@intentius/chant-lexicon-aws 0.44.14 → 0.46.0

package/src/lifecycle-integration.test.ts

@@ -28,8 +28,11 @@ const { awsPlugin } = await import("./plugin");
 const { liveImportFromPlugins } = await import("@intentius/chant/cli/commands/import");
 const { buildChangeSet } = await import("@intentius/chant/lifecycle/change-set");
 const { normalizeObservation } = await import("@intentius/chant/observation");
+const { buildLiveGraphIr } = await import("@intentius/chant/graph-ir");
 const { liveEvidenceFromChangeSet, reconcileStatus } = await import("@intentius/chant/lifecycle/status");
 const { describeObservationConformance } = await import("@intentius/chant-test-utils");
+const { observeResources } = await import("@intentius/chant/lifecycle/observe");
+const { DECLARABLE_MARKER } = await import("@intentius/chant/declarable");
 
 const liveTemplate = {
   AWSTemplateFormatVersion: "2010-09-09",
@@ -143,6 +146,49 @@ describe("aws lifecycle integration (#163)", () => {
     expect(cs2.entries.find((e) => e.name === "MyBucket")!.action).toBe("noop");
   });
 
+  // #1279 — a node's attributes are the resource's own. The stack's outputs
+  // used to be copied onto every member, so a VPC carried `expWebIp` and no
+  // `CidrBlock`; they now ride the envelope once, keyed by the stack.
+  test("an observed VPC carries its own properties; the stack carries the exports (#1279)", async () => {
+    stubCfn((action) =>
+      action === "DescribeStackResources"
+        ? { text: stackResourcesXml([{ logicalId: "vpc", type: "AWS::EC2::VPC", physicalId: "vpc-a5a41663" }]) }
+        : { text: stackOutputsXml({ expVpcId: "vpc-a5a41663", expWebIp: "54.1.2.3", expDbPassword: "hunter2" }) },
+    );
+    spawnMock.mockResolvedValue(
+      ok(JSON.stringify({ Vpcs: [{ VpcId: "vpc-a5a41663", CidrBlock: "10.0.0.0/16", IsDefault: false }] })),
+    );
+
+    const observed = normalizeObservation(
+      await awsPlugin.describeResources!({
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["vpc"],
+        entities: new Map(),
+      }),
+    );
+
+    const attrs = observed.resources.vpc?.attributes ?? {};
+    expect(attrs.CidrBlock).toBe("10.0.0.0/16");
+    expect(attrs.IsDefault).toBe(false);
+    expect(Object.keys(attrs).filter((k) => k.startsWith("exp"))).toEqual([]);
+
+    expect(observed.stackExports).toEqual({
+      prod: { expVpcId: "vpc-a5a41663", expWebIp: "54.1.2.3", expDbPassword: "[REDACTED]" },
+    });
+
+    // And through the graph: the exports land on the IR's `exports`, not on the node.
+    const ir = buildLiveGraphIr([{ lexicon: "aws", resources: observed.resources, stackExports: observed.stackExports }]);
+    const node = ir.nodes.find((n) => n.id === "vpc")!;
+    expect(node.attrs.CidrBlock).toBe("10.0.0.0/16");
+    expect(node.attrs.expVpcId).toBeUndefined();
+    expect(ir.exports).toEqual([
+      { name: "expDbPassword", value: "[REDACTED]", stack: "prod" },
+      { name: "expVpcId", value: "vpc-a5a41663", stack: "prod" },
+      { name: "expWebIp", value: "54.1.2.3", stack: "prod" },
+    ]);
+  });
+
   // #1647 — the carve state, end to end: terraform applied the bucket, carve
   // emitted a carveout declaring it by BucketName, and no CFN stack has ever
   // heard of it. The stack read alone said confirmed-absent (missing → a plan
@@ -303,6 +349,49 @@ describe("aws lifecycle integration (#163)", () => {
     });
     expect(cs.entries[0].action).toBe("create");
   });
+
+  // #1265 — the ownership notice printed once per `describeResources` call, so
+  // a four-stack project got four identical copies ahead of every answer. It
+  // is a property of the read path, not of a stack: the plugin now returns it
+  // as a note on the observation and core says it once per run.
+  test("owned read on a four-stack project: one ownership note, nothing printed", async () => {
+    stubCfn((action) =>
+      action === "DescribeStackResources"
+        ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+        : { text: stackOutputsXml() },
+    );
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+    const entities = new Map([
+      ["MyBucket", { [DECLARABLE_MARKER]: true as const, lexicon: "aws", entityType: "AWS::S3::Bucket", props: {} }],
+    ]);
+    const result = await observeResources(
+      "prod",
+      [awsPlugin],
+      { errors: [], warnings: [], entities, outputs: new Map([["aws", ""]]) } as never,
+      { owned: true, stacks: ["prod-net", "prod-data", "prod-app", "prod-edge"] },
+    );
+    const ownership = result.notes.filter((n) => n.includes("ownership filter unavailable"));
+    expect(ownership).toHaveLength(1);
+    expect(ownership[0]).toBe(
+      "[aws] ownership filter unavailable on describeResources (no tags from describe-stack-resources) — returning all, each with an explicit `unknown` verdict; use `chant import --from <env> --owned` for ownership-filtered export",
+    );
+    expect(result.warnings.join("\n")).not.toContain("ownership filter unavailable");
+    expect(warn).not.toHaveBeenCalled();
+    expect(error).not.toHaveBeenCalled();
+  });
+
+  test("an unowned read carries no ownership note", async () => {
+    stubCfn((action) =>
+      action === "DescribeStackResources"
+        ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+        : { text: stackOutputsXml() },
+    );
+    const observed = normalizeObservation(
+      await awsPlugin.describeResources!({ environment: "prod", buildOutput: "", entityNames: ["MyBucket"], entities: new Map() }),
+    );
+    expect(observed.notes).toEqual([]);
+  });
 });
 
