@intentius/chant-lexicon-aws 0.44.1 → 0.44.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/dist/composites/landing-zone.d.ts +2 -2
  2. package/dist/governance.d.ts +11 -11
  3. package/dist/governance.d.ts.map +1 -1
  4. package/dist/integrity.json +5 -5
  5. package/dist/lint/post-synth/waw056.d.ts +1 -1
  6. package/dist/lint/post-synth/waw057.d.ts +1 -1
  7. package/dist/lint/post-synth/waw058.d.ts +1 -1
  8. package/dist/manifest.json +1 -1
  9. package/dist/rules/waw056.ts +1 -1
  10. package/dist/rules/waw057.ts +1 -1
  11. package/dist/rules/waw058.ts +1 -1
  12. package/package.json +2 -2
  13. package/src/composites/landing-zone.test.ts +1 -1
  14. package/src/composites/landing-zone.ts +2 -2
  15. package/src/governance.test.ts +1 -1
  16. package/src/governance.ts +12 -12
  17. package/src/index.ts +2 -2
  18. package/src/lint/audit-catalog.ts +1 -1
  19. package/src/lint/post-synth/waw056.ts +1 -1
  20. package/src/lint/post-synth/waw057.ts +1 -1
  21. package/src/lint/post-synth/waw058.ts +1 -1
package/dist/composites/landing-zone.d.ts CHANGED
@@ -1,12 +1,12 @@
1
1
  /**
2
- * Landing-zone bootstrap composites (#791, epic #787 C1).
2
+ * Landing-zone bootstrap composites.
3
3
  *
4
4
  * Fixed-shape resources for greenfield creation of the recommended
5
5
  * governance foundation through a management-account stack. The evaluability
6
6
  * rules (EVL002/004) require composites to declare a fixed set of resources,
7
7
  * so these carry the foundation only; arbitrary OU/account trees are
8
8
  * authored as config with `landingZoneConfig()` (../governance.ts) and
9
- * reconciled by the AWS cloud warden (#792), and further OUs/accounts are
9
+ * reconciled by an external governance reconciler, and further OUs/accounts are
10
10
  * declared as ordinary resources referencing these members' ids.
11
11
  *
12
12
  * The pieces compose:
package/dist/governance.d.ts CHANGED
@@ -1,17 +1,17 @@
1
1
  /**
2
- * AWS governance authoring (#791, epic #787 C1): the desired-state config
3
- * shape the AWS cloud warden (#792) reconciles, and `landingZoneConfig()` —
2
+ * AWS governance authoring: the desired-state config
3
+ * shape an external governance reconciler applies, and `landingZoneConfig()` —
4
4
  * the typed authoring layer that emits it.
5
5
  *
6
6
  * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
7
7
  * #916/#952) require composites to declare a fixed set of resources, so a
8
8
  * data-driven OU tree walker cannot be one. The split mirrors the SCM
9
- * wardens: authoring emits config (this module, arbitrary cardinality);
9
+ * reconcilers: authoring emits config (this module, arbitrary cardinality);
10
10
  * resources for greenfield bootstrap are the fixed-shape composites in
11
- * `composites/landing-zone.ts`; the warden consumes only the config.
11
+ * `composites/landing-zone.ts`; the reconciler consumes only the config.
12
12
  *
13
13
  * GCP (Folder/OrgPolicy/AuditConfig) and Azure (blocked on #1545)
14
- * counterparts are tracked as #791 follow-ups.
14
+ * counterparts followed the same shape.
15
15
  */
16
16
  /** An SCP definition, keyed by name in `AwsGovernanceConfig.scps`. */
17
17
  export interface ScpConfig {
@@ -51,23 +51,23 @@ export interface AssignmentConfig {
51
51
  /** Account names (as declared in the OU tree) the grant applies to. */
52
52
  accounts: string[];
53
53
  }
54
- /** IAM Identity Center desired state — the `identity-assignment` verb (#792). */
54
+ /** IAM Identity Center desired state — the `identity-assignment` verb. */
55
55
  export interface IdentityConfig {
56
56
  /** Permission-set definitions, keyed by the names assignments reference. */
57
57
  permissionSets: Record<string, PermissionSetConfig>;
58
58
  assignments?: AssignmentConfig[];
59
59
  /**
60
60
  * The named break-glass admin grant. Implicitly desired (reconcile keeps
61
- * it) and protected by the warden's break-glass-admin guardrail: no plan
61
+ * it) and protected by the reconciler's break-glass-admin guardrail: no plan
62
62
  * may remove this assignment or its permission set.
63
63
  */
64
64
  breakGlass?: AssignmentConfig;
65
65
  }
66
66
  /**
67
67
  * The desired-state governance tree for one AWS organization. This is the
68
- * shape `wardens/aws` (#792) loads as config — the AWS counterpart of the
69
- * SCM wardens' GovernanceConfig. Cycles map onto the governance verbs
70
- * (#790): the OU/account tree is `org-unit`, SCPs are `policy-guardrail`,
68
+ * shape an external governance reconciler loads as config — the AWS counterpart of the
69
+ * SCM governance reconcilers' GovernanceConfig. Cycles map onto the governance verbs
70
+ *: the OU/account tree is `org-unit`, SCPs are `policy-guardrail`,
71
71
  * audit sinks are `audit-sink`.
72
72
  */
73
73
  export interface AwsGovernanceConfig {
@@ -120,7 +120,7 @@ export interface LandingZoneConfigProps {
120
120
  cloudtrailBucket?: string;
121
121
  }
122
122
  /**
123
- * Author the desired-state tree the AWS cloud warden (#792) reconciles.
123
+ * Author the desired-state tree an external governance reconciler applies.
124
124
  * Pure. Throws when the tree attaches an SCP name with no definition; only
125
125
  * SCPs the tree actually attaches are included in the output.
126
126
  */
package/dist/governance.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACrC;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE;QACZ,mDAAmD;QACnD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,kCAAkC;IAClC,UAAU,CAAC,EAAE;QACX,UAAU,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,OAAO,CAAA;SAAE,CAAC;KACvD,CAAC;CACH;AAMD,eAAO,MAAM,uBAAuB,EAAE,SAMrC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,SAkB/B,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAuBvE;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAKnD,CAAC;AAMF,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6HAA6H;IAC7H,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,sBAA2B,GAAG,mBAAmB,CAgDzF"}
1
+ {"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACrC;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE;QACZ,mDAAmD;QACnD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,kCAAkC;IAClC,UAAU,CAAC,EAAE;QACX,UAAU,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,OAAO,CAAA;SAAE,CAAC;KACvD,CAAC;CACH;AAMD,eAAO,MAAM,uBAAuB,EAAE,SAMrC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,SAkB/B,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAuBvE;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAKnD,CAAC;AAMF,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6HAA6H;IAC7H,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/B,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,sBAA2B,GAAG,mBAAmB,CAgDzF"}
package/dist/integrity.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "algorithm": "sha256",
3
3
  "artifacts": {
4
- "manifest.json": "abd193c646742bc5cc5557c6ee32bdccb6e18e5009446c0dfd2b1bcddd411ceb",
4
+ "manifest.json": "7df1db8daa453b7482e812744378a26ee786799339d4f0e85b5f98ce081c6448",
5
5
  "meta.json": "2e4cae67cbc2eb2962c3dd0aa57008ae96fb725dd0118af7b04b2b44eab7722a",
6
6
  "types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
7
7
  "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
@@ -55,12 +55,12 @@
55
55
  "rules/waw053.ts": "0115a06c87e75cbace13832ed931953e4af15885f77a28329a6c6fee64af65ad",
56
56
  "rules/waw054.ts": "a1a9c1d1d04aebd72e14c01340f6203231d9513add64958edd42366aaa419d42",
57
57
  "rules/waw055.ts": "f924e6bca957da1860c7d56dd385d28d91ab57bfd0f1499077d63a9cfc5b81e5",
58
- "rules/waw056.ts": "05820527815a30cc6d0cda143dff3e4ce04cef9b6092a1e01bc72bb23ce50c4c",
59
- "rules/waw057.ts": "e9804c808213a83b00dce58c8609012098c81fe51bed53799da40014f52f97db",
60
- "rules/waw058.ts": "f72220738bb62eab6b5fc88cfc7e7749047815e405e6cc62503825d7134ada17",
58
+ "rules/waw056.ts": "d686630ddcdbb9496582b5712a8ceae13f61c19a6803f22f09dd52c0947dd4e9",
59
+ "rules/waw057.ts": "5db562dc7d0c0ccedbfcb08357d2d0f7f561a828df17e1b1a183c338ef0a3ec1",
60
+ "rules/waw058.ts": "fbcfde64bbf81abe919f4e60a7e283a1b2ff30454b2c1cec2e0e099e7ad187e6",
61
61
  "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
62
62
  "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
63
63
  "skills/chant-aws-carve-terraform.md": "52dc7a8a10156d236266cc8dbf75614fabb6e2fa4caf31c13cca348e167a58b5"
64
64
  },
65
- "composite": "e75e7058423aa306eddb08d3b42b83c2454bd81317da8f816c0612201a7e11dd"
65
+ "composite": "162df967eefc5958fec2e6f9b4111b08c02254ce9ce89c10ff644e18abb95f10"
66
66
  }
package/dist/lint/post-synth/waw056.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW056: SCP Guardrail Denies Nothing (#793, epic #787 C3)
2
+ * WAW056: SCP Guardrail Denies Nothing
3
3
  *
4
4
  * Flags SERVICE_CONTROL_POLICY resources whose document contains no Deny
5
5
  * statement. SCPs never grant permissions — they only filter — so an SCP
package/dist/lint/post-synth/waw057.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW057: SCP Guardrail Attached to No Targets (#793, epic #787 C3)
2
+ * WAW057: SCP Guardrail Attached to No Targets
3
3
  *
4
4
  * Flags SERVICE_CONTROL_POLICY resources with no TargetIds. A defined but
5
5
  * unattached SCP enforces nothing — the usual shape of a guardrail that was
package/dist/lint/post-synth/waw058.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW058: Organization Audit Trail Dropped or Scoped Down (#793, epic #787 C3)
2
+ * WAW058: Organization Audit Trail Dropped or Scoped Down
3
3
  *
4
4
  * The audit-sink posture regressions on AWS: a trail with logging switched
5
5
  * off, an organization trail narrowed to a single region, or an organization
package/dist/manifest.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "aws",
3
- "version": "0.44.1",
3
+ "version": "0.44.2",
4
4
  "chantVersion": ">=0.1.0",
5
5
  "namespace": "AWS",
6
6
  "intrinsics": [
package/dist/rules/waw056.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW056: SCP Guardrail Denies Nothing (#793, epic #787 C3)
2
+ * WAW056: SCP Guardrail Denies Nothing
3
3
  *
4
4
  * Flags SERVICE_CONTROL_POLICY resources whose document contains no Deny
5
5
  * statement. SCPs never grant permissions — they only filter — so an SCP
package/dist/rules/waw057.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW057: SCP Guardrail Attached to No Targets (#793, epic #787 C3)
2
+ * WAW057: SCP Guardrail Attached to No Targets
3
3
  *
4
4
  * Flags SERVICE_CONTROL_POLICY resources with no TargetIds. A defined but
5
5
  * unattached SCP enforces nothing — the usual shape of a guardrail that was
package/dist/rules/waw058.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW058: Organization Audit Trail Dropped or Scoped Down (#793, epic #787 C3)
2
+ * WAW058: Organization Audit Trail Dropped or Scoped Down
3
3
  *
4
4
  * The audit-sink posture regressions on AWS: a trail with logging switched
5
5
  * off, an organization trail narrowed to a single region, or an organization
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@intentius/chant-lexicon-aws",
3
- "version": "0.44.1",
3
+ "version": "0.44.2",
4
4
  "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
5
5
  "license": "Apache-2.0",
6
6
  "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
80
80
  "typescript": "^5.9.3"
81
81
  },
82
82
  "peerDependencies": {
83
- "@intentius/chant": "^0.44.1",
83
+ "@intentius/chant": "^0.44.2",
84
84
  "typescript": "^5.9.3"
85
85
  }
86
86
  }
package/src/composites/landing-zone.test.ts CHANGED
@@ -3,7 +3,7 @@ import { expandComposite } from "@intentius/chant";
3
3
  import { AttrRef } from "@intentius/chant/attrref";
4
4
  import { GovernanceFoundation, OrganizationRoot, OrganizationTrail, RegionRestriction } from "./landing-zone";
5
5
 
