@intentius/chant-lexicon-azure 0.124.31 → 0.124.32

package/dist/lint/post-synth/azr015.js

@@ -0,0 +1,66 @@
+/**
+ * AZR015: Missing Encryption on Storage Account
+ *
+ * Warns when a Storage Account does not have encryption configured.
+ * Storage accounts should have encryption services enabled for blob,
+ * file, table, and queue to protect data at rest.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const STORAGE_ACCOUNT_TYPE = "Microsoft.Storage/storageAccounts";
+export const azr015 = {
+    id: "AZR015",
+    description: "Missing encryption on storage account — enable encryption services to protect data at rest",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== STORAGE_ACCOUNT_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const encryption = props.encryption;
+                if (!encryption) {
+                    diagnostics.push({
+                        checkId: "AZR015",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" has no encryption configuration — enable encryption services for blob, file, table, and queue`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                    continue;
+                }
+                // Check that encryption services are defined
+                const services = encryption.services;
+                if (!services) {
+                    diagnostics.push({
+                        checkId: "AZR015",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" has encryption configured but no encryption services specified — enable blob, file, table, and queue encryption`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                    continue;
+                }
+                // Check for blob and file at minimum
+                const missingServices = [];
+                if (!services.blob)
+                    missingServices.push("blob");
+                if (!services.file)
+                    missingServices.push("file");
+                if (missingServices.length > 0) {
+                    diagnostics.push({
+                        checkId: "AZR015",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" is missing encryption for: ${missingServices.join(", ")}`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr016.js

@@ -0,0 +1,37 @@
+/**
+ * AZR016: Key Vault soft-delete not enabled
+ *
+ * Warns when a Key Vault does not have soft-delete enabled.
+ * Soft delete is required to protect against accidental deletion
+ * of keys, secrets, and certificates.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const KEY_VAULT_TYPE = "Microsoft.KeyVault/vaults";
+export const azr016 = {
+    id: "AZR016",
+    description: "Key Vault soft-delete not enabled — enable to protect against accidental deletion",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== KEY_VAULT_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.enableSoftDelete !== true) {
+                    diagnostics.push({
+                        checkId: "AZR016",
+                        severity: "warning",
+                        message: `Key Vault "${resourceName}" does not have soft-delete enabled — set enableSoftDelete to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr017.js

@@ -0,0 +1,37 @@
+/**
+ * AZR017: Key Vault purge protection not enabled
+ *
+ * Warns when a Key Vault does not have purge protection enabled.
+ * Purge protection prevents permanent deletion of soft-deleted vaults
+ * and vault objects during the retention period.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const KEY_VAULT_TYPE = "Microsoft.KeyVault/vaults";
+export const azr017 = {
+    id: "AZR017",
+    description: "Key Vault purge protection not enabled — enable to prevent permanent deletion during retention period",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== KEY_VAULT_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.enablePurgeProtection !== true) {
+                    diagnostics.push({
+                        checkId: "AZR017",
+                        severity: "warning",
+                        message: `Key Vault "${resourceName}" does not have purge protection enabled — set enablePurgeProtection to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr018.js

@@ -0,0 +1,42 @@
+/**
+ * AZR018: SQL Server missing auditing
+ *
+ * Warns when a SQL Server does not have auditing configured.
+ * Azure SQL auditing tracks database events and writes them
+ * to an audit log, helping meet compliance requirements.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const SQL_SERVER_TYPE = "Microsoft.Sql/servers";
+const AUDIT_TYPE = "Microsoft.Sql/servers/auditingSettings";
+export const azr018 = {
+    id: "AZR018",
+    description: "SQL Server missing auditing — enable auditing for compliance and threat detection",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            const sqlServers = template.resources.filter((r) => r.type === SQL_SERVER_TYPE);
+            const auditSettings = template.resources.filter((r) => r.type === AUDIT_TYPE);
+            for (const server of sqlServers) {
+                const serverName = typeof server.name === "string" ? server.name : String(server.name);
+                // Check for a matching auditing settings resource
+                const hasAudit = auditSettings.some((a) => {
+                    const auditName = typeof a.name === "string" ? a.name : String(a.name);
+                    return auditName.startsWith(`${serverName}/`);
+                });
+                if (!hasAudit) {
+                    diagnostics.push({
+                        checkId: "AZR018",
+                        severity: "warning",
+                        message: `SQL Server "${serverName}" does not have auditing configured — add a Microsoft.Sql/servers/auditingSettings resource`,
+                        entity: serverName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr019.js

