@intentius/chant-lexicon-aws 0.45.0 → 0.46.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/components/cloud-executor.d.ts.map +1 -1
- package/dist/composites/lambda-function.d.ts +4 -4
- package/dist/composites/lambda-function.d.ts.map +1 -1
- package/dist/integrity.json +5 -3
- package/dist/lint/audit-catalog.d.ts.map +1 -1
- package/dist/lint/post-synth/cf-refs.d.ts +7 -0
- package/dist/lint/post-synth/cf-refs.d.ts.map +1 -1
- package/dist/lint/post-synth/index.d.ts.map +1 -1
- package/dist/lint/post-synth/waw059.d.ts +36 -0
- package/dist/lint/post-synth/waw059.d.ts.map +1 -0
- package/dist/lint/post-synth/waw060.d.ts +16 -0
- package/dist/lint/post-synth/waw060.d.ts.map +1 -0
- package/dist/manifest.json +1 -1
- package/dist/okf/index.md +2 -0
- package/dist/okf/rules/WAW059.md +25 -0
- package/dist/okf/rules/WAW060.md +17 -0
- package/dist/okf/types/Action.md +1 -0
- package/dist/okf/types/Bucket.md +1 -0
- package/dist/okf/types/GlobalTable.md +4 -0
- package/dist/okf/types/IamPolicy.md +2 -0
- package/dist/okf/types/InstanceProfile.md +4 -0
- package/dist/okf/types/ManagedPolicy.md +2 -0
- package/dist/okf/types/Map.md +1 -0
- package/dist/okf/types/Queue.md +1 -0
- package/dist/okf/types/Role.md +1 -0
- package/dist/okf/types/Table.md +1 -0
- package/dist/okf/types/Type.md +2 -0
- package/dist/op/activities/aws-apply.d.ts +48 -5
- package/dist/op/activities/aws-apply.d.ts.map +1 -1
- package/dist/op/activities/index.d.ts +5 -4
- package/dist/op/activities/index.d.ts.map +1 -1
- package/dist/ownership.d.ts +18 -0
- package/dist/ownership.d.ts.map +1 -1
- package/dist/plugin.d.ts.map +1 -1
- package/dist/rules/cf-refs.ts +22 -0
- package/dist/rules/waw059.ts +353 -0
- package/dist/rules/waw060.ts +91 -0
- package/dist/serializer.d.ts.map +1 -1
- package/dist/teardown.d.ts +85 -0
- package/dist/teardown.d.ts.map +1 -0
- package/package.json +2 -2
- package/src/components/cloud-executor.ts +10 -1
- package/src/lifecycle-integration.test.ts +4 -0
- package/src/lint/audit-catalog.ts +5 -0
- package/src/lint/post-synth/cf-refs.ts +22 -0
- package/src/lint/post-synth/index.ts +4 -0
- package/src/lint/post-synth/waw059.test.ts +309 -0
- package/src/lint/post-synth/waw059.ts +353 -0
- package/src/lint/post-synth/waw060.test.ts +131 -0
- package/src/lint/post-synth/waw060.ts +91 -0
- package/src/op/activities/aws-apply.test.ts +111 -0
- package/src/op/activities/aws-apply.ts +100 -6
- package/src/op/activities/index.ts +5 -3
- package/src/ownership.test.ts +24 -1
- package/src/ownership.ts +37 -0
- package/src/plugin.ts +18 -0
- package/src/serializer-ownership.test.ts +18 -0
- package/src/serializer.ts +9 -1
- package/src/teardown.test.ts +258 -0
- package/src/teardown.ts +276 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cloud-executor.d.ts","sourceRoot":"","sources":["../../src/components/cloud-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,kDAAkD,CAAC;
|
|
1
|
+
{"version":3,"file":"cloud-executor.d.ts","sourceRoot":"","sources":["../../src/components/cloud-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,kDAAkD,CAAC;AAIjG,YAAY,EAAE,YAAY,EAAE,CAAC;AAM7B,MAAM,WAAW,SAAS;IACxB,6GAA6G;IAC7G,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAID,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,WAAW,EAAE,OAAO,CAAC;IACrB,yGAAyG;IACzG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf;;;kCAG8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,yGAAyG;IACzG,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE,8CAA8C;IAC9C,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,4FAA4F;IAC5F,eAAe,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,mHAAmH;IACnH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7G,uDAAuD;IACvD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1D,yGAAyG;IACzG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAID,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,4GAA4G;IAC5G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,uCAAuC;IACvC,UAAU,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IAC/B,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,sHAAsH;IACtH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,yIAAyI;IACzI,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,iFAAiF;IACjF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5E,8FAA8F;IAC9F,eAAe,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qFAAqF;IACrF,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1E;AAID,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACjG,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,4DAA4D;IAC5D,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvH,4JAA4J;IAC5J,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAID,MAAM,WAAW,gBAAgB;IAC/B,sHAAsH;IACtH,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,+KAA+K;IAC/K,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,uLAAuL;IACvL,UAAU,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,iKAAiK;IACjK,IAAI,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5G;AAID,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,sFAAsF;IACtF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,mFAAmF;IACnF,cAAc,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG,0EAA0E;IAC1E,WAAW,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,gFAAgF;IAChF,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClF,uKAAuK;IACvK,MAAM,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpI;AAID,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,6GAA6G;IAC7G,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,2HAA2H;IAC3H,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4DAA4D;IAC5D,eAAe,CAAC,EAAE,UAAU,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;CACxE;AAED,MAAM,WAAW,SAAS;IACxB,uIAAuI;IACvI,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,2FAA2F;IAC3F,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,2FAA2F;IAC3F,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3G,mDAAmD;IACnD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACxD,uDAAuD;IACvD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAID;;;;;;GAMG;AAGH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,wFAAwF;IACxF,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,qEAAqE;IACrE,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,kBAAkB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAID,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,GAAG,mBAAmB,GAAG,YAAY,CAAC;AAE1G,MAAM,WAAW,cAAc;IAC7B,qJAAqJ;IACrJ,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,oBAAoB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxG,0JAA0J;IAC1J,OAAO,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,SAAS,CAAC;IACf,cAAc,EAAE,oBAAoB,CAAC;IACrC,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,SAAS,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,QAAQ,CAAC;IACb,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGtF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAG3F;AAyBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAE/E;AAED,iGAAiG;AACjG,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAInF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAMnE;AAqGD;;6DAE6D;AAC7D,wBAAgB,eAAe,CAAC,SAAS,EAAE;IAAE,OAAO,EAAE;QAAE,WAAW,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAA;CAAE,GAAG,MAAM,CAEvG;AAED;4EAC4E;AAC5E,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG,SAAS,GACzF,OAAO,CAIT;AA2UD,2HAA2H;AAC3H,wBAAgB,iBAAiB,IAAI,aAAa,CAcjD;AAKD,+FAA+F;AAC/F,wBAAgB,oBAAoB,IAAI,aAAa,CAGpD;AAED,sFAAsF;AACtF,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}
|
|
@@ -27,9 +27,9 @@ export declare const LambdaNode: import("@intentius/chant").CompositeDefinition<
|
|
|
27
27
|
Policies?: InstanceType<typeof Role_Policy>[] | undefined;
|
|
28
28
|
Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
|
|
29
29
|
VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
|
|
30
|
+
ManagedPolicyArns?: string[] | undefined;
|
|
30
31
|
MemorySize?: number | undefined;
|
|
31
32
|
Timeout?: number | undefined;
|
|
32
|
-
ManagedPolicyArns?: string[] | undefined;
|
|
33
33
|
defaults?: {
|
|
34
34
|
role?: Partial<ConstructorParameters<typeof Role>[0]>;
|
|
35
35
|
func?: Partial<ConstructorParameters<typeof Function>[0]>;
|
|
@@ -43,9 +43,9 @@ export declare const LambdaPython: import("@intentius/chant").CompositeDefinitio
|
|
|
43
43
|
Policies?: InstanceType<typeof Role_Policy>[] | undefined;
|
|
44
44
|
Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
|
|
45
45
|
VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
|
|
46
|
+
ManagedPolicyArns?: string[] | undefined;
|
|
46
47
|
MemorySize?: number | undefined;
|
|
47
48
|
Timeout?: number | undefined;
|
|
48
|
-
ManagedPolicyArns?: string[] | undefined;
|
|
49
49
|
defaults?: {
|
|
50
50
|
role?: Partial<ConstructorParameters<typeof Role>[0]>;
|
|
51
51
|
func?: Partial<ConstructorParameters<typeof Function>[0]>;
|
|
@@ -60,9 +60,9 @@ export declare const NodeLambda: import("@intentius/chant").CompositeDefinition<
|
|
|
60
60
|
Policies?: InstanceType<typeof Role_Policy>[] | undefined;
|
|
61
61
|
Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
|
|
62
62
|
VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
|
|
63
|
+
ManagedPolicyArns?: string[] | undefined;
|
|
63
64
|
MemorySize?: number | undefined;
|
|
64
65
|
Timeout?: number | undefined;
|
|
65
|
-
ManagedPolicyArns?: string[] | undefined;
