@intentius/chant-lexicon-aws 0.49.0 → 0.51.0

package/src/lint/post-synth/waw065.test.ts

@@ -0,0 +1,90 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw065, checkTgwRouteTableWiring } from "./waw065";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW065: Transit Gateway Route Table Wiring Is Incomplete", () => {
+  test("check metadata", () => {
+    expect(waw065.id).toBe("WAW065");
+    expect(waw065.description).toContain("propagation");
+  });
+
+  test("route table with an association but no propagation → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAssociation: {
+          Type: "AWS::EC2::TransitGatewayRouteTableAssociation",
+          Properties: { TransitGatewayAttachmentId: { Ref: "SpokeAttachment" }, TransitGatewayRouteTableId: { Ref: "SpokeRouteTable" } },
+        },
+      },
+    });
+    const diags = checkTgwRouteTableWiring(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW065");
+    expect(diags[0].entity).toBe("SpokeRouteTable");
+    expect(diags[0].message).toContain("no route propagations");
+  });
+
+  test("attachment referenced by neither an association nor a propagation → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        OrphanAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+      },
+    });
+    const diags = checkTgwRouteTableWiring(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("OrphanAttachment");
+    expect(diags[0].message).toContain("no route table wiring");
+  });
+
+  test("both patterns fire independently in the same template", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAssociation: {
+          Type: "AWS::EC2::TransitGatewayRouteTableAssociation",
+          Properties: { TransitGatewayAttachmentId: { Ref: "SpokeAttachment" }, TransitGatewayRouteTableId: { Ref: "SpokeRouteTable" } },
+        },
+        OrphanAttachment: { Type: "AWS::EC2::TransitGatewayVpnAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+      },
+    });
+    const diags = checkTgwRouteTableWiring(ctx);
+    expect(diags).toHaveLength(2);
+    const entities = diags.map((d) => d.entity).sort();
+    expect(entities).toEqual(["OrphanAttachment", "SpokeRouteTable"]);
+  });
+
+  test("route table with both an association and a propagation, attachment referenced by both → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Tgw: { Type: "AWS::EC2::TransitGateway", Properties: {} },
+        SpokeRouteTable: { Type: "AWS::EC2::TransitGatewayRouteTable", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAttachment: { Type: "AWS::EC2::TransitGatewayVpcAttachment", Properties: { TransitGatewayId: { Ref: "Tgw" } } },
+        SpokeAssociation: {
+          Type: "AWS::EC2::TransitGatewayRouteTableAssociation",
+          Properties: { TransitGatewayAttachmentId: { Ref: "SpokeAttachment" }, TransitGatewayRouteTableId: { Ref: "SpokeRouteTable" } },
+        },
+        SpokePropagation: {
+          Type: "AWS::EC2::TransitGatewayRouteTablePropagation",
+          Properties: { TransitGatewayAttachmentId: { Ref: "SpokeAttachment" }, TransitGatewayRouteTableId: { Ref: "SpokeRouteTable" } },
+        },
+      },
+    });
+    expect(checkTgwRouteTableWiring(ctx)).toHaveLength(0);
+  });
+
+  test("no transit gateway resources at all → no diagnostic", () => {
+    const ctx = makeCtx({ Resources: { Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } } } });
+    expect(checkTgwRouteTableWiring(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw065.ts

@@ -0,0 +1,110 @@
+/**
+ * WAW065: Transit Gateway Route Table Wiring Is Incomplete
+ *
+ * A Transit Gateway route table only does anything once two independent
+ * pieces are both wired up: an `AWS::EC2::TransitGatewayRouteTableAssociation`
+ * (which attachment's traffic is evaluated against this table) and an
+ * `AWS::EC2::TransitGatewayRouteTablePropagation` (which attachments' routes
+ * populate it). CloudFormation is happy to deploy a route table with one but
+ * not the other — the stack succeeds, and the gap only shows up as traffic
+ * that can't find a route. Two patterns, both "declared but half-wired":
+ *
+ *  - a route table has one or more associations but zero propagations — the
+ *    associated attachment's traffic is evaluated against this table, but
