@intentius/chant-lexicon-aws 0.46.0 → 0.50.0

package/dist/lint/post-synth/waw063.d.ts

@@ -0,0 +1,35 @@
+/**
+ * WAW063: IAM Policy Denies An Action It Also Allows
+ *
+ * IAM evaluates an explicit Deny as an absolute veto: it wins over any
+ * Allow granted to the same principal, from any attached policy, no matter
+ * how the Allow got there. When a role ends up with both an Allow and a
+ * Deny for the same action (over an overlapping resource scope) —
+ * typically because a broad guardrail policy and a feature-specific policy
+ * were attached to the same role independently — CloudFormation deploys
+ * the stack without complaint and the contradiction only surfaces as a
+ * runtime 403, the most expensive class of error to trace back to its
+ * source. This is IAM-reasoning static analysis over the declared graph:
+ * collect every Allow/Deny statement attached to each declared IAM::Role
+ * (inline, standalone IAM::Policy, and IAM::ManagedPolicy) and flag a
+ * literal action+resource collision between an Allow and a Deny.
+ *
+ * Deliberately conservative to avoid flagging the common intentional
+ * "broad Allow + narrow safety-Deny" guardrail pattern (e.g. `Allow ec2:*`
+ * plus `Deny ec2:TerminateInstances`):
+ *   - both statements' Action lists are compared string-by-string; a match
+ *     requires either the literal same action on both sides, or a
+ *     wildcarded Deny action that matches a literal (non-wildcarded) Allow
+ *     action. A wildcarded Allow paired with a literal Deny is exactly the
+ *     guardrail pattern and is never flagged;
+ *   - resources are compared the same way: `Resource: "*"` on the Deny
+ *     side always overlaps, or a literal exact match; a wildcarded Allow
+ *     resource paired with a narrower literal Deny is not flagged;
+ *   - any statement carrying a Condition, NotAction, NotResource,
+ *     Principal, or an intrinsic Action/Resource is skipped — the rule
+ *     can't prove those statically, so it stays quiet.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDenyAllowContradiction(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw063: PostSynthCheck;
+//# sourceMappingURL=waw063.d.ts.map

package/dist/lint/post-synth/waw063.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw063.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw063.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAyG9G,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA8CxF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw064.d.ts

@@ -0,0 +1,17 @@
+/**
+ * WAW064: Transit Gateway Route Table Declares A Blackhole Route
+ *
+ * `AWS::EC2::TransitGatewayRoute` with `Blackhole: true` silently drops any
+ * traffic matching its destination CIDR instead of forwarding it —
+ * CloudFormation deploys this without complaint, and the packet loss only
+ * surfaces downstream as unreachable hosts or a timeout nobody can explain
+ * from the template alone. A blackhole route is sometimes deliberate — an
+ * explicit deny for a CIDR range, or a placeholder pending real
+ * infrastructure — but it is also exactly what a copy-pasted route table or
+ * a forgotten cleanup step leaves behind. Warn so it stays a conscious
+ * choice rather than a silent accident.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkTgwBlackholeRoute(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw064: PostSynthCheck;
+//# sourceMappingURL=waw064.d.ts.map

package/dist/lint/post-synth/waw064.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw064.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw064.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAyBnF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw065.d.ts

@@ -0,0 +1,23 @@
+/**
+ * WAW065: Transit Gateway Route Table Wiring Is Incomplete
+ *
+ * A Transit Gateway route table only does anything once two independent
+ * pieces are both wired up: an `AWS::EC2::TransitGatewayRouteTableAssociation`
+ * (which attachment's traffic is evaluated against this table) and an
+ * `AWS::EC2::TransitGatewayRouteTablePropagation` (which attachments' routes
+ * populate it). CloudFormation is happy to deploy a route table with one but
+ * not the other — the stack succeeds, and the gap only shows up as traffic
+ * that can't find a route. Two patterns, both "declared but half-wired":
+ *
+ *  - a route table has one or more associations but zero propagations — the
+ *    associated attachment's traffic is evaluated against this table, but
+ *    nothing ever populates it with routes;
+ *  - a declared attachment (VPC/VPN/peering, or the generic
+ *    TransitGatewayAttachment) is referenced by neither an association nor
+ *    a propagation anywhere in the template — it hangs off the transit
+ *    gateway with no route table wiring at all.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkTgwRouteTableWiring(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw065: PostSynthCheck;
+//# sourceMappingURL=waw065.d.ts.map

package/dist/lint/post-synth/waw065.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw065.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw065.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAU9G,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAsErF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw066.d.ts

@@ -0,0 +1,25 @@
+/**
+ * WAW066: Private Subnet Route Table Has No Working Default Route
+ *
+ * Cross-resource join: a subnet's outbound path depends on a chain of three
+ * independently-declared resources — the `AWS::EC2::SubnetRouteTableAssociation`
+ * that pins it to a route table, the `AWS::EC2::Route` on that table for
+ * `0.0.0.0/0`, and the gateway that route names. CloudFormation validates
+ * none of this end-to-end: a subnet can be wired to a route table with no
+ * default route at all, or with a default route whose NAT gateway / Transit
+ * Gateway target was renamed or removed elsewhere in the template, and the
+ * stack still deploys clean. The subnet is black-holed — every deploy
+ * succeeds, and the only symptom is a workload with no outbound connectivity.
+ *
+ * A route table with a default route to an `AWS::EC2::InternetGateway` is
+ * treated as a public subnet and is out of scope for this check — this rule
+ * only flags the private case: no default route, or one whose target
+ * (`NatGatewayId` / `TransitGatewayId` / etc.) does not resolve to a
+ * resource declared in the same template. A route naming a target that
+ * exists in the template resolves cleanly and is never flagged, per the
+ * cross-resource contract.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkPrivateSubnetDefaultRoute(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw066: PostSynthCheck;
+//# sourceMappingURL=waw066.d.ts.map

package/dist/lint/post-synth/waw066.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw066.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw066.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAgD9G,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA2E3F;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw067.d.ts

@@ -0,0 +1,24 @@
+/**
+ * WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets
+ *
+ * Cross-resource join across four resource kinds: a NAT gateway lives in one
+ * subnet, which lives in one Availability Zone; a route table's default
+ * route names the NAT gateway it forwards to; a subnet is pinned to a route
+ * table by an `AWS::EC2::SubnetRouteTableAssociation`. Follow that chain and
+ * a common reliability gap falls out — private subnets in two or more AZs
+ * all defaulting to the *same* NAT gateway. CloudFormation has no opinion on
+ * this; it deploys cleanly. But a NAT gateway lives entirely inside one AZ,
+ * so if that AZ has an outage, every subnet depending on it loses egress —
+ * including the subnets in AZs that were otherwise healthy. The
+ * Well-Architected fix is one NAT gateway per AZ, each serving only its own
+ * AZ's subnets.
+ *
+ * Only fires when the Availability Zones involved are literal strings —
+ * an `Fn::GetAZs`/`Fn::Select`-derived AZ can't be compared statically, so a
+ * subnet without a literal `AvailabilityZone` is silently excluded rather
+ * than guessed at.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkNatGatewaySingleAz(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw067: PostSynthCheck;
+//# sourceMappingURL=waw067.d.ts.map

package/dist/lint/post-synth/waw067.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw067.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw067.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAgFpF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw068.d.ts

@@ -0,0 +1,20 @@
+/**
+ * WAW068: VPN Gateway Has A Single VPN Connection
+ *
+ * An `AWS::EC2::VPNConnection` always gets two tunnels from AWS, but that
+ * redundancy only covers the tunnel pair inside one connection — it does
+ * nothing if the connection's Customer Gateway, on-prem device, or the
+ * single site it terminates at goes down. The reliability boundary that
+ * matters is the connection itself: a `AWS::EC2::VPNGateway` (or a Transit
+ * Gateway used for VPN attachment) with only one `VPNConnection` attached
+ * has no fallback path for hybrid connectivity if that connection's
+ * Customer Gateway or on-prem side fails.
+ *
+ * Cross-resource join: group every declared `VPNConnection` by the gateway
+ * (`VpnGatewayId` or `TransitGatewayId`) it attaches to, and flag any
+ * gateway left with exactly one.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkVpnGatewayRedundancy(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw068: PostSynthCheck;
+//# sourceMappingURL=waw068.d.ts.map