|
|
66
66
|
defaults?: {
|
|
67
67
|
role?: Partial<ConstructorParameters<typeof Role>[0]>;
|
|
68
68
|
func?: Partial<ConstructorParameters<typeof Function>[0]>;
|
|
@@ -77,9 +77,9 @@ export declare const PythonLambda: import("@intentius/chant").CompositeDefinitio
|
|
|
77
77
|
Policies?: InstanceType<typeof Role_Policy>[] | undefined;
|
|
78
78
|
Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
|
|
79
79
|
VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
|
|
80
|
+
ManagedPolicyArns?: string[] | undefined;
|
|
80
81
|
MemorySize?: number | undefined;
|
|
81
82
|
Timeout?: number | undefined;
|
|
82
|
-
ManagedPolicyArns?: string[] | undefined;
|
|
83
83
|
defaults?: {
|
|
84
84
|
role?: Partial<ConstructorParameters<typeof Role>[0]>;
|
|
85
85
|
func?: Partial<ConstructorParameters<typeof Function>[0]>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lambda-function.d.ts","sourceRoot":"","sources":["../../src/composites/lambda-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAkBpC,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACvE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,SAAS,CAAC,EAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,cAAc,2FA6BP,CAAC;AAErB,eAAO,MAAM,UAAU;UApDf,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"lambda-function.d.ts","sourceRoot":"","sources":["../../src/composites/lambda-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAkBpC,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACvE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,SAAS,CAAC,EAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,cAAc,2FA6BP,CAAC;AAErB,eAAO,MAAM,UAAU;UApDf,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;wBAF3C,MAAM,EAAE;iBAFf,MAAM;cADT,MAAM;eAML;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA0CD,CAAC;AAEH,eAAO,MAAM,YAAY;UAzDjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;wBAF3C,MAAM,EAAE;iBAFf,MAAM;cADT,MAAM;eAML;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA+CD,CAAC;AAEH,2CAA2C;AAC3C,eAAO,MAAM,UAAU;UA/Df,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;wBAF3C,MAAM,EAAE;iBAFf,MAAM;cADT,MAAM;eAML;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAkDiC,CAAC;AACrC,6CAA6C;AAC7C,eAAO,MAAM,YAAY;UAjEjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;wBAF3C,MAAM,EAAE;iBAFf,MAAM;cADT,MAAM;eAML;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAoDqC,CAAC"}
|
package/dist/integrity.json
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
{
|
|
2
2
|
"algorithm": "sha256",
|
|
3
3
|
"artifacts": {
|
|
4
|
-
"manifest.json": "
|
|
4
|
+
"manifest.json": "df6e137cd4b191fed64b7a1f64d9478f0ff8c0a997dcee3a52ee3156e94d8911",
|
|
5
5
|
"meta.json": "2e4cae67cbc2eb2962c3dd0aa57008ae96fb725dd0118af7b04b2b44eab7722a",
|
|
6
6
|
"types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
|
|
7
7
|
"rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
|
|
8
8
|
"rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
|
|
9
9
|
"rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
|
|
10
|
-
"rules/cf-refs.ts": "
|
|
10
|
+
"rules/cf-refs.ts": "ec83a98348c9ff418230523bea1de1a08bb6e6c72bbb255ab9bca57191ff5fef",
|
|
11
11
|
"rules/cor020.ts": "915bbb4c083c7b3b84b93e8e891b5ffffe5a138fdccda32ecfdda91b8685798c",
|
|
12
12
|
"rules/ext001.ts": "f8703f37a50ab23d0ecaef539c0215a71269d420fa5e09a3d0454b18b7350b34",
|
|
13
13
|
"rules/waw010.ts": "41c58aaedb8f9fe266f4b40f1a076f762796427fdf9b317b8a4a50c713e45571",
|
|
@@ -58,9 +58,11 @@
|
|
|
58
58
|
"rules/waw056.ts": "d686630ddcdbb9496582b5712a8ceae13f61c19a6803f22f09dd52c0947dd4e9",
|
|
59
59
|
"rules/waw057.ts": "5db562dc7d0c0ccedbfcb08357d2d0f7f561a828df17e1b1a183c338ef0a3ec1",
|
|
60
60
|
"rules/waw058.ts": "fbcfde64bbf81abe919f4e60a7e283a1b2ff30454b2c1cec2e0e099e7ad187e6",
|
|
61
|
+
"rules/waw059.ts": "abaa8b31e5e50837be8d8ebe124b6e2156e0bbb8699e93e60eb63f623db37f24",
|
|
62
|
+
"rules/waw060.ts": "0fd439ba658b44ae16454bc850948d97ebf81739ff5ef0a46de69fcc0c4ac705",
|
|
61
63
|
"skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
|
|
62
64
|
"skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
|
|
63
65
|
"skills/chant-aws-carve-terraform.md": "52dc7a8a10156d236266cc8dbf75614fabb6e2fa4caf31c13cca348e167a58b5"
|
|
64
66
|
},
|
|
65
|
-
"composite": "
|
|
67
|
+
"composite": "6784c3bcfe687d1f0736330b975673c4a8bd900227234e864329fc7863cd521b"
|
|
66
68
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,
|
|
1
|
+
{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0DpD,CAAC"}
|
|
@@ -32,6 +32,13 @@ export declare function parseCFTemplate(output: string | {
|
|
|
32
32
|
* Skips pseudo-parameters (those starting with "AWS::").