+ *    nothing ever populates it with routes;
+ *  - a declared attachment (VPC/VPN/peering, or the generic
+ *    TransitGatewayAttachment) is referenced by neither an association nor
+ *    a propagation anywhere in the template — it hangs off the transit
+ *    gateway with no route table wiring at all.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs } from "./cf-refs";
+
+const ATTACHMENT_TYPES = new Set([
+  "AWS::EC2::TransitGatewayAttachment",
+  "AWS::EC2::TransitGatewayVpcAttachment",
+  "AWS::EC2::TransitGatewayVpnAttachment",
+  "AWS::EC2::TransitGatewayPeeringAttachment",
+]);
+
+export function checkTgwRouteTableWiring(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    const routeTableIds = new Set<string>();
+    const attachmentIds = new Set<string>();
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTable") routeTableIds.add(logicalId);
+      if (ATTACHMENT_TYPES.has(resource.Type)) attachmentIds.add(logicalId);
+    }
+    if (routeTableIds.size === 0 && attachmentIds.size === 0) continue;
+
+    const associationsByTable = new Map<string, Set<string>>();
+    const propagationsByTable = new Map<string, Set<string>>();
+    const referencedAttachments = new Set<string>();
+
+    for (const resource of Object.values(resources)) {
+      let bucket: Map<string, Set<string>> | null = null;
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTableAssociation") bucket = associationsByTable;
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTablePropagation") bucket = propagationsByTable;
+      if (!bucket) continue;
+
+      const props = resource.Properties ?? {};
+      const attachmentRefs = findResourceRefs(props.TransitGatewayAttachmentId);
+      for (const attId of attachmentRefs) referencedAttachments.add(attId);
+
+      for (const rtId of findResourceRefs(props.TransitGatewayRouteTableId)) {
+        let attSet = bucket.get(rtId);
+        if (!attSet) {
+          attSet = new Set();
+          bucket.set(rtId, attSet);
+        }
+        for (const attId of attachmentRefs) attSet.add(attId);
+      }
+    }
+
+    // Pattern A: associated but never propagated.
+    for (const rtId of routeTableIds) {
+      const associations = associationsByTable.get(rtId);
+      const propagations = propagationsByTable.get(rtId);
+      if (associations && associations.size > 0 && (!propagations || propagations.size === 0)) {
+        diagnostics.push({
+          checkId: "WAW065",
+          severity: "warning",
+          message: `TransitGatewayRouteTable "${rtId}" has ${associations.size} association(s) but no route propagations — the associated attachment's routes never populate this table, likely incomplete wiring`,
+          entity: rtId,
+          lexicon: "aws",
+        });
+      }
+    }
+
+    // Pattern B: a declared attachment wired into no route table at all.
+    for (const attId of attachmentIds) {
+      if (!referencedAttachments.has(attId)) {
+        diagnostics.push({
+          checkId: "WAW065",
+          severity: "warning",
+          message: `Transit Gateway attachment "${attId}" is referenced by no TransitGatewayRouteTableAssociation or TransitGatewayRouteTablePropagation — it has no route table wiring, so nothing can route to or from it`,
+          entity: attId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw065: PostSynthCheck = {
+  id: "WAW065",
+  description: "Transit Gateway route table has associations but no propagations, or an attachment wired into no route table",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkTgwRouteTableWiring(ctx);
+  },
+};

package/src/lint/post-synth/waw066.test.ts

@@ -0,0 +1,108 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw066, checkPrivateSubnetDefaultRoute } from "./waw066";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW066: Private Subnet Route Table Has No Working Default Route", () => {
+  test("check metadata", () => {
+    expect(waw066.id).toBe("WAW066");
+    expect(waw066.description).toContain("default route");
+  });
+
+  test("subnet's route table has no default route at all → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        PrivateSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        PrivateRouteTable: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssoc: {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: "PrivateSubnet" }, RouteTableId: { Ref: "PrivateRouteTable" } },
