@intentius/chant-lexicon-aws 0.45.0 → 0.49.0

package/src/lint/post-synth/waw060.test.ts

@@ -0,0 +1,131 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw060, checkPolicyUnattached } from "./waw060";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+const ALLOW_S3_READ = {
+  Version: "2012-10-17",
+  Statement: [{ Effect: "Allow", Action: ["s3:GetObject"], Resource: "arn:aws:s3:::data/*" }],
+};
+
+function managedPolicy(extra?: Record<string, unknown>) {
+  return {
+    Type: "AWS::IAM::ManagedPolicy",
+    Properties: { PolicyDocument: ALLOW_S3_READ, ...extra },
+  };
+}
+
+function inlinePolicy(extra?: Record<string, unknown>) {
+  return {
+    Type: "AWS::IAM::Policy",
+    Properties: { PolicyName: "read", PolicyDocument: ALLOW_S3_READ, ...extra },
+  };
+}
+
+function role(extra?: Record<string, unknown>) {
+  return {
+    Type: "AWS::IAM::Role",
+    Properties: {
+      AssumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [{ Effect: "Allow", Principal: { Service: "lambda.amazonaws.com" }, Action: "sts:AssumeRole" }],
+      },
+      ...extra,
+    },
+  };
+}
+
+describe("WAW060: IAM policy attached to no principal", () => {
+  test("check metadata", () => {
+    expect(waw060.id).toBe("WAW060");
+    expect(waw060.description).toContain("principal");
+  });
+
+  test("flags an unattached IAM::Policy", () => {
+    const ctx = makeCtx({ Resources: { Orphan: inlinePolicy() } });
+    const diags = checkPolicyUnattached(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW060");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("Orphan");
+    expect(diags[0].message).toContain("grants nothing");
+  });
+
+  test("flags an unattached ManagedPolicy and one with empty principal lists", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Orphan: managedPolicy(),
+        EmptyLists: managedPolicy({ Roles: [], Users: [], Groups: [] }),
+      },
+    });
+    const diags = checkPolicyUnattached(ctx);
+    expect(diags.map((d) => d.entity).sort()).toEqual(["EmptyLists", "Orphan"]);
+  });
+
+  test("quiet when a role's ManagedPolicyArns references the policy", () => {
+    const ctx = makeCtx({
+      Resources: {
+        ReadPolicy: managedPolicy(),
+        AppRole: role({ ManagedPolicyArns: [{ Ref: "ReadPolicy" }] }),
+      },
+    });
+    expect(checkPolicyUnattached(ctx)).toHaveLength(0);
+  });
+
+  test("quiet when the policy declares a Roles list", () => {
+    const ctx = makeCtx({
+      Resources: {
+        AppRole: role(),
+        ReadPolicy: managedPolicy({ Roles: [{ Ref: "AppRole" }] }),
+        InlineRead: inlinePolicy({ Roles: [{ Ref: "AppRole" }] }),
+      },
+    });
+    expect(checkPolicyUnattached(ctx)).toHaveLength(0);
+  });
+
+  test("AWS-managed ARN strings elsewhere do not attach the template's own policy", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Orphan: managedPolicy(),
+        AppRole: role({ ManagedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"] }),
+      },
+    });
+    const diags = checkPolicyUnattached(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Orphan");
+  });
+
+  test("quiet on attachment-style resources and GetAtt edges", () => {
+    const ctx = makeCtx({
+      Resources: {
+        ReadPolicy: managedPolicy(),
+        Attachment: {
+          Type: "AWS::SSO::PermissionSet",
+          Properties: { ManagedPolicies: [{ "Fn::GetAtt": ["ReadPolicy", "PolicyArn"] }] },
+        },
+      },
+    });
+    expect(checkPolicyUnattached(ctx)).toHaveLength(0);
+  });
+
+  test("an Output exporting the policy counts as a reference", () => {
+    const ctx = makeCtx({
+      Resources: { SharedPolicy: managedPolicy() },
+      Outputs: { SharedPolicyArn: { Value: { Ref: "SharedPolicy" }, Export: { Name: "shared-read" } } },
+    });
+    expect(checkPolicyUnattached(ctx)).toHaveLength(0);
+  });
+
+  test("intrinsic principal lists are skipped, and non-policy IAM types are ignored", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Conditional: managedPolicy({ Roles: { "Fn::If": ["UseRole", [{ Ref: "AppRole" }], []] } }),
+        AppRole: role(),
+      },
+    });
+    expect(checkPolicyUnattached(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw060.ts

