",
+          message: `RDS instance "${logicalId}" has PubliclyAccessible: true — keep the database inside the VPC, unreachable from the internet`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw038: PostSynthCheck = {
+  id: "WAW038",
+  description: "RDS instance is publicly accessible — keep databases inside the VPC",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkRdsPubliclyAccessible(ctx);
+  },
+};

package/dist/rules/waw039.ts

@@ -0,0 +1,51 @@
+/**
+ * WAW039: RDS Backup Retention Not Set
+ *
+ * Flags RDS instances and clusters without a positive BackupRetentionPeriod —
+ * a retention of 0 (or an unset property on a resource that otherwise pins
+ * every other property explicitly) disables automated backups entirely.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+const RDS_TYPES = new Set(["AWS::RDS::DBInstance", "AWS::RDS::DBCluster"]);
+
+export function checkRdsBackupRetention(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (!RDS_TYPES.has(resource.Type)) continue;
+
+      const props = resource.Properties ?? {};
+      const retention = props.BackupRetentionPeriod;
+
+      if (isIntrinsic(retention)) continue;
+
+      if (retention === undefined || retention === 0) {
+        diagnostics.push({
+          checkId: "WAW039",
+          severity: "error",
+          message: `RDS resource "${logicalId}" (${resource.Type}) does not have a positive BackupRetentionPeriod — automated backups are disabled`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw039: PostSynthCheck = {
+  id: "WAW039",
+  description: "RDS instance or cluster has automated backups disabled — set a positive BackupRetentionPeriod",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkRdsBackupRetention(ctx);
+  },
+};

package/dist/rules/waw040.ts

@@ -0,0 +1,54 @@
+/**
+ * WAW040: RDS Deletion Protection Disabled (full tier)
+ *
+ * Flags RDS instances and clusters without DeletionProtection: true. Tier-aware
+ * (#894): a relaxed "light" stack (local/Floci, or no --env/ownership.env set)
+ * only warns, since local/dev databases are routinely torn down on purpose; the
+ * strict "full"/production tier (ctx.env === "prod"/"production"/"full", the
+ * existing #201 env seam — see isFullTierEnv) fails the build.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic, isFullTierEnv } from "./cf-refs";
+
+const RDS_TYPES = new Set(["AWS::RDS::DBInstance", "AWS::RDS::DBCluster"]);
+
+export function checkRdsDeletionProtection(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+  const severity = isFullTierEnv(ctx.env) ? "error" : "warning";
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (!RDS_TYPES.has(resource.Type)) continue;
+
+      const props = resource.Properties ?? {};
+      const deletionProtection = props.DeletionProtection;
+
+      if (isIntrinsic(deletionProtection)) continue;
+
+      if (deletionProtection !== true) {
+        diagnostics.push({
+          checkId: "WAW040",
+          severity,
+          message: `RDS resource "${logicalId}" (${resource.Type}) does not have DeletionProtection: true — enable it on the full/production tier`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw040: PostSynthCheck = {
+  id: "WAW040",
+  description: "RDS instance or cluster does not have DeletionProtection enabled (full tier)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkRdsDeletionProtection(ctx);
+  },
+};

package/dist/rules/waw041.ts

@@ -0,0 +1,48 @@
+/**
+ * WAW041: RDS Proxy TLS Not Required
+ *
+ * Flags RDS Proxy resources without RequireTLS: true — without it, a client
+ * can connect to the proxy over plaintext.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkDbProxyTls(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::RDS::DBProxy") continue;
+
+      const props = resource.Properties ?? {};
+      const requireTls = props.RequireTLS;
+
+      if (isIntrinsic(requireTls)) continue;
+
+      if (requireTls !== true) {
+        diagnostics.push({
+          checkId: "WAW041",
+          severity: "error",
+          message: `RDS Proxy "${logicalId}" does not have RequireTLS: true — clients can connect over plaintext`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw041: PostSynthCheck = {
+  id: "WAW041",
+  description: "RDS Proxy does not require TLS for client connections",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkDbProxyTls(ctx);
+  },
+};

package/dist/rules/waw042.ts

@@ -0,0 +1,87 @@
+/**
+ * WAW042: S3 Bucket Missing TLS-Only Policy
+ *
+ * Flags S3 buckets without a companion BucketPolicy that denies requests made
+ * over plaintext (a Deny statement keyed on `aws:SecureTransport` being
+ * false). Encryption at rest is WAW006; the public-access block is WAW018;
+ * this covers encryption in transit.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFResource } from "./cf-refs";
+
+function statementDeniesInsecureTransport(stmt: Record<string, unknown>): boolean {
+  if (stmt.Effect !== "Deny") return false;
+
+  const condition = stmt.Condition;
+  if (typeof condition !== "object" || condition === null) return false;
+
+  const cond = condition as Record<string, unknown>;
+  for (const operator of ["Bool", "NumericLessThan"]) {
+    const clause = cond[operator];
+    if (typeof clause !== "object" || clause === null) continue;
+    const value = (clause as Record<string, unknown>)["aws:SecureTransport"];
+    if (value === "false" || value === false) return true;
+  }
+  return false;
+}
+
+/** Logical ids of every bucket a BucketPolicy's `Bucket` property resolves to. */
+function bucketPolicyTargets(resource: CFResource): Set<string> {
+  const props = resource.Properties ?? {};
+  return findResourceRefs(props.Bucket);
+}
+
+export function checkS3TlsOnlyPolicy(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    const bucketsWithTlsPolicy = new Set<string>();
+
+    for (const resource of Object.values(template.Resources)) {
+      if (resource.Type !== "AWS::S3::BucketPolicy") continue;
+
+      const props = resource.Properties ?? {};
+      const policyDoc = props.PolicyDocument;
+      if (typeof policyDoc !== "object" || policyDoc === null) continue;
+      const statements = (policyDoc as Record<string, unknown>).Statement;
+      if (!Array.isArray(statements)) continue;
+
+      const hasTlsDeny = statements.some(
+        (stmt) => typeof stmt === "object" && stmt !== null && statementDeniesInsecureTransport(stmt as Record<string, unknown>),
+      );
+      if (!hasTlsDeny) continue;
+
+      for (const bucketId of bucketPolicyTargets(resource)) {
+        bucketsWithTlsPolicy.add(bucketId);
+      }
+    }
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::S3::Bucket") continue;
+      if (bucketsWithTlsPolicy.has(logicalId)) continue;
+
+      diagnostics.push({
+        checkId: "WAW042",
+        severity: "error",
+        message: `S3 bucket "${logicalId}" has no bucket policy denying non-TLS requests — add a Deny statement on aws:SecureTransport = false`,
+        entity: logicalId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw042: PostSynthCheck = {
+  id: "WAW042",
+  description: "S3 bucket missing a TLS-only bucket policy — deny requests over plaintext",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkS3TlsOnlyPolicy(ctx);
+  },
+};

package/dist/rules/waw043.ts

@@ -0,0 +1,57 @@
+/**
+ * WAW043: KMS Key Rotation Disabled
+ *
+ * Flags customer-managed KMS keys without EnableKeyRotation: true. Skips
+ * asymmetric/HMAC keys (a non-default KeySpec) — AWS does not support
+ * automatic rotation for those.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+function supportsRotation(props: Record<string, unknown>): boolean {
+  const keySpec = props.KeySpec;
+  if (keySpec === undefined) return true; // default is SYMMETRIC_DEFAULT
+  if (isIntrinsic(keySpec)) return false; // can't statically verify — don't guess
+  return keySpec === "SYMMETRIC_DEFAULT";
+}
+
+export function checkKmsKeyRotation(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::KMS::Key") continue;
+
+      const props = resource.Properties ?? {};
+      if (!supportsRotation(props)) continue;
+
+      const rotation = props.EnableKeyRotation;
+      if (isIntrinsic(rotation)) continue;
+
+      if (rotation !== true) {
+        diagnostics.push({
+          checkId: "WAW043",
+          severity: "warning",
+          message: `KMS key "${logicalId}" does not have EnableKeyRotation: true — enable automatic annual key rotation`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw043: PostSynthCheck = {
+  id: "WAW043",
+  description: "KMS customer-managed key does not have automatic key rotation enabled",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkKmsKeyRotation(ctx);
+  },
+};

package/dist/rules/waw044.ts

@@ -0,0 +1,68 @@
+/**
+ * WAW044: ALB HTTP Listener Not Redirecting To HTTPS (full tier)
+ *
+ * Flags load balancer Listener resources on Protocol: HTTP whose
+ * DefaultActions don't redirect to HTTPS — the listener serves plaintext
+ * traffic instead of upgrading it. Access logging is WAW024; this covers
+ * transport security on the listener itself.
+ *
+ * Tier-aware (#917), same seam as WAW040/WAW052 (#894): a relaxed "light"
+ * stack (local/Floci, or no --env/ownership.env set) only warns, since the
+ * light tier is intentionally HTTP-only with no ACM cert to redirect to; the
+ * strict "full"/production tier (ctx.env === "prod"/"production"/"full", the
+ * existing #201 env seam — see isFullTierEnv) fails the build.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic, isFullTierEnv } from "./cf-refs";
+
+function redirectsToHttps(actions: unknown): boolean {
+  if (!Array.isArray(actions)) return false;
+  return actions.some((action) => {
+    if (typeof action !== "object" || action === null) return false;
+    const a = action as Record<string, unknown>;
+    if (a.Type !== "redirect") return false;
+    const redirectConfig = a.RedirectConfig;
+    if (typeof redirectConfig !== "object" || redirectConfig === null) return false;
+    return (redirectConfig as Record<string, unknown>).Protocol === "HTTPS";
+  });
+}
+
+export function checkAlbHttpRedirect(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+  const severity = isFullTierEnv(ctx.env) ? "error" : "warning";
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ElasticLoadBalancingV2::Listener") continue;
+
+      const props = resource.Properties ?? {};
+      const protocol = props.Protocol;
+      if (isIntrinsic(protocol) || protocol !== "HTTP") continue;
+
+      if (!redirectsToHttps(props.DefaultActions)) {
+        diagnostics.push({
+          checkId: "WAW044",
+          severity,
+          message: `Listener "${logicalId}" is HTTP and does not redirect to HTTPS — add a redirect DefaultAction (Protocol: HTTPS) on the full/production tier`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw044: PostSynthCheck = {
+  id: "WAW044",
+  description: "ALB HTTP listener does not redirect to HTTPS (full tier)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkAlbHttpRedirect(ctx);
+  },
+};

package/dist/rules/waw045.ts

@@ -0,0 +1,58 @@
+/**
+ * WAW045: ALB Weak Or Missing TLS Policy
+ *
+ * Flags HTTPS/TLS listeners without a modern SslPolicy (TLS 1.2+). The
+ * account-wide default (`ELBSecurityPolicy-2016-08`) still allows TLS 1.0, so
+ * a missing SslPolicy is flagged the same as an explicit legacy one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+const SECURE_PROTOCOLS = new Set(["HTTPS", "TLS"]);
+
+/** AWS's predefined TLS 1.2+ policies all carry a "-1-2-" or "-1-3-" segment (FS/TLS13 variants included). */
+function isModernTlsPolicy(policy: string): boolean {
+  return /-1-2-|-1-3-/.test(policy);
+}
+
+export function checkAlbTlsPolicy(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ElasticLoadBalancingV2::Listener") continue;
+
+      const props = resource.Properties ?? {};
+      const protocol = props.Protocol;
+      if (isIntrinsic(protocol) || typeof protocol !== "string" || !SECURE_PROTOCOLS.has(protocol)) continue;
+
+      const sslPolicy = props.SslPolicy;
+      if (isIntrinsic(sslPolicy)) continue;
+
+      if (typeof sslPolicy !== "string" || !isModernTlsPolicy(sslPolicy)) {
+        diagnostics.push({
+          checkId: "WAW045",
+          severity: "error",
+          message: `Listener "${logicalId}" (${protocol}) ${sslPolicy ? `uses SslPolicy "${sslPolicy}"` : "has no SslPolicy set"} — use a TLS 1.2+ predefined policy (e.g. ELBSecurityPolicy-TLS13-1-2-2021-06)`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw045: PostSynthCheck = {
+  id: "WAW045",
+  description: "ALB HTTPS/TLS listener does not use a modern (TLS 1.2+) SslPolicy",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkAlbTlsPolicy(ctx);
+  },
+};