@intentius/chant-lexicon-azure 0.124.31 → 0.124.33

package/dist/lint/post-synth/azr023.js

@@ -0,0 +1,39 @@
+/**
+ * AZR023: VM missing managed disk
+ *
+ * Warns when a Virtual Machine's OS disk does not use managed disks.
+ * Managed disks provide better reliability, scalability, and
+ * simplified management compared to unmanaged (VHD-based) disks.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const VM_TYPE = "Microsoft.Compute/virtualMachines";
+export const azr023 = {
+    id: "AZR023",
+    description: "VM missing managed disk — use managed disks for better reliability and management",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== VM_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const storageProfile = props.storageProfile;
+                const osDisk = storageProfile?.osDisk;
+                if (!osDisk?.managedDisk) {
+                    diagnostics.push({
+                        checkId: "AZR023",
+                        severity: "warning",
+                        message: `VM "${resourceName}" OS disk does not use managed disks — add managedDisk configuration to storageProfile.osDisk`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr024.js

@@ -0,0 +1,39 @@
+/**
+ * AZR024: VM missing boot diagnostics
+ *
+ * Warns when a Virtual Machine does not have boot diagnostics enabled.
+ * Boot diagnostics helps troubleshoot VM startup failures by capturing
+ * serial console output and screenshots.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const VM_TYPE = "Microsoft.Compute/virtualMachines";
+export const azr024 = {
+    id: "AZR024",
+    description: "VM missing boot diagnostics — enable for troubleshooting startup failures",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== VM_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const diagnosticsProfile = props.diagnosticsProfile;
+                const bootDiagnostics = diagnosticsProfile?.bootDiagnostics;
+                if (!bootDiagnostics || bootDiagnostics.enabled !== true) {
+                    diagnostics.push({
+                        checkId: "AZR024",
+                        severity: "warning",
+                        message: `VM "${resourceName}" does not have boot diagnostics enabled — set diagnosticsProfile.bootDiagnostics.enabled to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr025.js

@@ -0,0 +1,37 @@
+/**
+ * AZR025: AKS missing RBAC
+ *
+ * Warns when an AKS cluster does not have RBAC enabled.
+ * RBAC provides fine-grained access control for Kubernetes
+ * resources within the cluster.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const AKS_TYPE = "Microsoft.ContainerService/managedClusters";
+export const azr025 = {
+    id: "AZR025",
+    description: "AKS cluster missing RBAC — enable Kubernetes RBAC for access control",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== AKS_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.enableRBAC !== true) {
+                    diagnostics.push({
+                        checkId: "AZR025",
+                        severity: "warning",
+                        message: `AKS cluster "${resourceName}" does not have RBAC enabled — set enableRBAC to true`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr026.js

@@ -0,0 +1,38 @@
+/**
+ * AZR026: AKS missing network policy
+ *
+ * Warns when an AKS cluster does not have a network policy configured.
+ * Network policies control pod-to-pod traffic and are essential for
+ * microsegmentation and defense in depth.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const AKS_TYPE = "Microsoft.ContainerService/managedClusters";
+export const azr026 = {
+    id: "AZR026",
+    description: "AKS cluster missing network policy — configure networkPolicy for pod-to-pod traffic control",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== AKS_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const networkProfile = props.networkProfile;
+                if (!networkProfile?.networkPolicy) {
+                    diagnostics.push({
+                        checkId: "AZR026",
+                        severity: "warning",
+                        message: `AKS cluster "${resourceName}" does not have a network policy configured — set networkProfile.networkPolicy to "azure" or "calico"`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr027.js

@@ -0,0 +1,37 @@
+/**
+ * AZR027: Container Registry admin user enabled
+ *
+ * Warns when a Container Registry has the admin user enabled.
+ * Admin user provides shared credentials which cannot be individually
+ * revoked. Use Azure AD authentication or service principals instead.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const ACR_TYPE = "Microsoft.ContainerRegistry/registries";
+export const azr027 = {
+    id: "AZR027",
+    description: "Container Registry admin user enabled — disable admin and use Azure AD or service principals",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== ACR_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (props.adminUserEnabled === true) {
+                    diagnostics.push({
+                        checkId: "AZR027",
+                        severity: "warning",
+                        message: `Container Registry "${resourceName}" has admin user enabled — disable adminUserEnabled and use Azure AD authentication`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr028.js

