@intentius/chant-lexicon-aws 0.41.19 → 0.42.1

package/src/composites/landing-zone.ts

@@ -0,0 +1,150 @@
+/**
+ * Landing-zone bootstrap composites (#791, epic #787 C1).
+ *
+ * Fixed-shape resources for greenfield creation of the recommended
+ * governance foundation through a management-account stack. The evaluability
+ * rules (EVL002/004) require composites to declare a fixed set of resources,
+ * so these carry the foundation only; arbitrary OU/account trees are
+ * authored as config with `landingZoneConfig()` (../governance.ts) and
+ * reconciled by the AWS cloud warden (#792), and further OUs/accounts are
+ * declared as ordinary resources referencing these members' ids.
+ *
+ * The pieces compose:
+ *   const org = OrganizationRoot({});                      // greenfield only
+ *   const lz  = GovernanceFoundation({ parentRootId: org.organization.RootId });
+ *   const rr  = RegionRestriction({ regions: ["eu-west-1"], targetIds: [org.organization.RootId] });
+ *   const at  = OrganizationTrail({ bucket: "acme-org-audit" });
+ * Brownfield skips OrganizationRoot and passes the existing root id
+ * ("r-...") to GovernanceFoundation.
+ */
+
+import { Composite } from "@intentius/chant";
+import {
+  Organization,
+  OrganizationalUnit,
+  OrganizationsPolicy,
+  Trail,
+} from "../generated";
+import { DENY_AUDIT_TAMPER, DENY_LEAVE_ORGANIZATION, regionRestriction } from "../governance";
+
+// ---------------------------------------------------------------------------
+// OrganizationRoot — greenfield only
+// ---------------------------------------------------------------------------
+
+export interface OrganizationRootProps {
+  featureSet?: "ALL" | "CONSOLIDATED_BILLING";
+}
+
+export type OrganizationRootResult = {
+  organization: InstanceType<typeof Organization>;
+};
+
+/** Creates the organization itself. Control Tower / existing orgs skip this. */
+export const OrganizationRoot = Composite<OrganizationRootProps, OrganizationRootResult>((props) => {
+  const organization = new Organization({ FeatureSet: props.featureSet ?? "ALL" });
+  return { organization };
+}, "OrganizationRoot");
+
+// ---------------------------------------------------------------------------
+// GovernanceFoundation — the recommended foundation
+// ---------------------------------------------------------------------------
+
+export interface GovernanceFoundationProps {
+  /** The organization root to hang the foundation off ("r-..." or `OrganizationRoot(...).organization.RootId`). */
+  parentRootId: string;
+}
+
+export type GovernanceFoundationResult = {
+  ouSecurity: InstanceType<typeof OrganizationalUnit>;
+  ouInfrastructure: InstanceType<typeof OrganizationalUnit>;
+  ouSandbox: InstanceType<typeof OrganizationalUnit>;
+  ouWorkloads: InstanceType<typeof OrganizationalUnit>;
+  scpDenyLeaveOrganization: InstanceType<typeof OrganizationsPolicy>;
+  scpDenyAuditTamper: InstanceType<typeof OrganizationsPolicy>;
+};
+
+/**
+ * Security / Infrastructure / Sandbox / Workloads OUs,
+ * `deny-leave-organization` attached at the root and `deny-audit-tamper`
+ * on the Security OU — the same baseline `landingZoneConfig()` declares.
+ */
+export const GovernanceFoundation = Composite<GovernanceFoundationProps, GovernanceFoundationResult>((props) => {
+  const ouSecurity = new OrganizationalUnit({ Name: "Security", ParentId: props.parentRootId });
+  const ouInfrastructure = new OrganizationalUnit({ Name: "Infrastructure", ParentId: props.parentRootId });
+  const ouSandbox = new OrganizationalUnit({ Name: "Sandbox", ParentId: props.parentRootId });
+  const ouWorkloads = new OrganizationalUnit({ Name: "Workloads", ParentId: props.parentRootId });
+
+  const scpDenyLeaveOrganization = new OrganizationsPolicy({
+    Name: "deny-leave-organization",
+    Type: "SERVICE_CONTROL_POLICY",
+    Content: DENY_LEAVE_ORGANIZATION.document,
+    Description: DENY_LEAVE_ORGANIZATION.description,
+    TargetIds: [props.parentRootId],
+  });
+  const scpDenyAuditTamper = new OrganizationsPolicy({
+    Name: "deny-audit-tamper",
+    Type: "SERVICE_CONTROL_POLICY",
+    Content: DENY_AUDIT_TAMPER.document,
+    Description: DENY_AUDIT_TAMPER.description,
+    TargetIds: [ouSecurity.Id],
+  });
+
+  return {
+    ouSecurity,
+    ouInfrastructure,
+    ouSandbox,
+    ouWorkloads,
+    scpDenyLeaveOrganization,
+    scpDenyAuditTamper,
+  };
+}, "GovernanceFoundation");
+
+// ---------------------------------------------------------------------------
+// RegionRestriction — optional root guardrail
+// ---------------------------------------------------------------------------
+
+export interface RegionRestrictionProps {
+  /** The only regions requests may target (global services excepted). */
+  regions: string[];
+  /** Root/OU ids the SCP attaches to. */
+  targetIds: string[];
+}
+
+export type RegionRestrictionResult = {
+  scpRegionRestriction: InstanceType<typeof OrganizationsPolicy>;
+};
+
+export const RegionRestriction = Composite<RegionRestrictionProps, RegionRestrictionResult>((props) => {
+  const policy = regionRestriction(props.regions);
+  const scpRegionRestriction = new OrganizationsPolicy({
+    Name: "region-restriction",
+    Type: "SERVICE_CONTROL_POLICY",
+    Content: policy.document,
+    Description: policy.description,
+    TargetIds: props.targetIds,
+  });
+  return { scpRegionRestriction };
+}, "RegionRestriction");
+
+// ---------------------------------------------------------------------------
+// OrganizationTrail — the audit sink
+// ---------------------------------------------------------------------------
+
+export interface OrganizationTrailProps {
+  /** S3 bucket the organization trail delivers into. */
+  bucket: string;
+}
+
+export type OrganizationTrailResult = {
+  trail: InstanceType<typeof Trail>;
+};
+
+export const OrganizationTrail = Composite<OrganizationTrailProps, OrganizationTrailResult>((props) => {
+  const trail = new Trail({
+    IsLogging: true,
+    S3BucketName: props.bucket,
+    IsMultiRegionTrail: true,
+    IsOrganizationTrail: true,
+  });
+  return { trail };
+}, "OrganizationTrail");