@@ -0,0 +1,41 @@
+/**
+ * AZR019: SQL Server missing Transparent Data Encryption (TDE)
+ *
+ * Warns when a SQL Server database does not have TDE configured.
+ * TDE provides encryption at rest for the entire database, backups,
+ * and transaction log files.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const SQL_DB_TYPE = "Microsoft.Sql/servers/databases";
+const TDE_TYPE = "Microsoft.Sql/servers/databases/transparentDataEncryption";
+export const azr019 = {
+    id: "AZR019",
+    description: "SQL Server database missing TDE — enable Transparent Data Encryption to protect data at rest",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            const databases = template.resources.filter((r) => r.type === SQL_DB_TYPE);
+            const tdeSettings = template.resources.filter((r) => r.type === TDE_TYPE);
+            for (const db of databases) {
+                const dbName = typeof db.name === "string" ? db.name : String(db.name);
+                const hasTde = tdeSettings.some((t) => {
+                    const tdeName = typeof t.name === "string" ? t.name : String(t.name);
+                    return tdeName.startsWith(`${dbName}/`);
+                });
+                if (!hasTde) {
+                    diagnostics.push({
+                        checkId: "AZR019",
+                        severity: "warning",
+                        message: `SQL database "${dbName}" does not have TDE configured — add transparentDataEncryption resource`,
+                        entity: dbName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr020.js

@@ -0,0 +1,37 @@
+/**
+ * AZR020: App Service missing managed identity
+ *
+ * Warns when a Web App does not have a managed identity configured.
+ * Managed identity eliminates the need for credentials in code
+ * and enables secure access to Azure services.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const WEB_APP_TYPE = "Microsoft.Web/sites";
+export const azr020 = {
+    id: "AZR020",
+    description: "App Service missing managed identity — enable SystemAssigned or UserAssigned identity",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== WEB_APP_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const identity = resource.identity;
+                if (!identity || !identity.type) {
+                    diagnostics.push({
+                        checkId: "AZR020",
+                        severity: "warning",
+                        message: `App Service "${resourceName}" does not have managed identity configured — set identity.type to "SystemAssigned" or "UserAssigned"`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr021.js

@@ -0,0 +1,36 @@
+/**
+ * AZR021: App Service missing HTTPS-only
+ *
+ * Warns when a Web App does not enforce HTTPS-only traffic.
+ * HTTP traffic can be intercepted and exposes sensitive data.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const WEB_APP_TYPE = "Microsoft.Web/sites";
+export const azr021 = {
+    id: "AZR021",
+    description: "App Service missing HTTPS-only — set httpsOnly to true to enforce encrypted traffic",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== WEB_APP_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.httpsOnly !== true) {
+                    diagnostics.push({
+                        checkId: "AZR021",
+                        severity: "warning",
+                        message: `App Service "${resourceName}" does not enforce HTTPS-only — set httpsOnly to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr022.js

@@ -0,0 +1,39 @@
+/**
+ * AZR022: App Service missing minimum TLS 1.2
+ *
+ * Warns when a Web App does not enforce a minimum TLS version of 1.2.
+ * Older TLS versions (1.0, 1.1) have known vulnerabilities and should
+ * not be used.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const WEB_APP_TYPE = "Microsoft.Web/sites";
+export const azr022 = {
+    id: "AZR022",
+    description: "App Service missing minimum TLS 1.2 — set minTlsVersion in siteConfig to enforce TLS 1.2+",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== WEB_APP_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const siteConfig = props.siteConfig;
+                const minTlsVersion = siteConfig?.minTlsVersion;
+                if (minTlsVersion !== "1.2" && minTlsVersion !== "1.3") {
+                    diagnostics.push({
+                        checkId: "AZR022",
+                        severity: "warning",
+                        message: `App Service "${resourceName}" does not enforce minimum TLS 1.2 — set siteConfig.minTlsVersion to "1.2"`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr023.js

@@ -0,0 +1,39 @@
+/**
+ * AZR023: VM missing managed disk
+ *
+ * Warns when a Virtual Machine's OS disk does not use managed disks.
+ * Managed disks provide better reliability, scalability, and
+ * simplified management compared to unmanaged (VHD-based) disks.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const VM_TYPE = "Microsoft.Compute/virtualMachines";
+export const azr023 = {
+    id: "AZR023",
+    description: "VM missing managed disk — use managed disks for better reliability and management",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== VM_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const storageProfile = props.storageProfile;
+                const osDisk = storageProfile?.osDisk;
+                if (!osDisk?.managedDisk) {
+                    diagnostics.push({
+                        checkId: "AZR023",
+                        severity: "warning",
+                        message: `VM "${resourceName}" OS disk does not use managed disks — add managedDisk configuration to storageProfile.osDisk`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr024.js

@@ -0,0 +1,39 @@
+/**
+ * AZR024: VM missing boot diagnostics
+ *
+ * Warns when a Virtual Machine does not have boot diagnostics enabled.
+ * Boot diagnostics helps troubleshoot VM startup failures by capturing
+ * serial console output and screenshots.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const VM_TYPE = "Microsoft.Compute/virtualMachines";
+export const azr024 = {
+    id: "AZR024",
+    description: "VM missing boot diagnostics — enable for troubleshooting startup failures",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== VM_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const diagnosticsProfile = props.diagnosticsProfile;
+                const bootDiagnostics = diagnosticsProfile?.bootDiagnostics;
+                if (!bootDiagnostics || bootDiagnostics.enabled !== true) {
+                    diagnostics.push({
+                        checkId: "AZR024",
+                        severity: "warning",
+                        message: `VM "${resourceName}" does not have boot diagnostics enabled — set diagnosticsProfile.bootDiagnostics.enabled to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr025.js

@@ -0,0 +1,37 @@
+/**
+ * AZR025: AKS missing RBAC
+ *
+ * Warns when an AKS cluster does not have RBAC enabled.
+ * RBAC provides fine-grained access control for Kubernetes
+ * resources within the cluster.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const AKS_TYPE = "Microsoft.ContainerService/managedClusters";
+export const azr025 = {
+    id: "AZR025",
+    description: "AKS cluster missing RBAC — enable Kubernetes RBAC for access control",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== AKS_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.enableRBAC !== true) {
+                    diagnostics.push({
+                        checkId: "AZR025",
+                        severity: "warning",
+                        message: `AKS cluster "${resourceName}" does not have RBAC enabled — set enableRBAC to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr026.js

@@ -0,0 +1,38 @@
+/**
+ * AZR026: AKS missing network policy
+ *
+ * Warns when an AKS cluster does not have a network policy configured.
+ * Network policies control pod-to-pod traffic and are essential for
+ * microsegmentation and defense in depth.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const AKS_TYPE = "Microsoft.ContainerService/managedClusters";
+export const azr026 = {
+    id: "AZR026",
+    description: "AKS cluster missing network policy — configure networkPolicy for pod-to-pod traffic control",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== AKS_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const networkProfile = props.networkProfile;
+                if (!networkProfile?.networkPolicy) {
+                    diagnostics.push({
+                        checkId: "AZR026",
+                        severity: "warning",
+                        message: `AKS cluster "${resourceName}" does not have a network policy configured — set networkProfile.networkPolicy to "azure" or "calico"`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr027.js

@@ -0,0 +1,37 @@
+/**
+ * AZR027: Container Registry admin user enabled
+ *
+ * Warns when a Container Registry has the admin user enabled.
+ * Admin user provides shared credentials which cannot be individually
+ * revoked. Use Azure AD authentication or service principals instead.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const ACR_TYPE = "Microsoft.ContainerRegistry/registries";
+export const azr027 = {
+    id: "AZR027",
+    description: "Container Registry admin user enabled — disable admin and use Azure AD or service principals",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== ACR_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.adminUserEnabled === true) {
+                    diagnostics.push({
+                        checkId: "AZR027",
+                        severity: "warning",
+                        message: `Container Registry "${resourceName}" has admin user enabled — disable adminUserEnabled and use Azure AD authentication`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr028.js

@@ -0,0 +1,37 @@
+/**
+ * AZR028: Network interface missing NSG
+ *
+ * Warns when a Network Interface does not have a Network Security Group
+ * associated. NSGs provide essential firewall rules to control inbound
+ * and outbound traffic.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const NIC_TYPE = "Microsoft.Network/networkInterfaces";
+export const azr028 = {
+    id: "AZR028",
+    description: "Network interface missing NSG — associate an NSG to control network traffic",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== NIC_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (!props.networkSecurityGroup) {
+                    diagnostics.push({
+                        checkId: "AZR028",
+                        severity: "warning",
+                        message: `Network interface "${resourceName}" does not have an NSG associated — set networkSecurityGroup.id`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr029.js

@@ -0,0 +1,38 @@
+/**
+ * AZR029: Managed disk missing encryption
+ *
+ * Warns when a managed disk resource does not have encryption
+ * configured. Encryption at rest protects data on managed disks
+ * against unauthorized access.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const DISK_TYPE = "Microsoft.Compute/disks";
+export const azr029 = {
+    id: "AZR029",
+    description: "Managed disk missing encryption — enable encryption to protect data at rest",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== DISK_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const encryption = props.encryption;
+                if (!encryption) {
+                    diagnostics.push({
+                        checkId: "AZR029",
+                        severity: "warning",
+                        message: `Managed disk "${resourceName}" does not have encryption configured — set encryption.type to "EncryptionAtRestWithPlatformKey" or use customer-managed keys`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr030.js

@@ -0,0 +1,44 @@
+/**
+ * AZR030: Resource deployed at an unsupported template scope
+ *
+ * Errors when a template contains a resource whose ARM schema does not
+ * define it at the template's deployment scope (#1545). The serializer
+ * picks the template $schema from the common scope of all resources; a
+ * template mixing, say, management groups (tenant-only) with virtual
+ * networks (resource-group-only) has no valid single-template scope —
+ * split the project so each scope deploys its own template (linked
+ * deployments cross scopes).
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+import { deployScopesFor, scopeForTemplateSchema } from "../../deploy-scopes.js";
+export const azr030 = {
+    id: "AZR030",
+    description: "Resource deployed at an unsupported template scope — split scopes into separate templates",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            const templateScope = scopeForTemplateSchema(template.$schema);
+            for (const resource of template.resources) {
+                if (typeof resource.type !== "string")
+                    continue;
+                const scopes = deployScopesFor(resource.type);
+                if (scopes.includes(templateScope))
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                diagnostics.push({
+                    checkId: "AZR030",
+                    severity: "error",
+                    message: `Resource "${resourceName}" (${resource.type}) deploys at ` +
+                        `${scopes.join("/")} scope, but this template targets ${templateScope} scope — ` +
+                        `move it to a project deployed at a scope its schema supports`,
+                    entity: resourceName,
+                    lexicon: "azure",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};