@@ -0,0 +1,37 @@
+/**
+ * AZR028: Network interface missing NSG
+ *
+ * Warns when a Network Interface does not have a Network Security Group
+ * associated. NSGs provide essential firewall rules to control inbound
+ * and outbound traffic.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const NIC_TYPE = "Microsoft.Network/networkInterfaces";
+export const azr028 = {
+    id: "AZR028",
+    description: "Network interface missing NSG — associate an NSG to control network traffic",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== NIC_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                if (!props.networkSecurityGroup) {
+                    diagnostics.push({
+                        checkId: "AZR028",
+                        severity: "warning",
+                        message: `Network interface "${resourceName}" does not have an NSG associated — set networkSecurityGroup.id`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr029.js

@@ -0,0 +1,38 @@
+/**
+ * AZR029: Managed disk missing encryption
+ *
+ * Warns when a managed disk resource does not have encryption
+ * configured. Encryption at rest protects data on managed disks
+ * against unauthorized access.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const DISK_TYPE = "Microsoft.Compute/disks";
+export const azr029 = {
+    id: "AZR029",
+    description: "Managed disk missing encryption — enable encryption to protect data at rest",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== DISK_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                const encryption = props.encryption;
+                if (!encryption) {
+                    diagnostics.push({
+                        checkId: "AZR029",
+                        severity: "warning",
+                        message: `Managed disk "${resourceName}" does not have encryption configured — set encryption.type to "EncryptionAtRestWithPlatformKey" or use customer-managed keys`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr030.js

@@ -0,0 +1,44 @@
+/**
+ * AZR030: Resource deployed at an unsupported template scope
+ *
+ * Errors when a template contains a resource whose ARM schema does not
+ * define it at the template's deployment scope (#1545). The serializer
+ * picks the template $schema from the common scope of all resources; a
+ * template mixing, say, management groups (tenant-only) with virtual
+ * networks (resource-group-only) has no valid single-template scope —
+ * split the project so each scope deploys its own template (linked
+ * deployments cross scopes).
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+import { deployScopesFor, scopeForTemplateSchema } from "../../deploy-scopes.js";
+export const azr030 = {
+    id: "AZR030",
+    description: "Resource deployed at an unsupported template scope — split scopes into separate templates",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            const templateScope = scopeForTemplateSchema(template.$schema);
+            for (const resource of template.resources) {
+                if (typeof resource.type !== "string")
+                    continue;
+                const scopes = deployScopesFor(resource.type);
+                if (scopes.includes(templateScope))
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                diagnostics.push({
+                    checkId: "AZR030",
+                    severity: "error",
+                    message: `Resource "${resourceName}" (${resource.type}) deploys at ` +
+                        `${scopes.join("/")} scope, but this template targets ${templateScope} scope — ` +
+                        `move it to a project deployed at a scope its schema supports`,
+                    entity: resourceName,
+                    lexicon: "azure",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr031.js

@@ -0,0 +1,36 @@
+/**
+ * AZR031: Policy Assignment Not Enforced
+ *
+ * Flags Microsoft.Authorization/policyAssignments with enforcementMode
+ * DoNotEnforce. The assignment stays visible in the tree while denying
+ * nothing — the Azure shape of a disabled guardrail.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+export const azr031 = {
+    id: "AZR031",
+    description: "Policy assignment has enforcementMode DoNotEnforce — the guardrail is disabled",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== "Microsoft.Authorization/policyAssignments")
+                    continue;
+                const mode = resource.properties?.enforcementMode;
+                if (mode !== "DoNotEnforce")
+                    continue;
+                const name = typeof resource.name === "string" ? resource.name : String(resource.name);
+                diagnostics.push({
+                    checkId: "AZR031",
+                    severity: "error",
+                    message: `Policy assignment "${name}" has enforcementMode DoNotEnforce — the guardrail is assigned but enforces nothing`,
+                    entity: name,
+                    lexicon: "azure",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr032.js