|
|
33
33
|
*/
|
|
34
34
|
export declare function findResourceRefs(value: unknown): Set<string>;
|
|
35
|
+
/**
|
|
36
|
+
* Build the reverse of `findResourceRefs` for a whole template: logical id →
|
|
37
|
+
* the set of logical ids whose Properties reference it via Ref/Fn::GetAtt.
|
|
38
|
+
* Lets a check walk the graph consumer-ward (who uses this role?) instead of
|
|
39
|
+
* dependency-ward. Used by WAW059.
|
|
40
|
+
*/
|
|
41
|
+
export declare function buildReverseRefIndex(template: CFTemplate): Map<string, Set<string>>;
|
|
35
42
|
/**
|
|
36
43
|
* Check if a value is a CloudFormation intrinsic function (Ref, Fn::*, etc.)
|
|
37
44
|
* that cannot be statically evaluated.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cf-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cf-refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAWvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI5D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAInD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhC;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAK5F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAgBT"}
|
|
1
|
+
{"version":3,"file":"cf-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cf-refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAWvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAcnF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAInD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhC;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAK5F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAgBT"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAsDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAqD3C,CAAC"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* WAW059: Wildcard Resource where the declared graph enumerates the touched set
|
|
3
|
+
*
|
|
4
|
+
* An identity policy that allows resource-scopable actions on `Resource: "*"`
|
|
5
|
+
* (or a service-wide ARN pattern) when every consumer of the attached role
|
|
6
|
+
* only touches resources declared in the same template. In that case the
|
|
7
|
+
* declared graph already enumerates the touched set, so the statement can be
|
|
8
|
+
* tightened to the `Fn::GetAtt` Arn list of those declared entities.
|
|
9
|
+
*
|
|
10
|
+
* Deliberately narrow (#1225). Fires only when ALL of these hold:
|
|
11
|
+
* - the statement is an `Effect: Allow` identity-policy statement (role inline
|
|
12
|
+
* policy, IAM::Policy, IAM::ManagedPolicy) — trust policies carry a
|
|
13
|
+
* Principal and are skipped, resource policies live on other types;
|
|
14
|
+
* - no Condition/NotAction/NotResource and no intrinsics in Action/Resource;
|
|
15
|
+
* - `Resource` is `"*"` or a service-wide ARN pattern;
|
|
16
|
+
* - every Action is in the curated resource-scopable table (s3, dynamodb,
|
|
17
|
+
* sqs) — actions that genuinely need `"*"` (s3:ListAllMyBuckets,
|
|
18
|
+
* dynamodb:ListTables, sqs:ListQueues) are not in the table;
|
|
19
|
+
* - the attached principal resolves to declared roles only, those roles have
|
|
20
|
+
* consumers in the template, and no consumer carries a foreign edge (a
|
|
21
|
+
* literal ARN of the service) or an intrinsic edge (Fn::ImportValue) that
|
|
22
|
+
* would put resources outside the declared graph in reach.
|
|
23
|
+
*
|
|
24
|
+
* Anything the static graph cannot prove stays quiet.
|
|
25
|
+
*/
|
|
26
|
+
import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
|
|
27
|
+
/**
|
|
28
|
+
* Curated table of actions that support resource-level permissions, per
|
|
29
|
+
* service. Lower-cased (IAM action matching is case-insensitive). An action
|
|
30
|
+
* outside this table gates the whole statement off — it may legitimately
|
|
31
|
+
* require `Resource: "*"`.
|
|
32
|
+
*/
|
|
33
|
+
export declare const RESOURCE_SCOPABLE_ACTIONS: Record<string, ReadonlySet<string>>;
|
|
34
|
+
export declare function checkWildcardResourceEnumerable(ctx: PostSynthContext): PostSynthDiagnostic[];
|
|
35
|
+
export declare const waw059: PostSynthCheck;
|
|
36
|
+
//# sourceMappingURL=waw059.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"waw059.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw059.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAW9G;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CA6CzE,CAAC;AA6KF,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAiF5F;AAED,eAAO,MAAM,MAAM,EAAE,cAQpB,CAAC"}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* WAW060: IAM Policy Attached to No Principal
|
|
3
|
+
*
|
|
4
|
+
* Flags AWS::IAM::Policy / AWS::IAM::ManagedPolicy resources with empty or
|
|
5
|
+
* absent Roles, Users, and Groups that no other part of the template
|
|
6
|
+
* references. A policy attached to no principal grants nothing — the same
|
|
7
|
+
* detached-guardrail shape WAW057 catches for SCPs. Any Ref/GetAtt edge to
|
|
8
|
+
* the policy (a role's ManagedPolicyArns, an attachment-style resource, a
|
|
9
|
+
* stack Output exporting it for another stack to attach) keeps it quiet;
|
|
10
|
+
* plain AWS-managed ARN strings elsewhere are not references to the
|
|
11
|
+
* template's own policy.
