@intentius/chant-lexicon-aws 0.45.0 → 0.46.0

package/dist/rules/waw059.ts

@@ -0,0 +1,353 @@
+/**
+ * WAW059: Wildcard Resource where the declared graph enumerates the touched set
+ *
+ * An identity policy that allows resource-scopable actions on `Resource: "*"`
+ * (or a service-wide ARN pattern) when every consumer of the attached role
+ * only touches resources declared in the same template. In that case the
+ * declared graph already enumerates the touched set, so the statement can be
+ * tightened to the `Fn::GetAtt` Arn list of those declared entities.
+ *
+ * Deliberately narrow (#1225). Fires only when ALL of these hold:
+ * - the statement is an `Effect: Allow` identity-policy statement (role inline
+ *   policy, IAM::Policy, IAM::ManagedPolicy) — trust policies carry a
+ *   Principal and are skipped, resource policies live on other types;
+ * - no Condition/NotAction/NotResource and no intrinsics in Action/Resource;
+ * - `Resource` is `"*"` or a service-wide ARN pattern;
+ * - every Action is in the curated resource-scopable table (s3, dynamodb,
+ *   sqs) — actions that genuinely need `"*"` (s3:ListAllMyBuckets,
+ *   dynamodb:ListTables, sqs:ListQueues) are not in the table;
+ * - the attached principal resolves to declared roles only, those roles have
+ *   consumers in the template, and no consumer carries a foreign edge (a
+ *   literal ARN of the service) or an intrinsic edge (Fn::ImportValue) that
+ *   would put resources outside the declared graph in reach.
+ *
+ * Anything the static graph cannot prove stays quiet.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import {
+  parseCFTemplate,
+  walkPolicyStatements,
+  findResourceRefs,
+  buildReverseRefIndex,
+  isIntrinsic,
+  type CFTemplate,
+  type CFResource,
+} from "./cf-refs";
+
+/**
+ * Curated table of actions that support resource-level permissions, per
+ * service. Lower-cased (IAM action matching is case-insensitive). An action
+ * outside this table gates the whole statement off — it may legitimately
+ * require `Resource: "*"`.
+ */
+export const RESOURCE_SCOPABLE_ACTIONS: Record<string, ReadonlySet<string>> = {
+  s3: new Set([
+    "getobject",
+    "getobjectversion",
+    "getobjectacl",
+    "getobjecttagging",
+    "putobject",
+    "putobjectacl",
+    "putobjecttagging",
+    "deleteobject",
+    "deleteobjectversion",
+    "listbucket",
+    "listbucketversions",
+    "listbucketmultipartuploads",
+    "listmultipartuploadparts",
+    "abortmultipartupload",
+    "getbucketlocation",
+  ]),
+  dynamodb: new Set([
+    "getitem",
+    "batchgetitem",
+    "query",
+    "scan",
+    "putitem",
+    "updateitem",
+    "deleteitem",
+    "batchwriteitem",
+    "conditioncheckitem",
+    "describetable",
+    "getrecords",
+    "getsharditerator",
+    "describestream",
+  ]),
+  sqs: new Set([
+    "sendmessage",
+    "sendmessagebatch",
+    "receivemessage",
+    "deletemessage",
+    "deletemessagebatch",
+    "changemessagevisibility",
+    "changemessagevisibilitybatch",
+    "getqueueattributes",
+    "getqueueurl",
+    "purgequeue",
+  ]),
+};
+
+/** CloudFormation types that declare an entity of each curated service. */
+const SERVICE_RESOURCE_TYPES: Record<string, ReadonlySet<string>> = {
+  s3: new Set(["AWS::S3::Bucket"]),
+  dynamodb: new Set(["AWS::DynamoDB::Table", "AWS::DynamoDB::GlobalTable"]),
+  sqs: new Set(["AWS::SQS::Queue"]),
+};
+
+/**
+ * ARN resource segments that make an ARN service-wide rather than
+ * entity-scoped. `arn:aws:s3:::my-bucket/*` is bucket-scoped and NOT here.
+ */
+const SERVICE_WIDE_REST: Record<string, ReadonlySet<string>> = {
+  s3: new Set(["*"]),
+  dynamodb: new Set(["*", "table/*"]),
+  sqs: new Set(["*"]),
+};
+
+const IAM_TYPES = new Set(["AWS::IAM::Policy", "AWS::IAM::Role", "AWS::IAM::ManagedPolicy"]);
+
+const ARN_SERVICE_RE = /arn:[^:\s]*:([a-z0-9-]+):/g;
+
+function asStringArray(value: unknown): string[] | null {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+    return value as string[];
+  }
+  return null;
+}
+
+/** `"*"`, or an ARN whose service is in `services` and whose resource segment is service-wide. */
+function isServiceWideResource(value: string, services: Set<string>): boolean {
+  if (value === "*") return true;
+  const m = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(value);
+  if (!m) return false;
+  const [, service, rest] = m;
+  if (!services.has(service)) return false;
+  return SERVICE_WIDE_REST[service]?.has(rest) ?? false;
+}
+
+/**
+ * The services an Allow statement touches, if every action lands in the
+ * curated resource-scopable table. Null when any action is outside it
+ * (or malformed / an action-name wildcard).
+ */
+function curatedServices(actions: string[]): Set<string> | null {
+  const services = new Set<string>();
+  for (const action of actions) {
+    const m = /^([a-z0-9-]+):([A-Za-z0-9]+)$/.exec(action);
+    if (!m) return null;
+    const [, service, name] = m;
+    const table = RESOURCE_SCOPABLE_ACTIONS[service];
+    if (!table || !table.has(name.toLowerCase())) return null;
+    services.add(service);
+  }
+  return services.size > 0 ? services : null;
+}
+
+/**
+ * Resolve which declared roles a policy resource is attached to. Null means
+ * "cannot prove" (users/groups, literal role names, no roles at all).
+ */
+function attachedRoles(logicalId: string, resource: CFResource, template: CFTemplate): Set<string> | null {
+  const resources = template.Resources ?? {};
+  if (resource.Type === "AWS::IAM::Role") return new Set([logicalId]);
+
+  const props = resource.Properties ?? {};
+  // Users/groups have no consumers in the resource graph — untraceable.
+  if (Array.isArray(props.Users) && props.Users.length > 0) return null;
+  if (Array.isArray(props.Groups) && props.Groups.length > 0) return null;
+
+  const roles = new Set<string>();
+  if (props.Roles !== undefined) {
+    if (!Array.isArray(props.Roles)) return null;
+    for (const entry of props.Roles) {
+      // A literal role name points outside the declared graph.
+      if (typeof entry === "string") return null;
+      const refs = findResourceRefs(entry);
+      if (refs.size !== 1) return null;
+      const [id] = refs;
+      if (resources[id]?.Type !== "AWS::IAM::Role") return null;
+      roles.add(id);
+    }
+  }
+
+  // A managed policy can also be attached from the role side (ManagedPolicyArns).
+  if (resource.Type === "AWS::IAM::ManagedPolicy") {
+    for (const [roleId, candidate] of Object.entries(resources)) {
+      if (candidate.Type !== "AWS::IAM::Role") continue;
+      if (findResourceRefs(candidate.Properties?.ManagedPolicyArns).has(logicalId)) {
+        roles.add(roleId);
+      }
+    }
+  }
+
+  return roles.size > 0 ? roles : null;
+}
+
+/**
+ * The non-IAM resources that reference any of the roles (the role's
+ * consumers). An IAM::InstanceProfile is a pass-through hop: its own
+ * consumers count instead.
+ */
+function consumersOf(
+  roleIds: Set<string>,
+  reverseIndex: Map<string, Set<string>>,
+  template: CFTemplate,
+): Array<[string, CFResource]> {
+  const resources = template.Resources ?? {};
+  const seen = new Set<string>();
+  const queue = [...roleIds].flatMap((id) => [...(reverseIndex.get(id) ?? [])]);
+  const consumers: Array<[string, CFResource]> = [];
+
+  while (queue.length > 0) {
+    const id = queue.shift() as string;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const resource = resources[id];
+    if (!resource) continue;
+    if (resource.Type === "AWS::IAM::InstanceProfile") {
+      queue.push(...(reverseIndex.get(id) ?? []));
+      continue;
+    }
+    if (resource.Type.startsWith("AWS::IAM::")) continue; // attachment, not consumption
+    consumers.push([id, resource]);
+  }
+
+  return consumers;
+}
+
+/**
+ * A consumer edge the declared graph cannot enumerate: a literal ARN of one
+ * of the statement's services (a foreign, undeclared entity) or an
+ * Fn::ImportValue anywhere in the consumer (a cross-stack edge).
+ */
+function hasForeignOrIntrinsicEdge(value: unknown, services: Set<string>): boolean {
+  if (value === null || value === undefined) return false;
+  if (typeof value === "string") {
+    for (const m of value.matchAll(ARN_SERVICE_RE)) {
+      if (services.has(m[1])) return true;
+    }
+    return false;
+  }
+  if (typeof value !== "object") return false;
+  if (Array.isArray(value)) {
+    return value.some((item) => hasForeignOrIntrinsicEdge(item, services));
+  }
+  const obj = value as Record<string, unknown>;
+  if ("Fn::ImportValue" in obj) return true;
+  return Object.values(obj).some((v) => hasForeignOrIntrinsicEdge(v, services));
+}
+
+const S3_OBJECT_ACTIONS = new Set([
+  "getobject",
+  "getobjectversion",
+  "getobjectacl",
+  "getobjecttagging",
+  "putobject",
+  "putobjectacl",
+  "putobjecttagging",
+  "deleteobject",
+  "deleteobjectversion",
+  "listmultipartuploadparts",
+  "abortmultipartupload",
+]);
+
+function policyKind(type: string): string {
+  if (type === "AWS::IAM::Role") return "role";
+  if (type === "AWS::IAM::ManagedPolicy") return "managed policy";
+  return "policy";
+}
+
+export function checkWildcardResourceEnumerable(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    const reverseIndex = buildReverseRefIndex(template);
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (!IAM_TYPES.has(resource.Type)) continue;
+
+      // walkPolicyStatements also yields a role's AssumeRolePolicyDocument
+      // statements; those always carry a Principal and are gated off below.
+      for (const stmt of walkPolicyStatements(resource)) {
+        if (stmt.Effect !== "Allow") continue;
+        if ("Condition" in stmt || "NotAction" in stmt || "NotResource" in stmt) continue;
+        if ("Principal" in stmt || "NotPrincipal" in stmt) continue;
+        if (isIntrinsic(stmt.Action) || isIntrinsic(stmt.Resource)) continue;
+
+        const actions = asStringArray(stmt.Action);
+        const resources = asStringArray(stmt.Resource);
+        if (!actions || !resources || actions.length === 0 || resources.length === 0) continue;
+
+        const services = curatedServices(actions);
+        if (!services) continue;
+        if (!resources.every((r) => isServiceWideResource(r, services))) continue;
+
+        const roles = attachedRoles(logicalId, resource, template);
+        if (!roles) continue;
+
+        const consumers = consumersOf(roles, reverseIndex, template);
+        if (consumers.length === 0) continue;
+
+        // Every consumer edge must stay inside the declared graph.
+        if (consumers.some(([, c]) => hasForeignOrIntrinsicEdge(c.Properties, services))) continue;
+
+        // The declared entities of each granted service the consumers touch.
+        const touched = new Set<string>();
+        let enumerable = true;
+        for (const service of services) {
+          const types = SERVICE_RESOURCE_TYPES[service];
+          const serviceTouched = new Set<string>();
+          for (const [, consumer] of consumers) {
+            for (const ref of findResourceRefs(consumer.Properties)) {
+              if (types.has(template.Resources[ref]?.Type ?? "")) serviceTouched.add(ref);
+            }
+          }
+          if (serviceTouched.size === 0) {
+            enumerable = false;
+            break;
+          }
+          for (const id of serviceTouched) touched.add(id);
+        }
+        if (!enumerable) continue;
+
+        const suggestion = JSON.stringify(
+          [...touched].sort().map((id) => ({ "Fn::GetAtt": [id, "Arn"] })),
+        );
+        const objectHint = actions.some((a) => {
+          const [service, name] = a.split(":");
+          return service === "s3" && S3_OBJECT_ACTIONS.has(name.toLowerCase());
+        })
+          ? ' (s3 object-level actions also need the "/*" object suffix on the bucket Arn)'
+          : "";
+
+        diagnostics.push({
+          checkId: "WAW059",
+          severity: "warning",
+          message:
+            `IAM ${policyKind(resource.Type)} "${logicalId}" allows ${actions.join(", ")} on ` +
+            `Resource ${JSON.stringify(stmt.Resource)}, but the declared graph enumerates the touched set — ` +
+            `tighten Resource to ${suggestion}${objectHint}`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw059: PostSynthCheck = {
+  id: "WAW059",
+  description:
+    "Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkWildcardResourceEnumerable(ctx);
+  },
+};

package/dist/rules/waw060.ts

@@ -0,0 +1,91 @@
+/**
+ * WAW060: IAM Policy Attached to No Principal
+ *
+ * Flags AWS::IAM::Policy / AWS::IAM::ManagedPolicy resources with empty or
+ * absent Roles, Users, and Groups that no other part of the template
+ * references. A policy attached to no principal grants nothing — the same
+ * detached-guardrail shape WAW057 catches for SCPs. Any Ref/GetAtt edge to
+ * the policy (a role's ManagedPolicyArns, an attachment-style resource, a
+ * stack Output exporting it for another stack to attach) keeps it quiet;
+ * plain AWS-managed ARN strings elsewhere are not references to the
+ * template's own policy.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, isIntrinsic, type CFTemplate } from "./cf-refs";
+
+const POLICY_TYPES = new Set(["AWS::IAM::Policy", "AWS::IAM::ManagedPolicy"]);
+const PRINCIPAL_PROPS = ["Roles", "Users", "Groups"] as const;
+
+/**
+ * Collect every logical id referenced via Ref/Fn::GetAtt from anywhere in the
+ * template except the policy resources themselves — other resources'
+ * properties and the Outputs section. An Output edge counts as attachment
+ * evidence: the policy may be exported for a consuming stack to attach.
+ */
+function collectExternalRefs(template: CFTemplate, excludeIds: Set<string>): Set<string> {
+  const refs = new Set<string>();
+  for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+    if (excludeIds.has(logicalId)) continue;
+    for (const ref of findResourceRefs(resource)) refs.add(ref);
+  }
+  for (const ref of findResourceRefs(template.Outputs)) refs.add(ref);
+  return refs;
+}
+
+export function checkPolicyUnattached(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    const policyIds = new Set(
+      Object.entries(template.Resources)
+        .filter(([, resource]) => POLICY_TYPES.has(resource.Type))
+        .map(([logicalId]) => logicalId),
+    );
+    if (policyIds.size === 0) continue;
+
+    const externalRefs = collectExternalRefs(template, policyIds);
+
+    for (const logicalId of policyIds) {
+      const resource = template.Resources[logicalId];
+      const props = resource.Properties ?? {};
+
+      // Any declared principal list keeps the policy quiet. An intrinsic
+      // can't be statically evaluated, so it counts as attached.
+      let attached = false;
+      for (const prop of PRINCIPAL_PROPS) {
+        const value = props[prop];
+        if (isIntrinsic(value)) attached = true;
+        else if (Array.isArray(value) && value.length > 0) attached = true;
+      }
+      if (attached) continue;
+
+      // Reverse lookup: anything else in the template holding a Ref/GetAtt
+      // edge to this policy attaches (or exports) it.
+      if (externalRefs.has(logicalId)) continue;
+
+      const kind = resource.Type === "AWS::IAM::ManagedPolicy" ? "Managed policy" : "Policy";
+      diagnostics.push({
+        checkId: "WAW060",
+        severity: "warning",
+        message: `${kind} "${logicalId}" is attached to no principal — no Roles/Users/Groups and nothing in the template references it; an unattached policy grants nothing`,
+        entity: logicalId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw060: PostSynthCheck = {
+  id: "WAW060",
+  description: "IAM policy attached to no principal — it grants nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkPolicyUnattached(ctx);
+  },
+};