package/src/governance.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, test } from "vitest";
+import { landingZoneConfig, FOUNDATION_OUS } from "./governance";
+
+describe("landingZoneConfig (#791)", () => {
+  test("the default is the recommended foundation", () => {
+    const cfg = landingZoneConfig();
+    expect(Object.keys(cfg.ous)).toEqual(["Security", "Infrastructure", "Sandbox", "Workloads"]);
+    expect(cfg.organization.scps).toEqual(["deny-leave-organization"]);
+    expect(cfg.ous.Security.scps).toEqual(["deny-audit-tamper"]);
+    expect(Object.keys(cfg.scps).sort()).toEqual(["deny-audit-tamper", "deny-leave-organization"]);
+    expect(cfg.auditSinks).toBeUndefined();
+  });
+
+  test("custom OUs and accounts merge over the foundation (brownfield: partial trees work)", () => {
+    const cfg = landingZoneConfig({
+      ous: {
+        Workloads: {
+          children: { Prod: { accounts: [{ name: "checkout", email: "aws+checkout@acme.dev" }] } },
+        },
+      },
+    });
+    // Same-name key wins over the foundation's Workloads…
+    expect(cfg.ous.Workloads.children?.Prod.accounts?.[0].name).toBe("checkout");
+    // …while the rest of the foundation persists.
+    expect(cfg.ous.Security).toEqual(FOUNDATION_OUS.Security);
+
+    const partial = landingZoneConfig({ foundation: false, ous: { Legacy: {} }, rootScps: [] });
+    expect(Object.keys(partial.ous)).toEqual(["Legacy"]);
+    expect(partial.organization.scps).toBeUndefined();
+    expect(partial.scps).toEqual({});
+  });
+
+  test("allowedRegions adds a root region-restriction SCP", () => {
+    const cfg = landingZoneConfig({ allowedRegions: ["eu-west-1", "eu-central-1"] });
+    expect(cfg.organization.scps).toContain("region-restriction");
+    expect(JSON.stringify(cfg.scps["region-restriction"].document)).toContain("eu-central-1");
+  });
+
+  test("cloudtrailBucket declares the audit sink", () => {
+    const cfg = landingZoneConfig({ cloudtrailBucket: "acme-audit" });
+    expect(cfg.auditSinks?.cloudtrail).toEqual({ bucket: "acme-audit", multiRegion: true });
+  });
+
+  test("identity passes through; assignments must reference defined permission sets", () => {
+    const identity = {
+      permissionSets: { admin: { managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"] } },
+      breakGlass: { principal: "BreakGlass", principalType: "GROUP" as const, permissionSet: "admin", accounts: ["management"] },
+    };
+    const cfg = landingZoneConfig({ identity });
+    expect(cfg.identity).toEqual(identity);
+    expect(landingZoneConfig().identity).toBeUndefined();
+
+    expect(() =>
+      landingZoneConfig({
+        identity: {
+          permissionSets: {},
+          assignments: [{ principal: "Platform", principalType: "GROUP", permissionSet: "nope", accounts: ["management"] }],
+        },
+      }),
+    ).toThrowError('references permission set "nope"');
+    expect(() =>
+      landingZoneConfig({
+        identity: {
+          permissionSets: {},
+          breakGlass: { principal: "BreakGlass", principalType: "GROUP", permissionSet: "gone", accounts: ["management"] },
+        },
+      }),
+    ).toThrowError('references permission set "gone"');
+  });
+
+  test("only attached SCPs are emitted; attaching an undefined SCP throws", () => {
+    const cfg = landingZoneConfig({
+      scps: { unused: { document: { Version: "2012-10-17", Statement: [] } } },
+    });
+    expect(cfg.scps.unused).toBeUndefined();
+
+    expect(() => landingZoneConfig({ ous: { Security: { scps: ["nope"] } } })).toThrowError(
+      'SCP "nope" is attached but not defined',
+    );
+  });
+});

package/src/governance.ts

@@ -0,0 +1,249 @@
+/**
+ * AWS governance authoring (#791, epic #787 C1): the desired-state config
+ * shape the AWS cloud warden (#792) reconciles, and `landingZoneConfig()` —
+ * the typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven OU tree walker cannot be one. The split mirrors the SCM
+ * wardens: authoring emits config (this module, arbitrary cardinality);
+ * resources for greenfield bootstrap are the fixed-shape composites in
+ * `composites/landing-zone.ts`; the warden consumes only the config.
+ *
+ * GCP (Folder/OrgPolicy/AuditConfig) and Azure (blocked on #1545)
+ * counterparts are tracked as #791 follow-ups.
+ */
+
+// ---------------------------------------------------------------------------
+// The desired-state config shape the AWS cloud warden consumes (#792)
+// ---------------------------------------------------------------------------
+
+/** An SCP definition, keyed by name in `AwsGovernanceConfig.scps`. */
+export interface ScpConfig {
+  description?: string;
+  /** The policy document (SCP JSON). */
+  document: Record<string, unknown>;
+}
+
+/** A member account declared inside an OU. */
+export interface AccountConfig {
+  name: string;
+  email: string;
+}
+
+/** One OU: its guardrails, accounts, and child OUs, keyed by OU name. */
+export interface OuConfig {
+  /** Names of SCPs (from `scps`) attached to this OU. */
+  scps?: string[];
+  accounts?: AccountConfig[];
+  children?: Record<string, OuConfig>;
+}
+
+/** An IAM Identity Center permission set, keyed by name in `IdentityConfig.permissionSets`. */
+export interface PermissionSetConfig {
+  description?: string;
+  /** ISO-8601 session duration, e.g. "PT8H". Omitted → the provider default (PT1H). */
+  sessionDuration?: string;
+  /** Managed policy ARNs attached to the set. */
+  managedPolicies?: string[];
+  /** Inline policy document attached to the set. */
+  inlinePolicy?: Record<string, unknown>;
+}
+
+/** One permission-set grant to an identity-store principal on member accounts. */
+export interface AssignmentConfig {
+  /** Identity-store principal: a group's DisplayName or a user's UserName. */
+  principal: string;
+  principalType: "GROUP" | "USER";
+  /** Permission-set name from `IdentityConfig.permissionSets`. */
+  permissionSet: string;
+  /** Account names (as declared in the OU tree) the grant applies to. */
+  accounts: string[];
+}
+
+/** IAM Identity Center desired state — the `identity-assignment` verb (#792). */
+export interface IdentityConfig {
+  /** Permission-set definitions, keyed by the names assignments reference. */
+  permissionSets: Record<string, PermissionSetConfig>;
+  assignments?: AssignmentConfig[];
+  /**
+   * The named break-glass admin grant. Implicitly desired (reconcile keeps
+   * it) and protected by the warden's break-glass-admin guardrail: no plan
+   * may remove this assignment or its permission set.
+   */
+  breakGlass?: AssignmentConfig;
+}
+
+/**
+ * The desired-state governance tree for one AWS organization. This is the
+ * shape `wardens/aws` (#792) loads as config — the AWS counterpart of the
+ * SCM wardens' GovernanceConfig. Cycles map onto the governance verbs
+ * (#790): the OU/account tree is `org-unit`, SCPs are `policy-guardrail`,
+ * audit sinks are `audit-sink`.
+ */
+export interface AwsGovernanceConfig {
+  organization: {
+    /** SCP names attached at the organization root. */
+    scps?: string[];
+  };
+  /** Top-level OUs under the root, keyed by OU name. */
+  ous: Record<string, OuConfig>;
+  /** SCP definitions, keyed by the names the tree attaches. */
+  scps: Record<string, ScpConfig>;
+  /** IAM Identity Center permission sets and account assignments. */
+  identity?: IdentityConfig;
+  /** Where audit evidence flows. */
+  auditSinks?: {
+    cloudtrail?: { bucket: string; multiRegion: boolean };
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+
+export const DENY_LEAVE_ORGANIZATION: ScpConfig = {
+  description: "Member accounts may not remove themselves from the organization.",
+  document: {
+    Version: "2012-10-17",
+    Statement: [{ Effect: "Deny", Action: "organizations:LeaveOrganization", Resource: "*" }],
+  },
+};
+
+export const DENY_AUDIT_TAMPER: ScpConfig = {
+  description: "Audit trails and recorders cannot be stopped or deleted from member accounts.",
+  document: {
+    Version: "2012-10-17",
+    Statement: [
+      {
+        Effect: "Deny",
+        Action: [
+          "cloudtrail:StopLogging",
+          "cloudtrail:DeleteTrail",
+          "config:StopConfigurationRecorder",
+          "config:DeleteConfigurationRecorder",
+          "config:DeleteDeliveryChannel",
+        ],
+        Resource: "*",
+      },
+    ],
+  },
+};
+
+/** Deny requests outside `regions`, excepting global services. */
+export function regionRestriction(regions: readonly string[]): ScpConfig {
+  return {
+    description: `Deny requests outside [${regions.join(", ")}] except global services.`,
+    document: {
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Deny",
+          NotAction: [
+            "iam:*",
+            "organizations:*",
+            "route53:*",
+            "cloudfront:*",
+            "sts:*",
+            "support:*",
+            "budgets:*",
+          ],
+          Resource: "*",
+          Condition: { StringNotEquals: { "aws:RequestedRegion": regions } },
+        },
+      ],
+    },
+  };
+}
+
+/**
+ * The recommended foundation OU structure. Exported so callers can extend it
+ * rather than restate it.
+ */
+export const FOUNDATION_OUS: Record<string, OuConfig> = {
+  Security: { scps: ["deny-audit-tamper"] },
+  Infrastructure: {},
+  Sandbox: {},
+  Workloads: {},
+};
+
+// ---------------------------------------------------------------------------
+// Authoring
+// ---------------------------------------------------------------------------
+
+export interface LandingZoneConfigProps {
+  /**
+   * Start from the recommended foundation: Security / Infrastructure /
+   * Sandbox / Workloads OUs, `deny-leave-organization` at the root, and
+   * `deny-audit-tamper` on Security. Default true; your `ous`/`scps` merge
+   * over it (same-name keys win).
+   */
+  foundation?: boolean;
+  /** Adds a region-restriction SCP at the root allowing only these regions. */
+  allowedRegions?: string[];
+  /** OU tree, merged over the foundation's. Greenfield (full tree) and brownfield (partial subtree) are both just this map. */
+  ous?: Record<string, OuConfig>;
+  /** SCP definitions, merged over the foundation's. */
+  scps?: Record<string, ScpConfig>;
+  /** Extra SCP names to attach at the organization root. */
+  rootScps?: string[];
+  /** IAM Identity Center permission sets, assignments, and the break-glass admin. */
+  identity?: IdentityConfig;
+  /** Declare an organization CloudTrail flowing into this bucket. */
+  cloudtrailBucket?: string;
+}
+
+/**
+ * Author the desired-state tree the AWS cloud warden (#792) reconciles.
+ * Pure. Throws when the tree attaches an SCP name with no definition; only
+ * SCPs the tree actually attaches are included in the output.
+ */
+export function landingZoneConfig(props: LandingZoneConfigProps = {}): AwsGovernanceConfig {
+  const foundation = props.foundation ?? true;
+  const scps: Record<string, ScpConfig> = {
+    ...(foundation
+      ? { "deny-leave-organization": DENY_LEAVE_ORGANIZATION, "deny-audit-tamper": DENY_AUDIT_TAMPER }
+      : {}),
+    ...(props.allowedRegions?.length ? { "region-restriction": regionRestriction(props.allowedRegions) } : {}),
+    ...props.scps,
+  };
+  const ous = { ...(foundation ? FOUNDATION_OUS : {}), ...props.ous };
+  const rootScps = [
+    ...(foundation ? ["deny-leave-organization"] : []),
+    ...(props.allowedRegions?.length ? ["region-restriction"] : []),
+    ...(props.rootScps ?? []),
+  ];
+
+  const attached = new Set(rootScps);
+  const collect = (tree: Record<string, OuConfig>): void => {
+    for (const node of Object.values(tree)) {
+      for (const s of node.scps ?? []) attached.add(s);
+      if (node.children) collect(node.children);
+    }
+  };
+  collect(ous);
+  for (const name of attached) {
+    if (!scps[name]) throw new Error(`landingZoneConfig: SCP "${name}" is attached but not defined in scps`);
+  }
+
+  if (props.identity) {
+    const granted = [...(props.identity.assignments ?? []), ...(props.identity.breakGlass ? [props.identity.breakGlass] : [])];
+    for (const a of granted) {
+      if (!props.identity.permissionSets[a.permissionSet]) {
+        throw new Error(
+          `landingZoneConfig: assignment for "${a.principal}" references permission set "${a.permissionSet}" not defined in identity.permissionSets`,
+        );
+      }
+    }
+  }
+
+  return {
+    organization: rootScps.length ? { scps: rootScps } : {},
+    ous,
+    scps: Object.fromEntries(Object.entries(scps).filter(([n]) => attached.has(n))),
+    ...(props.identity ? { identity: props.identity } : {}),
+    ...(props.cloudtrailBucket
+      ? { auditSinks: { cloudtrail: { bucket: props.cloudtrailBucket, multiRegion: true } } }
+      : {}),
+  };
+}

package/src/index.ts

@@ -114,6 +114,7 @@ export {
   SolrFargateService,
   MicrovmApp, MICROVM_LIMITS,
   AgentCoreAgent,
+  OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail,
 } from "./composites/index";
 export type {
   LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps,
@@ -124,6 +125,7 @@ export type {
   SolrFargateServiceProps,
   MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB,
   AgentCoreAgentProps, AgentCoreAgentResult,
+  OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps,
 } from "./composites/index";
 
 // Code generation pipeline
@@ -135,3 +137,17 @@ export type { PackageOptions, PackageResult } from "./codegen/package";
 // emr-*, code-deploy, …) contributed to core's capability-plugin seam. Core
 // loads `awsCapabilityPlugin` when a project's chant.config lists this lexicon.
 export { awsCapabilityPlugin } from "./components/capability-plugin";
+
+// AWS governance authoring (#791): the desired-state config the AWS cloud
+// warden (#792) reconciles, and the typed landing-zone authoring layer.
+export { landingZoneConfig, regionRestriction, DENY_AUDIT_TAMPER, DENY_LEAVE_ORGANIZATION, FOUNDATION_OUS } from "./governance";
+export type {
+  AwsGovernanceConfig,
+  LandingZoneConfigProps,
+  OuConfig,
+  ScpConfig,
+  AccountConfig,
+  IdentityConfig,
+  PermissionSetConfig,
+  AssignmentConfig,
+} from "./governance";