package/dist/lint/post-synth/waw068.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw068.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw068.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAgDtF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.46.0",
+  "version": "0.50.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -6222,6 +6222,9 @@
     "deprecatedProperties": [
       "DeleteStorageConnectors"
     ],
+    "inferredDeprecations": [
+      "DeleteStorageConnectors"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -11669,6 +11672,9 @@
     "deprecatedProperties": [
       "AccessControl"
     ],
+    "inferredDeprecations": [
+      "AccessControl"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -14989,6 +14995,9 @@
     "deprecatedProperties": [
       "ComputeModel"
     ],
+    "inferredDeprecations": [
+      "ComputeModel"
+    ],
     "replacementStrategy": "delete_then_create",
     "tagging": {
       "taggable": true,
@@ -15385,6 +15394,9 @@
     "deprecatedProperties": [
       "ComputeModel"
     ],
+    "inferredDeprecations": [
+      "ComputeModel"
+    ],
     "conditionalCreateOnly": [
       "DbNodes"
     ],
@@ -17085,6 +17097,9 @@
     "deprecatedProperties": [
       "Deprecated"
     ],
+    "inferredDeprecations": [
+      "Deprecated"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -29032,6 +29047,9 @@
       "TdeCredentialPassword",
       "DBSecurityGroups"
     ],
+    "inferredDeprecations": [
+      "DBSecurityGroups"
+    ],
     "conditionalCreateOnly": [
       "AutoMinorVersionUpgrade",
       "AvailabilityZone",
@@ -33246,6 +33264,9 @@
     "deprecatedProperties": [
       "ImageScanningConfiguration"
     ],
+    "inferredDeprecations": [
+      "ImageScanningConfiguration"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -41749,6 +41770,9 @@
     "deprecatedProperties": [
       "Runtime"
     ],
+    "inferredDeprecations": [
+      "Runtime"
+    ],
     "conditionalCreateOnly": [
       "DurableConfig"
     ],
@@ -49621,6 +49645,10 @@
       "ElasticGpuSpecifications",
       "ElasticInferenceAccelerators"
     ],
+    "inferredDeprecations": [
+      "ElasticGpuSpecifications",
+      "ElasticInferenceAccelerators"
+    ],
     "conditionalCreateOnly": [
       "AdditionalInfo",
       "Affinity",
@@ -64878,6 +64906,9 @@
     "deprecatedProperties": [
       "DBPort"
     ],
+    "inferredDeprecations": [
+      "DBPort"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -100101,6 +100132,9 @@
     "deprecatedProperties": [
       "State"
     ],
+    "inferredDeprecations": [
+      "State"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,

package/dist/okf/index.md

@@ -1724,3 +1724,11 @@ okf_version: '0.2'
 * [WAW058](/rules/WAW058.md) - Organization audit trail missing, not logging, or scoped down to a single region
 * [WAW059](/rules/WAW059.md) - Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
 * [WAW060](/rules/WAW060.md) - IAM policy attached to no principal — it grants nothing
+* [WAW061](/rules/WAW061.md) - Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+* [WAW062](/rules/WAW062.md) - Duplicate export name or explicit resource name within a template — fails at deploy time
+* [WAW063](/rules/WAW063.md) - IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+* [WAW064](/rules/WAW064.md) - Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident
+* [WAW065](/rules/WAW065.md) - Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+* [WAW066](/rules/WAW066.md) - Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+* [WAW067](/rules/WAW067.md) - A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+* [WAW068](/rules/WAW068.md) - VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity

package/dist/okf/rules/WAW061.md

@@ -0,0 +1,17 @@
+---
+type: post-synth-check
+title: WAW061
+description: Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+id: WAW061
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+
+## Applies to
+
+- [Subnet](/types/Subnet.md)
+- [Type](/types/Type.md)
+- [Vpc](/types/Vpc.md)

package/dist/okf/rules/WAW062.md

@@ -0,0 +1,27 @@
+---
+type: post-synth-check
+title: WAW062
+description: Duplicate export name or explicit resource name within a template — fails at deploy time
+id: WAW062
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Duplicate export name or explicit resource name within a template — fails at deploy time
+
+## Applies to
+
+- [AutoScalingGroup](/types/AutoScalingGroup.md)
+- [Bucket](/types/Bucket.md)
+- [ECRRepository](/types/ECRRepository.md)
+- [Function](/types/Function.md)
+- [LaunchTemplate](/types/LaunchTemplate.md)
+- [LoadBalancer](/types/LoadBalancer.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Map](/types/Map.md)
+- [Role](/types/Role.md)
+- [SecurityGroup](/types/SecurityGroup.md)
+- [StateMachine](/types/StateMachine.md)
+- [Table](/types/Table.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW063.md

@@ -0,0 +1,19 @@
+---
+type: post-synth-check
+title: WAW063
+description: IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+id: WAW063
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+
+## Applies to
+
+- [Action](/types/Action.md)
+- [IamPolicy](/types/IamPolicy.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Role](/types/Role.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW064.md

@@ -0,0 +1,18 @@
+---
+type: post-synth-check
+title: WAW064
+description: Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident
+id: WAW064
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident
+
+## Applies to
+
+- [Table](/types/Table.md)
+- [TransitGateway](/types/TransitGateway.md)
+- [TransitGatewayRoute](/types/TransitGatewayRoute.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW065.md

@@ -0,0 +1,25 @@
+---
+type: post-synth-check
+title: WAW065
+description: Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+id: WAW065
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+
+## Applies to
+
+- [Map](/types/Map.md)
+- [Table](/types/Table.md)
+- [TransitGateway](/types/TransitGateway.md)
+- [TransitGatewayAttachment](/types/TransitGatewayAttachment.md)
+- [TransitGatewayPeeringAttachment](/types/TransitGatewayPeeringAttachment.md)
+- [TransitGatewayRoute](/types/TransitGatewayRoute.md)
+- [TransitGatewayRouteTable](/types/TransitGatewayRouteTable.md)
+- [TransitGatewayRouteTableAssociation](/types/TransitGatewayRouteTableAssociation.md)
+- [TransitGatewayRouteTablePropagation](/types/TransitGatewayRouteTablePropagation.md)
+- [TransitGatewayVpcAttachment](/types/TransitGatewayVpcAttachment.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW066.md

@@ -0,0 +1,22 @@
+---
+type: post-synth-check
+title: WAW066
+description: Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+id: WAW066
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+
+## Applies to
+
+- [EC2Route](/types/EC2Route.md)
+- [InternetGateway](/types/InternetGateway.md)
+- [Map](/types/Map.md)
+- [RouteTable](/types/RouteTable.md)
+- [Subnet](/types/Subnet.md)
+- [SubnetRouteTableAssociation](/types/SubnetRouteTableAssociation.md)
+- [Table](/types/Table.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW067.md

@@ -0,0 +1,20 @@
+---
+type: post-synth-check
+title: WAW067
+description: A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+id: WAW067
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+
+## Applies to
+
+- [EC2Route](/types/EC2Route.md)
+- [Map](/types/Map.md)
+- [NatGateway](/types/NatGateway.md)
+- [Subnet](/types/Subnet.md)
+- [SubnetRouteTableAssociation](/types/SubnetRouteTableAssociation.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW068.md

@@ -0,0 +1,19 @@
+---
+type: post-synth-check
+title: WAW068
+description: VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity
+id: WAW068
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity
+
+## Applies to
+
+- [Map](/types/Map.md)
+- [TransitGateway](/types/TransitGateway.md)
+- [Type](/types/Type.md)
+- [VPNConnection](/types/VPNConnection.md)
+- [VPNGateway](/types/VPNGateway.md)

package/dist/okf/types/Action.md

@@ -32,3 +32,4 @@ resource_type: AWS::SageMaker::Action
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/AutoScalingGroup.md

@@ -57,3 +57,4 @@ resource_type: AWS::AutoScaling::AutoScalingGroup
 ## Governed by
 