+        },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    const diags = checkPrivateSubnetDefaultRoute(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW066");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("PrivateSubnet");
+    expect(diags[0].message).toContain("no default route");
+  });
+
+  test("default route targets a NAT gateway that does not exist in the template → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        PrivateSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        PrivateRouteTable: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssoc: {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: "PrivateSubnet" }, RouteTableId: { Ref: "PrivateRouteTable" } },
+        },
+        DefaultRoute: {
+          Type: "AWS::EC2::Route",
+          Properties: { RouteTableId: { Ref: "PrivateRouteTable" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "RemovedNatGateway" } },
+        },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    const diags = checkPrivateSubnetDefaultRoute(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("PrivateSubnet");
+    expect(diags[0].message).toContain("does not exist in this template");
+  });
+
+  test("default route to a NAT gateway that exists in the template → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        PrivateSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        PrivateRouteTable: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssoc: {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: "PrivateSubnet" }, RouteTableId: { Ref: "PrivateRouteTable" } },
+        },
+        DefaultRoute: {
+          Type: "AWS::EC2::Route",
+          Properties: { RouteTableId: { Ref: "PrivateRouteTable" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGateway" } },
+        },
+        NatGateway: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnet" } } },
+        PublicSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24" } },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    expect(checkPrivateSubnetDefaultRoute(ctx)).toHaveLength(0);
+  });
+
+  test("public subnet with a default route to an existing Internet Gateway → no diagnostic (out of scope)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        PublicSubnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24" } },
+        PublicRouteTable: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PublicAssoc: {
+          Type: "AWS::EC2::SubnetRouteTableAssociation",
+          Properties: { SubnetId: { Ref: "PublicSubnet" }, RouteTableId: { Ref: "PublicRouteTable" } },
+        },
+        DefaultRoute: {
+          Type: "AWS::EC2::Route",
+          Properties: { RouteTableId: { Ref: "PublicRouteTable" }, DestinationCidrBlock: "0.0.0.0/0", GatewayId: { Ref: "Igw" } },
+        },
+        Igw: { Type: "AWS::EC2::InternetGateway", Properties: {} },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    expect(checkPrivateSubnetDefaultRoute(ctx)).toHaveLength(0);
+  });
+
+  test("subnet with no explicit route table association → no diagnostic (out of scope, can't prove)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Subnet: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+      },
+    });
+    expect(checkPrivateSubnetDefaultRoute(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw066.ts

@@ -0,0 +1,155 @@
+/**
+ * WAW066: Private Subnet Route Table Has No Working Default Route
+ *
+ * Cross-resource join: a subnet's outbound path depends on a chain of three
+ * independently-declared resources — the `AWS::EC2::SubnetRouteTableAssociation`
+ * that pins it to a route table, the `AWS::EC2::Route` on that table for
+ * `0.0.0.0/0`, and the gateway that route names. CloudFormation validates
+ * none of this end-to-end: a subnet can be wired to a route table with no
+ * default route at all, or with a default route whose NAT gateway / Transit
+ * Gateway target was renamed or removed elsewhere in the template, and the
+ * stack still deploys clean. The subnet is black-holed — every deploy
+ * succeeds, and the only symptom is a workload with no outbound connectivity.