@@ -0,0 +1,53 @@
+/**
+ * AZR032: Policy Definition Assigned Nowhere
+ *
+ * Flags custom Microsoft.Authorization/policyDefinitions with no
+ * policyAssignments referencing them in the same template. The
+ * GovernanceBaseline composite always pairs definition and assignment; a
+ * definition alone is the leftover of a dropped guardrail assignment.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+/**
+ * True when a policyDefinitionId expression targets the definition name —
+ * either a quoted literal inside resourceId()/managementGroupResourceId()
+ * or the trailing segment of a literal resource id.
+ */
+function references(definitionName, policyDefinitionId) {
+    if (typeof policyDefinitionId !== "string")
+        return false;
+    return (policyDefinitionId.includes(`'${definitionName}'`) ||
+        policyDefinitionId.endsWith(`/${definitionName}`) ||
+        policyDefinitionId === definitionName);
+}
+export const azr032 = {
+    id: "AZR032",
+    description: "Custom policy definition assigned nowhere — a defined but unassigned guardrail enforces nothing",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            const assignmentIds = template.resources
+                .filter((r) => r.type === "Microsoft.Authorization/policyAssignments")
+                .map((r) => r.properties?.policyDefinitionId);
+            for (const resource of template.resources) {
+                if (resource.type !== "Microsoft.Authorization/policyDefinitions")
+                    continue;
+                if (typeof resource.name !== "string")
+                    continue;
+                const name = resource.name;
+                if (assignmentIds.some((id) => references(name, id)))
+                    continue;
+                diagnostics.push({
+                    checkId: "AZR032",
+                    severity: "error",
+                    message: `Policy definition "${name}" is assigned nowhere in this template — pair it with a policy assignment or the guardrail enforces nothing`,
+                    entity: name,
+                    lexicon: "azure",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr033.js

@@ -0,0 +1,35 @@
+/**
+ * AZR033: Subscriptions May Leave the Tenant
+ *
+ * Flags a Microsoft.Subscription/policies resource that sets
+ * blockSubscriptionsLeavingTenant to false — the tenant-level leave-block
+ * the landing-zone foundation declares, explicitly weakened.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+export const azr033 = {
+    id: "AZR033",
+    description: "Tenant subscription policy does not block subscriptions from leaving",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== "Microsoft.Subscription/policies")
+                    continue;
+                if (resource.properties?.blockSubscriptionsLeavingTenant !== false)
+                    continue;
+                const name = typeof resource.name === "string" ? resource.name : String(resource.name);
+                diagnostics.push({
+                    checkId: "AZR033",
+                    severity: "error",
+                    message: `Subscription tenant policy "${name}" sets blockSubscriptionsLeavingTenant: false — subscriptions can be moved out of the tenant`,
+                    entity: name,
+                    lexicon: "azure",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,50 @@
+import { azr010 } from "./azr010.js";
+import { azr011 } from "./azr011.js";
+import { azr012 } from "./azr012.js";
+import { azr013 } from "./azr013.js";
+import { azr014 } from "./azr014.js";
+import { azr015 } from "./azr015.js";
+import { azr016 } from "./azr016.js";
+import { azr017 } from "./azr017.js";
+import { azr018 } from "./azr018.js";
+import { azr019 } from "./azr019.js";
+import { azr020 } from "./azr020.js";
+import { azr021 } from "./azr021.js";
+import { azr022 } from "./azr022.js";
+import { azr023 } from "./azr023.js";
+import { azr024 } from "./azr024.js";
+import { azr025 } from "./azr025.js";
+import { azr026 } from "./azr026.js";
+import { azr027 } from "./azr027.js";
+import { azr028 } from "./azr028.js";
+import { azr029 } from "./azr029.js";
+import { azr030 } from "./azr030.js";
+import { azr031 } from "./azr031.js";
+import { azr032 } from "./azr032.js";
+import { azr033 } from "./azr033.js";
+export const postSynthChecks = [
+    azr010,
+    azr011,
+    azr012,
+    azr013,
+    azr014,
+    azr015,
+    azr016,
+    azr017,
+    azr018,
+    azr019,
+    azr020,
+    azr021,
+    azr022,
+    azr023,
+    azr024,
+    azr025,
+    azr026,
+    azr027,
+    azr028,
+    azr029,
+    azr030,
+    azr031,
+    azr032,
+    azr033,
+];

package/dist/lint/rules/hardcoded-location.js

@@ -0,0 +1,82 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * AZR001: Hardcoded Azure Location
+ *
+ * Detects hardcoded Azure location strings in code.
+ * Locations should use Azure.ResourceGroupLocation pseudo-parameter instead.
+ */
+export const hardcodedLocationRule = {
+    id: "AZR001",
+    severity: "warning",
+    category: "correctness",
+    description: "Detects hardcoded Azure location strings — use Azure.ResourceGroupLocation instead",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        // Common Azure location strings (case-insensitive match)
+        const azureLocations = new Set([
+            "eastus",
+            "eastus2",
+            "westus",
+            "westus2",
+            "westus3",
+            "centralus",
+            "northcentralus",
+            "southcentralus",
+            "westcentralus",
+            "canadacentral",
+            "canadaeast",
+            "brazilsouth",
+            "northeurope",
+            "westeurope",
+            "uksouth",
+            "ukwest",
+            "francecentral",
+            "francesouth",
+            "switzerlandnorth",
+            "switzerlandwest",
+            "germanywestcentral",
+            "norwayeast",
+            "norwaywest",
+            "swedencentral",
+            "eastasia",
+            "southeastasia",
+            "japaneast",
+            "japanwest",
+            "australiaeast",
+            "australiasoutheast",
+            "australiacentral",
+            "koreacentral",
+            "koreasouth",
+            "southafricanorth",
+            "southafricawest",
+            "uaenorth",
+            "uaecentral",
+            "centralindia",
+            "southindia",
+            "westindia",
+            "qatarcentral",
+            "polandcentral",
+            "italynorth",
+        ]);
+        function visit(node) {
+            if (ts.isStringLiteral(node)) {
+                const value = node.text.toLowerCase();
+                if (azureLocations.has(value)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "AZR001",
+                        severity: "warning",
+                        message: `Hardcoded location "${node.text}" detected. Use Azure.ResourceGroupLocation instead.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/index.js

@@ -0,0 +1,6 @@
+/**
+ * Azure-specific lint rules for chant projects
+ */
+export { hardcodedLocationRule } from "./hardcoded-location.js";
+export { storageHttpsRule } from "./storage-https.js";
+export { nsgWildcardRule } from "./nsg-wildcard.js";

package/dist/lint/rules/nsg-wildcard.js

@@ -0,0 +1,44 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * AZR003: NSG Wildcard Source Address
+ *
+ * Detects Network Security Group rules with sourceAddressPrefix: "*".
+ * Wildcard source addresses allow traffic from any source and should be
+ * restricted to specific IP ranges or service tags.
+ */
+export const nsgWildcardRule = {
+    id: "AZR003",
+    severity: "warning",
+    category: "security",
+    description: "Detects NSG rules with wildcard (*) source address — restrict to specific IP ranges or service tags",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for sourceAddressPrefix: "*" in object literals
+            if (ts.isPropertyAssignment(node)) {
+                const name = node.name;
+                if (ts.isIdentifier(name) || ts.isStringLiteral(name)) {
+                    const propName = ts.isIdentifier(name) ? name.text : name.text;
+                    if (propName === "sourceAddressPrefix") {
+                        // Check if value is "*"
+                        if (ts.isStringLiteral(node.initializer) && node.initializer.text === "*") {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "AZR003",
+                                severity: "warning",
+                                message: "NSG rule uses wildcard (*) sourceAddressPrefix. Restrict to specific IP ranges or service tags.",
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};