|
|
12
|
+
*/
|
|
13
|
+
import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
|
|
14
|
+
export declare function checkPolicyUnattached(ctx: PostSynthContext): PostSynthDiagnostic[];
|
|
15
|
+
export declare const waw060: PostSynthCheck;
|
|
16
|
+
//# sourceMappingURL=waw060.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"waw060.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw060.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAsB9G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA8ClF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}
|
package/dist/manifest.json
CHANGED
package/dist/okf/index.md
CHANGED
|
@@ -1722,3 +1722,5 @@ okf_version: '0.2'
|
|
|
1722
1722
|
* [WAW056](/rules/WAW056.md) - SCP guardrail has no Deny statement — it constrains nothing
|
|
1723
1723
|
* [WAW057](/rules/WAW057.md) - SCP guardrail is attached to no targets — it enforces nothing
|
|
1724
1724
|
* [WAW058](/rules/WAW058.md) - Organization audit trail missing, not logging, or scoped down to a single region
|
|
1725
|
+
* [WAW059](/rules/WAW059.md) - Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
|
1726
|
+
* [WAW060](/rules/WAW060.md) - IAM policy attached to no principal — it grants nothing
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
---
|
|
2
|
+
type: post-synth-check
|
|
3
|
+
title: WAW059
|
|
4
|
+
description: Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
|
5
|
+
id: WAW059
|
|
6
|
+
severity: error
|
|
7
|
+
category: post-synth
|
|
8
|
+
lexicon: aws
|
|
9
|
+
docs: https://intentius.io/chant/lexicons/aws/rules/
|
|
10
|
+
---
|
|
11
|
+
Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
|
12
|
+
|
|
13
|
+
## Applies to
|
|
14
|
+
|
|
15
|
+
- [Action](/types/Action.md)
|
|
16
|
+
- [Bucket](/types/Bucket.md)
|
|
17
|
+
- [GlobalTable](/types/GlobalTable.md)
|
|
18
|
+
- [IamPolicy](/types/IamPolicy.md)
|
|
19
|
+
- [InstanceProfile](/types/InstanceProfile.md)
|
|
20
|
+
- [ManagedPolicy](/types/ManagedPolicy.md)
|
|
21
|
+
- [Map](/types/Map.md)
|
|
22
|
+
- [Queue](/types/Queue.md)
|
|
23
|
+
- [Role](/types/Role.md)
|
|
24
|
+
- [Table](/types/Table.md)
|
|
25
|
+
- [Type](/types/Type.md)
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
---
|
|
2
|
+
type: post-synth-check
|
|
3
|
+
title: WAW060
|
|
4
|
+
description: IAM policy attached to no principal — it grants nothing
|
|
5
|
+
id: WAW060
|
|
6
|
+
severity: error
|
|
7
|
+
category: post-synth
|
|
8
|
+
lexicon: aws
|
|
9
|
+
docs: https://intentius.io/chant/lexicons/aws/rules/
|
|
10
|
+
---
|
|
11
|
+
IAM policy attached to no principal — it grants nothing
|
|
12
|
+
|
|
13
|
+
## Applies to
|
|
14
|
+
|
|
15
|
+
- [IamPolicy](/types/IamPolicy.md)
|
|
16
|
+
- [ManagedPolicy](/types/ManagedPolicy.md)
|
|
17
|
+
- [Type](/types/Type.md)
|
package/dist/okf/types/Action.md
CHANGED
|
@@ -31,3 +31,4 @@ resource_type: AWS::SageMaker::Action
|
|
|
31
31
|
## Governed by
|
|
32
32
|
|
|
33
33
|
- [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
|
|
34
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
package/dist/okf/types/Bucket.md
CHANGED
|
@@ -63,3 +63,4 @@ resource_type: AWS::S3::Bucket
|
|
|
63
63
|
- [WAW006](/rules/WAW006.md): S3 Bucket Encryption
|
|
64
64
|
- [WAW018](/rules/WAW018.md): S3 bucket missing public access block — all public access should be blocked
|
|
65
65
|
- [WAW042](/rules/WAW042.md): S3 bucket missing a TLS-only bucket policy — deny requests over plaintext
|
|
66
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
|
@@ -24,3 +24,5 @@ resource_type: AWS::IAM::Policy
|
|
|
24
24
|
## Governed by
|
|
25
25
|
|
|
26
26
|
- [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
|
|
27
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
|
28
|
+
- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
|
|
@@ -40,3 +40,5 @@ resource_type: AWS::IAM::ManagedPolicy
|
|
|
40
40
|
## Governed by
|
|
41
41
|
|
|
42
42
|