@@ -0,0 +1,91 @@
+/**
+ * WAW060: IAM Policy Attached to No Principal
+ *
+ * Flags AWS::IAM::Policy / AWS::IAM::ManagedPolicy resources with empty or
+ * absent Roles, Users, and Groups that no other part of the template
+ * references. A policy attached to no principal grants nothing — the same
+ * detached-guardrail shape WAW057 catches for SCPs. Any Ref/GetAtt edge to
+ * the policy (a role's ManagedPolicyArns, an attachment-style resource, a
+ * stack Output exporting it for another stack to attach) keeps it quiet;
+ * plain AWS-managed ARN strings elsewhere are not references to the
+ * template's own policy.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, isIntrinsic, type CFTemplate } from "./cf-refs";
+
+const POLICY_TYPES = new Set(["AWS::IAM::Policy", "AWS::IAM::ManagedPolicy"]);
+const PRINCIPAL_PROPS = ["Roles", "Users", "Groups"] as const;
+
+/**
+ * Collect every logical id referenced via Ref/Fn::GetAtt from anywhere in the
+ * template except the policy resources themselves — other resources'
+ * properties and the Outputs section. An Output edge counts as attachment
+ * evidence: the policy may be exported for a consuming stack to attach.
+ */
+function collectExternalRefs(template: CFTemplate, excludeIds: Set<string>): Set<string> {
+  const refs = new Set<string>();
+  for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+    if (excludeIds.has(logicalId)) continue;
+    for (const ref of findResourceRefs(resource)) refs.add(ref);
+  }
+  for (const ref of findResourceRefs(template.Outputs)) refs.add(ref);
+  return refs;
+}
+
+export function checkPolicyUnattached(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    const policyIds = new Set(
+      Object.entries(template.Resources)
+        .filter(([, resource]) => POLICY_TYPES.has(resource.Type))
+        .map(([logicalId]) => logicalId),
+    );
+    if (policyIds.size === 0) continue;
+
+    const externalRefs = collectExternalRefs(template, policyIds);
+
+    for (const logicalId of policyIds) {
+      const resource = template.Resources[logicalId];
+      const props = resource.Properties ?? {};
+
+      // Any declared principal list keeps the policy quiet. An intrinsic
+      // can't be statically evaluated, so it counts as attached.
+      let attached = false;
+      for (const prop of PRINCIPAL_PROPS) {
+        const value = props[prop];
+        if (isIntrinsic(value)) attached = true;
+        else if (Array.isArray(value) && value.length > 0) attached = true;
+      }
+      if (attached) continue;
+
+      // Reverse lookup: anything else in the template holding a Ref/GetAtt
+      // edge to this policy attaches (or exports) it.
+      if (externalRefs.has(logicalId)) continue;
+
+      const kind = resource.Type === "AWS::IAM::ManagedPolicy" ? "Managed policy" : "Policy";
+      diagnostics.push({
+        checkId: "WAW060",
+        severity: "warning",
+        message: `${kind} "${logicalId}" is attached to no principal — no Roles/Users/Groups and nothing in the template references it; an unattached policy grants nothing`,
+        entity: logicalId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw060: PostSynthCheck = {
+  id: "WAW060",
+  description: "IAM policy attached to no principal — it grants nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkPolicyUnattached(ctx);
+  },
+};

package/src/lint/post-synth/waw061.test.ts

@@ -0,0 +1,99 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw061, checkSubnetCidrContainment } from "./waw061";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW061: Subnet CIDR Not Contained In VPC CIDR", () => {
+  test("check metadata", () => {
+    expect(waw061.id).toBe("WAW061");
+    expect(waw061.description).toContain("CidrBlock");
+  });
+
+  test("subnet CIDR outside the VPC's CIDR range → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: { CidrBlock: "10.1.0.0/24", VpcId: { Ref: "MyVpc" } },
+        },
+      },
+    });
+    const diags = checkSubnetCidrContainment(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW061");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("MySubnet");
+    expect(diags[0].message).toContain("10.1.0.0/24");
+    expect(diags[0].message).toContain("10.0.0.0/16");
+    expect(diags[0].lexicon).toBe("aws");
+  });
+
+  test("subnet wider than its VPC → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.1.0/24" } },
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: { CidrBlock: "10.0.0.0/16", VpcId: { Ref: "MyVpc" } },
+        },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(1);
+  });
+
+  test("subnet CIDR contained in the VPC's CIDR → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: { CidrBlock: "10.0.1.0/24", VpcId: { Ref: "MyVpc" } },
+        },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(0);
+  });
+
+  test("intrinsic CidrBlock → no diagnostic (unprovable)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: {
+            CidrBlock: { "Fn::Select": [0, { "Fn::Cidr": [{ "Fn::GetAtt": ["MyVpc", "CidrBlock"] }, 4, 8] }] },
+            VpcId: { Ref: "MyVpc" },
+          },
+        },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(0);
+  });
+
+  test("VpcId not resolvable to a declared VPC (imported) → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: { CidrBlock: "10.1.0.0/24", VpcId: { "Fn::ImportValue": "shared-vpc-id" } },
+        },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(0);
+  });
+
+  test("multiple subnets in a VPC, all contained → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        SubnetA: { Type: "AWS::EC2::Subnet", Properties: { CidrBlock: "10.0.0.0/24", VpcId: { Ref: "MyVpc" } } },
+        SubnetB: { Type: "AWS::EC2::Subnet", Properties: { CidrBlock: "10.0.1.0/24", VpcId: { Ref: "MyVpc" } } },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw061.ts

@@ -0,0 +1,67 @@
+/**
+ * WAW061: Subnet CIDR Not Contained In VPC CIDR
+ *
+ * A subnet's CidrBlock must fall entirely inside its VPC's CidrBlock.
+ * Stock CDK does not check this — CloudFormation accepts the template and
+ * only fails the `AWS::EC2::Subnet` resource at deploy time
+ * ("The CIDR ... is invalid" / "does not fall within the CIDR range of the
+ * VPC"), after the rest of the stack may have already started rolling out.
+ * This is a cheap static graph check: follow the subnet's VpcId Ref to a
+ * declared VPC in the same template and do IPv4 CIDR-range math.
+ *
+ * Stays quiet whenever the graph can't prove it: intrinsic CIDR blocks,
+ * IPv6, a VpcId that isn't a simple Ref to a declared AWS::EC2::VPC, or a
+ * VPC whose own CidrBlock isn't a literal string.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, ipv4CidrContains } from "./cf-refs";
+
+export function checkSubnetCidrContainment(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::EC2::Subnet") continue;
+
+      const props = resource.Properties ?? {};
+      const subnetCidr = props.CidrBlock;
+      if (typeof subnetCidr !== "string") continue;
+
+      const vpcRefs = findResourceRefs(props.VpcId);
+      if (vpcRefs.size !== 1) continue;
+      const [vpcId] = vpcRefs;
+
+      const vpc = template.Resources[vpcId];
+      if (!vpc || vpc.Type !== "AWS::EC2::VPC") continue;
+
+      const vpcCidr = vpc.Properties?.CidrBlock;
+      if (typeof vpcCidr !== "string") continue;
+
+      const contained = ipv4CidrContains(vpcCidr, subnetCidr);
+      if (contained === false) {
+        diagnostics.push({
+          checkId: "WAW061",
+          severity: "error",
+          message: `Subnet "${logicalId}" CidrBlock ${subnetCidr} is not contained within VPC "${vpcId}"'s CidrBlock ${vpcCidr} — CloudFormation rejects this at deploy time`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw061: PostSynthCheck = {
+  id: "WAW061",
+  description: "Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkSubnetCidrContainment(ctx);
+  },
+};

package/src/lint/post-synth/waw062.test.ts

@@ -0,0 +1,109 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw062, checkDuplicateNamesAndExports } from "./waw062";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW062: Duplicate Name Or Export Within A Template", () => {
+  test("check metadata", () => {
+    expect(waw062.id).toBe("WAW062");
+    expect(waw062.description.toLowerCase()).toContain("duplicate");
+  });
+
+  test("duplicate Export Name → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+      },
+      Outputs: {
+        BucketArnA: { Value: { "Fn::GetAtt": ["MyBucket", "Arn"] }, Export: { Name: "shared-bucket-arn" } },
+        BucketArnB: { Value: { "Fn::GetAtt": ["MyBucket", "Arn"] }, Export: { Name: "shared-bucket-arn" } },
+      },
+    });
+    const diags = checkDuplicateNamesAndExports(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW062");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("shared-bucket-arn");
+    expect(diags[0].message).toContain("BucketArnA");
+    expect(diags[0].message).toContain("BucketArnB");
+    expect(diags[0].lexicon).toBe("aws");
+  });
+
+  test("unique Export Names → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {},
+      Outputs: {
+        A: { Value: "a", Export: { Name: "export-a" } },
+        B: { Value: "b", Export: { Name: "export-b" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(0);
+  });
+
+  test("duplicate ECR RepositoryName across two composites → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RepoOne: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "svc-images" } },
+        RepoTwo: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "svc-images" } },
+      },
+    });
+    const diags = checkDuplicateNamesAndExports(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("svc-images");
+    expect(diags[0].message).toContain("RepoOne");
+    expect(diags[0].message).toContain("RepoTwo");
+  });
+
+  test("duplicate LaunchTemplateName → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        LtA: { Type: "AWS::EC2::LaunchTemplate", Properties: { LaunchTemplateName: "worker-lt" } },
+        LtB: { Type: "AWS::EC2::LaunchTemplate", Properties: { LaunchTemplateName: "worker-lt" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(1);
+  });
+
+  test("duplicate SecurityGroup GroupName → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        SgA: { Type: "AWS::EC2::SecurityGroup", Properties: { GroupName: "web-sg", GroupDescription: "a" } },
+        SgB: { Type: "AWS::EC2::SecurityGroup", Properties: { GroupName: "web-sg", GroupDescription: "b" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(1);
+  });
+
+  test("same literal name across different resource types → no diagnostic (not comparable)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RepoOne: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "shared" } },
+        TableOne: { Type: "AWS::DynamoDB::Table", Properties: { TableName: "shared" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(0);
+  });
+
+  test("intrinsic explicit names → no diagnostic (unprovable)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RepoOne: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: { "Fn::Sub": "svc-${AWS::StackName}" } } },
+        RepoTwo: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: { "Fn::Sub": "svc-${AWS::StackName}" } } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(0);
+  });
+
+  test("distinct explicit names → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RepoOne: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "svc-images-a" } },
+        RepoTwo: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "svc-images-b" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(0);
+  });
+});