@intentius/chant-lexicon-terraform 0.100.0 → 0.102.0

package/src/lint/post-synth/fixtures/TF033/positive-absent.tf

@@ -0,0 +1,93 @@
+# Vendored for TF033 (chant #2288) from https://github.com/zoitech/terraform-aws-concourse
+# Path: rds.tf
+# Commit: fa3f3c3eecaa9144ea556e52cd3c43bff3bdd510
+# Licence: MIT, https://github.com/zoitech/terraform-aws-concourse/blob/fa3f3c3eecaa9144ea556e52cd3c43bff3bdd510/LICENSE
+# The whole file, unmodified.
+#
+# TF033: one error. aws_db_instance.postgres does not set storage_encrypted, and the provider default is false.
+# Its snapshot_identifier = "" is not a source: the provider reads it with GetOk, so "" is the same as unset.
+#
+# Copyright (c) 2017 Zoi TechCon GmbH
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_db_subnet_group" "postgres" {
+  name       = "${lower(var.prefix)}-private"
+  subnet_ids = var.private_sn
+
+  tags = var.rds_tags
+}
+
+resource "aws_db_parameter_group" "concourse" {
+  name   = "${var.prefix}-concourse-${var.postgres_family}"
+  family = var.postgres_family
+
+  tags = var.rds_tags
+}
+
+resource "aws_db_instance" "postgres" {
+  identifier                = "${lower(var.prefix)}-concourse-db"
+  allocated_storage         = var.concourse_db_storage
+  storage_type              = "gp2"
+  engine                    = "postgres"
+  engine_version            = var.postgres_version
+  instance_class            = var.concourse_db_size
+  username                  = var.postgres_username
+  password                  = local.postgres_password
+  db_subnet_group_name      = aws_db_subnet_group.postgres.id
+  parameter_group_name      = aws_db_parameter_group.concourse.id
+  multi_az                  = var.postgres_multiaz
+  backup_retention_period   = 35
+  maintenance_window        = "Sat:21:00-Sun:00:00"
+  backup_window             = "00:00-02:00"
+  vpc_security_group_ids    = [aws_security_group.RuleGroupWsIn.id]
+  copy_tags_to_snapshot     = true
+  snapshot_identifier       = ""
+  skip_final_snapshot       = true
+  final_snapshot_identifier = "LastSnap"
+  apply_immediately         = true
+
+  lifecycle {
+    prevent_destroy = true
+    ignore_changes  = [engine_version]
+  }
+
+  tags = merge({ Name = "${lower(var.prefix)}-concourse-db"}, var.rds_tags)
+}
+
+# Monitoring of DB events
+resource "aws_sns_topic" "postgres" {
+  name = "${lower(var.prefix)}-rds-topic"
+
+  tags = merge({ Name = "${lower(var.prefix)}-rds-topic"}, var.sns_tags)
+}
+
+resource "aws_db_event_subscription" "postgres" {
+  name      = "${lower(var.prefix)}-rds-sub"
+  sns_topic = aws_sns_topic.postgres.arn
+
+  source_type = "db-instance"
+  source_ids  = [aws_db_instance.postgres.identifier]
+
+  # see here for further event categories
+  event_categories = [
+    "low storage",
+  ]
+}
+