- [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
|
|
43
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
|
44
|
+
- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
|
package/dist/okf/types/Map.md
CHANGED
|
@@ -34,3 +34,4 @@ resource_type: AWS::Location::Map
|
|
|
34
34
|
- [WAW015](/rules/WAW015.md): Circular dependency between nested stacks would cause infinite build recursion
|
|
35
35
|
- [WAW016](/rules/WAW016.md): Deprecated property usage — flags properties marked as deprecated in the CloudFormation Registry
|
|
36
36
|
- [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
|
|
37
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
package/dist/okf/types/Queue.md
CHANGED
|
@@ -37,3 +37,4 @@ resource_type: AWS::SQS::Queue
|
|
|
37
37
|
## Governed by
|
|
38
38
|
|
|
39
39
|
- [WAW026](/rules/WAW026.md): SQS queue is not encrypted — enable SqsManagedSseEnabled or set KmsMasterKeyId
|
|
40
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
package/dist/okf/types/Role.md
CHANGED
|
@@ -31,3 +31,4 @@ resource_type: AWS::IAM::Role
|
|
|
31
31
|
|
|
32
32
|
- [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
|
|
33
33
|
- [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
|
|
34
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
package/dist/okf/types/Table.md
CHANGED
|
@@ -42,3 +42,4 @@ resource_type: AWS::DynamoDB::Table
|
|
|
42
42
|
|
|
43
43
|
- [WAW027](/rules/WAW027.md): DynamoDB table does not have point-in-time recovery enabled
|
|
44
44
|
- [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns
|
|
45
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
package/dist/okf/types/Type.md
CHANGED
|
@@ -73,3 +73,5 @@ resource_type: AWS::Cassandra::Type
|
|
|
73
73
|
- [WAW056](/rules/WAW056.md): SCP guardrail has no Deny statement — it constrains nothing
|
|
74
74
|
- [WAW057](/rules/WAW057.md): SCP guardrail is attached to no targets — it enforces nothing
|
|
75
75
|
- [WAW058](/rules/WAW058.md): Organization audit trail missing, not logging, or scoped down to a single region
|
|
76
|
+
- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
|
|
77
|
+
- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
|
|
@@ -35,6 +35,12 @@ export declare function cfnUrl(endpoint?: string, region?: string, env?: Record<
|
|
|
35
35
|
export declare function cfnForm(action: string, params: Record<string, string>): Record<string, string>;
|
|
36
36
|
/** Capabilities as the CFN `Capabilities.member.N` list params. */
|
|
37
37
|
export declare function capabilityParams(capabilities: string[]): Record<string, string>;
|
|
38
|
+
/**
|
|
39
|
+
* Stack tags as the CFN `Tags.member.N.Key/Value` list params (#1222). Sorted
|
|
40
|
+
* so the request is deterministic. Empty in, empty out — a template without an
|
|
41
|
+
* ownership marker adds no `Tags` parameter at all.
|
|
42
|
+
*/
|
|
43
|
+
export declare function tagParams(tags: Record<string, string>): Record<string, string>;
|
|
38
44
|
/**
|
|
39
45
|
* First `<tag>…</tag>` text in a CFN XML response.
|
|
40
46
|
*
|
|
@@ -65,22 +71,59 @@ export declare function waitForStackSettled(url: string, stackName: string, http
|
|
|
65
71
|
* CloudFormation API directly (create-or-update + poll to a settled stack),
|
|
66
72
|
* targeting a local Floci emulator or real AWS by endpoint override. The direct
|
|
67
73
|
* twin of `azApply`/`gcpApply`: it speaks the CloudFormation Query API over HTTP
|
|
68
|
-
* rather than shelling `aws cloudformation deploy`
|
|
69
|
-
*
|
|
70
|
-
* ownership boundary, so deletes ride CloudFormation
|
|
71
|
-
* `http` is injectable for tests.
|
|
74
|
+
* rather than shelling `aws cloudformation deploy` — and since chant #1449 it is
|
|
75
|
+
* also what `nativeApply({ target: "cloudformation" })` runs, so no CLI path
|
|
76
|
+
* remains. The stack is the ownership boundary, so deletes ride CloudFormation
|
|
77
|
+
* itself — no separate prune. `http` is injectable for tests.
