@intentius/chant-lexicon-aws 0.49.0 → 0.50.0

package/dist/rules/waw068.ts

@@ -0,0 +1,78 @@
+/**
+ * WAW068: VPN Gateway Has A Single VPN Connection
+ *
+ * An `AWS::EC2::VPNConnection` always gets two tunnels from AWS, but that
+ * redundancy only covers the tunnel pair inside one connection — it does
+ * nothing if the connection's Customer Gateway, on-prem device, or the
+ * single site it terminates at goes down. The reliability boundary that
+ * matters is the connection itself: a `AWS::EC2::VPNGateway` (or a Transit
+ * Gateway used for VPN attachment) with only one `VPNConnection` attached
+ * has no fallback path for hybrid connectivity if that connection's
+ * Customer Gateway or on-prem side fails.
+ *
+ * Cross-resource join: group every declared `VPNConnection` by the gateway
+ * (`VpnGatewayId` or `TransitGatewayId`) it attaches to, and flag any
+ * gateway left with exactly one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFTemplate } from "./cf-refs";
+
+export function checkVpnGatewayRedundancy(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // gateway logical id -> the VPNConnection logical ids attached to it.
+    const connectionsByGateway = new Map<string, string[]>();
+
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type !== "AWS::EC2::VPNConnection") continue;
+      const props = resource.Properties ?? {};
+
+      const gatewayProp = props.VpnGatewayId !== undefined ? props.VpnGatewayId : props.TransitGatewayId;
+      if (gatewayProp === undefined) continue; // no declared gateway target — can't group, stay quiet
+
+      const gwRefs = findResourceRefs(gatewayProp);
+      if (gwRefs.size !== 1) continue;
+      const [gwId] = gwRefs;
+
+      const gw = resources[gwId];
+      if (!gw || (gw.Type !== "AWS::EC2::VPNGateway" && gw.Type !== "AWS::EC2::TransitGateway")) continue;
+
+      let list = connectionsByGateway.get(gwId);
+      if (!list) {
+        list = [];
+        connectionsByGateway.set(gwId, list);
+      }
+      list.push(logicalId);
+    }
+
+    for (const [gwId, connectionIds] of connectionsByGateway) {
+      if (connectionIds.length !== 1) continue;
+
+      const kind = resources[gwId].Type === "AWS::EC2::VPNGateway" ? "VPN Gateway" : "Transit Gateway";
+      diagnostics.push({
+        checkId: "WAW068",
+        severity: "warning",
+        message: `${kind} "${gwId}" has only one VPN connection ("${connectionIds[0]}") attached — no redundant path if this connection, its tunnels, or its Customer Gateway fail; attach a second VPNConnection (ideally to a separate Customer Gateway) for hybrid-connectivity redundancy`,
+        entity: gwId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw068: PostSynthCheck = {
+  id: "WAW068",
+  description: "VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkVpnGatewayRedundancy(ctx);
+  },
+};

package/dist/spec/parse.d.ts

@@ -36,6 +36,13 @@ export interface ParsedResource {
     writeOnly: string[];
     primaryIdentifier: string[];
     deprecatedProperties: string[];
+    /**
+     * The subset of `deprecatedProperties` that no upstream declaration backs.
+     * These names come from {@link DEPRECATION_RE} matching the property
+     * description, so they are an inference rather than a reading. Kept apart so
+     * a consumer can tell the two apart and calibrate what it says (#1701).
+     */
+    inferredDeprecations: string[];
     conditionalCreateOnly: string[];
     replacementStrategy?: "delete_then_create" | "create_then_delete";
     tagging?: {

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAWhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,iBAAiB,CA6IvE;AAiBD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAkBhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,iBAAiB,CAmJvE;AAiBD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.49.0",
+    "@intentius/chant": "^0.50.0",
     "typescript": "^5.9.3"
   }
 }

package/src/codegen/fallback.ts

@@ -27,6 +27,7 @@ function fallbackLogGroup(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [],

package/src/codegen/generate-lexicon.ts

@@ -26,6 +26,11 @@ export interface LexiconEntry {
   writeOnly?: string[];
   primaryIdentifier?: string[];
   deprecatedProperties?: string[];
+  /**
+   * Subset of `deprecatedProperties` that only a regex over the property
+   * description supports; the rest is declared by the Registry schema (#1701).
+   */
+  inferredDeprecations?: string[];
   conditionalCreateOnly?: string[];
   replacementStrategy?: "delete_then_create" | "create_then_delete";
   tagging?: { taggable: boolean; tagOnCreate: boolean; tagUpdatable: boolean };
@@ -72,6 +77,7 @@ export function generateLexiconJSON(
         ...(r.resource.writeOnly.length > 0 && { writeOnly: r.resource.writeOnly }),
         ...(r.resource.primaryIdentifier.length > 0 && { primaryIdentifier: r.resource.primaryIdentifier }),
         ...(r.resource.deprecatedProperties?.length && { deprecatedProperties: r.resource.deprecatedProperties }),
+        ...(r.resource.inferredDeprecations?.length && { inferredDeprecations: r.resource.inferredDeprecations }),
         ...(r.resource.conditionalCreateOnly?.length && { conditionalCreateOnly: r.resource.conditionalCreateOnly }),
         ...(r.resource.replacementStrategy && { replacementStrategy: r.resource.replacementStrategy }),
         ...(r.resource.tagging && { tagging: r.resource.tagging }),

package/src/codegen/sam.ts

@@ -59,6 +59,7 @@ function samFunction(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [
@@ -147,6 +148,7 @@ function samApi(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [
@@ -200,6 +202,7 @@ function samHttpApi(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [
@@ -236,6 +239,7 @@ function samSimpleTable(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [
@@ -273,6 +277,7 @@ function samLayerVersion(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [],
@@ -306,6 +311,7 @@ function samStateMachine(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [
@@ -339,6 +345,7 @@ function samApplication(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [],
@@ -360,6 +367,7 @@ function samConnector(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [],
@@ -397,6 +405,7 @@ function samGraphQLApi(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [],

package/src/components/host-delivery.ts

@@ -73,9 +73,10 @@ function resolveTargets(
  * Deploy a revision to a host (fleet) via AWS CodeDeploy: create the
  * deployment, then wait for a terminal status. Rollback re-invokes
  * `stopAndRollback` against the deployment id this step created (captured in
- * a closure-scoped map keyed by application/deploymentGroup, since the
- * driver's saga rollback calls `rollback(ctx, sameInput)` rather than passing
- * `run`'s output) — riding CodeDeploy's own native automatic rollback to the
+ * a closure-scoped map keyed by application/deploymentGroup; the driver now
+ * also passes `run`'s output as `rollback`'s optional third arg (#1944), but
+ * this capability's input-derived key needs neither channel to resolve
+ * identity) — riding CodeDeploy's own native automatic rollback to the
  * last known-good revision rather than a chant-scripted compensation, the
  * "auto" rollback style the Neo4j pilot's docs comment contrasts with the
  * ALB/ECS pilot's component-declared one.

package/src/generated/lexicon-aws.json

@@ -6222,6 +6222,9 @@
     "deprecatedProperties": [
       "DeleteStorageConnectors"
     ],
+    "inferredDeprecations": [
+      "DeleteStorageConnectors"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -11669,6 +11672,9 @@
     "deprecatedProperties": [
       "AccessControl"
     ],
+    "inferredDeprecations": [
+      "AccessControl"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -14989,6 +14995,9 @@
     "deprecatedProperties": [
       "ComputeModel"
     ],
+    "inferredDeprecations": [
+      "ComputeModel"
+    ],
     "replacementStrategy": "delete_then_create",
     "tagging": {
       "taggable": true,
@@ -15385,6 +15394,9 @@
     "deprecatedProperties": [
       "ComputeModel"
     ],
+    "inferredDeprecations": [
+      "ComputeModel"
+    ],
     "conditionalCreateOnly": [
       "DbNodes"
     ],
@@ -17085,6 +17097,9 @@
     "deprecatedProperties": [
       "Deprecated"
     ],
+    "inferredDeprecations": [
+      "Deprecated"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -29032,6 +29047,9 @@
       "TdeCredentialPassword",
       "DBSecurityGroups"
     ],
+    "inferredDeprecations": [
+      "DBSecurityGroups"
+    ],
     "conditionalCreateOnly": [
       "AutoMinorVersionUpgrade",
       "AvailabilityZone",
@@ -33246,6 +33264,9 @@
     "deprecatedProperties": [
       "ImageScanningConfiguration"
     ],
+    "inferredDeprecations": [
+      "ImageScanningConfiguration"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -41749,6 +41770,9 @@
     "deprecatedProperties": [
       "Runtime"
     ],
+    "inferredDeprecations": [
+      "Runtime"
+    ],
     "conditionalCreateOnly": [
       "DurableConfig"
     ],
@@ -49621,6 +49645,10 @@
       "ElasticGpuSpecifications",
       "ElasticInferenceAccelerators"
     ],
+    "inferredDeprecations": [
+      "ElasticGpuSpecifications",
+      "ElasticInferenceAccelerators"
+    ],
     "conditionalCreateOnly": [
       "AdditionalInfo",
       "Affinity",
@@ -64878,6 +64906,9 @@
     "deprecatedProperties": [
       "DBPort"
     ],
+    "inferredDeprecations": [
+      "DBPort"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -100101,6 +100132,9 @@
     "deprecatedProperties": [
       "State"
     ],
+    "inferredDeprecations": [
+      "State"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,

package/src/index.ts

@@ -22,6 +22,14 @@ export type { AwsEffectReceiptDeclaration } from "./effect-receipt-row";
 export { awsReceiptStore, observeReceiptRows, ssmGetParameter, ssmPutParameter } from "./receipt-store";
 export type { AwsReceiptStoreOptions, ReceiptRowObservation } from "./receipt-store";
 
+// Typed Op step-builder wrappers (chant #1288 Stage 2) — awsApply/awsDelete/
+// flociUp/flociDown with authoring-time types derived from this lexicon's
+// own *Args interfaces (see ./op/builders.ts's module doc for why these live
+// here rather than in core or the temporal barrel). Opt-in:
+// `@intentius/chant-lexicon-temporal`'s same-named exports are core's
+// original untyped builders, unchanged, for cloud-agnostic authoring.
+export { awsApply, awsDelete, flociUp, flociDown } from "./op/builders";
+
 // Serializer
 export { awsSerializer } from "./serializer";
 

package/src/lint/audit-catalog.ts

@@ -78,4 +78,14 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   WAW061: auditRule("WAW061", "merge-worthy", "guidance", "Subnet CidrBlock not contained in its VPC's CidrBlock", "Fix the subnet's CidrBlock so it falls within the VPC's CidrBlock range.", { category: "correctness" }),
   WAW062: auditRule("WAW062", "merge-worthy", "guidance", "Duplicate export name or explicit resource name within a template", "Give each duplicated Export/name a distinct literal value.", { category: "correctness" }),
   WAW063: auditRule("WAW063", "merge-worthy", "guidance", "IAM policy denies an action another attached policy on the same role allows", "Remove or narrow the Deny, or move the Allow off this role — the explicit Deny always wins.", { category: "correctness" }),
+
+  // #826 — network-topology resiliency (Well-Architected Reliability Pillar):
+  // TGW route hygiene, private-subnet and NAT-gateway cross-resource joins,
+  // VPN redundancy. No live state needed — all determinable from the
+  // declared template.
+  WAW064: auditRule("WAW064", "report-only", "guidance", "Transit Gateway route table declares a Blackhole route", "Confirm the traffic drop is intentional; remove the route if it isn't.", { category: "best-practice" }),
+  WAW065: auditRule("WAW065", "report-only", "guidance", "Transit Gateway route table wiring is incomplete", "Add the missing TransitGatewayRouteTablePropagation, or wire the orphaned attachment into a route table.", { category: "best-practice" }),
+  WAW066: auditRule("WAW066", "merge-worthy", "guidance", "Private subnet's route table has no working default route", "Add a 0.0.0.0/0 route to a NAT gateway/Transit Gateway that exists in the template.", { category: "correctness" }),
+  WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
+  WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
 };

package/src/lint/post-synth/index.ts

@@ -55,6 +55,11 @@ import { waw060 } from "./waw060";
 import { waw061 } from "./waw061";
 import { waw062 } from "./waw062";
 import { waw063 } from "./waw063";
+import { waw064 } from "./waw064";
+import { waw065 } from "./waw065";
+import { waw066 } from "./waw066";
+import { waw067 } from "./waw067";
+import { waw068 } from "./waw068";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -112,4 +117,9 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw061,
   waw062,
   waw063,
+  waw064,
+  waw065,
+  waw066,
+  waw067,
+  waw068,
 ];

package/src/lint/post-synth/waw016.test.ts

@@ -1,16 +1,26 @@
 import { describe, test, expect } from "vitest";
 import { createPostSynthContext } from "@intentius/chant-test-utils";
-import { waw016, checkDeprecatedProperties } from "./waw016";
+import { waw016, checkDeprecatedProperties, type DeprecationBasis } from "./waw016";
 
 function makeCtx(template: object) {
   return createPostSynthContext({ aws: template });
 }
 
+function basisMap(entries: Array<[string, DeprecationBasis]>): Map<string, DeprecationBasis> {
+  return new Map(entries);
+}
+
 /** Synthetic deprecated-property map — no disk dependency. */
-function fakeDeprecated(): Map<string, Set<string>> {
+function fakeDeprecated(): Map<string, Map<string, DeprecationBasis>> {
   return new Map([
-    ["AWS::S3::Bucket", new Set(["AccessControl", "ObjectLockConfiguration"])],
-    ["AWS::Lambda::Function", new Set(["Code"])],
+    [
+      "AWS::S3::Bucket",
+      basisMap([
+        ["AccessControl", "declared"],
+        ["ObjectLockConfiguration", "declared"],
+      ]),
+    ],
+    ["AWS::Lambda::Function", basisMap([["Code", "declared"]])],
   ]);
 }
 
@@ -138,4 +148,51 @@ describe("WAW016: Deprecated Property Usage", () => {
     expect(diags[0].entity).toBe("Bucket");
     expect(diags[1].entity).toBe("Func");
   });
+
+  // --- Deprecation basis (#1701) ---
+
+  test("an inferred deprecation reports at info and names its basis", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Func: {
+          Type: "AWS::Lambda::Function",
+          Properties: { Runtime: "nodejs20.x" },
+        },
+      },
+    });
+    const deprecated = new Map([
+      ["AWS::Lambda::Function", basisMap([["Runtime", "inferred"]])],
+    ]);
+    const diags = checkDeprecatedProperties(ctx, deprecated);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW016");
+    expect(diags[0].severity).toBe("info");
+    expect(diags[0].message).toContain("Runtime");
+    expect(diags[0].message).toContain("does not declare it deprecated");
+  });
+
+  test("declared and inferred deprecations on one resource keep separate severities", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: {
+          Type: "AWS::S3::Bucket",
+          Properties: { AccessControl: "Private", ObjectLockConfiguration: {} },
+        },
+      },
+    });
+    const deprecated = new Map([
+      [
+        "AWS::S3::Bucket",
+        basisMap([
+          ["AccessControl", "declared"],
+          ["ObjectLockConfiguration", "inferred"],
+        ]),
+      ],
+    ]);
+    const diags = checkDeprecatedProperties(ctx, deprecated);
+    expect(diags).toHaveLength(2);
+    const bySeverity = new Map(diags.map((d) => [d.severity, d.message]));
+    expect(bySeverity.get("warning")).toContain("AccessControl");
+    expect(bySeverity.get("info")).toContain("ObjectLockConfiguration");
+  });
 });

package/src/lint/post-synth/waw016.ts

@@ -2,7 +2,13 @@
  * WAW016: Deprecated Property Usage
  *
  * Flags properties marked as deprecated in the CloudFormation Registry.
- * Sources: explicit `deprecatedProperties` array + description text mining.
+ *
+ * Two bases feed this, and the finding says which one it stands on (#1701).
+ * A `declared` name comes from the Registry schema's own `deprecatedProperties`
+ * array. An `inferred` name comes from a regex over the property description,
+ * which also matches descriptions that mention the deprecation of a sibling
+ * property, an enum value, or the thing the property configures. Declared is a
+ * warning; inferred is reported at info and worded as a guess.
  */
 
 import { readFileSync } from "fs";
@@ -10,18 +16,23 @@ import { join } from "path";
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { parseCFTemplate } from "./cf-refs";
 
+/** What a deprecation classification rests on. */
+export type DeprecationBasis = "declared" | "inferred";
+
 interface LexiconEntry {
   kind: string;
   resourceType: string;
   deprecatedProperties?: string[];
+  inferredDeprecations?: string[];
   [key: string]: unknown;
 }
 
 /**
- * Load deprecated properties per resource type from the lexicon JSON.
+ * Load deprecated properties per resource type from the lexicon JSON, each
+ * tagged with the basis it was classified on.
  */
-function loadDeprecatedProperties(): Map<string, Set<string>> {
-  const map = new Map<string, Set<string>>();
+function loadDeprecatedProperties(): Map<string, Map<string, DeprecationBasis>> {
+  const map = new Map<string, Map<string, DeprecationBasis>>();
   try {
     const pkgDir = join(__dirname, "..", "..", "..");
     const lexiconPath = join(pkgDir, "src", "generated", "lexicon-aws.json");
@@ -29,9 +40,15 @@ function loadDeprecatedProperties(): Map<string, Set<string>> {
     const data = JSON.parse(content) as Record<string, LexiconEntry>;
 
     for (const [_name, entry] of Object.entries(data)) {
-      if (entry.kind === "resource" && entry.resourceType && entry.deprecatedProperties && entry.deprecatedProperties.length > 0) {
-        map.set(entry.resourceType, new Set(entry.deprecatedProperties));
+      if (entry.kind !== "resource" || !entry.resourceType) continue;
+      if (!entry.deprecatedProperties?.length) continue;
+
+      const inferred = new Set(entry.inferredDeprecations ?? []);
+      const byProp = new Map<string, DeprecationBasis>();
+      for (const propName of entry.deprecatedProperties) {
+        byProp.set(propName, inferred.has(propName) ? "inferred" : "declared");
       }
+      map.set(entry.resourceType, byProp);
     }
   } catch {
     // Lexicon not available — skip
@@ -44,7 +61,7 @@ function loadDeprecatedProperties(): Map<string, Set<string>> {
  */
 export function checkDeprecatedProperties(
   ctx: PostSynthContext,
-  deprecated: Map<string, Set<string>>,
+  deprecated: Map<string, Map<string, DeprecationBasis>>,
 ): PostSynthDiagnostic[] {
   if (deprecated.size === 0) return [];
 
@@ -60,15 +77,19 @@ export function checkDeprecatedProperties(
 
       const props = resource.Properties ?? {};
       for (const propName of Object.keys(props)) {
-        if (deprProps.has(propName)) {
-          diagnostics.push({
-            checkId: "WAW016",
-            severity: "warning",
-            message: `Resource "${logicalId}" (${resource.Type}) uses deprecated property "${propName}" — consider alternatives`,
-            entity: logicalId,
-            lexicon: "aws",
-          });
-        }
+        const basis = deprProps.get(propName);
+        if (!basis) continue;
+
+        diagnostics.push({
+          checkId: "WAW016",
+          severity: basis === "declared" ? "warning" : "info",
+          message:
+            basis === "declared"
+              ? `Resource "${logicalId}" (${resource.Type}) uses deprecated property "${propName}" — consider alternatives`
+              : `Resource "${logicalId}" (${resource.Type}) uses property "${propName}", whose description reads as deprecated — the CloudFormation Registry does not declare it deprecated, so confirm before changing it`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
       }
     }
   }

package/src/lint/post-synth/waw064.test.ts

@@ -0,0 +1,79 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw064, checkTgwBlackholeRoute } from "./waw064";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW064: Transit Gateway Route Table Declares A Blackhole Route", () => {
+  test("check metadata", () => {
+    expect(waw064.id).toBe("WAW064");
+    expect(waw064.description).toContain("Blackhole");
+  });
+
+  test("TransitGatewayRoute with Blackhole: true → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        QuarantineRoute: {
+          Type: "AWS::EC2::TransitGatewayRoute",
+          Properties: {
+            TransitGatewayRouteTableId: { Ref: "TgwRouteTable" },
+            DestinationCidrBlock: "10.99.0.0/16",
+            Blackhole: true,
+          },
+        },
+        TgwRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+      },
+    });
+    const diags = checkTgwBlackholeRoute(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW064");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("QuarantineRoute");
+    expect(diags[0].message).toContain("10.99.0.0/16");
+    expect(diags[0].lexicon).toBe("aws");
+  });
+
+  test("normal TransitGatewayRoute forwarding to an attachment → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        SpokeRoute: {
+          Type: "AWS::EC2::TransitGatewayRoute",
+          Properties: {
+            TransitGatewayRouteTableId: { Ref: "TgwRouteTable" },
+            DestinationCidrBlock: "10.0.1.0/24",
+            TransitGatewayAttachmentId: { Ref: "SpokeAttachment" },
+          },
+        },
+        TgwRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: {} },
+      },
+    });
+    expect(checkTgwBlackholeRoute(ctx)).toHaveLength(0);
+  });
+
+  test("Blackhole: false is not flagged", () => {
+    const ctx = makeCtx({
+      Resources: {
+        SpokeRoute: {
+          Type: "AWS::EC2::TransitGatewayRoute",
+          Properties: {
+            TransitGatewayRouteTableId: { Ref: "TgwRouteTable" },
+            DestinationCidrBlock: "10.0.1.0/24",
+            TransitGatewayAttachmentId: { Ref: "SpokeAttachment" },
+            Blackhole: false,
+          },
+        },
+      },
+    });
+    expect(checkTgwBlackholeRoute(ctx)).toHaveLength(0);
+  });
+
+  test("no TransitGatewayRoute resources → no diagnostic", () => {
+    const ctx = makeCtx({ Resources: { Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } } } });
+    expect(checkTgwBlackholeRoute(ctx)).toHaveLength(0);
+  });
+});