@intentius/chant-lexicon-aws 0.46.0 → 0.50.0

package/src/lint/post-synth/waw066.ts

@@ -0,0 +1,155 @@
+/**
+ * WAW066: Private Subnet Route Table Has No Working Default Route
+ *
+ * Cross-resource join: a subnet's outbound path depends on a chain of three
+ * independently-declared resources — the `AWS::EC2::SubnetRouteTableAssociation`
+ * that pins it to a route table, the `AWS::EC2::Route` on that table for
+ * `0.0.0.0/0`, and the gateway that route names. CloudFormation validates
+ * none of this end-to-end: a subnet can be wired to a route table with no
+ * default route at all, or with a default route whose NAT gateway / Transit
+ * Gateway target was renamed or removed elsewhere in the template, and the
+ * stack still deploys clean. The subnet is black-holed — every deploy
+ * succeeds, and the only symptom is a workload with no outbound connectivity.
+ *
+ * A route table with a default route to an `AWS::EC2::InternetGateway` is
+ * treated as a public subnet and is out of scope for this check — this rule
+ * only flags the private case: no default route, or one whose target
+ * (`NatGatewayId` / `TransitGatewayId` / etc.) does not resolve to a
+ * resource declared in the same template. A route naming a target that
+ * exists in the template resolves cleanly and is never flagged, per the
+ * cross-resource contract.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFResource, type CFTemplate } from "./cf-refs";
+
+type RouteClass = "public" | "resolved" | "dangling";
+
+const OTHER_TARGET_KEYS = [
+  "NatGatewayId",
+  "TransitGatewayId",
+  "VpcPeeringConnectionId",
+  "EgressOnlyInternetGatewayId",
+  "LocalGatewayId",
+  "CarrierGatewayId",
+  "NetworkInterfaceId",
+  "InstanceId",
+] as const;
+
+/** Classify a `0.0.0.0/0` Route's target. A target Ref that exists always resolves. */
+function classifyDefaultRoute(route: CFResource, resources: Record<string, CFResource>): RouteClass {
+  const props = route.Properties ?? {};
+
+  if (props.GatewayId !== undefined) {
+    if (typeof props.GatewayId === "string") {
+      return props.GatewayId.startsWith("igw-") ? "public" : "resolved";
+    }
+    const refs = findResourceRefs(props.GatewayId);
+    if (refs.size !== 1) return "resolved"; // unprovable intrinsic — stay quiet
+    const [id] = refs;
+    if (!resources[id]) return "dangling";
+    return resources[id].Type === "AWS::EC2::InternetGateway" ? "public" : "resolved";
+  }
+
+  for (const key of OTHER_TARGET_KEYS) {
+    const value = (props as Record<string, unknown>)[key];
+    if (value === undefined) continue;
+    if (typeof value === "string") return "resolved"; // literal id from outside the template
+    const refs = findResourceRefs(value);
+    if (refs.size !== 1) return "resolved";
+    const [id] = refs;
+    return resources[id] ? "resolved" : "dangling";
+  }
+
+  return "resolved"; // no recognized target key — can't classify, stay quiet
+}
+
+function isDefaultRoute(route: CFResource): boolean {
+  return route.Properties?.DestinationCidrBlock === "0.0.0.0/0";
+}
+
+export function checkPrivateSubnetDefaultRoute(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // subnetId -> Set<routeTableId>, from explicit associations only.
+    const subnetRouteTables = new Map<string, Set<string>>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+      const props = resource.Properties ?? {};
+      const subnetRefs = findResourceRefs(props.SubnetId);
+      const rtRefs = findResourceRefs(props.RouteTableId);
+      for (const subnetId of subnetRefs) {
+        let set = subnetRouteTables.get(subnetId);
+        if (!set) {
+          set = new Set();
+          subnetRouteTables.set(subnetId, set);
+        }
+        for (const rtId of rtRefs) set.add(rtId);
+      }
+    }
+
+    // routeTableId -> Route resources targeting it.
+    const routesByTable = new Map<string, CFResource[]>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::Route") continue;
+      for (const rtId of findResourceRefs(resource.Properties?.RouteTableId)) {
+        let list = routesByTable.get(rtId);
+        if (!list) {
+          list = [];
+          routesByTable.set(rtId, list);
+        }
+        list.push(resource);
+      }
+    }
+
+    for (const [subnetId, rtIds] of subnetRouteTables) {
+      if (resources[subnetId]?.Type !== "AWS::EC2::Subnet") continue;
+
+      for (const rtId of rtIds) {
+        if (resources[rtId]?.Type !== "AWS::EC2::RouteTable") continue;
+
+        const routes = routesByTable.get(rtId) ?? [];
+        const defaultRoutes = routes.filter(isDefaultRoute);
+
+        if (defaultRoutes.length === 0) {
+          diagnostics.push({
+            checkId: "WAW066",
+            severity: "warning",
+            message: `Subnet "${subnetId}" is associated with route table "${rtId}", which has no default route (0.0.0.0/0) — outbound traffic from this subnet has no path out, black-holed by omission`,
+            entity: subnetId,
+            lexicon: "aws",
+          });
+          continue;
+        }
+
+        const classes = defaultRoutes.map((route) => classifyDefaultRoute(route, resources));
+        if (classes.includes("public")) continue; // has a real IGW default route — public subnet, out of scope
+        if (classes.every((c) => c === "dangling")) {
+          diagnostics.push({
+            checkId: "WAW066",
+            severity: "error",
+            message: `Subnet "${subnetId}"'s route table "${rtId}" has a default route (0.0.0.0/0) whose target does not exist in this template — outbound traffic from this subnet is black-holed`,
+            entity: subnetId,
+            lexicon: "aws",
+          });
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw066: PostSynthCheck = {
+  id: "WAW066",
+  description: "Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkPrivateSubnetDefaultRoute(ctx);
+  },
+};

package/src/lint/post-synth/waw067.test.ts

@@ -0,0 +1,79 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw067, checkNatGatewaySingleAz } from "./waw067";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets", () => {
+  test("check metadata", () => {
+    expect(waw067.id).toBe("WAW067");
+    expect(waw067.description).toContain("NAT gateway");
+  });
+
+  test("one NAT gateway serving private subnets in two AZs → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        PublicSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24", AvailabilityZone: "us-east-1a" } },
+        NatGateway: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnetA" } } },
+
+        PrivateSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24", AvailabilityZone: "us-east-1a" } },
+        PrivateRouteTableA: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocA: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetA" }, RouteTableId: { Ref: "PrivateRouteTableA" } } },
+        PrivateDefaultRouteA: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableA" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGateway" } } },
+
+        PrivateSubnetB: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.2.0/24", AvailabilityZone: "us-east-1b" } },
+        PrivateRouteTableB: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocB: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetB" }, RouteTableId: { Ref: "PrivateRouteTableB" } } },
+        PrivateDefaultRouteB: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableB" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGateway" } } },
+      },
+    });
+    const diags = checkNatGatewaySingleAz(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW067");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("NatGateway");
+    expect(diags[0].message).toContain("us-east-1a");
+    expect(diags[0].message).toContain("us-east-1b");
+  });
+
+  test("one NAT gateway per AZ, each serving only its own AZ's subnets → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+
+        PublicSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24", AvailabilityZone: "us-east-1a" } },
+        NatGatewayA: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnetA" } } },
+        PrivateSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24", AvailabilityZone: "us-east-1a" } },
+        PrivateRouteTableA: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocA: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetA" }, RouteTableId: { Ref: "PrivateRouteTableA" } } },
+        PrivateDefaultRouteA: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableA" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGatewayA" } } },
+
+        PublicSubnetB: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.10.0/24", AvailabilityZone: "us-east-1b" } },
+        NatGatewayB: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnetB" } } },
+        PrivateSubnetB: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.2.0/24", AvailabilityZone: "us-east-1b" } },
+        PrivateRouteTableB: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocB: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetB" }, RouteTableId: { Ref: "PrivateRouteTableB" } } },
+        PrivateDefaultRouteB: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableB" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGatewayB" } } },
+      },
+    });
+    expect(checkNatGatewaySingleAz(ctx)).toHaveLength(0);
+  });
+
+  test("one NAT gateway serving only subnets in its own AZ → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        PublicSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24", AvailabilityZone: "us-east-1a" } },
+        NatGateway: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnetA" } } },
+        PrivateSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24", AvailabilityZone: "us-east-1a" } },
+        PrivateRouteTableA: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocA: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetA" }, RouteTableId: { Ref: "PrivateRouteTableA" } } },
+        PrivateDefaultRouteA: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableA" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGateway" } } },
+      },
+    });
+    expect(checkNatGatewaySingleAz(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw067.ts

@@ -0,0 +1,114 @@
+/**
+ * WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets
+ *
+ * Cross-resource join across four resource kinds: a NAT gateway lives in one
+ * subnet, which lives in one Availability Zone; a route table's default
+ * route names the NAT gateway it forwards to; a subnet is pinned to a route
+ * table by an `AWS::EC2::SubnetRouteTableAssociation`. Follow that chain and
+ * a common reliability gap falls out — private subnets in two or more AZs
+ * all defaulting to the *same* NAT gateway. CloudFormation has no opinion on
+ * this; it deploys cleanly. But a NAT gateway lives entirely inside one AZ,
+ * so if that AZ has an outage, every subnet depending on it loses egress —
+ * including the subnets in AZs that were otherwise healthy. The
+ * Well-Architected fix is one NAT gateway per AZ, each serving only its own
+ * AZ's subnets.
+ *
+ * Only fires when the Availability Zones involved are literal strings —
+ * an `Fn::GetAZs`/`Fn::Select`-derived AZ can't be compared statically, so a
+ * subnet without a literal `AvailabilityZone` is silently excluded rather
+ * than guessed at.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFTemplate } from "./cf-refs";
+
+export function checkNatGatewaySingleAz(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // NAT gateway id -> its own subnet's literal AZ.
+    const natGatewayAz = new Map<string, string>();
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type !== "AWS::EC2::NatGateway") continue;
+      const subnetRefs = findResourceRefs(resource.Properties?.SubnetId);
+      if (subnetRefs.size !== 1) continue;
+      const [subnetId] = subnetRefs;
+      const az = resources[subnetId]?.Properties?.AvailabilityZone;
+      if (typeof az === "string") natGatewayAz.set(logicalId, az);
+    }
+    if (natGatewayAz.size === 0) continue;
+
+    // route table id -> the NAT gateway its default route forwards to.
+    const routeTableNatTarget = new Map<string, string>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::Route") continue;
+      const props = resource.Properties ?? {};
+      if (props.DestinationCidrBlock !== "0.0.0.0/0") continue;
+      const natRefs = findResourceRefs(props.NatGatewayId);
+      if (natRefs.size !== 1) continue;
+      const [natId] = natRefs;
+      if (!natGatewayAz.has(natId)) continue;
+      for (const rtId of findResourceRefs(props.RouteTableId)) {
+        routeTableNatTarget.set(rtId, natId);
+      }
+    }
+
+    // subnet id -> route table id, from explicit associations only.
+    const subnetRouteTable = new Map<string, string>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+      const props = resource.Properties ?? {};
+      const subnetRefs = findResourceRefs(props.SubnetId);
+      const rtRefs = findResourceRefs(props.RouteTableId);
+      if (subnetRefs.size !== 1 || rtRefs.size !== 1) continue;
+      const [subnetId] = subnetRefs;
+      const [rtId] = rtRefs;
+      subnetRouteTable.set(subnetId, rtId);
+    }
+
+    // NAT gateway id -> the set of subnets that default-route through it.
+    const servedSubnets = new Map<string, Set<string>>();
+    for (const [subnetId, rtId] of subnetRouteTable) {
+      const natId = routeTableNatTarget.get(rtId);
+      if (!natId) continue;
+      let set = servedSubnets.get(natId);
+      if (!set) {
+        set = new Set();
+        servedSubnets.set(natId, set);
+      }
+      set.add(subnetId);
+    }
+
+    for (const [natId, subnetIds] of servedSubnets) {
+      const azs = new Set<string>();
+      for (const subnetId of subnetIds) {
+        const az = resources[subnetId]?.Properties?.AvailabilityZone;
+        if (typeof az === "string") azs.add(az);
+      }
+      if (azs.size > 1) {
+        diagnostics.push({
+          checkId: "WAW067",
+          severity: "warning",
+          message: `NAT Gateway "${natId}" (in ${natGatewayAz.get(natId)}) is the default-route egress for private subnets across ${azs.size} Availability Zones (${[...azs].sort().join(", ")}) — a single-AZ NAT gateway is a single point of failure for cross-AZ egress; add one NAT gateway per AZ`,
+          entity: natId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw067: PostSynthCheck = {
+  id: "WAW067",
+  description: "A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkNatGatewaySingleAz(ctx);
+  },
+};

package/src/lint/post-synth/waw068.test.ts

@@ -0,0 +1,74 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw068, checkVpnGatewayRedundancy } from "./waw068";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW068: VPN Gateway Has A Single VPN Connection", () => {
+  test("check metadata", () => {
+    expect(waw068.id).toBe("WAW068");
+    expect(waw068.description).toContain("VPN Connection");
+  });
+
+  test("VPN Gateway with a single VPN connection → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Vgw: { Type: "AWS::EC2::VPNGateway", Properties: { Type: "ipsec.1" } },
+        CustomerGw: { Type: "AWS::EC2::CustomerGateway", Properties: { Type: "ipsec.1", BgpAsn: 65000, IpAddress: "203.0.113.1" } },
+        VpnConnection: {
+          Type: "AWS::EC2::VPNConnection",
+          Properties: { Type: "ipsec.1", CustomerGatewayId: { Ref: "CustomerGw" }, VpnGatewayId: { Ref: "Vgw" } },
+        },
+      },
+    });
+    const diags = checkVpnGatewayRedundancy(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW068");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("Vgw");
+    expect(diags[0].message).toContain("VpnConnection");
+  });
+
+  test("Transit Gateway with a single VPN connection → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        CustomerGw: { Type: "AWS::EC2::CustomerGateway", Properties: { Type: "ipsec.1", BgpAsn: 65000, IpAddress: "203.0.113.1" } },
+        VpnConnection: {
+          Type: "AWS::EC2::VPNConnection",
+          Properties: { Type: "ipsec.1", CustomerGatewayId: { Ref: "CustomerGw" }, TransitGatewayId: { Ref: "Tgw" } },
+        },
+      },
+    });
+    const diags = checkVpnGatewayRedundancy(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("Tgw");
+    expect(diags[0].message).toContain("Transit Gateway");
+  });
+
+  test("VPN Gateway with two VPN connections attached → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Vgw: { Type: "AWS::EC2::VPNGateway", Properties: { Type: "ipsec.1" } },
+        CustomerGwA: { Type: "AWS::EC2::CustomerGateway", Properties: { Type: "ipsec.1", BgpAsn: 65000, IpAddress: "203.0.113.1" } },
+        CustomerGwB: { Type: "AWS::EC2::CustomerGateway", Properties: { Type: "ipsec.1", BgpAsn: 65000, IpAddress: "203.0.113.2" } },
+        VpnConnectionA: {
+          Type: "AWS::EC2::VPNConnection",
+          Properties: { Type: "ipsec.1", CustomerGatewayId: { Ref: "CustomerGwA" }, VpnGatewayId: { Ref: "Vgw" } },
+        },
+        VpnConnectionB: {
+          Type: "AWS::EC2::VPNConnection",
+          Properties: { Type: "ipsec.1", CustomerGatewayId: { Ref: "CustomerGwB" }, VpnGatewayId: { Ref: "Vgw" } },
+        },
+      },
+    });
+    expect(checkVpnGatewayRedundancy(ctx)).toHaveLength(0);
+  });
+
+  test("no VPN connections at all → no diagnostic", () => {
+    const ctx = makeCtx({ Resources: { Vgw: { Type: "AWS::EC2::VPNGateway", Properties: { Type: "ipsec.1" } } } });
+    expect(checkVpnGatewayRedundancy(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw068.ts

@@ -0,0 +1,78 @@
+/**
+ * WAW068: VPN Gateway Has A Single VPN Connection
+ *
+ * An `AWS::EC2::VPNConnection` always gets two tunnels from AWS, but that
+ * redundancy only covers the tunnel pair inside one connection — it does
+ * nothing if the connection's Customer Gateway, on-prem device, or the
+ * single site it terminates at goes down. The reliability boundary that
+ * matters is the connection itself: a `AWS::EC2::VPNGateway` (or a Transit
+ * Gateway used for VPN attachment) with only one `VPNConnection` attached
+ * has no fallback path for hybrid connectivity if that connection's
+ * Customer Gateway or on-prem side fails.
+ *
+ * Cross-resource join: group every declared `VPNConnection` by the gateway
+ * (`VpnGatewayId` or `TransitGatewayId`) it attaches to, and flag any
+ * gateway left with exactly one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFTemplate } from "./cf-refs";
+
+export function checkVpnGatewayRedundancy(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // gateway logical id -> the VPNConnection logical ids attached to it.
+    const connectionsByGateway = new Map<string, string[]>();
+
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type !== "AWS::EC2::VPNConnection") continue;
+      const props = resource.Properties ?? {};
+
+      const gatewayProp = props.VpnGatewayId !== undefined ? props.VpnGatewayId : props.TransitGatewayId;
+      if (gatewayProp === undefined) continue; // no declared gateway target — can't group, stay quiet
+
+      const gwRefs = findResourceRefs(gatewayProp);
+      if (gwRefs.size !== 1) continue;
+      const [gwId] = gwRefs;
+
+      const gw = resources[gwId];
+      if (!gw || (gw.Type !== "AWS::EC2::VPNGateway" && gw.Type !== "AWS::EC2::TransitGateway")) continue;
+
+      let list = connectionsByGateway.get(gwId);
+      if (!list) {
+        list = [];
+        connectionsByGateway.set(gwId, list);
+      }
+      list.push(logicalId);
+    }
+
+    for (const [gwId, connectionIds] of connectionsByGateway) {
+      if (connectionIds.length !== 1) continue;
+
+      const kind = resources[gwId].Type === "AWS::EC2::VPNGateway" ? "VPN Gateway" : "Transit Gateway";
+      diagnostics.push({
+        checkId: "WAW068",
+        severity: "warning",
+        message: `${kind} "${gwId}" has only one VPN connection ("${connectionIds[0]}") attached — no redundant path if this connection, its tunnels, or its Customer Gateway fail; attach a second VPNConnection (ideally to a separate Customer Gateway) for hybrid-connectivity redundancy`,
+        entity: gwId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw068: PostSynthCheck = {
+  id: "WAW068",
+  description: "VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkVpnGatewayRedundancy(ctx);
+  },
+};

package/src/lsp/hover.ts

@@ -61,9 +61,24 @@ function resourceHover(className: string, entry: LexiconEntry): HoverInfo | unde
     lines.push(`**Conditionally immutable:** ${entry.conditionalCreateOnly.map((p) => `\`${p}\``).join(", ")}`);
   }
 
-  if (entry.deprecatedProperties?.length) {
+  // Declared and inferred deprecations rest on different evidence, so they
+  // read as separate lines rather than one merged list (#1701). The core
+  // `LexiconEntry` gains `inferredDeprecations` in the next core release; this
+  // lexicon builds against the published core, so widen locally until then.
+  const withBasis = entry as LexiconEntry & { inferredDeprecations?: string[] };
+  const inferred = new Set(withBasis.inferredDeprecations ?? []);
+  const declared = (entry.deprecatedProperties ?? []).filter((p) => !inferred.has(p));
+
+  if (declared.length > 0) {
+    lines.push("");
+    lines.push(`**Deprecated properties:** ${declared.map((p) => `\`${p}\``).join(", ")}`);
+  }
+
+  if (inferred.size > 0) {
     lines.push("");
-    lines.push(`**Deprecated properties:** ${entry.deprecatedProperties.map((p) => `\`${p}\``).join(", ")}`);
+    lines.push(
+      `**Possibly deprecated** (description text only, not declared by the Registry): ${[...inferred].map((p) => `\`${p}\``).join(", ")}`,
+    );
   }
 
   return { contents: lines.join("\n") };

package/src/op/activities/index.ts

@@ -46,6 +46,21 @@ export {
 } from "./aws-apply";
 export type { AwsApplyArgs, RollbackStackArgs, AwsHttp } from "./aws-apply";
 
+// Effect-receipt activities (#1835) — core's receipt seam (#1834) bound to
+// the SSM store, the way the k8s lexicon binds `ensureSecret` (#1830). The
+// registry keys exported functions by name, so the three bound activities are
+// re-exported individually: `receiptRead`/`receiptWrite` serve the `effect()`
+// step's read-compare-run-write, `receiptStaleness` serves WatchOp's
+// read-only phase. The store resolves its path identity and endpoint lazily
+// at first use, so this module stays cheap to load.
+import { receiptActivities } from "@intentius/chant/op/receipt-store";
+import { awsReceiptStore } from "../../receipt-store";
+
+const boundReceiptActivities = receiptActivities(awsReceiptStore());
+export const receiptRead = boundReceiptActivities.receiptRead;
+export const receiptWrite = boundReceiptActivities.receiptWrite;
+export const receiptStaleness = boundReceiptActivities.receiptStaleness;
+
 export { awsAgentCoreFetchTrace } from "../../agentcore/trace-fetch";
 export type {
   AgentCoreTraceSource,

package/src/op/builders.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Typed step-builder wrappers (chant #1288 Stage 2) — see
+ * `lexicons/k8s/src/op/builders.test.ts`'s module doc for what's asserted
+ * and why.
+ */
+
+import { describe, test, expect } from "vitest";
+import { awsApply as awsApplyOld, awsDelete as awsDeleteOld, flociUp as flociUpOld, flociDown as flociDownOld, stepOutput, type StepOutputRef } from "@intentius/chant/op";
+import { awsApply, awsDelete, flociUp, flociDown } from "./builders";
+
+describe("aws typed step builders (#1288 Stage 2)", () => {
+  test("awsApply: identical ActivityStep to core's original", () => {
+    const opts = { stackName: "my-stack" };
+    expect(awsApply("dist/template.json", opts)).toEqual(awsApplyOld("dist/template.json", opts));
+  });
+
+  test("awsApply: identical ActivityStep with more opts", () => {
+    const opts = { stackName: "my-stack", region: "us-west-2", capabilities: ["CAPABILITY_NAMED_IAM"], profile: "fastIdempotent" as const };
+    expect(awsApply("dist/template.json", opts)).toEqual(awsApplyOld("dist/template.json", opts));
+  });
+
+  test("awsDelete: identical ActivityStep to core's original", () => {
+    const opts = { stackName: "my-stack" };
+    expect(awsDelete("dist/template.json", opts)).toEqual(awsDeleteOld("dist/template.json", opts));
+  });
+
+  test("flociUp/flociDown: identical ActivityStep to core's original", () => {
+    expect(flociUp()).toEqual(flociUpOld());
+    expect(flociUp({ port: 4567 })).toEqual(flociUpOld({ port: 4567 }));
+    expect(flociDown()).toEqual(flociDownOld());
+  });
+
+  test("awsApply: accepts a StepOutputRef in a typed slot", () => {
+    const ref = stepOutput("resolve-region", "region");
+    const step = awsApply("dist/template.json", { stackName: "my-stack", region: ref });
+    expect(step.args?.region).toBe(ref);
+  });
+
+  test("awsApply: .out is reachable when an id is given", () => {
+    const step = awsApply("dist/template.json", { stackName: "my-stack", id: "apply" });
+    const ref: StepOutputRef = step.out.releaseName;
+    expect(ref.step).toBe("apply");
+  });
+});
+
+// ── Compile-time-only: authoring-time type errors (never executed) ──────────
+function _typeChecksOnly(): void {
+  // @ts-expect-error — stackName is required (the activity fails without it);
+  // omitting opts entirely is no longer a way around that.
+  awsApply("dist/template.json");
+
+  // @ts-expect-error — "stackname" (wrong case) is not a key of AwsApplyArgs.
+  awsApply("dist/template.json", { stackname: "my-stack" });
+
+  // @ts-expect-error — capabilities must be string[], not a single string.
+  awsApply("dist/template.json", { stackName: "my-stack", capabilities: "CAPABILITY_NAMED_IAM" });
+
+  // @ts-expect-error — port must be a number.
+  flociUp({ port: "4566" });
+}
+void _typeChecksOnly;