|
|
72
78
|
*/
|
|
73
79
|
export declare function awsApply(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
|
|
74
80
|
stackName: string;
|
|
75
81
|
status: string;
|
|
76
82
|
action: "created" | "updated" | "unchanged";
|
|
77
83
|
}>;
|
|
84
|
+
/** {@link awsDelete}'s arguments: {@link AwsApplyArgs} minus the template — a
|
|
85
|
+
* delete needs no body, so teardown (#1222) can call it with a stack name
|
|
86
|
+
* alone. Op builders that thread `templatePath` through keep working; it is
|
|
87
|
+
* simply unused here. */
|
|
88
|
+
export type AwsDeleteArgs = Omit<AwsApplyArgs, "templatePath"> & {
|
|
89
|
+
templatePath?: string;
|
|
90
|
+
};
|
|
78
91
|
/**
|
|
79
92
|
* The inverse of {@link awsApply} — DeleteStack, then poll until the stack is
|
|
80
93
|
* gone. Idempotent: an already-absent stack is a no-op. `http` is injectable.
|
|
81
94
|
*/
|
|
82
|
-
export declare function awsDelete(args:
|
|
95
|
+
export declare function awsDelete(args: AwsDeleteArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
|
|
83
96
|
stackName: string;
|
|
84
97
|
deleted: boolean;
|
|
85
98
|
}>;
|
|
99
|
+
export interface RollbackStackArgs {
|
|
100
|
+
/** CloudFormation stack name to roll back. */
|
|
101
|
+
stackName: string;
|
|
102
|
+
/** CFN endpoint override — same resolution rule as {@link AwsApplyArgs.endpoint} (#1694). */
|
|
103
|
+
endpoint?: string;
|
|
104
|
+
/** Region (real CFN host). Default: `us-east-1`. */
|
|
105
|
+
region?: string;
|
|
106
|
+
/** Stack-settle timeout in ms. Default: `300000`. */
|
|
107
|
+
timeoutMs?: number;
|
|
108
|
+
/** Poll interval in ms. Default: `3000`. */
|
|
109
|
+
intervalMs?: number;
|
|
110
|
+
}
|
|
111
|
+
/**
|
|
112
|
+
* The saga compensation for {@link awsApply} — CloudFormation `RollbackStack`
|
|
113
|
+
* via the same Query-API client, then poll until the stack settles. Returns the
|
|
114
|
+
* stack to its last known stable state after a failed update (#1449 — this
|
|
115
|
+
* replaces the Temporal lexicon exec-ing `aws cloudformation rollback-stack`).
|
|
116
|
+
*
|
|
117
|
+
* Degrades rather than crashes in two cases where there is nothing to do:
|
|
118
|
+
* an absent stack (nothing applied, nothing to revert) and a target that does
|
|
119
|
+
* not implement the action — Floci answers `UnknownAction` (#947). Both return
|
|
120
|
+
* `rolledBack: false` with a logged warning; every other API error throws,
|
|
121
|
+
* because a compensation that silently fails leaves partial state looking
|
|
122
|
+
* reverted when it isn't. `http` is injectable for tests.
|
|
123
|
+
*/
|
|
124
|
+
export declare function rollbackStack(args: RollbackStackArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
|
|
125
|
+
stackName: string;
|
|
126
|
+
rolledBack: boolean;
|
|
127
|
+
status?: string;
|
|
128
|
+
}>;
|
|
86
129
|
//# sourceMappingURL=aws-apply.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI;;;GAGG;AACH,wBAAgB,MAAM,CACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,SAAiB,EACvB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAGR;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAID;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAiD7F;AAED;;;yBAGyB;AACzB,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsBlD;AAED,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BtE"}
|
|
@@ -2,8 +2,9 @@
|
|
|
2
2
|
* AWS Op activities — resolved by the core activity registry when a project's
|
|
3
3
|
* `chant.config.ts` lists the `aws` lexicon. Contributes the local Floci AWS
|
|
4
4
|
* emulator lifecycle (`flociUp`/`flociDown`) and the native CloudFormation
|
|
5
|
-
* applier (`awsApply`
|
|
6
|
-
* shelling `aws` — the
|
|
5
|
+
* applier (`awsApply`, with `awsDelete` and the `rollbackStack` compensation),
|
|
6
|
+
* which calls the CloudFormation API directly rather than shelling `aws` — the
|
|
7
|
+
* direct twin of `azApply`/`gcpApply`.
|
|
7
8
|
*
|
|
8
9
|
* The registry keys every exported *function* here by its name, so only the
|
|
9
10
|
* activities themselves belong in this barrel. `awsAgentCoreFetchTrace`'s
|
|
@@ -15,8 +16,8 @@
|
|
|
15
16
|
*/
|
|
16
17
|
export { flociUp, flociDown, flociRunCommand, flociRmCommand, flociExistsCommand, flociHealthUrl, flociEnv, isFlociReady, } from "./floci.js";
|
|
17
18
|
export type { FlociUpArgs, FlociDownArgs } from "./floci.js";
|
|
18
|
-
export { awsApply, awsDelete, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
|
|
19
|
-
export type { AwsApplyArgs, AwsHttp } from "./aws-apply.js";
|
|
19
|
+
export { awsApply, awsDelete, rollbackStack, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
|
|
20
|
+
export type { AwsApplyArgs, RollbackStackArgs, AwsHttp } from "./aws-apply.js";
|
|
20
21
|
export { awsAgentCoreFetchTrace } from "../../agentcore/trace-fetch.js";
|
|
21
22
|
export type { AgentCoreTraceSource, AwsAgentCoreFetchTraceArgs, AwsAgentCoreFetchTraceResult, } from "../../agentcore/trace-fetch.js";
|
|
22
23
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC"}
|
package/dist/ownership.d.ts
CHANGED
|
@@ -7,4 +7,22 @@
|
|
|
7
7
|
import type { ChannelKeys } from "@intentius/chant/ownership";
|
|
8
8
|
/** AWS tag keys for chant's ownership markers. */
|
|
9
9
|
export declare const AWS_TAG_OWNERSHIP_KEYS: ChannelKeys;
|
|
10
|
+
/**
|
|
11
|
+
* Template-level `Metadata` key the serializer stamps the ownership marker
|
|
12
|
+
* under (#1222). Stack-level teardown verifies ownership on the *stack's own*
|
|
13
|
+
* tags, and CloudFormation stack tags are an API parameter, not a template
|
|
14
|
+
* section — so the template carries the marker here and the apply paths
|
|
15
|
+
* (`awsApply`, the `cfn-deploy` change set) turn it into stack tags on
|
|
16
|
+
* create/update. One source: the same build that stamps resource tags decides
|
|
17
|
+
* the stack tags.
|
|
18
|
+
*/
|
|
19
|
+
export declare const OWNERSHIP_METADATA_KEY = "chant:ownership";
|
|
20
|
+
/**
|
|
21
|
+
* The stack tags a template body asks for: the flat tag map under
|
|
22
|
+
* `Metadata["chant:ownership"]`, or nothing. Total on bad input — a body that
|
|
23
|
+
* is not JSON (a YAML template, a handwritten one) or carries no marker
|
|
24
|
+
* returns `{}`, and the stack simply stays untagged, which teardown reports
|
|
25
|
+
* as unverified rather than deleting.
|
|
26
|
+
*/
|
|
27
|
+
export declare function ownershipStackTagsForBody(body: string): Record<string, string>;
|
|
10
28
|
//# sourceMappingURL=ownership.d.ts.map
|
package/dist/ownership.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,EAAE,WAIpC,CAAC"}
|
|
1
|
+
{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,EAAE,WAIpC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiB9E"}
|
package/dist/plugin.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,
|
|
1
|
+
{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAm7BvB,CAAC"}
|
package/dist/rules/cf-refs.ts
CHANGED
|
@@ -50,6 +50,28 @@ export function findResourceRefs(value: unknown): Set<string> {
|
|
|
50
50
|
return refs;
|
|
51
51
|
}
|
|
52
52
|
|
|
53
|
+
/**
|
|
54
|
+
* Build the reverse of `findResourceRefs` for a whole template: logical id →
|
|
55
|
+
* the set of logical ids whose Properties reference it via Ref/Fn::GetAtt.
|
|
56
|
+
* Lets a check walk the graph consumer-ward (who uses this role?) instead of
|
|
57
|
+
* dependency-ward. Used by WAW059.
|
|
58
|
+
*/
|
|
59
|
+
export function buildReverseRefIndex(template: CFTemplate): Map<string, Set<string>> {
|
|
60
|
+
const index = new Map<string, Set<string>>();
|
|
61
|
+
for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
|
|
62
|
+
for (const target of findResourceRefs(resource.Properties)) {
|
|
63
|
+
if (target === logicalId) continue;
|
|
64
|
+
let consumers = index.get(target);
|
|
65
|
+
if (!consumers) {
|
|
66
|
+
consumers = new Set();
|
|
67
|
+
index.set(target, consumers);
|
|
68
|
+
}
|
|
69
|
+
consumers.add(logicalId);
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
return index;
|
|
73
|
+
}
|
|
74
|
+
|
|
53
75
|
/**
|
|
54
76
|
* Check if a value is a CloudFormation intrinsic function (Ref, Fn::*, etc.)
|
|
55
77
|
* that cannot be statically evaluated.
|