 // The shared conformance suite (#1089).
@@ -339,9 +428,13 @@ describeObservationConformance({
       },
     },
     {
+      // describe-stack-resources also carries no tags to read a stack/env
+      // identity from, so `marker` (#1222) stays absent here — stack-level
+      // handling reads the stack's own tags instead.
       name: "a healthy stack read",
       declared: ["MyBucket"],
       expectPresent: ["MyBucket"],
+      expectNoMarker: ["MyBucket"],
       run: () => {
         stubCfn((action) =>
           action === "DescribeStackResources"

package/src/lint/audit-catalog.ts

@@ -67,4 +67,9 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   WAW056: auditRule("WAW056", "merge-worthy", "guidance", "SCP guardrail has no Deny statement", "Add a Deny statement — SCPs only filter permissions, so a Deny-less SCP guards nothing.", { authority: [AWS_SEC] }),
   WAW057: auditRule("WAW057", "merge-worthy", "guidance", "SCP guardrail attached to no targets", "Attach the SCP to the organization root or an OU via TargetIds.", { authority: [AWS_SEC] }),
   WAW058: auditRule("WAW058", "merge-worthy", "guidance", "Organization audit trail dropped or scoped down", "Keep an organization CloudTrail with IsLogging: true and IsMultiRegionTrail: true.", { authority: [AWS_SEC] }),
+
+  // #1225 — least-privilege tightening the declared graph can prove. Report-only,
+  // so no authority citation (those are reserved for merge-worthy entries).
+  WAW059: auditRule("WAW059", "report-only", "guidance", "Wildcard Resource where the declared graph enumerates the touched set", "Tighten Resource from \"*\" to the Fn::GetAtt Arn list of the declared resources the role's consumers touch.", { category: "security" }),
+  WAW060: auditRule("WAW060", "report-only", "guidance", "IAM policy attached to no principal", "Attach the policy via Roles/Users/Groups or reference it from a principal's ManagedPolicyArns — unattached it grants nothing.", { category: "security" }),
 };

package/src/lint/post-synth/cf-refs.ts

@@ -50,6 +50,28 @@ export function findResourceRefs(value: unknown): Set<string> {
   return refs;
 }
 
+/**
+ * Build the reverse of `findResourceRefs` for a whole template: logical id →
+ * the set of logical ids whose Properties reference it via Ref/Fn::GetAtt.
+ * Lets a check walk the graph consumer-ward (who uses this role?) instead of
+ * dependency-ward. Used by WAW059.
+ */
+export function buildReverseRefIndex(template: CFTemplate): Map<string, Set<string>> {
+  const index = new Map<string, Set<string>>();
+  for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+    for (const target of findResourceRefs(resource.Properties)) {
+      if (target === logicalId) continue;
+      let consumers = index.get(target);
+      if (!consumers) {
+        consumers = new Set();
+        index.set(target, consumers);
+      }
+      consumers.add(logicalId);
+    }
+  }
+  return index;
+}
+
 /**
  * Check if a value is a CloudFormation intrinsic function (Ref, Fn::*, etc.)
  * that cannot be statically evaluated.

package/src/lint/post-synth/index.ts

@@ -50,6 +50,8 @@ import { waw055 } from "./waw055";
 import { waw056 } from "./waw056";
 import { waw057 } from "./waw057";
 import { waw058 } from "./waw058";
+import { waw059 } from "./waw059";
+import { waw060 } from "./waw060";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -102,4 +104,6 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw056,
   waw057,
   waw058,
+  waw059,
+  waw060,
 ];

package/src/lint/post-synth/waw059.test.ts

@@ -0,0 +1,309 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw059, checkWildcardResourceEnumerable } from "./waw059";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+const TRUST = {
+  Version: "2012-10-17",
+  Statement: [
+    {
+      Effect: "Allow",
+      Principal: { Service: "lambda.amazonaws.com" },
+      Action: "sts:AssumeRole",
+    },
+  ],
+};
+
+function role(statement: Record<string, unknown>) {
+  return {
+    Type: "AWS::IAM::Role",
+    Properties: {
+      AssumeRolePolicyDocument: TRUST,
+      Policies: [
+        {
+          PolicyName: "app",
+          PolicyDocument: { Version: "2012-10-17", Statement: [statement] },
+        },
+      ],
+    },
+  };
+}
+
+function lambda(env: Record<string, unknown>) {
+  return {
+    Type: "AWS::Lambda::Function",
+    Properties: {
+      Runtime: "nodejs20.x",
+      Handler: "index.handler",
+      Role: { "Fn::GetAtt": ["AppRole", "Arn"] },
+      Environment: { Variables: env },
+    },
+  };
+}
+
+const BUCKET = { Type: "AWS::S3::Bucket", Properties: {} };
+const TABLE = { Type: "AWS::DynamoDB::Table", Properties: { BillingMode: "PAY_PER_REQUEST" } };
+const QUEUE = { Type: "AWS::SQS::Queue", Properties: {} };
+
+describe("WAW059: wildcard Resource where the declared graph enumerates the touched set", () => {
+  test("check metadata", () => {
+    expect(waw059.id).toBe("WAW059");
+    expect(waw059.description).toContain("declared graph");
+  });
+
+  test("flags an over-broad role inline statement and suggests the declared Arns", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({
+          Effect: "Allow",
+          Action: ["s3:GetObject", "s3:PutObject"],
+          Resource: "*",
+        }),
+        AppFunc: lambda({ BUCKET_NAME: { Ref: "DataBucket" } }),
+      },
+    });
+    const diags = checkWildcardResourceEnumerable(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW059");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("AppRole");
+    expect(diags[0].message).toContain('{"Fn::GetAtt":["DataBucket","Arn"]}');
+    expect(diags[0].message).toContain('"/*"');
+  });
+
+  test("flags a service-wide ARN pattern, not just the bare wildcard", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Jobs: TABLE,
+        AppRole: role({
+          Effect: "Allow",
+          Action: ["dynamodb:GetItem", "dynamodb:Query"],
+          Resource: "arn:aws:dynamodb:*:*:table/*",
+        }),
+        AppFunc: lambda({ TABLE_NAME: { Ref: "Jobs" } }),
+      },
+    });
+    const diags = checkWildcardResourceEnumerable(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('{"Fn::GetAtt":["Jobs","Arn"]}');
+  });
+
+  test("flags an IAM::Policy attached to a declared role via Ref", () => {
+    const ctx = makeCtx({
+      Resources: {
+        WorkQueue: QUEUE,
+        AppRole: { Type: "AWS::IAM::Role", Properties: { AssumeRolePolicyDocument: TRUST } },
+        AppPolicy: {
+          Type: "AWS::IAM::Policy",
+          Properties: {
+            PolicyName: "app",
+            Roles: [{ Ref: "AppRole" }],
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [{ Effect: "Allow", Action: "sqs:SendMessage", Resource: "*" }],
+            },
+          },
+        },
+        AppFunc: lambda({ QUEUE_URL: { Ref: "WorkQueue" } }),
+      },
+    });
+    const diags = checkWildcardResourceEnumerable(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("AppPolicy");
+    expect(diags[0].message).toContain('{"Fn::GetAtt":["WorkQueue","Arn"]}');
+  });
+
+  test("exact-scoped statement is quiet", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({
+          Effect: "Allow",
+          Action: ["s3:GetObject"],
+          Resource: [{ "Fn::GetAtt": ["DataBucket", "Arn"] }],
+        }),
+        AppFunc: lambda({ BUCKET_NAME: { Ref: "DataBucket" } }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("foreign edge (literal service ARN in a consumer) is quiet", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({ Effect: "Allow", Action: "s3:GetObject", Resource: "*" }),
+        AppFunc: lambda({
+          BUCKET_NAME: { Ref: "DataBucket" },
+          EXTERNAL_BUCKET: "arn:aws:s3:::partner-drop-zone",
+        }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("intrinsic edge (Fn::ImportValue in a consumer) is quiet", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({ Effect: "Allow", Action: "s3:GetObject", Resource: "*" }),
+        AppFunc: lambda({
+          BUCKET_NAME: { Ref: "DataBucket" },
+          SHARED_BUCKET: { "Fn::ImportValue": "shared-bucket-name" },
+        }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("statement with a Condition is quiet", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({
+          Effect: "Allow",
+          Action: "s3:GetObject",
+          Resource: "*",
+          Condition: { StringEquals: { "aws:PrincipalOrgID": "o-abc123" } },
+        }),
+        AppFunc: lambda({ BUCKET_NAME: { Ref: "DataBucket" } }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("action outside the curated table is quiet", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({
+          Effect: "Allow",
+          Action: ["ec2:DescribeInstances", "elasticloadbalancing:DescribeTargetGroups"],
+          Resource: "*",
+        }),
+        AppFunc: lambda({ BUCKET_NAME: { Ref: "DataBucket" } }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("action needing '*' in a curated service is quiet (not in the table)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({ Effect: "Allow", Action: "s3:ListAllMyBuckets", Resource: "*" }),
+        AppFunc: lambda({ BUCKET_NAME: { Ref: "DataBucket" } }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("role with no consumers is quiet", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({ Effect: "Allow", Action: "s3:GetObject", Resource: "*" }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("consumers that touch no declared resource of the service are quiet", () => {
+    const ctx = makeCtx({
+      Resources: {
+        AppRole: role({ Effect: "Allow", Action: "s3:GetObject", Resource: "*" }),
+        AppFunc: lambda({ STAGE: "prod" }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("trust policy statements never fire (Principal gate)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: { Type: "AWS::IAM::Role", Properties: { AssumeRolePolicyDocument: TRUST } },
+        AppFunc: lambda({ BUCKET_NAME: { Ref: "DataBucket" } }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("policy attached to users or literal role names is quiet", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        UserPolicy: {
+          Type: "AWS::IAM::Policy",
+          Properties: {
+            PolicyName: "u",
+            Users: ["alice"],
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [{ Effect: "Allow", Action: "s3:GetObject", Resource: "*" }],
+            },
+          },
+        },
+        NamePolicy: {
+          Type: "AWS::IAM::Policy",
+          Properties: {
+            PolicyName: "n",
+            Roles: ["pre-existing-role-name"],
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [{ Effect: "Allow", Action: "s3:GetObject", Resource: "*" }],
+            },
+          },
+        },
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+
+  test("managed policy attached from the role side via ManagedPolicyArns fires", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Jobs: TABLE,
+        AppManaged: {
+          Type: "AWS::IAM::ManagedPolicy",
+          Properties: {
+            PolicyDocument: {
+              Version: "2012-10-17",
+              Statement: [{ Effect: "Allow", Action: "dynamodb:PutItem", Resource: "*" }],
+            },
+          },
+        },
+        AppRole: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: TRUST,
+            ManagedPolicyArns: [{ Ref: "AppManaged" }],
+          },
+        },
+        AppFunc: lambda({ TABLE_NAME: { Ref: "Jobs" } }),
+      },
+    });
+    const diags = checkWildcardResourceEnumerable(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("AppManaged");
+  });
+
+  test("mixed wildcard and concrete Resource entries are quiet (partially scoped)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        DataBucket: BUCKET,
+        AppRole: role({
+          Effect: "Allow",
+          Action: "s3:GetObject",
+          Resource: ["arn:aws:s3:::some-bucket/*", "*"],
+        }),
+        AppFunc: lambda({ BUCKET_NAME: { Ref: "DataBucket" } }),
+      },
+    });
+    expect(checkWildcardResourceEnumerable(ctx)).toHaveLength(0);
+  });
+});