@intentius/chant-lexicon-aws 0.41.20 → 0.42.1

package/dist/okf/types/WorkflowVersion.md

@@ -0,0 +1,44 @@
+---
+type: resource-type
+title: WorkflowVersion
+description: aws resource type AWS::Omics::WorkflowVersion
+name: WorkflowVersion
+lexicon: aws
+resource_type: AWS::Omics::WorkflowVersion
+---
+`AWS::Omics::WorkflowVersion`, a resource type of the aws lexicon.
+
+## Properties
+
+- `VersionName` (`string`, required)
+- `WorkflowId` (`string`, required)
+- `Accelerators` (`WorkflowVersion_Accelerators`, optional)
+- `Arn` (`string`, optional)
+- `ContainerRegistryMap` (`WorkflowVersion_ContainerRegistryMap`, optional)
+- `ContainerRegistryMapUri` (`string`, optional)
+- `CreationTime` (`string`, optional)
+- `DefinitionRepository` (`WorkflowVersion_DefinitionRepository`, optional)
+- `DefinitionUri` (`string`, optional)
+- `Description` (`string`, optional)
+- `Engine` (`WorkflowVersion_WorkflowEngine`, optional)
+- `Main` (`string`, optional)
+- `ParameterTemplate` (`Record<string, unknown>`, optional)
+- `ParameterTemplatePath` (`string`, optional): Path to the primary workflow parameter template JSON file inside the repository
+- `readmeMarkdown` (`string`, optional): The markdown content for the workflow's README file. This provides documentation and usage information for users of the workflow.
+- `readmePath` (`string`, optional): The path to the workflow README markdown file within the repository. This file provides documentation and usage information for the workflow. If not specified, the README.md file from the root directory of the repository will be used.
+- `readmeUri` (`string`, optional): The S3 URI of the README file for the workflow. This file provides documentation and usage information for the workflow. The S3 URI must begin with s3://USER-OWNED-BUCKET/. The requester must have access to the S3 bucket and object. The max README content length is 500 KiB.
+- `Status` (`WorkflowVersion_WorkflowStatus`, optional)
+- `StorageCapacity` (`number`, optional)
+- `StorageType` (`WorkflowVersion_StorageType`, optional)
+- `Tags` (`Record<string, unknown>`, optional)
+- `Type` (`WorkflowVersion_WorkflowType`, optional)
+- `Uuid` (`string`, optional)
+- `WorkflowBucketOwnerId` (`string`, optional)
+
+## Attributes
+
+- `Arn`
+- `CreationTime`
+- `Status`
+- `Type`
+- `Uuid`

package/dist/okf/types/Workgroup.md

@@ -0,0 +1,55 @@
+---
+type: resource-type
+title: Workgroup
+description: aws resource type AWS::RedshiftServerless::Workgroup
+name: Workgroup
+lexicon: aws
+resource_type: AWS::RedshiftServerless::Workgroup
+---
+`AWS::RedshiftServerless::Workgroup`, a resource type of the aws lexicon.
+
+## Properties
+
+- `WorkgroupName` (`string`, required): The name of the workgroup.
+- `BaseCapacity` (`number`, optional): The base compute capacity of the workgroup in Redshift Processing Units (RPUs).
+- `ConfigParameters` (`Workgroup_ConfigParameter[]`, optional): A list of parameters to set for finer control over a database. Available options are datestyle, enable_user_activity_logging, query_group, search_path, max_query_execution_time, and require_ssl.
+- `EnhancedVpcRouting` (`boolean`, optional): The value that specifies whether to enable enhanced virtual private cloud (VPC) routing, which forces Amazon Redshift Serverless to route traffic through your VPC.
+- `MaxCapacity` (`number`, optional): The max compute capacity of the workgroup in Redshift Processing Units (RPUs).
+- `NamespaceName` (`string`, optional): The namespace the workgroup is associated with.
+- `Port` (`number`, optional): The custom port to use when connecting to a workgroup. Valid port ranges are 5431-5455 and 8191-8215. The default is 5439.
+- `PricePerformanceTarget` (`Workgroup_PerformanceTarget`, optional): A property that represents the price performance target settings for the workgroup.
+- `PubliclyAccessible` (`boolean`, optional): A value that specifies whether the workgroup can be accessible from a public network.
+- `RecoveryPointId` (`string`, optional): The identifier of the recovery point to restore the namespace from. When this resource is first created, the namespace is restored from this recovery point. On subsequent updates, a restore occurs only when RecoveryPointId changes from its previous value. If the value is unchanged or removed, no restore takes place and existing data is preserved.
+- `SecurityGroupIds` (`string[]`, optional): A list of security group IDs to associate with the workgroup.
+- `SnapshotArn` (`string`, optional): The Amazon Resource Name (ARN) of the snapshot to restore the namespace from. Specify either SnapshotArn or SnapshotName, but not both. When this resource is first created, the namespace is restored from this snapshot. On subsequent updates, a restore occurs only when SnapshotArn changes from its previous value. If the value is unchanged or removed, no restore takes place and existing data is preserved.
+- `SnapshotName` (`string`, optional): The name of the snapshot to restore the namespace from. Because snapshot names are unique only within an account, also specify SnapshotOwnerAccount when restoring from a snapshot owned by a different account. Specify either SnapshotName or SnapshotArn, but not both. When this resource is first created, the namespace is restored from this snapshot. On subsequent updates, a restore occurs only when SnapshotName or SnapshotOwnerAccount changes from its previous value. If both values are unchanged or SnapshotName is removed, no restore takes place and existing data is preserved.
+- `SnapshotOwnerAccount` (`string`, optional): The AWS account ID that owns the snapshot. Required when restoring from a snapshot shared by another account. Used in combination with SnapshotName. On updates, changing this value while SnapshotName is set triggers a restore from the newly referenced snapshot. If the value is unchanged, no restore takes place and existing data is preserved.
+- `SubnetIds` (`string[]`, optional): A list of subnet IDs the workgroup is associated with.
+- `Tags` (`Workgroup_Tag[]`, optional): The map of the key-value pairs used to tag the workgroup.
+- `TrackName` (`string`, optional)
+- `Workgroup` (`Workgroup_Workgroup`, optional): Definition for workgroup resource
+
+## Attributes
+
+- `Workgroup.BaseCapacity`
+- `Workgroup.ConfigParameters`
+- `Workgroup.CreationDate`
+- `Workgroup.Endpoint.Address`
+- `Workgroup.Endpoint.Port`
+- `Workgroup.Endpoint.VpcEndpoints.*.NetworkInterfaces.*.AvailabilityZone`
+- `Workgroup.Endpoint.VpcEndpoints.*.NetworkInterfaces.*.NetworkInterfaceId`
+- `Workgroup.Endpoint.VpcEndpoints.*.NetworkInterfaces.*.PrivateIpAddress`
+- `Workgroup.Endpoint.VpcEndpoints.*.NetworkInterfaces.*.SubnetId`
+- `Workgroup.Endpoint.VpcEndpoints.*.VpcEndpointId`
+- `Workgroup.Endpoint.VpcEndpoints.*.VpcId`
+- `Workgroup.EnhancedVpcRouting`
+- `Workgroup.MaxCapacity`
+- `Workgroup.NamespaceName`
+- `Workgroup.PubliclyAccessible`
+- `Workgroup.SecurityGroupIds`
+- `Workgroup.Status`
+- `Workgroup.SubnetIds`
+- `Workgroup.TrackName`
+- `Workgroup.WorkgroupArn`
+- `Workgroup.WorkgroupId`
+- `Workgroup.WorkgroupName`