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA0YlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAoE3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAkZlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAoE3B,CAAC"}

package/dist/teardown.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Env teardown for the aws lexicon (chant #1222) — both halves of the
+ * `teardownOwned` / `executeTeardown` capability pair, at STACK granularity.
+ *
+ * Per-resource selection is impossible here by construction: the thin read
+ * (`describeResources`) is sourced from `describe-stack-resources`, which
+ * returns no tags, so no resource-level marker can be read on the teardown
+ * path. The stack is aws's ownership boundary anyway — the applier deploys
+ * whole stacks and deletes ride CloudFormation — so teardown enumerates the
+ * environment's stacks and verifies the marker on each STACK's own tags
+ * (`DescribeStacks` → `Tags`), stamped there by the apply paths from the
+ * template's `Metadata["chant:ownership"]` block.
+ *
+ * Which stacks are the environment's: the project's declared `stacks[]` when
+ * it is a multi-stack project, else the single-stack convention — the explicit
+ * `stack` option, else the stack named after the environment (the same rule
+ * `describeResources` and `exportResources` apply, see chant #932).
+ *
+ * Verification is tag-reading, never name-trusting. A resolved stack whose
+ * tags carry exactly the requested identity (managed-by + stack + env) is a
+ * candidate of type `AWS::CloudFormation::Stack`. A stack carrying a DIFFERENT
+ * marker identity verifiably belongs to another project or env — out of scope,
+ * silently, the way another env's resources are. A stack carrying NO marker at
+ * all is unknowable — a legacy chant stack from before stack tagging, or a
+ * foreign stack that happens to hold the env's name — and is reported as a
+ * hole (`filtered` / unverified-ownership), never deleted. An absent stack is
+ * knowledge, not a hole: nothing to tear down.
+ *
+ * Execution re-reads each candidate stack's tags immediately before deleting
+ * (the enumeration is a moment old at best, and a delete is not undoable),
+ * then rides the existing Query-API delete — `awsDelete`, DeleteStack polled
+ * to DELETE_COMPLETE. An identity that no longer matches is `not-prunable:
+ * unverified-ownership`; an already-absent stack is `deleted` (teardown is
+ * idempotent).
+ */
+import type { TeardownCandidate, TeardownEnumeration, TeardownExecution } from "@intentius/chant/lexicon";
+import { type OwnershipMarker } from "@intentius/chant/ownership";
+import { type AwsReadClientOptions } from "./api/read-client.js";
+import { type AwsHttp } from "./op/activities/aws-apply.js";
+/** The one candidate type this lexicon's teardown produces: whole stacks. */
+export declare const STACK_TYPE = "AWS::CloudFormation::Stack";
+export interface AwsTeardownOptions {
+    environment: string;
+    /** The identity to select on: this project's ownership stack + the env being torn down. */
+    marker: OwnershipMarker;
+    /** Explicit deployed stack name (single-stack override). */
+    stack?: string;
+    /** Region that stack is deployed in. */
+    region?: string;
+    /** A multi-stack project's declared stacks (chant.config `stacks[]`). */
+    stacks?: Array<{
+        name: string;
+        region?: string;
+    }>;
+}
+/** Injectable transports/timeouts, so tests double the Query API (no network). */
+export interface AwsTeardownDeps {
+    /** Options for the read client's `DescribeStacks` calls (http injection, endpoint). */
+    read?: AwsReadClientOptions;
+    /** The applier transport `awsDelete` polls DeleteStack through. */
+    applyHttp?: AwsHttp;
+    /** DeleteStack settle timeout in ms (default `awsDelete`'s 300000). */
+    timeoutMs?: number;
+    /** DeleteStack poll interval in ms (default `awsDelete`'s 3000). */
+    intervalMs?: number;
+}
+/** The stacks an env teardown resolves to: `stacks[]`, else the single-stack convention. */
+export declare function resolveTeardownStacks(options: AwsTeardownOptions): Array<{
+    name: string;
+    region?: string;
+}>;
+/**
+ * Enumerate the environment's marker-verified stacks — the aws half of
+ * `chant lifecycle teardown <env>` planning. Read-only.
+ */
+export declare function teardownOwned(options: AwsTeardownOptions, deps?: AwsTeardownDeps): Promise<TeardownEnumeration>;
+/**
+ * Delete the handed-over stacks: re-verify each stack's own tags, then
+ * DeleteStack via `awsDelete`, polled to DELETE_COMPLETE. One outcome per
+ * candidate, always.
+ */
+export declare function executeTeardown(options: AwsTeardownOptions & {
+    candidates: TeardownCandidate[];
+}, deps?: AwsTeardownDeps): Promise<TeardownExecution>;
+//# sourceMappingURL=teardown.d.ts.map

package/dist/teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../src/teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAGlB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAEjF,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAa,KAAK,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEpE,6EAA6E;AAC7E,eAAO,MAAM,UAAU,+BAA+B,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,MAAM,EAAE,eAAe,CAAC;IACxB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,CAAC,EAAE,oBAAoB,CAAC;IAC5B,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4FAA4F;AAC5F,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,kBAAkB,GAC1B,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1C;AAmDD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAuD9B;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG;IAAE,UAAU,EAAE,iBAAiB,EAAE,CAAA;CAAE,EACjE,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAW5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.45.0",
+    "@intentius/chant": "^0.46.0",
     "typescript": "^5.9.3"
   }
 }

package/src/components/cloud-executor.ts

@@ -24,6 +24,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { realDocker, type DockerClient } from "@intentius/chant/components/verbs/cloud-executor";
 import { q } from "@intentius/chant/components/verbs/process-runner";
+import { ownershipStackTagsForBody } from "../ownership.js";
 
 export type { DockerClient };
 
@@ -432,10 +433,18 @@ const realCloudFormation: CloudFormationClient = {
       body = readFileSync(args.templatePath, "utf8");
     } catch { /* unreadable template — create-change-set reports it */ }
     const capabilities = awsDeployCapabilitiesForBody(body).join(" ");
+    // The template's ownership marker becomes the STACK's own tags (#1222) —
+    // the identity stack-level teardown verifies before a DeleteStack. Same
+    // source as the applier's `Tags.member.N`: `Metadata["chant:ownership"]`.
+    const stackTags = Object.entries(ownershipStackTagsForBody(body))
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([k, v]) => q(`Key=${k},Value=${v}`))
+      .join(" ");
+    const tagsFlag = stackTags ? ` --tags ${stackTags}` : "";
     await run(
       `aws cloudformation create-change-set --stack-name ${q(args.stackName)} --change-set-name ${q(changeSetName)} ` +
         `--change-set-type ${changeSetType} ` +
-        `--template-body file://${args.templatePath} --capabilities ${capabilities}${paramFlag}`,
+        `--template-body file://${args.templatePath} --capabilities ${capabilities}${paramFlag}${tagsFlag}`,
     );
     await run(
       `aws cloudformation wait change-set-create-complete --stack-name ${q(args.stackName)} --change-set-name ${q(changeSetName)}`,

package/src/lifecycle-integration.test.ts

@@ -428,9 +428,13 @@ describeObservationConformance({
       },
     },
     {
+      // describe-stack-resources also carries no tags to read a stack/env
+      // identity from, so `marker` (#1222) stays absent here — stack-level
+      // handling reads the stack's own tags instead.
       name: "a healthy stack read",
       declared: ["MyBucket"],
       expectPresent: ["MyBucket"],
+      expectNoMarker: ["MyBucket"],
       run: () => {
         stubCfn((action) =>
           action === "DescribeStackResources"

package/src/lint/audit-catalog.ts

@@ -67,4 +67,9 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   WAW056: auditRule("WAW056", "merge-worthy", "guidance", "SCP guardrail has no Deny statement", "Add a Deny statement — SCPs only filter permissions, so a Deny-less SCP guards nothing.", { authority: [AWS_SEC] }),
   WAW057: auditRule("WAW057", "merge-worthy", "guidance", "SCP guardrail attached to no targets", "Attach the SCP to the organization root or an OU via TargetIds.", { authority: [AWS_SEC] }),
   WAW058: auditRule("WAW058", "merge-worthy", "guidance", "Organization audit trail dropped or scoped down", "Keep an organization CloudTrail with IsLogging: true and IsMultiRegionTrail: true.", { authority: [AWS_SEC] }),
+
+  // #1225 — least-privilege tightening the declared graph can prove. Report-only,
+  // so no authority citation (those are reserved for merge-worthy entries).
+  WAW059: auditRule("WAW059", "report-only", "guidance", "Wildcard Resource where the declared graph enumerates the touched set", "Tighten Resource from \"*\" to the Fn::GetAtt Arn list of the declared resources the role's consumers touch.", { category: "security" }),
+  WAW060: auditRule("WAW060", "report-only", "guidance", "IAM policy attached to no principal", "Attach the policy via Roles/Users/Groups or reference it from a principal's ManagedPolicyArns — unattached it grants nothing.", { category: "security" }),
 };

package/src/lint/post-synth/cf-refs.ts

@@ -50,6 +50,28 @@ export function findResourceRefs(value: unknown): Set<string> {
   return refs;
 }
 
+/**
+ * Build the reverse of `findResourceRefs` for a whole template: logical id →
+ * the set of logical ids whose Properties reference it via Ref/Fn::GetAtt.
+ * Lets a check walk the graph consumer-ward (who uses this role?) instead of
+ * dependency-ward. Used by WAW059.
+ */
+export function buildReverseRefIndex(template: CFTemplate): Map<string, Set<string>> {
+  const index = new Map<string, Set<string>>();
+  for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+    for (const target of findResourceRefs(resource.Properties)) {
+      if (target === logicalId) continue;
+      let consumers = index.get(target);
+      if (!consumers) {
+        consumers = new Set();
+        index.set(target, consumers);
+      }
+      consumers.add(logicalId);
+    }
+  }
+  return index;
+}
+
 /**
  * Check if a value is a CloudFormation intrinsic function (Ref, Fn::*, etc.)
  * that cannot be statically evaluated.

package/src/lint/post-synth/index.ts

@@ -50,6 +50,8 @@ import { waw055 } from "./waw055";
 import { waw056 } from "./waw056";
 import { waw057 } from "./waw057";
 import { waw058 } from "./waw058";
+import { waw059 } from "./waw059";
+import { waw060 } from "./waw060";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -102,4 +104,6 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw056,
   waw057,
   waw058,
+  waw059,
+  waw060,
 ];