+ *
+ * A route table with a default route to an `AWS::EC2::InternetGateway` is
+ * treated as a public subnet and is out of scope for this check — this rule
+ * only flags the private case: no default route, or one whose target
+ * (`NatGatewayId` / `TransitGatewayId` / etc.) does not resolve to a
+ * resource declared in the same template. A route naming a target that
+ * exists in the template resolves cleanly and is never flagged, per the
+ * cross-resource contract.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFResource, type CFTemplate } from "./cf-refs";
+
+type RouteClass = "public" | "resolved" | "dangling";
+
+const OTHER_TARGET_KEYS = [
+  "NatGatewayId",
+  "TransitGatewayId",
+  "VpcPeeringConnectionId",
+  "EgressOnlyInternetGatewayId",
+  "LocalGatewayId",
+  "CarrierGatewayId",
+  "NetworkInterfaceId",
+  "InstanceId",
+] as const;
+
+/** Classify a `0.0.0.0/0` Route's target. A target Ref that exists always resolves. */
+function classifyDefaultRoute(route: CFResource, resources: Record<string, CFResource>): RouteClass {
+  const props = route.Properties ?? {};
+
+  if (props.GatewayId !== undefined) {
+    if (typeof props.GatewayId === "string") {
+      return props.GatewayId.startsWith("igw-") ? "public" : "resolved";
+    }
+    const refs = findResourceRefs(props.GatewayId);
+    if (refs.size !== 1) return "resolved"; // unprovable intrinsic — stay quiet
+    const [id] = refs;
+    if (!resources[id]) return "dangling";
+    return resources[id].Type === "AWS::EC2::InternetGateway" ? "public" : "resolved";
+  }
+
+  for (const key of OTHER_TARGET_KEYS) {
+    const value = (props as Record<string, unknown>)[key];
+    if (value === undefined) continue;
+    if (typeof value === "string") return "resolved"; // literal id from outside the template
+    const refs = findResourceRefs(value);
+    if (refs.size !== 1) return "resolved";
+    const [id] = refs;
+    return resources[id] ? "resolved" : "dangling";
+  }
+
+  return "resolved"; // no recognized target key — can't classify, stay quiet
+}
+
+function isDefaultRoute(route: CFResource): boolean {
+  return route.Properties?.DestinationCidrBlock === "0.0.0.0/0";
+}
+
+export function checkPrivateSubnetDefaultRoute(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // subnetId -> Set<routeTableId>, from explicit associations only.
+    const subnetRouteTables = new Map<string, Set<string>>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+      const props = resource.Properties ?? {};
+      const subnetRefs = findResourceRefs(props.SubnetId);
+      const rtRefs = findResourceRefs(props.RouteTableId);
+      for (const subnetId of subnetRefs) {
+        let set = subnetRouteTables.get(subnetId);
+        if (!set) {
+          set = new Set();
+          subnetRouteTables.set(subnetId, set);
+        }
+        for (const rtId of rtRefs) set.add(rtId);
+      }
+    }
+
+    // routeTableId -> Route resources targeting it.
+    const routesByTable = new Map<string, CFResource[]>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::Route") continue;
+      for (const rtId of findResourceRefs(resource.Properties?.RouteTableId)) {
+        let list = routesByTable.get(rtId);
+        if (!list) {
+          list = [];
+          routesByTable.set(rtId, list);
+        }
+        list.push(resource);
+      }
+    }
+
+    for (const [subnetId, rtIds] of subnetRouteTables) {
+      if (resources[subnetId]?.Type !== "AWS::EC2::Subnet") continue;
+
+      for (const rtId of rtIds) {
+        if (resources[rtId]?.Type !== "AWS::EC2::RouteTable") continue;
+
+        const routes = routesByTable.get(rtId) ?? [];
+        const defaultRoutes = routes.filter(isDefaultRoute);
+
+        if (defaultRoutes.length === 0) {
+          diagnostics.push({
+            checkId: "WAW066",
+            severity: "warning",
+            message: `Subnet "${subnetId}" is associated with route table "${rtId}", which has no default route (0.0.0.0/0) — outbound traffic from this subnet has no path out, black-holed by omission`,
+            entity: subnetId,
+            lexicon: "aws",
+          });
+          continue;
+        }
+
+        const classes = defaultRoutes.map((route) => classifyDefaultRoute(route, resources));
+        if (classes.includes("public")) continue; // has a real IGW default route — public subnet, out of scope
+        if (classes.every((c) => c === "dangling")) {
+          diagnostics.push({
+            checkId: "WAW066",
+            severity: "error",
+            message: `Subnet "${subnetId}"'s route table "${rtId}" has a default route (0.0.0.0/0) whose target does not exist in this template — outbound traffic from this subnet is black-holed`,
+            entity: subnetId,
+            lexicon: "aws",
+          });
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw066: PostSynthCheck = {
+  id: "WAW066",
+  description: "Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkPrivateSubnetDefaultRoute(ctx);
+  },
+};

package/src/lint/post-synth/waw067.test.ts

@@ -0,0 +1,79 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw067, checkNatGatewaySingleAz } from "./waw067";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets", () => {
+  test("check metadata", () => {