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Bucket.md

@@ -64,3 +64,4 @@ resource_type: AWS::S3::Bucket
 - [WAW018](/rules/WAW018.md): S3 bucket missing public access block — all public access should be blocked
 - [WAW042](/rules/WAW042.md): S3 bucket missing a TLS-only bucket policy — deny requests over plaintext
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/EC2Route.md

@@ -35,3 +35,5 @@ resource_type: AWS::EC2::Route
 ## Governed by
 
 - [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress

package/dist/okf/types/ECRRepository.md

@@ -31,3 +31,4 @@ resource_type: AWS::ECR::Repository
 
 - [WAW053](/rules/WAW053.md): ECR repository does not scan images on push
 - [WAW054](/rules/WAW054.md): ECR repository does not have immutable image tags
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Function.md

@@ -56,3 +56,4 @@ resource_type: AWS::Lambda::Function
 - [WAW011](/rules/WAW011.md): Deprecated Lambda runtime — flags deprecated or approaching-EOL Lambda runtimes
 - [WAW022](/rules/WAW022.md): Lambda function is not configured with a VPC — consider adding VpcConfig for network isolation
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/IamPolicy.md

@@ -26,3 +26,4 @@ resource_type: AWS::IAM::Policy
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
 - [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/InternetGateway.md

@@ -16,3 +16,7 @@ resource_type: AWS::EC2::InternetGateway
 ## Attributes
 
 - `InternetGatewayId`
+
+## Governed by
+
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template

package/dist/okf/types/LaunchTemplate.md

@@ -27,3 +27,4 @@ resource_type: AWS::EC2::LaunchTemplate
 ## Governed by
 
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/LoadBalancer.md

@@ -41,3 +41,4 @@ resource_type: AWS::ElasticLoadBalancingV2::LoadBalancer
 ## Governed by
 
 - [WAW024](/rules/WAW024.md): Application Load Balancer does not have access logging enabled
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/ManagedPolicy.md

@@ -42,3 +42,5 @@ resource_type: AWS::IAM::ManagedPolicy
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
 - [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/Map.md

@@ -35,3 +35,8 @@ resource_type: AWS::Location::Map
 - [WAW016](/rules/WAW016.md): Deprecated property usage — flags properties marked as deprecated in the CloudFormation Registry
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+- [WAW068](/rules/WAW068.md): VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity

package/dist/okf/types/NatGateway.md

@@ -35,3 +35,7 @@ resource_type: AWS::EC2::NatGateway
 - `EniId`
 - `NatGatewayId`
 - `RouteTableId`
+
+## Governed by
+
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress

package/dist/okf/types/Role.md

@@ -32,3 +32,5 @@ resource_type: AWS::IAM::Role
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/RouteTable.md

@@ -17,3 +17,7 @@ resource_type: AWS::EC2::RouteTable
 ## Attributes
 
 - `RouteTableId`
+
+## Governed by
+
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template

package/dist/okf/types/SecurityGroup.md

@@ -29,3 +29,4 @@ resource_type: AWS::EC2::SecurityGroup
 - [WAW019](/rules/WAW019.md): Security group allows unrestricted ingress on sensitive ports (SSH, RDP, database)
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
 - [WAW049](/rules/WAW049.md): Security group allows unrestricted ingress on a port other than ALB:80/443
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/StateMachine.md

@@ -30,3 +30,7 @@ resource_type: AWS::StepFunctions::StateMachine
 - `Arn`
 - `Name`
 - `StateMachineRevisionId`
+
+## Governed by
+
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Subnet.md

@@ -38,3 +38,9 @@ resource_type: AWS::EC2::Subnet
 - `Ipv6CidrBlocks`
 - `NetworkAclAssociationId`
 - `SubnetId`
+
+## Governed by
+
+- [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress

package/dist/okf/types/SubnetRouteTableAssociation.md

@@ -17,3 +17,8 @@ resource_type: AWS::EC2::SubnetRouteTableAssociation
 ## Attributes
 
 - `Id`
+
+## Governed by
+
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress