@intentius/chant-lexicon-aws 0.45.0 → 0.49.0

package/dist/receipt-store.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The aws `ReceiptStore` (#1835, epic #1703) — core's injectable receipt seam
+ * (#1834, `@intentius/chant/op/receipt-store`) implemented over SSM Parameter
+ * Store, plain `String`, at the path identity ./effect-receipt-row.ts derives
+ * from the ownership marker fields.
+ *
+ * The transport is the lexicon's own read/apply transport (./api/read-client,
+ * #1206), pointed at the SSM JSON API: `fetch`, SigV4 when credentials
+ * resolve, and the one endpoint-override rule (#1694) — the `endpoint`
+ * option, else `AWS_ENDPOINT_URL_SSM`, else `AWS_ENDPOINT_URL` — so a local
+ * emulator lane reads and writes receipts without any store-specific wiring.
+ *
+ * Write discipline (epic decision 3): `write` exists for the `effect()` step
+ * alone — the step's read-compare-run-write is the only path that reaches it,
+ * on success, last. `PutParameter` is `Type: "String"` always; the first
+ * write creates the parameter with the ownership tags, and a later write
+ * overwrites the value (SSM refuses `Overwrite` and `Tags` in one call, so
+ * tags ride creation only — they never change after).
+ *
+ * Identity: the parameter name needs `<stack>` and `<env>`, which the
+ * activity args deliberately do not carry (the `EffectReceiptRef` is
+ * identity-of-the-effect, not identity-of-the-deployment). The store resolves
+ * them once, lazily, at first use: an explicit option, else `CHANT_ENV` (what
+ * `chant run --env` sets) and the project's `ownership` block — the same
+ * fields that stamp markers (epic decision 4). Nothing resolving is an error,
+ * never a guessed segment.
+ */
+import type { ReceiptStore } from "@intentius/chant/op/receipt-store";
+import type { ResourceMetadata } from "@intentius/chant/lexicon";
+import type { UnobservedReason } from "@intentius/chant/observation";
+import { type AwsCredentialSource, type AwsReadClientOptions, type AwsReadHttp } from "./api/read-client.js";
+/** Options for {@link awsReceiptStore}. All optional: the default store reads
+ * its identity from the project and its endpoint from the environment. */
+export interface AwsReceiptStoreOptions {
+    /** The path's `<stack>` segment. Omitted, the project's `ownership.stack`
+     * (chant.config.ts, found upward from `cwd`) answers. */
+    stack?: string;
+    /** The path's `<env>` segment — explicit by decision 4. Omitted, `CHANT_ENV`
+     * (set by `chant run --env`) answers, then a literal `ownership.env`. */
+    environment?: string;
+    /** Where to look for chant.config.ts. Defaults to the working directory. */
+    cwd?: string;
+    /** Endpoint override; omitted, `AWS_ENDPOINT_URL[_SSM]` answers (#1694). */
+    endpoint?: string;
+    /** Region for the real-AWS host. */
+    region?: string;
+    /** Injectable HTTP, mirroring the read client's. Tests avoid the network. */
+    http?: AwsReadHttp;
+    /** Environment record the endpoint/credential/identity fallbacks read.
+     * Defaults to `process.env`; injectable for tests. */
+    env?: Record<string, string | undefined>;
+    /** What to sign with — same seam as the read client. */
+    credentials?: AwsCredentialSource;
+    /** Sign even against an endpoint override — for an override that is real AWS. */
+    signEndpointOverride?: boolean;
+}
+/** One SSM JSON call. Exported for the observation leg (plugin.ts), which
+ * reads the same parameters the store writes. */
+export declare function ssmCall(action: string, payload: Record<string, unknown>, options: AwsReadClientOptions): Promise<{
+    status: number;
+    json: Record<string, unknown>;
+}>;
+/** The API's own error code from a JSON-protocol error body — `__type`, with
+ * any `namespace#` prefix stripped. */
+export declare function ssmErrorCode(json: Record<string, unknown>): string | undefined;
+/**
+ * `GetParameter` by name. Absent (`ParameterNotFound`) is `undefined` — a real
+ * answer, distinct from a failed read, which throws.
+ */
+export declare function ssmGetParameter(name: string, options?: AwsReadClientOptions): Promise<string | undefined>;
+/**
+ * `PutParameter`, plain `String`. Creation carries `tags`; an existing
+ * parameter is overwritten (`Overwrite: true`) without them — SSM refuses
+ * `Overwrite` and `Tags` in the same call, and ownership tags never change.
+ */
+export declare function ssmPutParameter(name: string, value: string, tags: Record<string, string>, options?: AwsReadClientOptions): Promise<void>;
+/** What the observation leg learned about the declared receipt rows. */
+export interface ReceiptRowObservation {
+    resources: Record<string, ResourceMetadata>;
+    unobserved: Record<string, {
+        type: string;
+        reason: UnobservedReason;
+        detail: string;
+    }>;
+}
+/**
+ * The plan-side live read of the receipt rows (#1835's observation leg).
+ *
+ * A receipt is not a stack member — the applier never writes it (#1832) — so
+ * `describe-stack-resources` honestly reports it absent even while the
+ * parameter exists. The serializer renders each receipt's derived path into
+ * the template's `Metadata` (./serializer.ts), so this leg reads the paths
+ * back from the build output — one derivation, decision 4 — and asks SSM
+ * `GetParameter` for each. Present maps the stored value onto
+ * `attributes.value` (core's `RECEIPT_VALUE_ATTRIBUTE`); `ParameterNotFound`
+ * is a real absence and stays one; a failed read is an `unobserved` hole,
+ * never a wrong answer — a receipt nobody could read must not arrive
+ * downstream as "the effect never ran".
+ */
+export declare function observeReceiptRows(entityNames: string[], buildOutput: string, options?: AwsReadClientOptions): Promise<ReceiptRowObservation>;
+/**
+ * The `ReceiptStore` over SSM. Bind it once in the op activities barrel —
+ * `receiptActivities(awsReceiptStore())` — and the registry resolves
+ * `receiptRead`/`receiptWrite`/`receiptStaleness` by name, exactly like
+ * `ensureSecret` (#1830). Identity and endpoint resolve lazily at first use,
+ * so module load never reads the project or the environment.
+ */
+export declare function awsReceiptStore(options?: AwsReceiptStoreOptions): ReceiptStore;
+//# sourceMappingURL=receipt-store.d.ts.map

package/dist/receipt-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-store.d.ts","sourceRoot":"","sources":["../src/receipt-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAoB,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAO3B;0EAC0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC;6DACyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6EACyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;0DACsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,wDAAwD;IACxD,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;iDACiD;AACjD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAyB5D;AAED;uCACuC;AACvC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAI9E;AAQD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAiBf;AA4CD,wEAAwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,qBAAqB,CAAC,CA+ChC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,YAAY,CAyBlF"}

package/dist/rules/cf-refs.ts

@@ -50,6 +50,28 @@ export function findResourceRefs(value: unknown): Set<string> {
   return refs;
 }
 
+/**
+ * Build the reverse of `findResourceRefs` for a whole template: logical id →
+ * the set of logical ids whose Properties reference it via Ref/Fn::GetAtt.
+ * Lets a check walk the graph consumer-ward (who uses this role?) instead of
+ * dependency-ward. Used by WAW059.
+ */
+export function buildReverseRefIndex(template: CFTemplate): Map<string, Set<string>> {
+  const index = new Map<string, Set<string>>();
+  for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+    for (const target of findResourceRefs(resource.Properties)) {
+      if (target === logicalId) continue;
+      let consumers = index.get(target);
+      if (!consumers) {
+        consumers = new Set();
+        index.set(target, consumers);
+      }
+      consumers.add(logicalId);
+    }
+  }
+  return index;
+}
+
 /**
  * Check if a value is a CloudFormation intrinsic function (Ref, Fn::*, etc.)
  * that cannot be statically evaluated.
@@ -147,6 +169,46 @@ export function isFullTierEnv(env: string | undefined): boolean {
   return env === "prod" || env === "production" || env === "full";
 }
 
+/**
+ * Parse an IPv4 CIDR literal ("10.0.0.0/16") into its numeric base address
+ * and prefix length. Returns null for anything that isn't a plain IPv4 CIDR
+ * (IPv6, malformed octets, out-of-range prefix) — callers treat that as
+ * "can't prove statically" rather than an error.
+ */
+export function parseIpv4Cidr(cidr: string): { base: number; prefix: number } | null {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(cidr.trim());
+  if (!m) return null;
+  const octets = m.slice(1, 5).map(Number);
+  if (octets.some((o) => o < 0 || o > 255)) return null;
+  const prefix = Number(m[5]);
+  if (prefix < 0 || prefix > 32) return null;
+  const base = ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
+  return { base, prefix };
+}
+
+/** [networkAddress, broadcastAddress] for a parsed IPv4 CIDR block. */
+function ipv4Range(cidr: { base: number; prefix: number }): [number, number] {
+  const maskBits = cidr.prefix === 0 ? 0 : (0xffffffff << (32 - cidr.prefix)) >>> 0;
+  const network = (cidr.base & maskBits) >>> 0;
+  const broadcast = (network | (~maskBits >>> 0)) >>> 0;
+  return [network, broadcast];
+}
+
+/**
+ * Whether `inner` (an IPv4 CIDR literal) falls entirely within `outer`.
+ * Returns null — not false — when either literal isn't a plain, parseable
+ * IPv4 CIDR (e.g. IPv6, or a CloudFormation intrinsic already stringified
+ * elsewhere); a null means "statically unprovable", not "violation".
+ */
+export function ipv4CidrContains(outer: string, inner: string): boolean | null {
+  const outerCidr = parseIpv4Cidr(outer);
+  const innerCidr = parseIpv4Cidr(inner);
+  if (!outerCidr || !innerCidr) return null;
+  const [oStart, oEnd] = ipv4Range(outerCidr);
+  const [iStart, iEnd] = ipv4Range(innerCidr);
+  return iStart >= oStart && iEnd <= oEnd;
+}
+
 /**
  * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
  */

package/dist/rules/waw059.ts

@@ -0,0 +1,353 @@
+/**
+ * WAW059: Wildcard Resource where the declared graph enumerates the touched set
+ *
+ * An identity policy that allows resource-scopable actions on `Resource: "*"`
+ * (or a service-wide ARN pattern) when every consumer of the attached role
+ * only touches resources declared in the same template. In that case the
+ * declared graph already enumerates the touched set, so the statement can be
+ * tightened to the `Fn::GetAtt` Arn list of those declared entities.
+ *
+ * Deliberately narrow (#1225). Fires only when ALL of these hold:
+ * - the statement is an `Effect: Allow` identity-policy statement (role inline
+ *   policy, IAM::Policy, IAM::ManagedPolicy) — trust policies carry a
+ *   Principal and are skipped, resource policies live on other types;
+ * - no Condition/NotAction/NotResource and no intrinsics in Action/Resource;
+ * - `Resource` is `"*"` or a service-wide ARN pattern;
+ * - every Action is in the curated resource-scopable table (s3, dynamodb,
+ *   sqs) — actions that genuinely need `"*"` (s3:ListAllMyBuckets,
+ *   dynamodb:ListTables, sqs:ListQueues) are not in the table;
+ * - the attached principal resolves to declared roles only, those roles have
+ *   consumers in the template, and no consumer carries a foreign edge (a
+ *   literal ARN of the service) or an intrinsic edge (Fn::ImportValue) that
+ *   would put resources outside the declared graph in reach.
+ *
+ * Anything the static graph cannot prove stays quiet.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import {
+  parseCFTemplate,
+  walkPolicyStatements,
+  findResourceRefs,
+  buildReverseRefIndex,
+  isIntrinsic,
+  type CFTemplate,
+  type CFResource,
+} from "./cf-refs";
+
+/**
+ * Curated table of actions that support resource-level permissions, per
+ * service. Lower-cased (IAM action matching is case-insensitive). An action
+ * outside this table gates the whole statement off — it may legitimately
+ * require `Resource: "*"`.
+ */
+export const RESOURCE_SCOPABLE_ACTIONS: Record<string, ReadonlySet<string>> = {
+  s3: new Set([
+    "getobject",
+    "getobjectversion",
+    "getobjectacl",
+    "getobjecttagging",
+    "putobject",
+    "putobjectacl",
+    "putobjecttagging",
+    "deleteobject",
+    "deleteobjectversion",
+    "listbucket",
+    "listbucketversions",
+    "listbucketmultipartuploads",
+    "listmultipartuploadparts",
+    "abortmultipartupload",
+    "getbucketlocation",
+  ]),
+  dynamodb: new Set([
+    "getitem",
+    "batchgetitem",
+    "query",
+    "scan",
+    "putitem",
+    "updateitem",
+    "deleteitem",
+    "batchwriteitem",
+    "conditioncheckitem",
+    "describetable",
+    "getrecords",
+    "getsharditerator",
+    "describestream",
+  ]),
+  sqs: new Set([
+    "sendmessage",
+    "sendmessagebatch",
+    "receivemessage",
+    "deletemessage",
+    "deletemessagebatch",
+    "changemessagevisibility",
+    "changemessagevisibilitybatch",
+    "getqueueattributes",
+    "getqueueurl",
+    "purgequeue",
+  ]),
+};
+
+/** CloudFormation types that declare an entity of each curated service. */
+const SERVICE_RESOURCE_TYPES: Record<string, ReadonlySet<string>> = {
+  s3: new Set(["AWS::S3::Bucket"]),
+  dynamodb: new Set(["AWS::DynamoDB::Table", "AWS::DynamoDB::GlobalTable"]),
+  sqs: new Set(["AWS::SQS::Queue"]),
+};
+
+/**
+ * ARN resource segments that make an ARN service-wide rather than
+ * entity-scoped. `arn:aws:s3:::my-bucket/*` is bucket-scoped and NOT here.