package/src/lint/audit-catalog.ts

@@ -62,4 +62,9 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   WAW053: auditRule("WAW053", "merge-worthy", "guidance", "ECR repository does not scan images on push", "Set ImageScanningConfiguration.ScanOnPush: true.", { authority: [AWS_SEC] }),
   WAW054: auditRule("WAW054", "merge-worthy", "guidance", "ECR repository allows mutable image tags", "Set ImageTagMutability: IMMUTABLE.", { authority: [AWS_SEC] }),
   WAW055: auditRule("WAW055", "report-only", "guidance", "CloudWatch Logs log group has no retention period", "Set an explicit RetentionInDays.", { category: "best-practice" }),
+
+  // #793 — governance posture regressions (epic #787 C3).
+  WAW056: auditRule("WAW056", "merge-worthy", "guidance", "SCP guardrail has no Deny statement", "Add a Deny statement — SCPs only filter permissions, so a Deny-less SCP guards nothing.", { authority: [AWS_SEC] }),
+  WAW057: auditRule("WAW057", "merge-worthy", "guidance", "SCP guardrail attached to no targets", "Attach the SCP to the organization root or an OU via TargetIds.", { authority: [AWS_SEC] }),
+  WAW058: auditRule("WAW058", "merge-worthy", "guidance", "Organization audit trail dropped or scoped down", "Keep an organization CloudTrail with IsLogging: true and IsMultiRegionTrail: true.", { authority: [AWS_SEC] }),
 };

package/src/lint/post-synth/index.ts

@@ -47,6 +47,9 @@ import { waw052 } from "./waw052";
 import { waw053 } from "./waw053";
 import { waw054 } from "./waw054";
 import { waw055 } from "./waw055";
+import { waw056 } from "./waw056";
+import { waw057 } from "./waw057";
+import { waw058 } from "./waw058";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -96,4 +99,7 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw053,
   waw054,
   waw055,
+  waw056,
+  waw057,
+  waw058,
 ];

package/src/lint/post-synth/waw056.test.ts

@@ -0,0 +1,78 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw056, checkScpDeniesNothing } from "./waw056";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+function scp(content: unknown) {
+  return {
+    Type: "AWS::Organizations::Policy",
+    Properties: { Name: "guard", Type: "SERVICE_CONTROL_POLICY", Content: content, TargetIds: ["r-1"] },
+  };
+}
+
+describe("WAW056: SCP guardrail denies nothing", () => {
+  test("check metadata", () => {
+    expect(waw056.id).toBe("WAW056");
+    expect(waw056.description).toContain("Deny");
+  });
+
+  test("flags an SCP whose statements are all Allow", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Guard: scp({ Version: "2012-10-17", Statement: [{ Effect: "Allow", Action: "*", Resource: "*" }] }),
+      },
+    });
+    const diags = checkScpDeniesNothing(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW056");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("Guard");
+  });
+
+  test("flags an SCP with an empty Statement array", () => {
+    const ctx = makeCtx({ Resources: { Guard: scp({ Version: "2012-10-17", Statement: [] }) } });
+    expect(checkScpDeniesNothing(ctx)).toHaveLength(1);
+  });
+
+  test("no diagnostic when a Deny statement is present", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Guard: scp({
+          Version: "2012-10-17",
+          Statement: [{ Effect: "Deny", Action: "organizations:LeaveOrganization", Resource: "*" }],
+        }),
+      },
+    });
+    expect(checkScpDeniesNothing(ctx)).toHaveLength(0);
+  });
+
+  test("parses string Content and accepts a single Statement object", () => {
+    const denied = makeCtx({
+      Resources: {
+        Guard: scp(JSON.stringify({ Statement: { Effect: "Deny", Action: "s3:*", Resource: "*" } })),
+      },
+    });
+    expect(checkScpDeniesNothing(denied)).toHaveLength(0);
+
+    const allowOnly = makeCtx({
+      Resources: { Guard: scp(JSON.stringify({ Statement: [{ Effect: "Allow", Action: "*" }] })) },
+    });
+    expect(checkScpDeniesNothing(allowOnly)).toHaveLength(1);
+  });
+
+  test("skips intrinsic Content and non-SCP policy types", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Intrinsic: scp({ Ref: "PolicyDoc" }),
+        TagPolicy: {
+          Type: "AWS::Organizations::Policy",
+          Properties: { Name: "tags", Type: "TAG_POLICY", Content: { Statement: [] } },
+        },
+      },
+    });
+    expect(checkScpDeniesNothing(ctx)).toHaveLength(0);
+  });
+});