+    expect(waw067.id).toBe("WAW067");
+    expect(waw067.description).toContain("NAT gateway");
+  });
+
+  test("one NAT gateway serving private subnets in two AZs → warning", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        PublicSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24", AvailabilityZone: "us-east-1a" } },
+        NatGateway: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnetA" } } },
+
+        PrivateSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24", AvailabilityZone: "us-east-1a" } },
+        PrivateRouteTableA: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocA: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetA" }, RouteTableId: { Ref: "PrivateRouteTableA" } } },
+        PrivateDefaultRouteA: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableA" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGateway" } } },
+
+        PrivateSubnetB: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.2.0/24", AvailabilityZone: "us-east-1b" } },
+        PrivateRouteTableB: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocB: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetB" }, RouteTableId: { Ref: "PrivateRouteTableB" } } },
+        PrivateDefaultRouteB: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableB" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGateway" } } },
+      },
+    });
+    const diags = checkNatGatewaySingleAz(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW067");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("NatGateway");
+    expect(diags[0].message).toContain("us-east-1a");
+    expect(diags[0].message).toContain("us-east-1b");
+  });
+
+  test("one NAT gateway per AZ, each serving only its own AZ's subnets → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+
+        PublicSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24", AvailabilityZone: "us-east-1a" } },
+        NatGatewayA: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnetA" } } },
+        PrivateSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24", AvailabilityZone: "us-east-1a" } },
+        PrivateRouteTableA: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocA: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetA" }, RouteTableId: { Ref: "PrivateRouteTableA" } } },
+        PrivateDefaultRouteA: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableA" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGatewayA" } } },
+
+        PublicSubnetB: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.10.0/24", AvailabilityZone: "us-east-1b" } },
+        NatGatewayB: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnetB" } } },
+        PrivateSubnetB: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.2.0/24", AvailabilityZone: "us-east-1b" } },
+        PrivateRouteTableB: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocB: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetB" }, RouteTableId: { Ref: "PrivateRouteTableB" } } },
+        PrivateDefaultRouteB: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableB" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGatewayB" } } },
+      },
+    });
+    expect(checkNatGatewaySingleAz(ctx)).toHaveLength(0);
+  });
+
+  test("one NAT gateway serving only subnets in its own AZ → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Vpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        PublicSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.0.0/24", AvailabilityZone: "us-east-1a" } },
+        NatGateway: { Type: "AWS::EC2::NatGateway", Properties: { SubnetId: { Ref: "PublicSubnetA" } } },
+        PrivateSubnetA: { Type: "AWS::EC2::Subnet", Properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24", AvailabilityZone: "us-east-1a" } },
+        PrivateRouteTableA: { Type: "AWS::EC2::RouteTable", Properties: { VpcId: { Ref: "Vpc" } } },
+        PrivateAssocA: { Type: "AWS::EC2::SubnetRouteTableAssociation", Properties: { SubnetId: { Ref: "PrivateSubnetA" }, RouteTableId: { Ref: "PrivateRouteTableA" } } },
+        PrivateDefaultRouteA: { Type: "AWS::EC2::Route", Properties: { RouteTableId: { Ref: "PrivateRouteTableA" }, DestinationCidrBlock: "0.0.0.0/0", NatGatewayId: { Ref: "NatGateway" } } },
+      },
+    });
+    expect(checkNatGatewaySingleAz(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw067.ts

@@ -0,0 +1,114 @@
+/**
+ * WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets
+ *
+ * Cross-resource join across four resource kinds: a NAT gateway lives in one
+ * subnet, which lives in one Availability Zone; a route table's default
+ * route names the NAT gateway it forwards to; a subnet is pinned to a route
+ * table by an `AWS::EC2::SubnetRouteTableAssociation`. Follow that chain and
+ * a common reliability gap falls out — private subnets in two or more AZs
+ * all defaulting to the *same* NAT gateway. CloudFormation has no opinion on
+ * this; it deploys cleanly. But a NAT gateway lives entirely inside one AZ,
+ * so if that AZ has an outage, every subnet depending on it loses egress —
+ * including the subnets in AZs that were otherwise healthy. The
+ * Well-Architected fix is one NAT gateway per AZ, each serving only its own
+ * AZ's subnets.
+ *
+ * Only fires when the Availability Zones involved are literal strings —
+ * an `Fn::GetAZs`/`Fn::Select`-derived AZ can't be compared statically, so a
+ * subnet without a literal `AvailabilityZone` is silently excluded rather
+ * than guessed at.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFTemplate } from "./cf-refs";
+
+export function checkNatGatewaySingleAz(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // NAT gateway id -> its own subnet's literal AZ.
+    const natGatewayAz = new Map<string, string>();
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type !== "AWS::EC2::NatGateway") continue;
+      const subnetRefs = findResourceRefs(resource.Properties?.SubnetId);
+      if (subnetRefs.size !== 1) continue;
+      const [subnetId] = subnetRefs;
+      const az = resources[subnetId]?.Properties?.AvailabilityZone;
+      if (typeof az === "string") natGatewayAz.set(logicalId, az);
+    }
+    if (natGatewayAz.size === 0) continue;
+
+    // route table id -> the NAT gateway its default route forwards to.
+    const routeTableNatTarget = new Map<string, string>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::Route") continue;
+      const props = resource.Properties ?? {};
+      if (props.DestinationCidrBlock !== "0.0.0.0/0") continue;
+      const natRefs = findResourceRefs(props.NatGatewayId);
+      if (natRefs.size !== 1) continue;
+      const [natId] = natRefs;
+      if (!natGatewayAz.has(natId)) continue;
+      for (const rtId of findResourceRefs(props.RouteTableId)) {
+        routeTableNatTarget.set(rtId, natId);
+      }
+    }
+
+    // subnet id -> route table id, from explicit associations only.
+    const subnetRouteTable = new Map<string, string>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+      const props = resource.Properties ?? {};
+      const subnetRefs = findResourceRefs(props.SubnetId);
+      const rtRefs = findResourceRefs(props.RouteTableId);
+      if (subnetRefs.size !== 1 || rtRefs.size !== 1) continue;
+      const [subnetId] = subnetRefs;
+      const [rtId] = rtRefs;
+      subnetRouteTable.set(subnetId, rtId);
+    }
+
+    // NAT gateway id -> the set of subnets that default-route through it.
+    const servedSubnets = new Map<string, Set<string>>();
+    for (const [subnetId, rtId] of subnetRouteTable) {
+      const natId = routeTableNatTarget.get(rtId);
+      if (!natId) continue;
+      let set = servedSubnets.get(natId);
+      if (!set) {
+        set = new Set();
+        servedSubnets.set(natId, set);
+      }
+      set.add(subnetId);
+    }
+
+    for (const [natId, subnetIds] of servedSubnets) {
+      const azs = new Set<string>();
+      for (const subnetId of subnetIds) {
+        const az = resources[subnetId]?.Properties?.AvailabilityZone;
+        if (typeof az === "string") azs.add(az);
+      }
+      if (azs.size > 1) {
+        diagnostics.push({
+          checkId: "WAW067",
+          severity: "warning",
+          message: `NAT Gateway "${natId}" (in ${natGatewayAz.get(natId)}) is the default-route egress for private subnets across ${azs.size} Availability Zones (${[...azs].sort().join(", ")}) — a single-AZ NAT gateway is a single point of failure for cross-AZ egress; add one NAT gateway per AZ`,
+          entity: natId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw067: PostSynthCheck = {
+  id: "WAW067",
+  description: "A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkNatGatewaySingleAz(ctx);
+  },
+};