@intentius/chant-lexicon-aws 0.46.0 → 0.50.0

package/src/lint/post-synth/waw063.test.ts

@@ -0,0 +1,220 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw063, checkDenyAllowContradiction } from "./waw063";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW063: IAM Policy Denies An Action It Also Allows", () => {
+  test("check metadata", () => {
+    expect(waw063.id).toBe("WAW063");
+    expect(waw063.description).toContain("Deny");
+  });
+
+  test("guardrail policy denies exactly what a workflow policy allows on the same role → error", () => {
+    // Mirrors the issue's own example: a role used by a StepFunctions workflow
+    // needs ec2:ModifyInstanceAttribute; a separately-attached guardrail policy
+    // denies it. Deploy succeeds; the workflow 403s at runtime.
+    const ctx = makeCtx({
+      Resources: {
+        WorkflowRole: { Type: "AWS::IAM::Role", Properties: { AssumeRolePolicyDocument: { Statement: [] } } },
+        WorkflowPolicy: {
+          Type: "AWS::IAM::Policy",
+          Properties: {
+            PolicyName: "workflow-needs",
+            Roles: [{ Ref: "WorkflowRole" }],
+            PolicyDocument: {
+              Statement: [{ Effect: "Allow", Action: "ec2:ModifyInstanceAttribute", Resource: "*" }],
+            },
+          },
+        },
+        SecurityGuardrailPolicy: {
+          Type: "AWS::IAM::Policy",
+          Properties: {
+            PolicyName: "guardrail",
+            Roles: [{ Ref: "WorkflowRole" }],
+            PolicyDocument: {
+              Statement: [{ Effect: "Deny", Action: "ec2:ModifyInstanceAttribute", Resource: "*" }],
+            },
+          },
+        },
+      },
+    });
+    const diags = checkDenyAllowContradiction(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW063");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("WorkflowRole");
+    expect(diags[0].message).toContain("ec2:ModifyInstanceAttribute");
+    expect(diags[0].message).toContain("SecurityGuardrailPolicy");
+    expect(diags[0].message).toContain("WorkflowPolicy");
+    expect(diags[0].lexicon).toBe("aws");
+  });
+
+  test("wildcarded Deny nullifies a literal Allow on the same role's inline policy → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        AppRole: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: { Statement: [] },
+            Policies: [
+              {
+                PolicyName: "inline",
+                PolicyDocument: {
+                  Statement: [
+                    { Effect: "Allow", Action: "s3:GetObject", Resource: "*" },
+                    { Effect: "Deny", Action: "s3:*", Resource: "*" },
+                  ],
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+    expect(checkDenyAllowContradiction(ctx)).toHaveLength(1);
+  });
+
+  test("broad Allow with a narrow safety Deny (intentional guardrail) → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        AppRole: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: { Statement: [] },
+            Policies: [
+              {
+                PolicyName: "inline",
+                PolicyDocument: {
+                  Statement: [
+                    { Effect: "Allow", Action: "ec2:*", Resource: "*" },
+                    { Effect: "Deny", Action: "ec2:TerminateInstances", Resource: "*" },
+                  ],
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+    expect(checkDenyAllowContradiction(ctx)).toHaveLength(0);
+  });
+
+  test("Deny on a different role than the Allow → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RoleA: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: { Statement: [] },
+            Policies: [{ PolicyName: "p", PolicyDocument: { Statement: [{ Effect: "Allow", Action: "ec2:ModifyInstanceAttribute", Resource: "*" }] } }],
+          },
+        },
+        RoleB: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: { Statement: [] },
+            Policies: [{ PolicyName: "p", PolicyDocument: { Statement: [{ Effect: "Deny", Action: "ec2:ModifyInstanceAttribute", Resource: "*" }] } }],
+          },
+        },
+      },
+    });
+    expect(checkDenyAllowContradiction(ctx)).toHaveLength(0);
+  });
+
+  test("Deny scoped to a disjoint literal resource → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        AppRole: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: { Statement: [] },
+            Policies: [
+              {
+                PolicyName: "inline",
+                PolicyDocument: {
+                  Statement: [
+                    { Effect: "Allow", Action: "s3:GetObject", Resource: "arn:aws:s3:::bucket-a/*" },
+                    { Effect: "Deny", Action: "s3:GetObject", Resource: "arn:aws:s3:::bucket-b/*" },
+                  ],
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+    expect(checkDenyAllowContradiction(ctx)).toHaveLength(0);
+  });
+
+  test("conditional Deny is skipped (unprovable statically) → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        AppRole: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: { Statement: [] },
+            Policies: [
+              {
+                PolicyName: "inline",
+                PolicyDocument: {
+                  Statement: [
+                    { Effect: "Allow", Action: "s3:GetObject", Resource: "*" },
+                    {
+                      Effect: "Deny",
+                      Action: "s3:GetObject",
+                      Resource: "*",
+                      Condition: { StringNotEquals: { "aws:SourceVpc": "vpc-123" } },
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+    expect(checkDenyAllowContradiction(ctx)).toHaveLength(0);
+  });
+
+  test("Deny from a managed policy attached via ManagedPolicyArns collides with an inline Allow → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        AppRole: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: { Statement: [] },
+            ManagedPolicyArns: [{ Ref: "GuardrailManagedPolicy" }],
+            Policies: [{ PolicyName: "inline", PolicyDocument: { Statement: [{ Effect: "Allow", Action: "ec2:ModifyInstanceAttribute", Resource: "*" }] } }],
+          },
+        },
+        GuardrailManagedPolicy: {
+          Type: "AWS::IAM::ManagedPolicy",
+          Properties: {
+            PolicyDocument: { Statement: [{ Effect: "Deny", Action: "ec2:ModifyInstanceAttribute", Resource: "*" }] },
+          },
+        },
+      },
+    });
+    const diags = checkDenyAllowContradiction(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("GuardrailManagedPolicy");
+  });
+
+  test("role with only Allow statements → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        AppRole: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: { Statement: [] },
+            Policies: [{ PolicyName: "p", PolicyDocument: { Statement: [{ Effect: "Allow", Action: "s3:GetObject", Resource: "*" }] } }],
+          },
+        },
+      },
+    });
+    expect(checkDenyAllowContradiction(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw064.test.ts

@@ -0,0 +1,79 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw064, checkTgwBlackholeRoute } from "./waw064";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW064: Transit Gateway Route Table Declares A Blackhole Route", () => {
+  test("check metadata", () => {
+    expect(waw064.id).toBe("WAW064");
+    expect(waw064.description).toContain("Blackhole");
+  });
+
+  test("TransitGatewayRoute with Blackhole: true → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        QuarantineRoute: {
+          Type: "AWS::EC2::TransitGatewayRoute",
+          Properties: {
+            TransitGatewayRouteTableId: { Ref: "TgwRouteTable" },
+            DestinationCidrBlock: "10.99.0.0/16",
+            Blackhole: true,
+          },
+        },
+        TgwRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+      },
+    });
+    const diags = checkTgwBlackholeRoute(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW064");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("QuarantineRoute");
+    expect(diags[0].message).toContain("10.99.0.0/16");
+    expect(diags[0].lexicon).toBe("aws");
+  });
+
+  test("normal TransitGatewayRoute forwarding to an attachment → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        SpokeRoute: {
+          Type: "AWS::EC2::TransitGatewayRoute",
+          Properties: {
+            TransitGatewayRouteTableId: { Ref: "TgwRouteTable" },
+            DestinationCidrBlock: "10.0.1.0/24",
+            TransitGatewayAttachmentId: { Ref: "SpokeAttachment" },
+          },
+        },
+        TgwRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: {} },
+      },
+    });
+    expect(checkTgwBlackholeRoute(ctx)).toHaveLength(0);
+  });
+
+  test("Blackhole: false is not flagged", () => {
+    const ctx = makeCtx({
+      Resources: {
+        SpokeRoute: {
+          Type: "AWS::EC2::TransitGatewayRoute",
+          Properties: {
+            TransitGatewayRouteTableId: { Ref: "TgwRouteTable" },
+            DestinationCidrBlock: "10.0.1.0/24",
+            TransitGatewayAttachmentId: { Ref: "SpokeAttachment" },
+            Blackhole: false,
+          },
+        },
+      },
+    });
+    expect(checkTgwBlackholeRoute(ctx)).toHaveLength(0);
+  });
+
+  test("no TransitGatewayRoute resources → no diagnostic", () => {
+    const ctx = makeCtx({ Resources: { Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } } } });
+    expect(checkTgwBlackholeRoute(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw064.ts

@@ -0,0 +1,52 @@
+/**
+ * WAW064: Transit Gateway Route Table Declares A Blackhole Route
+ *
+ * `AWS::EC2::TransitGatewayRoute` with `Blackhole: true` silently drops any
+ * traffic matching its destination CIDR instead of forwarding it —
+ * CloudFormation deploys this without complaint, and the packet loss only
+ * surfaces downstream as unreachable hosts or a timeout nobody can explain
+ * from the template alone. A blackhole route is sometimes deliberate — an
+ * explicit deny for a CIDR range, or a placeholder pending real
+ * infrastructure — but it is also exactly what a copy-pasted route table or
+ * a forgotten cleanup step leaves behind. Warn so it stays a conscious
+ * choice rather than a silent accident.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate } from "./cf-refs";
+
+export function checkTgwBlackholeRoute(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::EC2::TransitGatewayRoute") continue;
+
+      const props = resource.Properties ?? {};
+      if (props.Blackhole !== true) continue;
+
+      const cidr = typeof props.DestinationCidrBlock === "string" ? props.DestinationCidrBlock : "(unknown destination)";
+      diagnostics.push({
+        checkId: "WAW064",
+        severity: "warning",
+        message: `TransitGatewayRoute "${logicalId}" declares Blackhole: true for destination ${cidr} — traffic matching this route is silently dropped; confirm this is intentional`,
+        entity: logicalId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw064: PostSynthCheck = {
+  id: "WAW064",
+  description: "Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkTgwBlackholeRoute(ctx);
+  },
+};

package/src/lint/post-synth/waw065.test.ts

@@ -0,0 +1,90 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw065, checkTgwRouteTableWiring } from "./waw065";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW065: Transit Gateway Route Table Wiring Is Incomplete", () => {
+  test("check metadata", () => {
+    expect(waw065.id).toBe("WAW065");
+    expect(waw065.description).toContain("propagation");
+  });
+
+  test("route table with an association but no propagation → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAssociation: {
+          Type: "AWS::EC2::TransitGatewayRouteTableAssociation",
+          Properties: { TransitGatewayAttachmentId: { Ref: "SpokeAttachment" }, TransitGatewayRouteTableId: { Ref: "SpokeRouteTable" } },
+        },
+      },
+    });
+    const diags = checkTgwRouteTableWiring(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW065");
+    expect(diags[0].entity).toBe("SpokeRouteTable");
+    expect(diags[0].message).toContain("no route propagations");
+  });
+
+  test("attachment referenced by neither an association nor a propagation → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        OrphanAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+      },
+    });
+    const diags = checkTgwRouteTableWiring(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("OrphanAttachment");
+    expect(diags[0].message).toContain("no route table wiring");
+  });
+
+  test("both patterns fire independently in the same template", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAssociation: {
+          Type: "AWS::EC2::TransitGatewayRouteTableAssociation",
+          Properties: { TransitGatewayAttachmentId: { Ref: "SpokeAttachment" }, TransitGatewayRouteTableId: { Ref: "SpokeRouteTable" } },
+        },
+        OrphanAttachment: { Type: "AWS::EC2::TransitGatewayVpnAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+      },
+    });
+    const diags = checkTgwRouteTableWiring(ctx);
+    expect(diags).toHaveLength(2);
+    const entities = diags.map((d) => d.entity).sort();
+    expect(entities).toEqual(["OrphanAttachment", "SpokeRouteTable"]);
+  });
+
+  test("route table with both an association and a propagation, attachment referenced by both → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAssociation: {
+          Type: "AWS::EC2::TransitGatewayRouteTableAssociation",
+          Properties: { TransitGatewayAttachmentId: { Ref: "SpokeAttachment" }, TransitGatewayRouteTableId: { Ref: "SpokeRouteTable" } },
+        },
+        SpokePropagation: {
+          Type: "AWS::EC2::TransitGatewayRouteTablePropagation",
+          Properties: { TransitGatewayAttachmentId: { Ref: "SpokeAttachment" }, TransitGatewayRouteTableId: { Ref: "SpokeRouteTable" } },
+        },
+      },
+    });
+    expect(checkTgwRouteTableWiring(ctx)).toHaveLength(0);
+  });
+
+  test("no transit gateway resources at all → no diagnostic", () => {
+    const ctx = makeCtx({ Resources: { Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } } } });
+    expect(checkTgwRouteTableWiring(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw065.ts