package/src/lint/post-synth/fixtures/TF033/positive.tf

@@ -0,0 +1,50 @@
+# Vendored for TF033 (chant #2288) from https://github.com/bridgecrewio/terragoat
+# Path: terraform/aws/db-app.tf
+# Commit: 729f8da62c6a85ce4af5ad3d123de97776d954c4
+# Licence: Apache-2.0, https://github.com/bridgecrewio/terragoat/blob/729f8da62c6a85ce4af5ad3d123de97776d954c4/LICENSE
+# Excerpt: lines 1-42, unmodified.
+#
+# TF033: one error. TerraGoat is a deliberately vulnerable estate; aws_db_instance.default writes storage_encrypted = false.
+
+resource "aws_db_instance" "default" {
+
+  name                   = var.dbname
+  engine                 = "mysql"
+  option_group_name      = aws_db_option_group.default.name
+  parameter_group_name   = aws_db_parameter_group.default.name
+  db_subnet_group_name   = aws_db_subnet_group.default.name
+  vpc_security_group_ids = ["${aws_security_group.default.id}"]
+
+  identifier              = "rds-${local.resource_prefix.value}"
+  engine_version          = "8.0" # Latest major version 
+  instance_class          = "db.t3.micro"
+  allocated_storage       = "20"
+  username                = "admin"
+  password                = var.password
+  apply_immediately       = true
+  multi_az                = false
+  backup_retention_period = 0
+  storage_encrypted       = false
+  skip_final_snapshot     = true
+  monitoring_interval     = 0
+  publicly_accessible     = true
+
+  tags = merge({
+    Name        = "${local.resource_prefix.value}-rds"
+    Environment = local.resource_prefix.value
+    }, {
+    git_commit           = "e6d83b21346fe85d4fe28b16c0b2f1e0662eb1d7"
+    git_file             = "terraform/aws/db-app.tf"
+    git_last_modified_at = "2023-04-27 12:47:51"
+    git_last_modified_by = "nadler@paloaltonetworks.com"
+    git_modifiers        = "nadler/nimrodkor"
+    git_org              = "bridgecrewio"
+    git_repo             = "terragoat"
+    yor_trace            = "47c13290-c2ce-48a7-b666-1b0085effb92"
+  })
+
+  # Ignore password changes from tf plan diff
+  lifecycle {
+    ignore_changes = ["password"]
+  }
+}

package/src/lint/post-synth/fixtures/TF034/negative.tf

@@ -0,0 +1,24 @@
+# Vendored for TF034 (chant #2288) from https://github.com/covidgreen/covid-green-infra
+# Path: sns.tf
+# Commit: 864d159afca9367db21cca05b1e8eb58038bdbd6
+# Licence: Apache-2.0, https://github.com/covidgreen/covid-green-infra/blob/864d159afca9367db21cca05b1e8eb58038bdbd6/LICENSE
+# The whole file, unmodified.
+#
+# TF034: silent. Both topics set kms_master_key_id = aws_kms_alias.sns.arn, an attribute of a managed alias,
+# which is never empty.
+
+resource "aws_sns_topic" "callback_email_notifications" {
+  count = local.enable_callback_email_notifications_count
+
+  name              = "${module.labels.id}-callback-email-notifications"
+  kms_master_key_id = aws_kms_alias.sns.arn
+  tags              = module.labels.tags
+}
+
+resource "aws_sns_topic" "daily_registrations_reporter" {
+  count = local.lambda_daily_registrations_reporter_count
+
+  name              = "${module.labels.id}-daily-registrations-reporter"
+  kms_master_key_id = aws_kms_alias.sns.arn
+  tags              = module.labels.tags
+}

package/src/lint/post-synth/fixtures/TF034/positive-absent.tf

@@ -0,0 +1,36 @@
+# Vendored for TF034 (chant #2288) from https://github.com/radian-software/riju
+# Path: tf/sns.tf
+# Commit: ace9df7cd8f186b869af14d721e055864ed8f3e4
+# Licence: MIT, https://github.com/radian-software/riju/blob/ace9df7cd8f186b869af14d721e055864ed8f3e4/LICENSE.md
+# The whole file, unmodified.
+#
+# TF034: one warning. The topic does not set kms_master_key_id, and no AWS default encrypts a topic that names no key.
+#
+# Copyright (c) 2020–2022 [Radian LLC](https://radian.codes) and
+# contributors
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_sns_topic" "riju" {
+  name = "Riju"
+
+  tags = {
+    BillingSubcategory = "Riju:SNS"
+  }
+}

package/src/lint/post-synth/fixtures/TF034/positive.tf

@@ -0,0 +1,14 @@
+# Vendored for TF034 (chant #2288) from https://github.com/Checkmarx/kics
+# Path: assets/queries/terraform/aws/sns_topic_not_encrypted/test/positive1.tf
+# