@intentius/chant-lexicon-aws 0.56.0 → 0.58.0

package/src/import/parser.ts

@@ -3,6 +3,8 @@ import type {
   TemplateIR,
   ResourceIR,
   ParameterIR,
+  ConditionIR,
+  OutputIR,
 } from "@intentius/chant/import/parser";
 import { BaseValueParser } from "@intentius/chant/import/base-parser";
 import yaml from "js-yaml";
@@ -114,8 +116,19 @@ interface CFTemplate {
   AWSTemplateFormatVersion?: string;
   Description?: string;
   Parameters?: Record<string, CFParameter>;
+  Conditions?: Record<string, unknown>;
   Resources?: Record<string, CFResource>;
-  Outputs?: Record<string, unknown>;
+  Outputs?: Record<string, CFOutput>;
+}
+
+/**
+ * CloudFormation output
+ */
+interface CFOutput {
+  Value: unknown;
+  Description?: string;
+  Export?: { Name?: unknown };
+  Condition?: string;
 }
 
 /**
@@ -135,6 +148,7 @@ interface CFResource {
   Properties?: Record<string, unknown>;
   Metadata?: Record<string, unknown>;
   DependsOn?: string | string[];
+  Condition?: string;
 }
 
 /**
@@ -156,11 +170,17 @@ export class CFParser extends BaseValueParser implements TemplateParser {
     const template = parsed as CFTemplate;
 
     const parameters = this.parseParameters(template.Parameters ?? {});
+    const conditions = this.parseConditions(template.Conditions ?? {});
     const resources = this.parseResources(template.Resources ?? {});
+    const outputs = this.parseOutputs(template.Outputs ?? {});
+    const warnings = this.collectDroppedSectionWarnings(template as unknown as Record<string, unknown>);
 
     return {
       parameters,
+      conditions: conditions.length > 0 ? conditions : undefined,
       resources,
+      outputs: outputs.length > 0 ? outputs : undefined,
+      warnings: warnings.length > 0 ? warnings : undefined,
       metadata: {
         version: template.AWSTemplateFormatVersion ?? "2010-09-09",
         description: template.Description,
@@ -168,6 +188,64 @@ export class CFParser extends BaseValueParser implements TemplateParser {
     };
   }
 
+  /**
+   * Template sections import carries. Anything else is named in a warning
+   * rather than dropped silently (#2069).
+   */
+  private static readonly CARRIED_SECTIONS = new Set([
+    "AWSTemplateFormatVersion",
+    "Description",
+    "Parameters",
+    "Conditions",
+    "Resources",
+    "Outputs",
+  ]);
+
+  private collectDroppedSectionWarnings(template: Record<string, unknown>): string[] {
+    const warnings: string[] = [];
+    for (const key of Object.keys(template)) {
+      if (!CFParser.CARRIED_SECTIONS.has(key)) {
+        warnings.push(`Template section "${key}" is not carried by import — it is dropped from the generated source`);
+      }
+    }
+    return warnings;
+  }
+
+  /**
+   * Parse the Conditions section (#2069). Inside a condition expression the
+   * single-key `{ "Condition": "<name>" }` form references another declared
+   * condition; `inConditionExpression` scopes that dispatch to this section
+   * so a resource property that happens to hold a single-key `Condition`
+   * object is left alone.
+   */
+  private inConditionExpression = false;
+
+  private parseConditions(conditions: Record<string, unknown>): ConditionIR[] {
+    return Object.entries(conditions).map(([name, expression]) => {
+      this.inConditionExpression = true;
+      try {
+        return { name, expression: this.parseValue(expression) };
+      } finally {
+        this.inConditionExpression = false;
+      }
+    });
+  }
+
+  /**
+   * Parse the Outputs section (#2069).
+   */
+  private parseOutputs(outputs: Record<string, CFOutput>): OutputIR[] {
+    return Object.entries(outputs)
+      .filter(([_, output]) => typeof output === "object" && output !== null)
+      .map(([name, output]) => ({
+        name,
+        value: this.parseValue(output.Value),
+        description: output.Description,
+        exportName: output.Export?.Name !== undefined ? this.parseValue(output.Export.Name) : undefined,
+        condition: typeof output.Condition === "string" ? output.Condition : undefined,
+      }));
+  }
+
   /**
    * Parse parameters section
    */
@@ -192,6 +270,7 @@ export class CFParser extends BaseValueParser implements TemplateParser {
         type: resource.Type,
         properties: this.parseProperties(resource.Properties ?? {}),
         metadata: resource.Metadata,
+        condition: typeof resource.Condition === "string" ? resource.Condition : undefined,
       }));
   }
 
@@ -212,6 +291,12 @@ export class CFParser extends BaseValueParser implements TemplateParser {
    * CFN-specific intrinsic dispatch table.
    */
   protected dispatchIntrinsic(key: string, value: unknown, _obj: Record<string, unknown>): unknown | null {
+    // `{ "Condition": "<name>" }` — only valid inside the Conditions section
+    // (#2069); see parseConditions for the scoping.
+    if (key === "Condition" && this.inConditionExpression && typeof value === "string") {
+      return { __intrinsic: "ConditionRef", name: value };
+    }
+
     if (key === "Ref") {
       return { __intrinsic: "Ref", name: value };
     }

package/src/import/roundtrip-fixtures.test.ts

@@ -112,6 +112,56 @@ describe("parameters.json build roundtrip", () => {
   });
 });
 
+describe("with-conditions.json build roundtrip (#2069)", () => {
+  test("Conditions, Condition keys, and the conditioned output round-trip exactly", async () => {
+    const content = readFileSync(join(roundtripDir, "with-conditions.json"), "utf-8");
+    const source = JSON.parse(content);
+
+    const ir = parser.parse(content);
+    const files = generator.generate(ir);
+    const mainFile = files.find((f) => f.path === "main.ts")!;
+
+    // The generated source declares both conditions and keeps the references
+    expect(mainFile.content).toContain("new Condition(Equals(Ref(Cutover), \"true\"))");
+    expect(mainFile.content).toContain("new Condition(Not(DoCutover))");
+    expect(mainFile.content).toContain("{ Condition: DoCutover }");
+    expect(mainFile.content).toContain("stackOutput(Ref(Rule), { condition: DoCutover })");
+
+    const dir = mkdtempSync(join(import.meta.dirname, "../../.roundtrip-tmp-"));
+    try {
+      const srcDir = join(dir, "src");
+      mkdirSync(srcDir);
+      writeFileSync(join(srcDir, "main.ts"), mainFile.content);
+
+      const result = await build(srcDir, [awsSerializer]);
+      expect(result.errors).toHaveLength(0);
+
+      const template = JSON.parse(result.outputs.get("aws") as string);
+
+      // The Conditions section round-trips exactly, {Condition: ...} ref included
+      expect(template.Conditions).toEqual(source.Conditions);
+      // The resource keeps its Condition key and its Fn::If
+      expect(template.Resources.Rule.Condition).toBe("DoCutover");
+      expect(template.Resources.Rule.Properties.LogGroupName).toEqual(
+        source.Resources.Rule.Properties.LogGroupName,
+      );
+      // The conditioned output round-trips exactly
+      expect(template.Outputs).toEqual(source.Outputs);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("a section import cannot carry is named in a warning, never dropped silently", () => {
+    const template = JSON.parse(readFileSync(join(roundtripDir, "with-conditions.json"), "utf-8"));
+    template.Mappings = { RegionMap: { "us-east-1": { AMI: "ami-123" } } };
+    const ir = parser.parse(JSON.stringify(template));
+    expect(ir.warnings).toEqual([
+      'Template section "Mappings" is not carried by import — it is dropped from the generated source',
+    ]);
+  });
+});
+
 describe("SAM roundtrip fixtures", () => {
   const fixtures = readdirSync(samDir).filter(
     (f) => f.endsWith(".yaml") || f.endsWith(".yml"),

package/src/index.ts

@@ -1,6 +1,9 @@
 // Parameter
 export { Parameter } from "./parameter";
 
+// Condition (#2068) — the Conditions-section declarable
+export { Condition, isCondition, CONDITION_ENTITY_TYPE } from "./condition";
+
 // Default Tags
 export { defaultTags, isDefaultTags, DEFAULT_TAGS_MARKER } from "./default-tags";
 export type { DefaultTags, TagEntry } from "./default-tags";
@@ -25,9 +28,9 @@ export type { AwsReceiptStoreOptions, ReceiptRowObservation } from "./receipt-st
 // Typed Op step-builder wrappers (chant #1288 Stage 2) — awsApply/awsDelete/
 // flociUp/flociDown with authoring-time types derived from this lexicon's
 // own *Args interfaces (see ./op/builders.ts's module doc for why these live
-// here rather than in core or the temporal barrel). Opt-in:
-// `@intentius/chant-lexicon-temporal`'s same-named exports are core's
-// original untyped builders, unchanged, for cloud-agnostic authoring.
+// here rather than in core). Opt-in: `@intentius/chant/op`'s same-named
+// exports are core's original untyped builders, unchanged, for
+// cloud-agnostic authoring.
 export { awsApply, awsDelete, flociUp, flociDown } from "./op/builders";
 
 // Serializer
@@ -105,6 +108,10 @@ export {
   Split,
   Base64,
   GetAZs,
+  Equals,
+  And,
+  Or,
+  Not,
   SubIntrinsic,
   RefIntrinsic,
   GetAttIntrinsic,
@@ -114,7 +121,12 @@ export {
   SplitIntrinsic,
   Base64Intrinsic,
   GetAZsIntrinsic,
+  EqualsIntrinsic,
+  AndIntrinsic,
+  OrIntrinsic,
+  NotIntrinsic,
 } from "./intrinsics";
+export type { ConditionOperand } from "./intrinsics";
 
 // Pseudo-parameters
 export {

package/src/intrinsics.ts

@@ -2,6 +2,25 @@ import { INTRINSIC_MARKER, resolveIntrinsicValue, isIntrinsic, type Intrinsic }
 import { buildInterpolatedString, defaultInterpolationSerializer } from "@intentius/chant/intrinsic-interpolation";
 import { type Declarable } from "@intentius/chant/declarable";
 import { getLogicalName } from "@intentius/chant/utils";
+import { isCondition, type Condition } from "./condition";
+
+/**
+ * An operand allowed where CloudFormation expects a condition (#2068): a
+ * nested condition intrinsic (`Equals`/`And`/`Or`/`Not`), the `Condition`
+ * declarable itself, or a condition name string. The latter two both emit
+ * the `{ "Condition": "<name>" }` reference form.
+ */
+export type ConditionOperand = Intrinsic | Condition | string;
+
+function resolveConditionOperand(operand: ConditionOperand): unknown {
+  if (typeof operand === "string") {
+    return { Condition: operand };
+  }
+  if (isCondition(operand)) {
+    return { Condition: getLogicalName(operand) };
+  }
+  return resolveIntrinsicValue(operand);
+}
 
 /**
  * Fn::Sub intrinsic function implementation
@@ -99,29 +118,135 @@ export function GetAtt(logicalName: string, attribute: string): GetAttIntrinsic
  */
 export class IfIntrinsic implements Intrinsic {
   readonly [INTRINSIC_MARKER] = true as const;
-  private conditionName: string;
+  private conditionName: string | Condition;
   private valueIfTrue: unknown;
   private valueIfFalse: unknown;
 
-  constructor(conditionName: string, valueIfTrue: unknown, valueIfFalse: unknown) {
+  constructor(conditionName: string | Condition, valueIfTrue: unknown, valueIfFalse: unknown) {
     this.conditionName = conditionName;
     this.valueIfTrue = valueIfTrue;
     this.valueIfFalse = valueIfFalse;
   }
 
   toJSON(): { "Fn::If": [string, unknown, unknown] } {
-    return { "Fn::If": [this.conditionName, resolveIntrinsicValue(this.valueIfTrue), resolveIntrinsicValue(this.valueIfFalse)] };
+    const name = typeof this.conditionName === "string" ? this.conditionName : getLogicalName(this.conditionName);
+    return { "Fn::If": [name, resolveIntrinsicValue(this.valueIfTrue), resolveIntrinsicValue(this.valueIfFalse)] };
   }
 }
 
 
 /**
- * Create an If intrinsic
+ * Create an If intrinsic. The condition is a name string, or the `Condition`
+ * declarable itself (resolved to its logical name at serialization, #2068).
  */
-export function If(conditionName: string, valueIfTrue: unknown, valueIfFalse: unknown): IfIntrinsic {
+export function If(conditionName: string | Condition, valueIfTrue: unknown, valueIfFalse: unknown): IfIntrinsic {
   return new IfIntrinsic(conditionName, valueIfTrue, valueIfFalse);
 }
 
+/**
+ * Fn::Equals condition intrinsic (#2068).
+ * Compares two values; each may be a literal or a value intrinsic (Ref etc.).
+ */
+export class EqualsIntrinsic implements Intrinsic {
+  readonly [INTRINSIC_MARKER] = true as const;
+  private left: unknown;
+  private right: unknown;
+
+  constructor(left: unknown, right: unknown) {
+    this.left = left;
+    this.right = right;
+  }
+
+  toJSON(): { "Fn::Equals": [unknown, unknown] } {
+    return { "Fn::Equals": [resolveIntrinsicValue(this.left), resolveIntrinsicValue(this.right)] };
+  }
+}
+
+/**
+ * Create an Equals condition intrinsic: `Equals(Ref(cutover), "true")`.
+ */
+export function Equals(left: unknown, right: unknown): EqualsIntrinsic {
+  return new EqualsIntrinsic(left, right);
+}
+
+/**
+ * Fn::And condition intrinsic (#2068).
+ */
+export class AndIntrinsic implements Intrinsic {
+  readonly [INTRINSIC_MARKER] = true as const;
+  private conditions: ConditionOperand[];
+
+  constructor(conditions: ConditionOperand[]) {
+    this.conditions = conditions;
+  }
+
+  toJSON(): { "Fn::And": unknown[] } {
+    return { "Fn::And": this.conditions.map(resolveConditionOperand) };
+  }
+}
+
+/**
+ * Create an And condition intrinsic over 2–10 operands, each a nested
+ * condition intrinsic, a `Condition` declarable, or a condition name.
+ */
+export function And(...conditions: ConditionOperand[]): AndIntrinsic {
+  if (conditions.length < 2 || conditions.length > 10) {
+    throw new Error("And(...conditions): Fn::And takes between 2 and 10 conditions");
+  }
+  return new AndIntrinsic(conditions);
+}
+
+/**
+ * Fn::Or condition intrinsic (#2068).
+ */
+export class OrIntrinsic implements Intrinsic {
+  readonly [INTRINSIC_MARKER] = true as const;
+  private conditions: ConditionOperand[];
+
+  constructor(conditions: ConditionOperand[]) {
+    this.conditions = conditions;
+  }
+
+  toJSON(): { "Fn::Or": unknown[] } {
+    return { "Fn::Or": this.conditions.map(resolveConditionOperand) };
+  }
+}
+
+/**
+ * Create an Or condition intrinsic over 2–10 operands, each a nested
+ * condition intrinsic, a `Condition` declarable, or a condition name.
+ */
+export function Or(...conditions: ConditionOperand[]): OrIntrinsic {
+  if (conditions.length < 2 || conditions.length > 10) {
+    throw new Error("Or(...conditions): Fn::Or takes between 2 and 10 conditions");
+  }
+  return new OrIntrinsic(conditions);
+}
+
+/**
+ * Fn::Not condition intrinsic (#2068).
+ */
+export class NotIntrinsic implements Intrinsic {
+  readonly [INTRINSIC_MARKER] = true as const;
+  private condition: ConditionOperand;
+
+  constructor(condition: ConditionOperand) {
+    this.condition = condition;
+  }
+
+  toJSON(): { "Fn::Not": [unknown] } {
+    return { "Fn::Not": [resolveConditionOperand(this.condition)] };
+  }
+}
+
+/**
+ * Create a Not condition intrinsic over a nested condition intrinsic, a
+ * `Condition` declarable, or a condition name.
+ */
+export function Not(condition: ConditionOperand): NotIntrinsic {
+  return new NotIntrinsic(condition);
+}
+
 /**
  * Fn::Join intrinsic function
  * Joins values with a delimiter

package/src/lint/audit-catalog.ts

@@ -5,7 +5,8 @@
  * #350); core keeps only the generic catalog machinery + cross-cutting ids.
  */
 
-import { auditRule, type RuleMeta, type Authority } from "@intentius/chant/audit/catalog";
+import { auditRule, type RuleMeta, type Authority, applyLineage } from "@intentius/chant/audit/catalog";
+import { awsAuditLineage } from "./audit-lineage";
 
 /** AWS Well-Architected Security Pillar — the authority chant cites for AWS security findings. */
 const AWS_SEC: Authority = {
@@ -88,4 +89,8 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   WAW066: auditRule("WAW066", "merge-worthy", "guidance", "Private subnet's route table has no working default route", "Add a 0.0.0.0/0 route to a NAT gateway/Transit Gateway that exists in the template.", { category: "correctness" }),
   WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
   WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
+  WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
 };
+
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(awsAuditCatalog, awsAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,159 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const awsAuditLineage: Record<string, Lineage[]> = {
+  WAW010: [
+    { tool: "cfn-lint", rule: "W3005", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#W3005", relation: "equivalent" },
+  ],
+  WAW011: [
+    { tool: "cfn-lint", rule: "W2531", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#W2531", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_363", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+  ],
+  WAW017: [
+    { tool: "kics", rule: "Lambda Function Without Tags", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/8df8e857-bd59-44fa-9f4c-d77594b95b46/", relation: "extends" },
+    { tool: "kics", rule: "EFS Without Tags", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/08e39832-5e42-4304-98a0-aa5b43393162/", relation: "extends" },
+  ],
+  WAW018: [
+    { tool: "guard-rules-registry", rule: "S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_s3/s3_bucket_level_public_access_prohibited.guard", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_53", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
+    { tool: "checkov", rule: "CKV_AWS_56", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
+  ],
+  WAW019: [
+    { tool: "guard-rules-registry", rule: "RESTRICTED_INCOMING_TRAFFIC", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/restricted_common_ports.guard", relation: "overlaps" },
+    { tool: "kics", rule: "EC2 Sensitive Port Is Publicly Exposed", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/494b03d3-bf40-4464-8524-7c56ad0700ed/", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_24", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
+  ],
+  WAW020: [
+    { tool: "checkov", rule: "CKV_AWS_63", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "cfn-nag", rule: "F4", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamPolicyWildcardActionRule.rb", relation: "overlaps" },
+    { tool: "guard-rules-registry", rule: "IAM_ROLE_NO_WILDCARD_ACTIONS_ON_PERMISSIONS", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/iam/iam_role_no_wildcard_actions_on_permissions.guard", relation: "overlaps" },
+  ],
+  WAW021: [
+    { tool: "cfn-nag", rule: "F27", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSDBInstanceStorageEncryptedRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_16", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "RDS_STORAGE_ENCRYPTED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/rds_storage_encrypted.guard", relation: "equivalent" },
+  ],
+  WAW022: [
+    { tool: "cfn-nag", rule: "W89", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/LambdaFunctionInsideVPCRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_117", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "LAMBDA_INSIDE_VPC", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/lambda/lambda_inside_vpc.guard", relation: "equivalent" },
+  ],
+  WAW023: [
+    { tool: "checkov", rule: "CKV_AWS_68", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "kics", rule: "CloudFront Without WAF", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/0f139403-303f-467c-96bd-e717e6cfd62d/", relation: "equivalent" },
+  ],
+  WAW024: [
+    { tool: "cfn-nag", rule: "W52", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2AccessLoggingRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_91", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "kics", rule: "ELBv2 ALB Access Log Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/c62e8b7d-1fdf-4050-ac4c-76ba9e1d9621/", relation: "equivalent" },
+  ],
+  WAW025: [
+    { tool: "cfn-nag", rule: "W47", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SnsTopicKmsMasterKeyIdRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_26", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "SNS_ENCRYPTED_KMS", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_sns/sns_encrypted_kms.guard", relation: "equivalent" },
+  ],
+  WAW026: [
+    { tool: "checkov", rule: "CKV_AWS_27", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "kics", rule: "SQS With SSE Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/12726829-93ed-4d51-9cbe-13423f4299e1/", relation: "equivalent" },
+    { tool: "cfn-nag", rule: "W48", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SqsQueueKmsMasterKeyIdRule.rb", relation: "overlaps" },
+  ],
+  WAW027: [
+    { tool: "cfn-nag", rule: "W78", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/DynamoDBBackupRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_28", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "DYNAMODB_PITR_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/dynamodb/dynamodb_pitr_enabled.guard", relation: "equivalent" },
+  ],
+  WAW028: [
+    { tool: "cfn-nag", rule: "F1", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/EbsVolumeHasSseRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_3", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "ENCRYPTED_VOLUMES", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/encrypted_volumes.guard", relation: "equivalent" },
+  ],
+  WAW029: [
+    { tool: "cfn-lint", rule: "E3005", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3005", relation: "equivalent" },
+  ],
+  WAW032: [
+    { tool: "checkov", rule: "CKV_AWS_97", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "kics", rule: "EFS Volume With Disabled Transit Encryption", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/c1282e03-b285-4637-aee7-eefe3a7bb658/", relation: "equivalent" },
+  ],
+  WAW038: [
+    { tool: "cfn-nag", rule: "F22", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstancePubliclyAccessibleRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_17", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "kics", rule: "RDS DB Instance Publicly Accessible", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/de38e1d5-54cb-4111-a868-6f7722695007/", relation: "equivalent" },
+  ],
+  WAW039: [
+    { tool: "cfn-nag", rule: "W75", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstanceBackupRetentionPeriodRule.rb", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "DB_INSTANCE_BACKUP_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/db_instance_backup_enabled.guard", relation: "equivalent" },
+    { tool: "kics", rule: "RDS With Backup Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/8c415f6f-7b90-4a27-a44a-51047e1506f9/", relation: "equivalent" },
+  ],
+  WAW040: [
+    { tool: "cfn-nag", rule: "F80", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstanceDeletionProtectionRule.rb", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "RDS_INSTANCE_DELETION_PROTECTION_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/rds_instance_deletion_protection_enabled.guard", relation: "equivalent" },
+    { tool: "kics", rule: "RDS DB Instance With Deletion Protection Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/2c161e58-cb52-454f-abea-6470c37b5e6e/", relation: "equivalent" },
+  ],
+  WAW042: [
+    { tool: "guard-rules-registry", rule: "S3_BUCKET_SSL_REQUESTS_ONLY", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_s3/s3_bucket_ssl_requests_only.guard", relation: "equivalent" },
+    { tool: "kics", rule: "S3 Bucket Without SSL In Write Actions", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/38c64e76-c71e-4d92-a337-60174d1de1c9/", relation: "overlaps" },
+  ],
+  WAW043: [
+    { tool: "cfn-nag", rule: "F19", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/KMSKeyRotationRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_7", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "CMK_BACKING_KEY_ROTATION_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_kms/cmk_backing_key_rotation_enabled.guard", relation: "equivalent" },
+  ],
+  WAW044: [
+    { tool: "checkov", rule: "CKV_AWS_2", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "overlaps" },
+    { tool: "cfn-nag", rule: "W56", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerProtocolRule.rb", relation: "overlaps" },
+  ],
+  WAW045: [
+    { tool: "cfn-nag", rule: "W55", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerSslPolicyRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_103", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "ELBV2_LISTENER_SSL_POLICY_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/elastic_load_balancing_v2/elbv2_listener_ssl_policy_rule.guard", relation: "equivalent" },
+  ],
+  WAW049: [
+    { tool: "cfn-nag", rule: "W2", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb", relation: "overlaps" },
+    { tool: "guard-rules-registry", rule: "EC2_SECURITY_GROUP_INGRESS_OPEN_TO_WORLD_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/ec2_security_group_ingress_open_to_world_rule.guard", relation: "overlaps" },
+    { tool: "kics", rule: "Unrestricted Security Group Ingress", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/4a1e6b34-1008-4e61-a5f2-1f7c276f8d14/", relation: "overlaps" },
+  ],
+  WAW052: [
+    { tool: "cfn-nag", rule: "F78", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/CognitoUserPoolMfaConfigurationOnorOptionalRule.rb", relation: "overlaps" },
+    { tool: "guard-rules-registry", rule: "COGNITO_USER_POOL_MFA_CONFIGURATION_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_cognito/cognito_user_pool_mfa_configuration_rule.guard", relation: "overlaps" },
+    { tool: "kics", rule: "Cognito UserPool Without MFA", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/74a18d1a-cf02-4a31-8791-ed0967ad7fdc/", relation: "overlaps" },
+  ],
+  WAW053: [
+    { tool: "cfn-nag", rule: "W79", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ECRRepositoryScanOnPushRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_163", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "ECR_REPO_SCAN_ON_PUSH", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_ecr/ecr_repo_scan_on_push_rule.guard", relation: "equivalent" },
+  ],
+  WAW054: [
+    { tool: "checkov", rule: "CKV_AWS_51", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "kics", rule: "ECR Image Tag Not Immutable", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/33f41d31-86b1-46a4-81f7-9c9a671f59ac/", relation: "equivalent" },
+  ],
+  WAW055: [
+    { tool: "cfn-nag", rule: "W86", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/LogsLogGroupRetentionRule.rb", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_66", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
+    { tool: "guard-rules-registry", rule: "CW_LOGGROUP_RETENTION_PERIOD_CHECK", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/cloudwatch/cw_loggroup_retention_period_check.guard", relation: "equivalent" },
+  ],
+  WAW058: [
+    { tool: "guard-rules-registry", rule: "MULTI_REGION_CLOUD_TRAIL_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/cloudtrail/multi_region_cloud_trail_enabled.guard", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_67", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "overlaps" },
+    { tool: "kics", rule: "CloudTrail Logging Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/5c0b06d5-b7a4-484c-aeb0-75a836269ff0/", relation: "overlaps" },
+  ],
+  WAW059: [
+    { tool: "cfn-nag", rule: "W12", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamPolicyWildcardResourceRule.rb", relation: "overlaps" },
+    { tool: "cfn-nag", rule: "W11", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb", relation: "overlaps" },
+    { tool: "guard-rules-registry", rule: "IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/iam/iam_policydocument_no_wildcard_resource.guard", relation: "overlaps" },
+  ],
+  WAW061: [
+    { tool: "cfn-lint", rule: "E3059", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3059", relation: "equivalent" },
+  ],
+  WAW062: [
+    { tool: "cfn-lint", rule: "E3019", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3019", relation: "overlaps" },
+  ],
+  WAW069: [
+    { tool: "cfn-lint", rule: "E8002", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E8002", relation: "equivalent" },
+  ],
+};

package/src/lint/post-synth/index.ts

@@ -60,6 +60,7 @@ import { waw065 } from "./waw065";
 import { waw066 } from "./waw066";
 import { waw067 } from "./waw067";
 import { waw068 } from "./waw068";
+import { waw069 } from "./waw069";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -122,4 +123,5 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw066,
   waw067,
   waw068,
+  waw069,
 ];