package/dist/okf/types/WorkloadIdentity.md

@@ -0,0 +1,24 @@
+---
+type: resource-type
+title: WorkloadIdentity
+description: aws resource type AWS::BedrockAgentCore::WorkloadIdentity
+name: WorkloadIdentity
+lexicon: aws
+resource_type: AWS::BedrockAgentCore::WorkloadIdentity
+---
+`AWS::BedrockAgentCore::WorkloadIdentity`, a resource type of the aws lexicon.
+
+## Properties
+
+- `Name` (`string`, required): The name of the workload identity. The name must be unique within your account.
+- `AllowedResourceOauth2ReturnUrls` (`string[]`, optional): The list of allowed OAuth2 return URLs for resources associated with this workload identity.
+- `CreatedTime` (`number`, optional): The timestamp when the workload identity was created.
+- `LastUpdatedTime` (`number`, optional): The timestamp when the workload identity was last updated.
+- `Tags` (`WorkloadIdentity_Tag[]`, optional): An array of key-value pairs to apply to this resource.
+- `WorkloadIdentityArn` (`string`, optional): The Amazon Resource Name (ARN) of the workload identity.
+
+## Attributes
+
+- `CreatedTime`
+- `LastUpdatedTime`
+- `WorkloadIdentityArn`

package/dist/okf/types/WorkspaceInstance.md

@@ -0,0 +1,24 @@
+---
+type: resource-type
+title: WorkspaceInstance
+description: aws resource type AWS::WorkspacesInstances::WorkspaceInstance
+name: WorkspaceInstance
+lexicon: aws
+resource_type: AWS::WorkspacesInstances::WorkspaceInstance
+---
+`AWS::WorkspacesInstances::WorkspaceInstance`, a resource type of the aws lexicon.
+
+## Properties
+
+- `EC2ManagedInstance` (`WorkspaceInstance_EC2ManagedInstance`, optional)
+- `ManagedInstance` (`Record<string, unknown>`, optional)
+- `ProvisionState` (`"ALLOCATED" | "ALLOCATING" | "DEALLOCATED" | "DEALLOCATING" | "ERROR_ALLOCATING" | "ERROR_DEALLOCATING"`, optional): The current state of the workspace instance
+- `Tags` (`WorkspaceInstance_Tag[]`, optional)
+- `WorkspaceInstanceId` (`string`, optional): Unique identifier for the workspace instance
+
+## Attributes
+
+- `EC2ManagedInstance`
+- `EC2ManagedInstance.InstanceId`
+- `ProvisionState`
+- `WorkspaceInstanceId`

package/dist/okf/types/WorkspaceIpGroup.md

@@ -0,0 +1,23 @@
+---
+type: resource-type
+title: WorkspaceIpGroup
+description: aws resource type AWS::WorkSpaces::WorkspaceIpGroup
+name: WorkspaceIpGroup
+lexicon: aws
+resource_type: AWS::WorkSpaces::WorkspaceIpGroup
+---
+`AWS::WorkSpaces::WorkspaceIpGroup`, a resource type of the aws lexicon.
+
+## Properties
+
+- `GroupName` (`string`, required): The name of the group.
+- `Arn` (`string`, optional): The Amazon Resource Name (ARN) of the IP access control group.
+- `GroupDesc` (`string`, optional): The description of the group.
+- `GroupId` (`string`, optional): The identifier of the IP access control group.
+- `Tags` (`WorkspaceIpGroup_Tag[]`, optional): The tags for the IP access control group.
+- `UserRules` (`WorkspaceIpGroup_IpRuleItem[]`, optional): The rules for the IP access control group.
+
+## Attributes
+
+- `Arn`
+- `GroupId`

package/dist/okf/types/WorkspacesInstancesVolume.md

@@ -0,0 +1,26 @@
+---
+type: resource-type
+title: WorkspacesInstancesVolume
+description: aws resource type AWS::WorkspacesInstances::Volume
+name: WorkspacesInstancesVolume
+lexicon: aws
+resource_type: AWS::WorkspacesInstances::Volume
+---
+`AWS::WorkspacesInstances::Volume`, a resource type of the aws lexicon.
+
+## Properties
+
+- `AvailabilityZone` (`string`, required): The Availability Zone in which to create the volume
+- `Encrypted` (`boolean`, optional): Indicates whether the volume should be encrypted
+- `Iops` (`number`, optional): The number of I/O operations per second (IOPS)
+- `KmsKeyId` (`string`, optional): The identifier of the AWS Key Management Service (AWS KMS) customer master key (CMK) to use for Amazon EBS encryption
+- `SizeInGB` (`number`, optional): The size of the volume, in GiBs
+- `SnapshotId` (`string`, optional): The snapshot from which to create the volume
+- `TagSpecifications` (`WorkspacesInstancesVolume_TagSpecification[]`, optional): The tags passed to EBS volume
+- `Throughput` (`number`, optional): The throughput to provision for a volume, with a maximum of 1,000 MiB/s
+- `VolumeId` (`string`, optional): Unique identifier for the volume
+- `VolumeType` (`"gp2" | "gp3" | "io1" | "io2" | "sc1" | "st1" | "standard"`, optional): The volume type
+
+## Attributes
+
+- `VolumeId`

package/dist/okf/types/WorkspacesPool.md

@@ -0,0 +1,30 @@
+---
+type: resource-type
+title: WorkspacesPool
+description: aws resource type AWS::WorkSpaces::WorkspacesPool
+name: WorkspacesPool
+lexicon: aws
+resource_type: AWS::WorkSpaces::WorkspacesPool
+---
+`AWS::WorkSpaces::WorkspacesPool`, a resource type of the aws lexicon.
+
+## Properties
+
+- `BundleId` (`string`, required)
+- `Capacity` (`WorkspacesPool_Capacity`, required)
+- `DirectoryId` (`string`, required)
+- `PoolName` (`string`, required)
+- `ApplicationSettings` (`WorkspacesPool_ApplicationSettings`, optional)
+- `CreatedAt` (`string`, optional)
+- `Description` (`string`, optional)
+- `PoolArn` (`string`, optional)
+- `PoolId` (`string`, optional)
+- `RunningMode` (`WorkspacesPool_RunningMode`, optional)
+- `Tags` (`WorkspacesPool_Tag[]`, optional)
+- `TimeoutSettings` (`WorkspacesPool_TimeoutSettings`, optional)
+
+## Attributes
+
+- `CreatedAt`
+- `PoolArn`
+- `PoolId`

package/dist/okf/types/Workteam.md

@@ -0,0 +1,23 @@
+---
+type: resource-type
+title: Workteam
+description: aws resource type AWS::SageMaker::Workteam
+name: Workteam
+lexicon: aws
+resource_type: AWS::SageMaker::Workteam
+---
+`AWS::SageMaker::Workteam`, a resource type of the aws lexicon.
+
+## Properties
+
+- `Description` (`string`, optional)
+- `Id` (`string`, optional)
+- `MemberDefinitions` (`Workteam_MemberDefinition[]`, optional)
+- `NotificationConfiguration` (`Workteam_NotificationConfiguration`, optional)
+- `Tags` (`Workteam_Tag[]`, optional)
+- `WorkforceName` (`string`, optional)
+- `WorkteamName` (`string`, optional)
+
+## Attributes
+
+- `Id`

package/dist/okf/types/XRayGroup.md

@@ -0,0 +1,21 @@
+---
+type: resource-type
+title: XRayGroup
+description: aws resource type AWS::XRay::Group
+name: XRayGroup
+lexicon: aws
+resource_type: AWS::XRay::Group
+---
+`AWS::XRay::Group`, a resource type of the aws lexicon.
+
+## Properties
+
+- `GroupName` (`string`, required): The case-sensitive name of the new group. Names must be unique.
+- `FilterExpression` (`string`, optional): The filter expression defining criteria by which to group traces.
+- `GroupARN` (`string`, optional): The ARN of the group that was generated on creation.
+- `InsightsConfiguration` (`XRayGroup_InsightsConfiguration`, optional)
+- `Tags` (`any`, optional)
+
+## Attributes
+
+- `GroupARN`

package/dist/okf/types/XRayResourcePolicy.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: XRayResourcePolicy
+description: aws resource type AWS::XRay::ResourcePolicy
+name: XRayResourcePolicy
+lexicon: aws
+resource_type: AWS::XRay::ResourcePolicy
+---
+`AWS::XRay::ResourcePolicy`, a resource type of the aws lexicon.
+
+## Properties
+
+- `PolicyDocument` (`string`, required): The resource policy document, which can be up to 5kb in size.
+- `PolicyName` (`string`, required): The name of the resource policy. Must be unique within a specific AWS account.
+- `BypassPolicyLockoutCheck` (`boolean`, optional): A flag to indicate whether to bypass the resource policy lockout safety check

package/dist/okf/types/ZonalAutoshiftConfiguration.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: ZonalAutoshiftConfiguration
+description: aws resource type AWS::ARCZonalShift::ZonalAutoshiftConfiguration
+name: ZonalAutoshiftConfiguration
+lexicon: aws
+resource_type: AWS::ARCZonalShift::ZonalAutoshiftConfiguration
+---
+`AWS::ARCZonalShift::ZonalAutoshiftConfiguration`, a resource type of the aws lexicon.
+
+## Properties
+
+- `PracticeRunConfiguration` (`ZonalAutoshiftConfiguration_PracticeRunConfiguration`, optional)
+- `ResourceIdentifier` (`string`, optional)
+- `ZonalAutoshiftStatus` (`ZonalAutoshiftConfiguration_ZonalAutoshiftStatus`, optional)

package/dist/rules/waw056.ts

@@ -0,0 +1,67 @@
+/**
+ * WAW056: SCP Guardrail Denies Nothing (#793, epic #787 C3)
+ *
+ * Flags SERVICE_CONTROL_POLICY resources whose document contains no Deny
+ * statement. SCPs never grant permissions — they only filter — so an SCP
+ * without a Deny is a no-op guardrail: the posture it appears to declare
+ * does not exist.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+function statementsOf(content: unknown): Array<Record<string, unknown>> | undefined {
+  let doc = content;
+  if (typeof doc === "string") {
+    try {
+      doc = JSON.parse(doc);
+    } catch {
+      return undefined;
+    }
+  }
+  if (typeof doc !== "object" || doc === null) return undefined;
+  const statement = (doc as Record<string, unknown>).Statement;
+  if (Array.isArray(statement)) return statement as Array<Record<string, unknown>>;
+  if (typeof statement === "object" && statement !== null) return [statement as Record<string, unknown>];
+  return [];
+}
+
+export function checkScpDeniesNothing(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::Organizations::Policy") continue;
+      const props = resource.Properties ?? {};
+      if (props.Type !== "SERVICE_CONTROL_POLICY") continue;
+      if (isIntrinsic(props.Content)) continue;
+
+      const statements = statementsOf(props.Content);
+      if (statements === undefined) continue;
+
+      if (!statements.some((s) => s.Effect === "Deny")) {
+        diagnostics.push({
+          checkId: "WAW056",
+          severity: "error",
+          message: `SCP "${logicalId}" has no Deny statement — SCPs only filter permissions, so a Deny-less SCP guards nothing`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw056: PostSynthCheck = {
+  id: "WAW056",
+  description: "SCP guardrail has no Deny statement — it constrains nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkScpDeniesNothing(ctx);
+  },
+};

package/dist/rules/waw057.ts

@@ -0,0 +1,48 @@
+/**
+ * WAW057: SCP Guardrail Attached to No Targets (#793, epic #787 C3)
+ *
+ * Flags SERVICE_CONTROL_POLICY resources with no TargetIds. A defined but
+ * unattached SCP enforces nothing — the usual shape of a guardrail that was
+ * "kept" in a template while being detached from the root or its OUs.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkScpUnattached(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::Organizations::Policy") continue;
+      const props = resource.Properties ?? {};
+      if (props.Type !== "SERVICE_CONTROL_POLICY") continue;
+
+      const targets = props.TargetIds;
+      if (isIntrinsic(targets)) continue;
+      if (Array.isArray(targets) && targets.length > 0) continue;
+
+      diagnostics.push({
+        checkId: "WAW057",
+        severity: "error",
+        message: `SCP "${logicalId}" is attached to no targets — a detached guardrail enforces nothing; attach it to the root or an OU via TargetIds`,
+        entity: logicalId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw057: PostSynthCheck = {
+  id: "WAW057",
+  description: "SCP guardrail is attached to no targets — it enforces nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkScpUnattached(ctx);
+  },
+};

package/dist/rules/waw058.ts

@@ -0,0 +1,71 @@
+/**
+ * WAW058: Organization Audit Trail Dropped or Scoped Down (#793, epic #787 C3)
+ *
+ * The audit-sink posture regressions on AWS: a trail with logging switched
+ * off, an organization trail narrowed to a single region, or an organization
+ * declared with no CloudTrail trail at all. Audit evidence is the layer the
+ * other guardrails depend on, so losing it is merge-worthy.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkAuditTrailPosture(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    let declaresOrganization = false;
+    let trailCount = 0;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type === "AWS::Organizations::Organization") declaresOrganization = true;
+      if (resource.Type !== "AWS::CloudTrail::Trail") continue;
+      trailCount++;
+
+      const props = resource.Properties ?? {};
+
+      if (!isIntrinsic(props.IsLogging) && props.IsLogging === false) {
+        diagnostics.push({
+          checkId: "WAW058",
+          severity: "error",
+          message: `Trail "${logicalId}" has IsLogging: false — the audit sink is declared but delivers nothing`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+
+      if (props.IsOrganizationTrail === true && !isIntrinsic(props.IsMultiRegionTrail) && props.IsMultiRegionTrail !== true) {
+        diagnostics.push({
+          checkId: "WAW058",
+          severity: "error",
+          message: `Organization trail "${logicalId}" is not multi-region — audit evidence is scoped down to a single region`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+
+    if (declaresOrganization && trailCount === 0) {
+      diagnostics.push({
+        checkId: "WAW058",
+        severity: "error",
+        message: "Template creates an AWS::Organizations::Organization with no CloudTrail trail — the landing zone has no audit sink",
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw058: PostSynthCheck = {
+  id: "WAW058",
+  description: "Organization audit trail missing, not logging, or scoped down to a single region",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkAuditTrailPosture(ctx);
+  },
+};

package/dist/skills/chant-aws-carve-terraform.md

@@ -53,14 +53,17 @@ From `examples/terraform-carve-out`, with `TF=./terraform`:
    chant carve emit --from ./terraform --select aws_s3_bucket.assets \
      --state ./terraform/terraform.tfstate --output ./carveout
    ```
-   Show `./carveout/assets.ts` — a real `new Bucket({ BucketName, Tags })` with
+   Show `./carveout/src/assets.ts` — a real `new Bucket({ BucketName, Tags })` with
    CloudFormation-style properties mapped from the Terraform state attributes.
-   Explain: a Terraform-managed resource is not in any CloudFormation stack, so
-   the correct source of its live shape is the state file, not a cloud read.
+   Emit also scaffolds `./carveout` into a buildable chant project
+   (`chant.config.ts`, `package.json`), so `npm install && npm run build` works
+   there as-is. Explain: a Terraform-managed resource is not in any
+   CloudFormation stack, so the correct source of its live shape is the state
+   file, not a cloud read.
 
 3. **Lint the inherited resource — optional, offer it.**
    ```bash
-   chant lint ./carveout --lexicon aws
+   chant lint ./carveout/src --lexicon aws
    ```
    After emit, offer to lint the carved source. chant audits the resource you
    inherited from Terraform against the AWS lexicon's rules. Findings have a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.41.20",
+  "version": "0.42.1",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.41.20",
+    "@intentius/chant": "^0.42.1",
     "typescript": "^5.9.3"
   }
 }

package/src/codegen/package.test.ts

@@ -1,6 +1,8 @@
 import { describe, test, expect } from "vitest";
 import { packageLexicon } from "./package";
 import { validateManifest } from "@intentius/chant/lexicon-schema";
+import { okfConformanceProblems, splitFrontmatter } from "@intentius/chant/okf";
+import { parseYAML } from "@intentius/chant/yaml";
 
 describe("packageLexicon", () => {
   test("produces valid BundleSpec with all artifacts", async () => {
@@ -46,6 +48,22 @@ describe("packageLexicon", () => {
     // Skills
     expect(spec.skills.size).toBeGreaterThan(0);
 
+    // OKF knowledge bundle (#1060) — the CloudFormation-derived generation
+    // path: one conformant concept per resource type, property descriptions
+    // carried from the CFN spec via the declarations, rules cross-linked.
+    expect(spec.okf).toBeDefined();
+    expect(okfConformanceProblems(spec.okf!)).toEqual([]);
+    const okfFiles = new Map(spec.okf!.map((f) => [f.path, f.content]));
+    const bucket = splitFrontmatter(okfFiles.get("types/Bucket.md")!)!;
+    const bucketFront = parseYAML(bucket.frontmatter);
+    expect(bucketFront.type).toBe("resource-type");
+    expect(bucketFront.resource_type).toBe("AWS::S3::Bucket");
+    expect(bucket.body).toContain("- `BucketName` (`string`, optional): A name for the bucket.");
+    expect(bucket.body).toContain("[WAW006](/rules/WAW006.md)");
+    const waw006 = splitFrontmatter(okfFiles.get("rules/WAW006.md")!)!;
+    expect(parseYAML(waw006.frontmatter).category).toBe("security");
+    expect(waw006.body).toContain("- [Bucket](/types/Bucket.md)");
+
     // Stats
     expect(stats.resources).toBeGreaterThan(100);
     expect(stats.ruleCount).toBeGreaterThan(0);

package/src/governance.test.ts

@@ -41,6 +41,33 @@ describe("landingZoneConfig (#791)", () => {
     expect(cfg.auditSinks?.cloudtrail).toEqual({ bucket: "acme-audit", multiRegion: true });
   });
 
+  test("identity passes through; assignments must reference defined permission sets", () => {
+    const identity = {
+      permissionSets: { admin: { managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"] } },
+      breakGlass: { principal: "BreakGlass", principalType: "GROUP" as const, permissionSet: "admin", accounts: ["management"] },
+    };
+    const cfg = landingZoneConfig({ identity });
+    expect(cfg.identity).toEqual(identity);
+    expect(landingZoneConfig().identity).toBeUndefined();
+
+    expect(() =>
+      landingZoneConfig({
+        identity: {
+          permissionSets: {},
+          assignments: [{ principal: "Platform", principalType: "GROUP", permissionSet: "nope", accounts: ["management"] }],
+        },
+      }),
+    ).toThrowError('references permission set "nope"');
+    expect(() =>
+      landingZoneConfig({
+        identity: {
+          permissionSets: {},
+          breakGlass: { principal: "BreakGlass", principalType: "GROUP", permissionSet: "gone", accounts: ["management"] },
+        },
+      }),
+    ).toThrowError('references permission set "gone"');
+  });
+
   test("only attached SCPs are emitted; attaching an undefined SCP throws", () => {
     const cfg = landingZoneConfig({
       scps: { unused: { document: { Version: "2012-10-17", Statement: [] } } },