@intentius/chant-lexicon-aws 0.49.0 → 0.50.0

package/dist/okf/types/TransitGatewayPeeringAttachment.md

@@ -26,3 +26,7 @@ resource_type: AWS::EC2::TransitGatewayPeeringAttachment
 - `State`
 - `Status`
 - `TransitGatewayAttachmentId`
+
+## Governed by
+
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table

package/dist/okf/types/TransitGatewayRoute.md

@@ -14,3 +14,8 @@ resource_type: AWS::EC2::TransitGatewayRoute
 - `TransitGatewayRouteTableId` (`string`, required): The ID of transit gateway route table.
 - `Blackhole` (`boolean`, optional): Indicates whether to drop traffic that matches this route.
 - `TransitGatewayAttachmentId` (`string`, optional): The ID of transit gateway attachment.
+
+## Governed by
+
+- [WAW064](/rules/WAW064.md): Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table

package/dist/okf/types/TransitGatewayRouteTable.md

@@ -17,3 +17,7 @@ resource_type: AWS::EC2::TransitGatewayRouteTable
 ## Attributes
 
 - `TransitGatewayRouteTableId`
+
+## Governed by
+
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table

package/dist/okf/types/TransitGatewayRouteTableAssociation.md

@@ -12,3 +12,7 @@ resource_type: AWS::EC2::TransitGatewayRouteTableAssociation
 
 - `TransitGatewayAttachmentId` (`string`, required): The ID of transit gateway attachment.
 - `TransitGatewayRouteTableId` (`string`, required): The ID of transit gateway route table.
+
+## Governed by
+
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table

package/dist/okf/types/TransitGatewayRouteTablePropagation.md

@@ -12,3 +12,7 @@ resource_type: AWS::EC2::TransitGatewayRouteTablePropagation
 
 - `TransitGatewayAttachmentId` (`string`, required): The ID of transit gateway attachment.
 - `TransitGatewayRouteTableId` (`string`, required): The ID of transit gateway route table.
+
+## Governed by
+
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table

package/dist/okf/types/TransitGatewayVpcAttachment.md

@@ -22,3 +22,7 @@ resource_type: AWS::EC2::TransitGatewayVpcAttachment
 ## Attributes
 
 - `Id`
+
+## Governed by
+
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table

package/dist/okf/types/Type.md

@@ -78,3 +78,8 @@ resource_type: AWS::Cassandra::Type
 - [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
 - [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
 - [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+- [WAW064](/rules/WAW064.md): Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+- [WAW068](/rules/WAW068.md): VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity

package/dist/okf/types/VPNConnection.md

@@ -33,3 +33,7 @@ resource_type: AWS::EC2::VPNConnection
 ## Attributes
 
 - `VpnConnectionId`
+
+## Governed by
+
+- [WAW068](/rules/WAW068.md): VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity

package/dist/okf/types/VPNGateway.md

@@ -18,3 +18,7 @@ resource_type: AWS::EC2::VPNGateway
 ## Attributes
 
 - `VPNGatewayId`
+
+## Governed by
+
+- [WAW068](/rules/WAW068.md): VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity

package/dist/op/builders.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Typed step-builder wrappers for this lexicon's activities (chant #1288
+ * Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
+ * live beside their `*Args` interfaces rather than in core or the temporal
+ * barrel: core cannot import a lexicon's types (lexicons depend on core, not
+ * the reverse), and wiring them into the cloud-agnostic temporal barrel
+ * would make it depend on every cloud lexicon at runtime. `opts`'s type in
+ * each wrapper below IS the activity's own `*Args` interface (via
+ * `Omit`/`WithStepRefs`) — never restated. `core`'s own
+ * `awsApply`/`awsDelete`/`flociUp`/`flociDown` are unchanged and produce
+ * byte-identical `ActivityStep` output; these are purely additive.
+ */
+import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
+import type { AwsApplyArgs, AwsDeleteArgs } from "./activities/aws-apply.js";
+import type { FlociUpArgs, FlociDownArgs } from "./activities/floci.js";
+/** Extra opts every wrapper below accepts alongside its activity's own fields. */
+type StepOpts = {
+    profile?: ActivityStep["profile"];
+    id?: string;
+};
+/**
+ * Deploy a built CloudFormation template directly against the CFN API — the
+ * fully typed twin of core's `awsApply`. `opts` is {@link AwsApplyArgs}
+ * itself, minus the positional `templatePath`. Defaults to the `longInfra`
+ * profile.
+ */
+export declare const awsApply: (templatePath: string, opts: WithStepRefs<Omit<AwsApplyArgs, "templatePath">> & StepOpts) => NamedActivityStep;
+/**
+ * Delete a CloudFormation stack — the inverse of {@link awsApply}, fully
+ * typed twin of core's `awsDelete`. `opts` is {@link AwsDeleteArgs} itself,
+ * minus the positional `templatePath`. Defaults to the `longInfra` profile.
+ */
+export declare const awsDelete: (templatePath: string, opts: WithStepRefs<Omit<AwsDeleteArgs, "templatePath">> & StepOpts) => NamedActivityStep;
+/**
+ * Boot the local Floci AWS emulator — the fully typed twin of core's
+ * `flociUp`. `opts` is {@link FlociUpArgs} itself. Defaults to the
+ * `longInfra` profile.
+ */
+export declare const flociUp: (opts?: WithStepRefs<FlociUpArgs> & StepOpts) => NamedActivityStep;
+/**
+ * Stop and remove the local Floci emulator container — the fully typed twin
+ * of core's `flociDown`. `opts` is {@link FlociDownArgs} itself. Defaults to
+ * the `fastIdempotent` profile.
+ */
+export declare const flociDown: (opts?: WithStepRefs<FlociDownArgs> & StepOpts) => NamedActivityStep;
+export {};
+//# sourceMappingURL=builders.d.ts.map

package/dist/op/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAErE,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GACnB,cAAc,MAAM,EACpB,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,GAAG,QAAQ,KAChE,iBAGF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,GACpB,cAAc,MAAM,EACpB,MAAM,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,GAAG,QAAQ,KACjE,iBAGF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAAI,OAAO,YAAY,CAAC,WAAW,CAAC,GAAG,QAAQ,KAAG,iBAGrE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO,YAAY,CAAC,aAAa,CAAC,GAAG,QAAQ,KAAG,iBAGzE,CAAC"}

package/dist/rules/waw016.ts

@@ -2,7 +2,13 @@
  * WAW016: Deprecated Property Usage
  *
  * Flags properties marked as deprecated in the CloudFormation Registry.
- * Sources: explicit `deprecatedProperties` array + description text mining.
+ *
+ * Two bases feed this, and the finding says which one it stands on (#1701).
+ * A `declared` name comes from the Registry schema's own `deprecatedProperties`
+ * array. An `inferred` name comes from a regex over the property description,
+ * which also matches descriptions that mention the deprecation of a sibling
+ * property, an enum value, or the thing the property configures. Declared is a
+ * warning; inferred is reported at info and worded as a guess.
  */
 
 import { readFileSync } from "fs";
@@ -10,18 +16,23 @@ import { join } from "path";
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { parseCFTemplate } from "./cf-refs";
 
+/** What a deprecation classification rests on. */
+export type DeprecationBasis = "declared" | "inferred";
+
 interface LexiconEntry {
   kind: string;
   resourceType: string;
   deprecatedProperties?: string[];
+  inferredDeprecations?: string[];
   [key: string]: unknown;
 }
 
 /**
- * Load deprecated properties per resource type from the lexicon JSON.
+ * Load deprecated properties per resource type from the lexicon JSON, each
+ * tagged with the basis it was classified on.
  */
-function loadDeprecatedProperties(): Map<string, Set<string>> {
-  const map = new Map<string, Set<string>>();
+function loadDeprecatedProperties(): Map<string, Map<string, DeprecationBasis>> {
+  const map = new Map<string, Map<string, DeprecationBasis>>();
   try {
     const pkgDir = join(__dirname, "..", "..", "..");
     const lexiconPath = join(pkgDir, "src", "generated", "lexicon-aws.json");
@@ -29,9 +40,15 @@ function loadDeprecatedProperties(): Map<string, Set<string>> {
     const data = JSON.parse(content) as Record<string, LexiconEntry>;
 