+ */
+const SERVICE_WIDE_REST: Record<string, ReadonlySet<string>> = {
+  s3: new Set(["*"]),
+  dynamodb: new Set(["*", "table/*"]),
+  sqs: new Set(["*"]),
+};
+
+const IAM_TYPES = new Set(["AWS::IAM::Policy", "AWS::IAM::Role", "AWS::IAM::ManagedPolicy"]);
+
+const ARN_SERVICE_RE = /arn:[^:\s]*:([a-z0-9-]+):/g;
+
+function asStringArray(value: unknown): string[] | null {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value) && value.every((v) => typeof v === "string")) {
+    return value as string[];
+  }
+  return null;
+}
+
+/** `"*"`, or an ARN whose service is in `services` and whose resource segment is service-wide. */
+function isServiceWideResource(value: string, services: Set<string>): boolean {
+  if (value === "*") return true;
+  const m = /^arn:[^:]*:([^:]*):[^:]*:[^:]*:(.+)$/.exec(value);
+  if (!m) return false;
+  const [, service, rest] = m;
+  if (!services.has(service)) return false;
+  return SERVICE_WIDE_REST[service]?.has(rest) ?? false;
+}
+
+/**
+ * The services an Allow statement touches, if every action lands in the
+ * curated resource-scopable table. Null when any action is outside it
+ * (or malformed / an action-name wildcard).
+ */
+function curatedServices(actions: string[]): Set<string> | null {
+  const services = new Set<string>();
+  for (const action of actions) {
+    const m = /^([a-z0-9-]+):([A-Za-z0-9]+)$/.exec(action);
+    if (!m) return null;
+    const [, service, name] = m;
+    const table = RESOURCE_SCOPABLE_ACTIONS[service];
+    if (!table || !table.has(name.toLowerCase())) return null;
+    services.add(service);
+  }
+  return services.size > 0 ? services : null;
+}
+
+/**
+ * Resolve which declared roles a policy resource is attached to. Null means
+ * "cannot prove" (users/groups, literal role names, no roles at all).
+ */
+function attachedRoles(logicalId: string, resource: CFResource, template: CFTemplate): Set<string> | null {
+  const resources = template.Resources ?? {};
+  if (resource.Type === "AWS::IAM::Role") return new Set([logicalId]);
+
+  const props = resource.Properties ?? {};
+  // Users/groups have no consumers in the resource graph — untraceable.
+  if (Array.isArray(props.Users) && props.Users.length > 0) return null;
+  if (Array.isArray(props.Groups) && props.Groups.length > 0) return null;
+
+  const roles = new Set<string>();
+  if (props.Roles !== undefined) {
+    if (!Array.isArray(props.Roles)) return null;
+    for (const entry of props.Roles) {
+      // A literal role name points outside the declared graph.
+      if (typeof entry === "string") return null;
+      const refs = findResourceRefs(entry);
+      if (refs.size !== 1) return null;
+      const [id] = refs;
+      if (resources[id]?.Type !== "AWS::IAM::Role") return null;
+      roles.add(id);
+    }
+  }
+
+  // A managed policy can also be attached from the role side (ManagedPolicyArns).
+  if (resource.Type === "AWS::IAM::ManagedPolicy") {
+    for (const [roleId, candidate] of Object.entries(resources)) {
+      if (candidate.Type !== "AWS::IAM::Role") continue;
+      if (findResourceRefs(candidate.Properties?.ManagedPolicyArns).has(logicalId)) {
+        roles.add(roleId);
+      }
+    }
+  }
+
+  return roles.size > 0 ? roles : null;
+}
+
+/**
+ * The non-IAM resources that reference any of the roles (the role's
+ * consumers). An IAM::InstanceProfile is a pass-through hop: its own
+ * consumers count instead.
+ */
+function consumersOf(
+  roleIds: Set<string>,
+  reverseIndex: Map<string, Set<string>>,
+  template: CFTemplate,
+): Array<[string, CFResource]> {
+  const resources = template.Resources ?? {};
+  const seen = new Set<string>();
+  const queue = [...roleIds].flatMap((id) => [...(reverseIndex.get(id) ?? [])]);
+  const consumers: Array<[string, CFResource]> = [];
+
+  while (queue.length > 0) {
+    const id = queue.shift() as string;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    const resource = resources[id];
+    if (!resource) continue;
+    if (resource.Type === "AWS::IAM::InstanceProfile") {
+      queue.push(...(reverseIndex.get(id) ?? []));
+      continue;
+    }
+    if (resource.Type.startsWith("AWS::IAM::")) continue; // attachment, not consumption
+    consumers.push([id, resource]);
+  }
+
+  return consumers;
+}
+
+/**
+ * A consumer edge the declared graph cannot enumerate: a literal ARN of one
+ * of the statement's services (a foreign, undeclared entity) or an
+ * Fn::ImportValue anywhere in the consumer (a cross-stack edge).
+ */
+function hasForeignOrIntrinsicEdge(value: unknown, services: Set<string>): boolean {
+  if (value === null || value === undefined) return false;
+  if (typeof value === "string") {
+    for (const m of value.matchAll(ARN_SERVICE_RE)) {
+      if (services.has(m[1])) return true;
+    }
+    return false;
+  }
+  if (typeof value !== "object") return false;
+  if (Array.isArray(value)) {
+    return value.some((item) => hasForeignOrIntrinsicEdge(item, services));
+  }
+  const obj = value as Record<string, unknown>;
+  if ("Fn::ImportValue" in obj) return true;
+  return Object.values(obj).some((v) => hasForeignOrIntrinsicEdge(v, services));
+}
+
+const S3_OBJECT_ACTIONS = new Set([
+  "getobject",
+  "getobjectversion",
+  "getobjectacl",
+  "getobjecttagging",
+  "putobject",
+  "putobjectacl",
+  "putobjecttagging",
+  "deleteobject",
+  "deleteobjectversion",
+  "listmultipartuploadparts",
+  "abortmultipartupload",
+]);
+
+function policyKind(type: string): string {
+  if (type === "AWS::IAM::Role") return "role";
+  if (type === "AWS::IAM::ManagedPolicy") return "managed policy";
+  return "policy";
+}
+
+export function checkWildcardResourceEnumerable(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    const reverseIndex = buildReverseRefIndex(template);
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (!IAM_TYPES.has(resource.Type)) continue;
+
+      // walkPolicyStatements also yields a role's AssumeRolePolicyDocument
+      // statements; those always carry a Principal and are gated off below.
+      for (const stmt of walkPolicyStatements(resource)) {
+        if (stmt.Effect !== "Allow") continue;
+        if ("Condition" in stmt || "NotAction" in stmt || "NotResource" in stmt) continue;
+        if ("Principal" in stmt || "NotPrincipal" in stmt) continue;
+        if (isIntrinsic(stmt.Action) || isIntrinsic(stmt.Resource)) continue;
+
+        const actions = asStringArray(stmt.Action);
+        const resources = asStringArray(stmt.Resource);
+        if (!actions || !resources || actions.length === 0 || resources.length === 0) continue;
+
+        const services = curatedServices(actions);
+        if (!services) continue;
+        if (!resources.every((r) => isServiceWideResource(r, services))) continue;
+
+        const roles = attachedRoles(logicalId, resource, template);
+        if (!roles) continue;
+
+        const consumers = consumersOf(roles, reverseIndex, template);
+        if (consumers.length === 0) continue;
+
+        // Every consumer edge must stay inside the declared graph.
+        if (consumers.some(([, c]) => hasForeignOrIntrinsicEdge(c.Properties, services))) continue;
+
+        // The declared entities of each granted service the consumers touch.
+        const touched = new Set<string>();
+        let enumerable = true;
+        for (const service of services) {
+          const types = SERVICE_RESOURCE_TYPES[service];
+          const serviceTouched = new Set<string>();
+          for (const [, consumer] of consumers) {
+            for (const ref of findResourceRefs(consumer.Properties)) {
+              if (types.has(template.Resources[ref]?.Type ?? "")) serviceTouched.add(ref);
+            }
+          }
+          if (serviceTouched.size === 0) {
+            enumerable = false;
+            break;
+          }
+          for (const id of serviceTouched) touched.add(id);
+        }
+        if (!enumerable) continue;
+
+        const suggestion = JSON.stringify(
+          [...touched].sort().map((id) => ({ "Fn::GetAtt": [id, "Arn"] })),
+        );
+        const objectHint = actions.some((a) => {
+          const [service, name] = a.split(":");
+          return service === "s3" && S3_OBJECT_ACTIONS.has(name.toLowerCase());
+        })
+          ? ' (s3 object-level actions also need the "/*" object suffix on the bucket Arn)'
+          : "";
+
+        diagnostics.push({
+          checkId: "WAW059",
+          severity: "warning",
+          message:
+            `IAM ${policyKind(resource.Type)} "${logicalId}" allows ${actions.join(", ")} on ` +
+            `Resource ${JSON.stringify(stmt.Resource)}, but the declared graph enumerates the touched set — ` +
+            `tighten Resource to ${suggestion}${objectHint}`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw059: PostSynthCheck = {
+  id: "WAW059",
+  description:
+    "Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkWildcardResourceEnumerable(ctx);
+  },
+};

package/dist/rules/waw060.ts

@@ -0,0 +1,91 @@
+/**
+ * WAW060: IAM Policy Attached to No Principal
+ *
+ * Flags AWS::IAM::Policy / AWS::IAM::ManagedPolicy resources with empty or
+ * absent Roles, Users, and Groups that no other part of the template
+ * references. A policy attached to no principal grants nothing — the same
+ * detached-guardrail shape WAW057 catches for SCPs. Any Ref/GetAtt edge to
+ * the policy (a role's ManagedPolicyArns, an attachment-style resource, a
+ * stack Output exporting it for another stack to attach) keeps it quiet;
+ * plain AWS-managed ARN strings elsewhere are not references to the
+ * template's own policy.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, isIntrinsic, type CFTemplate } from "./cf-refs";
+
+const POLICY_TYPES = new Set(["AWS::IAM::Policy", "AWS::IAM::ManagedPolicy"]);
+const PRINCIPAL_PROPS = ["Roles", "Users", "Groups"] as const;
+
+/**
+ * Collect every logical id referenced via Ref/Fn::GetAtt from anywhere in the
+ * template except the policy resources themselves — other resources'
+ * properties and the Outputs section. An Output edge counts as attachment
+ * evidence: the policy may be exported for a consuming stack to attach.
+ */
+function collectExternalRefs(template: CFTemplate, excludeIds: Set<string>): Set<string> {
+  const refs = new Set<string>();
+  for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+    if (excludeIds.has(logicalId)) continue;
+    for (const ref of findResourceRefs(resource)) refs.add(ref);
+  }
+  for (const ref of findResourceRefs(template.Outputs)) refs.add(ref);
+  return refs;
+}
+
+export function checkPolicyUnattached(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    const policyIds = new Set(
+      Object.entries(template.Resources)
+        .filter(([, resource]) => POLICY_TYPES.has(resource.Type))
+        .map(([logicalId]) => logicalId),
+    );
+    if (policyIds.size === 0) continue;
+
+    const externalRefs = collectExternalRefs(template, policyIds);
+
+    for (const logicalId of policyIds) {
+      const resource = template.Resources[logicalId];
+      const props = resource.Properties ?? {};
+
+      // Any declared principal list keeps the policy quiet. An intrinsic
+      // can't be statically evaluated, so it counts as attached.
+      let attached = false;
+      for (const prop of PRINCIPAL_PROPS) {
+        const value = props[prop];
+        if (isIntrinsic(value)) attached = true;
+        else if (Array.isArray(value) && value.length > 0) attached = true;
+      }
+      if (attached) continue;
+
+      // Reverse lookup: anything else in the template holding a Ref/GetAtt
+      // edge to this policy attaches (or exports) it.
+      if (externalRefs.has(logicalId)) continue;
+
+      const kind = resource.Type === "AWS::IAM::ManagedPolicy" ? "Managed policy" : "Policy";
+      diagnostics.push({
+        checkId: "WAW060",
+        severity: "warning",
+        message: `${kind} "${logicalId}" is attached to no principal — no Roles/Users/Groups and nothing in the template references it; an unattached policy grants nothing`,
+        entity: logicalId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw060: PostSynthCheck = {
+  id: "WAW060",
+  description: "IAM policy attached to no principal — it grants nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkPolicyUnattached(ctx);
+  },
+};