@@ -0,0 +1,110 @@
+/**
+ * WAW065: Transit Gateway Route Table Wiring Is Incomplete
+ *
+ * A Transit Gateway route table only does anything once two independent
+ * pieces are both wired up: an `AWS::EC2::TransitGatewayRouteTableAssociation`
+ * (which attachment's traffic is evaluated against this table) and an
+ * `AWS::EC2::TransitGatewayRouteTablePropagation` (which attachments' routes
+ * populate it). CloudFormation is happy to deploy a route table with one but
+ * not the other — the stack succeeds, and the gap only shows up as traffic
+ * that can't find a route. Two patterns, both "declared but half-wired":
+ *
+ *  - a route table has one or more associations but zero propagations — the
+ *    associated attachment's traffic is evaluated against this table, but
+ *    nothing ever populates it with routes;
+ *  - a declared attachment (VPC/VPN/peering, or the generic
+ *    TransitGatewayAttachment) is referenced by neither an association nor
+ *    a propagation anywhere in the template — it hangs off the transit
+ *    gateway with no route table wiring at all.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs } from "./cf-refs";
+
+const ATTACHMENT_TYPES = new Set([
+  "AWS::EC2::TransitGatewayAttachment",
+  "AWS::EC2::TransitGatewayVpcAttachment",
+  "AWS::EC2::TransitGatewayVpnAttachment",
+  "AWS::EC2::TransitGatewayPeeringAttachment",
+]);
+
+export function checkTgwRouteTableWiring(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    const routeTableIds = new Set<string>();
+    const attachmentIds = new Set<string>();
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTable") routeTableIds.add(logicalId);
+      if (ATTACHMENT_TYPES.has(resource.Type)) attachmentIds.add(logicalId);
+    }
+    if (routeTableIds.size === 0 && attachmentIds.size === 0) continue;
+
+    const associationsByTable = new Map<string, Set<string>>();
+    const propagationsByTable = new Map<string, Set<string>>();
+    const referencedAttachments = new Set<string>();
+
+    for (const resource of Object.values(resources)) {
+      let bucket: Map<string, Set<string>> | null = null;
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTableAssociation") bucket = associationsByTable;
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTablePropagation") bucket = propagationsByTable;
+      if (!bucket) continue;
+
+      const props = resource.Properties ?? {};
+      const attachmentRefs = findResourceRefs(props.TransitGatewayAttachmentId);
+      for (const attId of attachmentRefs) referencedAttachments.add(attId);
+
+      for (const rtId of findResourceRefs(props.TransitGatewayRouteTableId)) {
+        let attSet = bucket.get(rtId);
+        if (!attSet) {
+          attSet = new Set();
+          bucket.set(rtId, attSet);
+        }
+        for (const attId of attachmentRefs) attSet.add(attId);
+      }
+    }
+
+    // Pattern A: associated but never propagated.
+    for (const rtId of routeTableIds) {
+      const associations = associationsByTable.get(rtId);
+      const propagations = propagationsByTable.get(rtId);
+      if (associations && associations.size > 0 && (!propagations || propagations.size === 0)) {
+        diagnostics.push({
+          checkId: "WAW065",
+          severity: "warning",
+          message: `TransitGatewayRouteTable "${rtId}" has ${associations.size} association(s) but no route propagations — the associated attachment's routes never populate this table, likely incomplete wiring`,
+          entity: rtId,
+          lexicon: "aws",
+        });
+      }
+    }
+
+    // Pattern B: a declared attachment wired into no route table at all.
+    for (const attId of attachmentIds) {
+      if (!referencedAttachments.has(attId)) {
+        diagnostics.push({
+          checkId: "WAW065",
+          severity: "warning",
+          message: `Transit Gateway attachment "${attId}" is referenced by no TransitGatewayRouteTableAssociation or TransitGatewayRouteTablePropagation — it has no route table wiring, so nothing can route to or from it`,
+          entity: attId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw065: PostSynthCheck = {
+  id: "WAW065",
+  description: "Transit Gateway route table has associations but no propagations, or an attachment wired into no route table",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkTgwRouteTableWiring(ctx);
+  },
+};

package/src/lint/post-synth/waw066.test.ts

@@ -0,0 +1,108 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw066, checkPrivateSubnetDefaultRoute } from "./waw066";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW066: Private Subnet Route Table Has No Working Default Route", () => {
+  test("check metadata", () => {
+    expect(waw066.id).toBe("WAW066");
+    expect(waw066.description).toContain("default route");
+  });
+
+  test("subnet's route table has no default route at all → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        PrivateSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        PrivateRouteTable: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssoc: {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: "PrivateSubnet" }, RouteTableId: { Ref: "PrivateRouteTable" } },
+        },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    const diags = checkPrivateSubnetDefaultRoute(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW066");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("PrivateSubnet");
+    expect(diags[0].message).toContain("no default route");
+  });
+
+  test("default route targets a NAT gateway that does not exist in the template → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        PrivateSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        PrivateRouteTable: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssoc: {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: "PrivateSubnet" }, RouteTableId: { Ref: "PrivateRouteTable" } },
+        },
+        DefaultRoute: {
+          Type: "AWS::EC2::Route",
+          Properties: { RouteTableId: { Ref: "PrivateRouteTable" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "RemovedNatGateway" } },
+        },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    const diags = checkPrivateSubnetDefaultRoute(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("PrivateSubnet");
+    expect(diags[0].message).toContain("does not exist in this template");
+  });
+
+  test("default route to a NAT gateway that exists in the template → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        PrivateSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        PrivateRouteTable: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssoc: {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: "PrivateSubnet" }, RouteTableId: { Ref: "PrivateRouteTable" } },
+        },
+        DefaultRoute: {
+          Type: "AWS::EC2::Route",
+          Properties: { RouteTableId: { Ref: "PrivateRouteTable" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGateway" } },
+        },
+        NatGateway: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnet" } } },
+        PublicSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24" } },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    expect(checkPrivateSubnetDefaultRoute(ctx)).toHaveLength(0);
+  });
+
+  test("public subnet with a default route to an existing Internet Gateway → no diagnostic (out of scope)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        PublicSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24" } },
+        PublicRouteTable: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PublicAssoc: {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: "PublicSubnet" }, RouteTableId: { Ref: "PublicRouteTable" } },
+        },
+        DefaultRoute: {
+          Type: "AWS::EC2::Route",
+          Properties: { RouteTableId: { Ref: "PublicRouteTable" }, DestinationCidrBlock: "0.0.0.0/0", GatewayId: { Ref: "Igw" } },
+        },
+        Igw: { Type: "AWS::EC2::InternetGateway", Properties: {} },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    expect(checkPrivateSubnetDefaultRoute(ctx)).toHaveLength(0);
+  });
+
+  test("subnet with no explicit route table association → no diagnostic (out of scope, can't prove)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Subnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    expect(checkPrivateSubnetDefaultRoute(ctx)).toHaveLength(0);
+  });
+});