     for (const [_name, entry] of Object.entries(data)) {
-      if (entry.kind === "resource" && entry.resourceType && entry.deprecatedProperties && entry.deprecatedProperties.length > 0) {
-        map.set(entry.resourceType, new Set(entry.deprecatedProperties));
+      if (entry.kind !== "resource" || !entry.resourceType) continue;
+      if (!entry.deprecatedProperties?.length) continue;
+
+      const inferred = new Set(entry.inferredDeprecations ?? []);
+      const byProp = new Map<string, DeprecationBasis>();
+      for (const propName of entry.deprecatedProperties) {
+        byProp.set(propName, inferred.has(propName) ? "inferred" : "declared");
       }
+      map.set(entry.resourceType, byProp);
     }
   } catch {
     // Lexicon not available — skip
@@ -44,7 +61,7 @@ function loadDeprecatedProperties(): Map<string, Set<string>> {
  */
 export function checkDeprecatedProperties(
   ctx: PostSynthContext,
-  deprecated: Map<string, Set<string>>,
+  deprecated: Map<string, Map<string, DeprecationBasis>>,
 ): PostSynthDiagnostic[] {
   if (deprecated.size === 0) return [];
 
@@ -60,15 +77,19 @@ export function checkDeprecatedProperties(
 
       const props = resource.Properties ?? {};
       for (const propName of Object.keys(props)) {
-        if (deprProps.has(propName)) {
-          diagnostics.push({
-            checkId: "WAW016",
-            severity: "warning",
-            message: `Resource "${logicalId}" (${resource.Type}) uses deprecated property "${propName}" — consider alternatives`,
-            entity: logicalId,
-            lexicon: "aws",
-          });
-        }
+        const basis = deprProps.get(propName);
+        if (!basis) continue;
+
+        diagnostics.push({
+          checkId: "WAW016",
+          severity: basis === "declared" ? "warning" : "info",
+          message:
+            basis === "declared"
+              ? `Resource "${logicalId}" (${resource.Type}) uses deprecated property "${propName}" — consider alternatives`
+              : `Resource "${logicalId}" (${resource.Type}) uses property "${propName}", whose description reads as deprecated — the CloudFormation Registry does not declare it deprecated, so confirm before changing it`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
       }
     }
   }

package/dist/rules/waw064.ts

@@ -0,0 +1,52 @@
+/**
+ * WAW064: Transit Gateway Route Table Declares A Blackhole Route
+ *
+ * `AWS::EC2::TransitGatewayRoute` with `Blackhole: true` silently drops any
+ * traffic matching its destination CIDR instead of forwarding it —
+ * CloudFormation deploys this without complaint, and the packet loss only
+ * surfaces downstream as unreachable hosts or a timeout nobody can explain
+ * from the template alone. A blackhole route is sometimes deliberate — an
+ * explicit deny for a CIDR range, or a placeholder pending real
+ * infrastructure — but it is also exactly what a copy-pasted route table or
+ * a forgotten cleanup step leaves behind. Warn so it stays a conscious
+ * choice rather than a silent accident.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate } from "./cf-refs";
+
+export function checkTgwBlackholeRoute(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::EC2::TransitGatewayRoute") continue;
+
+      const props = resource.Properties ?? {};
+      if (props.Blackhole !== true) continue;
+
+      const cidr = typeof props.DestinationCidrBlock === "string" ? props.DestinationCidrBlock : "(unknown destination)";
+      diagnostics.push({
+        checkId: "WAW064",
+        severity: "warning",
+        message: `TransitGatewayRoute "${logicalId}" declares Blackhole: true for destination ${cidr} — traffic matching this route is silently dropped; confirm this is intentional`,
+        entity: logicalId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw064: PostSynthCheck = {
+  id: "WAW064",
+  description: "Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkTgwBlackholeRoute(ctx);
+  },
+};

package/dist/rules/waw065.ts

@@ -0,0 +1,110 @@
+/**
+ * WAW065: Transit Gateway Route Table Wiring Is Incomplete
+ *
+ * A Transit Gateway route table only does anything once two independent
+ * pieces are both wired up: an `AWS::EC2::TransitGatewayRouteTableAssociation`
+ * (which attachment's traffic is evaluated against this table) and an
+ * `AWS::EC2::TransitGatewayRouteTablePropagation` (which attachments' routes
+ * populate it). CloudFormation is happy to deploy a route table with one but
+ * not the other — the stack succeeds, and the gap only shows up as traffic
+ * that can't find a route. Two patterns, both "declared but half-wired":
+ *
+ *  - a route table has one or more associations but zero propagations — the
+ *    associated attachment's traffic is evaluated against this table, but
+ *    nothing ever populates it with routes;
+ *  - a declared attachment (VPC/VPN/peering, or the generic
+ *    TransitGatewayAttachment) is referenced by neither an association nor
+ *    a propagation anywhere in the template — it hangs off the transit
+ *    gateway with no route table wiring at all.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs } from "./cf-refs";
+
+const ATTACHMENT_TYPES = new Set([
+  "AWS::EC2::TransitGatewayAttachment",
+  "AWS::EC2::TransitGatewayVpcAttachment",
+  "AWS::EC2::TransitGatewayVpnAttachment",
+  "AWS::EC2::TransitGatewayPeeringAttachment",
+]);
+
+export function checkTgwRouteTableWiring(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    const routeTableIds = new Set<string>();
+    const attachmentIds = new Set<string>();
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTable") routeTableIds.add(logicalId);
+      if (ATTACHMENT_TYPES.has(resource.Type)) attachmentIds.add(logicalId);
+    }
+    if (routeTableIds.size === 0 && attachmentIds.size === 0) continue;
+
+    const associationsByTable = new Map<string, Set<string>>();
+    const propagationsByTable = new Map<string, Set<string>>();
+    const referencedAttachments = new Set<string>();
+
+    for (const resource of Object.values(resources)) {
+      let bucket: Map<string, Set<string>> | null = null;
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTableAssociation") bucket = associationsByTable;
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTablePropagation") bucket = propagationsByTable;
+      if (!bucket) continue;
+
+      const props = resource.Properties ?? {};
+      const attachmentRefs = findResourceRefs(props.TransitGatewayAttachmentId);
+      for (const attId of attachmentRefs) referencedAttachments.add(attId);
+
+      for (const rtId of findResourceRefs(props.TransitGatewayRouteTableId)) {
+        let attSet = bucket.get(rtId);
+        if (!attSet) {
+          attSet = new Set();
+          bucket.set(rtId, attSet);
+        }
+        for (const attId of attachmentRefs) attSet.add(attId);
+      }
+    }
+
+    // Pattern A: associated but never propagated.
+    for (const rtId of routeTableIds) {
+      const associations = associationsByTable.get(rtId);
+      const propagations = propagationsByTable.get(rtId);
+      if (associations && associations.size > 0 && (!propagations || propagations.size === 0)) {
+        diagnostics.push({
+          checkId: "WAW065",
+          severity: "warning",
+          message: `TransitGatewayRouteTable "${rtId}" has ${associations.size} association(s) but no route propagations — the associated attachment's routes never populate this table, likely incomplete wiring`,
+          entity: rtId,
+          lexicon: "aws",
+        });
+      }
+    }
+
+    // Pattern B: a declared attachment wired into no route table at all.
+    for (const attId of attachmentIds) {
+      if (!referencedAttachments.has(attId)) {
+        diagnostics.push({
+          checkId: "WAW065",
+          severity: "warning",
+          message: `Transit Gateway attachment "${attId}" is referenced by no TransitGatewayRouteTableAssociation or TransitGatewayRouteTablePropagation — it has no route table wiring, so nothing can route to or from it`,
+          entity: attId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw065: PostSynthCheck = {
+  id: "WAW065",
+  description: "Transit Gateway route table has associations but no propagations, or an attachment wired into no route table",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkTgwRouteTableWiring(ctx);
+  },
+};

package/dist/rules/waw066.ts

@@ -0,0 +1,155 @@
+/**
+ * WAW066: Private Subnet Route Table Has No Working Default Route
+ *
+ * Cross-resource join: a subnet's outbound path depends on a chain of three
+ * independently-declared resources — the `AWS::EC2::SubnetRouteTableAssociation`
+ * that pins it to a route table, the `AWS::EC2::Route` on that table for
+ * `0.0.0.0/0`, and the gateway that route names. CloudFormation validates
+ * none of this end-to-end: a subnet can be wired to a route table with no
+ * default route at all, or with a default route whose NAT gateway / Transit
+ * Gateway target was renamed or removed elsewhere in the template, and the
+ * stack still deploys clean. The subnet is black-holed — every deploy
+ * succeeds, and the only symptom is a workload with no outbound connectivity.
+ *
+ * A route table with a default route to an `AWS::EC2::InternetGateway` is
+ * treated as a public subnet and is out of scope for this check — this rule
+ * only flags the private case: no default route, or one whose target
+ * (`NatGatewayId` / `TransitGatewayId` / etc.) does not resolve to a
+ * resource declared in the same template. A route naming a target that
+ * exists in the template resolves cleanly and is never flagged, per the
+ * cross-resource contract.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFResource, type CFTemplate } from "./cf-refs";
+
+type RouteClass = "public" | "resolved" | "dangling";
+
+const OTHER_TARGET_KEYS = [
+  "NatGatewayId",
+  "TransitGatewayId",
+  "VpcPeeringConnectionId",
+  "EgressOnlyInternetGatewayId",
+  "LocalGatewayId",
+  "CarrierGatewayId",
+  "NetworkInterfaceId",
+  "InstanceId",
+] as const;
+
+/** Classify a `0.0.0.0/0` Route's target. A target Ref that exists always resolves. */
+function classifyDefaultRoute(route: CFResource, resources: Record<string, CFResource>): RouteClass {
+  const props = route.Properties ?? {};
+
+  if (props.GatewayId !== undefined) {
+    if (typeof props.GatewayId === "string") {
+      return props.GatewayId.startsWith("igw-") ? "public" : "resolved";
+    }
+    const refs = findResourceRefs(props.GatewayId);
+    if (refs.size !== 1) return "resolved"; // unprovable intrinsic — stay quiet
+    const [id] = refs;
+    if (!resources[id]) return "dangling";
+    return resources[id].Type === "AWS::EC2::InternetGateway" ? "public" : "resolved";
+  }
+
+  for (const key of OTHER_TARGET_KEYS) {
+    const value = (props as Record<string, unknown>)[key];
+    if (value === undefined) continue;
+    if (typeof value === "string") return "resolved"; // literal id from outside the template
+    const refs = findResourceRefs(value);
+    if (refs.size !== 1) return "resolved";
+    const [id] = refs;
+    return resources[id] ? "resolved" : "dangling";
+  }
+
+  return "resolved"; // no recognized target key — can't classify, stay quiet
+}
+
+function isDefaultRoute(route: CFResource): boolean {
+  return route.Properties?.DestinationCidrBlock === "0.0.0.0/0";
+}
+
+export function checkPrivateSubnetDefaultRoute(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // subnetId -> Set<routeTableId>, from explicit associations only.
+    const subnetRouteTables = new Map<string, Set<string>>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+      const props = resource.Properties ?? {};
+      const subnetRefs = findResourceRefs(props.SubnetId);
+      const rtRefs = findResourceRefs(props.RouteTableId);
+      for (const subnetId of subnetRefs) {
+        let set = subnetRouteTables.get(subnetId);
+        if (!set) {
+          set = new Set();
+          subnetRouteTables.set(subnetId, set);
+        }
+        for (const rtId of rtRefs) set.add(rtId);
+      }
+    }
+
+    // routeTableId -> Route resources targeting it.
+    const routesByTable = new Map<string, CFResource[]>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::Route") continue;
+      for (const rtId of findResourceRefs(resource.Properties?.RouteTableId)) {
+        let list = routesByTable.get(rtId);
+        if (!list) {
+          list = [];
+          routesByTable.set(rtId, list);
+        }
+        list.push(resource);
+      }
+    }
+
+    for (const [subnetId, rtIds] of subnetRouteTables) {
+      if (resources[subnetId]?.Type !== "AWS::EC2::Subnet") continue;
+
+      for (const rtId of rtIds) {
+        if (resources[rtId]?.Type !== "AWS::EC2::RouteTable") continue;
+
+        const routes = routesByTable.get(rtId) ?? [];
+        const defaultRoutes = routes.filter(isDefaultRoute);
+
+        if (defaultRoutes.length === 0) {
+          diagnostics.push({
+            checkId: "WAW066",
+            severity: "warning",
+            message: `Subnet "${subnetId}" is associated with route table "${rtId}", which has no default route (0.0.0.0/0) — outbound traffic from this subnet has no path out, black-holed by omission`,
+            entity: subnetId,
+            lexicon: "aws",
+          });
+          continue;
+        }
+
+        const classes = defaultRoutes.map((route) => classifyDefaultRoute(route, resources));
+        if (classes.includes("public")) continue; // has a real IGW default route — public subnet, out of scope
+        if (classes.every((c) => c === "dangling")) {
+          diagnostics.push({
+            checkId: "WAW066",
+            severity: "error",
+            message: `Subnet "${subnetId}"'s route table "${rtId}" has a default route (0.0.0.0/0) whose target does not exist in this template — outbound traffic from this subnet is black-holed`,
+            entity: subnetId,
+            lexicon: "aws",
+          });
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw066: PostSynthCheck = {
+  id: "WAW066",
+  description: "Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkPrivateSubnetDefaultRoute(ctx);
+  },
+};

package/dist/rules/waw067.ts

@@ -0,0 +1,114 @@
+/**
+ * WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets
+ *
+ * Cross-resource join across four resource kinds: a NAT gateway lives in one
+ * subnet, which lives in one Availability Zone; a route table's default
+ * route names the NAT gateway it forwards to; a subnet is pinned to a route
+ * table by an `AWS::EC2::SubnetRouteTableAssociation`. Follow that chain and
+ * a common reliability gap falls out — private subnets in two or more AZs
+ * all defaulting to the *same* NAT gateway. CloudFormation has no opinion on
+ * this; it deploys cleanly. But a NAT gateway lives entirely inside one AZ,
+ * so if that AZ has an outage, every subnet depending on it loses egress —
+ * including the subnets in AZs that were otherwise healthy. The
+ * Well-Architected fix is one NAT gateway per AZ, each serving only its own
+ * AZ's subnets.
+ *
+ * Only fires when the Availability Zones involved are literal strings —
+ * an `Fn::GetAZs`/`Fn::Select`-derived AZ can't be compared statically, so a
+ * subnet without a literal `AvailabilityZone` is silently excluded rather
+ * than guessed at.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFTemplate } from "./cf-refs";
+
+export function checkNatGatewaySingleAz(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // NAT gateway id -> its own subnet's literal AZ.
+    const natGatewayAz = new Map<string, string>();
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type !== "AWS::EC2::NatGateway") continue;
+      const subnetRefs = findResourceRefs(resource.Properties?.SubnetId);
+      if (subnetRefs.size !== 1) continue;
+      const [subnetId] = subnetRefs;
+      const az = resources[subnetId]?.Properties?.AvailabilityZone;
+      if (typeof az === "string") natGatewayAz.set(logicalId, az);
+    }
+    if (natGatewayAz.size === 0) continue;
+
+    // route table id -> the NAT gateway its default route forwards to.
+    const routeTableNatTarget = new Map<string, string>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::Route") continue;
+      const props = resource.Properties ?? {};
+      if (props.DestinationCidrBlock !== "0.0.0.0/0") continue;
+      const natRefs = findResourceRefs(props.NatGatewayId);
+      if (natRefs.size !== 1) continue;
+      const [natId] = natRefs;
+      if (!natGatewayAz.has(natId)) continue;
+      for (const rtId of findResourceRefs(props.RouteTableId)) {
+        routeTableNatTarget.set(rtId, natId);
+      }
+    }
+
+    // subnet id -> route table id, from explicit associations only.
+    const subnetRouteTable = new Map<string, string>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+      const props = resource.Properties ?? {};
+      const subnetRefs = findResourceRefs(props.SubnetId);
+      const rtRefs = findResourceRefs(props.RouteTableId);
+      if (subnetRefs.size !== 1 || rtRefs.size !== 1) continue;
+      const [subnetId] = subnetRefs;
+      const [rtId] = rtRefs;
+      subnetRouteTable.set(subnetId, rtId);
+    }
+
+    // NAT gateway id -> the set of subnets that default-route through it.
+    const servedSubnets = new Map<string, Set<string>>();
+    for (const [subnetId, rtId] of subnetRouteTable) {
+      const natId = routeTableNatTarget.get(rtId);
+      if (!natId) continue;
+      let set = servedSubnets.get(natId);
+      if (!set) {
+        set = new Set();
+        servedSubnets.set(natId, set);
+      }
+      set.add(subnetId);
+    }
+
+    for (const [natId, subnetIds] of servedSubnets) {
+      const azs = new Set<string>();
+      for (const subnetId of subnetIds) {
+        const az = resources[subnetId]?.Properties?.AvailabilityZone;
+        if (typeof az === "string") azs.add(az);
+      }
+      if (azs.size > 1) {
+        diagnostics.push({
+          checkId: "WAW067",
+          severity: "warning",
+          message: `NAT Gateway "${natId}" (in ${natGatewayAz.get(natId)}) is the default-route egress for private subnets across ${azs.size} Availability Zones (${[...azs].sort().join(", ")}) — a single-AZ NAT gateway is a single point of failure for cross-AZ egress; add one NAT gateway per AZ`,
+          entity: natId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw067: PostSynthCheck = {
+  id: "WAW067",
+  description: "A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkNatGatewaySingleAz(ctx);
+  },
+};