6
- describe("GovernanceFoundation (#791)", () => {
6
+ describe("GovernanceFoundation", () => {
7
7
  test("declares the foundation OUs and baseline SCPs", () => {
8
8
  const lz = GovernanceFoundation({ parentRootId: "r-abc1" });
9
9
  expect(Object.keys(lz.members)).toEqual([
package/src/composites/landing-zone.ts CHANGED
@@ -1,12 +1,12 @@
1
1
  /**
2
- * Landing-zone bootstrap composites (#791, epic #787 C1).
2
+ * Landing-zone bootstrap composites.
3
3
  *
4
4
  * Fixed-shape resources for greenfield creation of the recommended
5
5
  * governance foundation through a management-account stack. The evaluability
6
6
  * rules (EVL002/004) require composites to declare a fixed set of resources,
7
7
  * so these carry the foundation only; arbitrary OU/account trees are
8
8
  * authored as config with `landingZoneConfig()` (../governance.ts) and
9
- * reconciled by the AWS cloud warden (#792), and further OUs/accounts are
9
+ * reconciled by an external governance reconciler, and further OUs/accounts are
10
10
  * declared as ordinary resources referencing these members' ids.
11
11
  *
12
12
  * The pieces compose:
package/src/governance.test.ts CHANGED
@@ -1,7 +1,7 @@
1
1
  import { describe, expect, test } from "vitest";
2
2
  import { landingZoneConfig, FOUNDATION_OUS } from "./governance";
3
3
 
4
- describe("landingZoneConfig (#791)", () => {
4
+ describe("landingZoneConfig", () => {
5
5
  test("the default is the recommended foundation", () => {
6
6
  const cfg = landingZoneConfig();
7
7
  expect(Object.keys(cfg.ous)).toEqual(["Security", "Infrastructure", "Sandbox", "Workloads"]);
package/src/governance.ts CHANGED
@@ -1,21 +1,21 @@
1
1
  /**
2
- * AWS governance authoring (#791, epic #787 C1): the desired-state config
3
- * shape the AWS cloud warden (#792) reconciles, and `landingZoneConfig()` —
2
+ * AWS governance authoring: the desired-state config
3
+ * shape an external governance reconciler applies, and `landingZoneConfig()` —
4
4
  * the typed authoring layer that emits it.
5
5
  *
6
6
  * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
7
7
  * #916/#952) require composites to declare a fixed set of resources, so a
8
8
  * data-driven OU tree walker cannot be one. The split mirrors the SCM
9
- * wardens: authoring emits config (this module, arbitrary cardinality);
9
+ * reconcilers: authoring emits config (this module, arbitrary cardinality);
10
10
  * resources for greenfield bootstrap are the fixed-shape composites in
11
- * `composites/landing-zone.ts`; the warden consumes only the config.
11
+ * `composites/landing-zone.ts`; the reconciler consumes only the config.
12
12
  *
13
13
  * GCP (Folder/OrgPolicy/AuditConfig) and Azure (blocked on #1545)
14
- * counterparts are tracked as #791 follow-ups.
14
+ * counterparts followed the same shape.
15
15
  */
16
16
 
17
17
  // ---------------------------------------------------------------------------
18
- // The desired-state config shape the AWS cloud warden consumes (#792)
18
+ // The desired-state config shape an external governance reconciler consumes
19
19
  // ---------------------------------------------------------------------------
20
20
 
21
21
  /** An SCP definition, keyed by name in `AwsGovernanceConfig.scps`. */
@@ -61,14 +61,14 @@ export interface AssignmentConfig {
61
61
  accounts: string[];
62
62
  }
63
63
 
64
- /** IAM Identity Center desired state — the `identity-assignment` verb (#792). */
64
+ /** IAM Identity Center desired state — the `identity-assignment` verb. */
65
65
  export interface IdentityConfig {
66
66
  /** Permission-set definitions, keyed by the names assignments reference. */
67
67
  permissionSets: Record<string, PermissionSetConfig>;
68
68
  assignments?: AssignmentConfig[];
69
69
  /**
70
70
  * The named break-glass admin grant. Implicitly desired (reconcile keeps
71
- * it) and protected by the warden's break-glass-admin guardrail: no plan
71
+ * it) and protected by the reconciler's break-glass-admin guardrail: no plan
72
72
  * may remove this assignment or its permission set.
73
73
  */
74
74
  breakGlass?: AssignmentConfig;
@@ -76,9 +76,9 @@ export interface IdentityConfig {
76
76
 
77
77
  /**
78
78
  * The desired-state governance tree for one AWS organization. This is the
79
- * shape `wardens/aws` (#792) loads as config — the AWS counterpart of the
80
- * SCM wardens' GovernanceConfig. Cycles map onto the governance verbs
81
- * (#790): the OU/account tree is `org-unit`, SCPs are `policy-guardrail`,
79
+ * shape an external governance reconciler loads as config — the AWS counterpart of the
80
+ * SCM governance reconcilers' GovernanceConfig. Cycles map onto the governance verbs
81
+ *: the OU/account tree is `org-unit`, SCPs are `policy-guardrail`,
82
82
  * audit sinks are `audit-sink`.
83
83
  */
84
84
  export interface AwsGovernanceConfig {
@@ -194,7 +194,7 @@ export interface LandingZoneConfigProps {
194
194
  }
195
195
 
196
196
  /**
197
- * Author the desired-state tree the AWS cloud warden (#792) reconciles.
197
+ * Author the desired-state tree an external governance reconciler applies.
198
198
  * Pure. Throws when the tree attaches an SCP name with no definition; only
199
199
  * SCPs the tree actually attaches are included in the output.
200
200
  */
package/src/index.ts CHANGED
@@ -138,8 +138,8 @@ export type { PackageOptions, PackageResult } from "./codegen/package";
138
138
  // loads `awsCapabilityPlugin` when a project's chant.config lists this lexicon.
139
139
  export { awsCapabilityPlugin } from "./components/capability-plugin";
140
140
 
141
- // AWS governance authoring (#791): the desired-state config the AWS cloud
142
- // warden (#792) reconciles, and the typed landing-zone authoring layer.
141
+ // AWS governance authoring: the desired-state config the AWS cloud
142
+ // external governance reconciler applies, and the typed landing-zone authoring layer.
143
143
  export { landingZoneConfig, regionRestriction, DENY_AUDIT_TAMPER, DENY_LEAVE_ORGANIZATION, FOUNDATION_OUS } from "./governance";
144
144
  export type {
145
145
  AwsGovernanceConfig,
package/src/lint/audit-catalog.ts CHANGED
@@ -63,7 +63,7 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
63
63
  WAW054: auditRule("WAW054", "merge-worthy", "guidance", "ECR repository allows mutable image tags", "Set ImageTagMutability: IMMUTABLE.", { authority: [AWS_SEC] }),
64
64
  WAW055: auditRule("WAW055", "report-only", "guidance", "CloudWatch Logs log group has no retention period", "Set an explicit RetentionInDays.", { category: "best-practice" }),
65
65
 
66
- // #793 — governance posture regressions (epic #787 C3).
66
+ // governance posture regressions.
67
67
  WAW056: auditRule("WAW056", "merge-worthy", "guidance", "SCP guardrail has no Deny statement", "Add a Deny statement — SCPs only filter permissions, so a Deny-less SCP guards nothing.", { authority: [AWS_SEC] }),
68
68
  WAW057: auditRule("WAW057", "merge-worthy", "guidance", "SCP guardrail attached to no targets", "Attach the SCP to the organization root or an OU via TargetIds.", { authority: [AWS_SEC] }),
69
69
  WAW058: auditRule("WAW058", "merge-worthy", "guidance", "Organization audit trail dropped or scoped down", "Keep an organization CloudTrail with IsLogging: true and IsMultiRegionTrail: true.", { authority: [AWS_SEC] }),
package/src/lint/post-synth/waw056.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW056: SCP Guardrail Denies Nothing (#793, epic #787 C3)
2
+ * WAW056: SCP Guardrail Denies Nothing
3
3
  *
4
4
  * Flags SERVICE_CONTROL_POLICY resources whose document contains no Deny
5
5
  * statement. SCPs never grant permissions — they only filter — so an SCP
package/src/lint/post-synth/waw057.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW057: SCP Guardrail Attached to No Targets (#793, epic #787 C3)
2
+ * WAW057: SCP Guardrail Attached to No Targets
3
3
  *
4
4
  * Flags SERVICE_CONTROL_POLICY resources with no TargetIds. A defined but
5
5
  * unattached SCP enforces nothing — the usual shape of a guardrail that was
package/src/lint/post-synth/waw058.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  /**
2
- * WAW058: Organization Audit Trail Dropped or Scoped Down (#793, epic #787 C3)
2
+ * WAW058: Organization Audit Trail Dropped or Scoped Down
3
3
  *
4
4
  * The audit-sink posture regressions on AWS: a trail with logging switched
5
5
  * off, an organization trail narrowed to a single region, or an organization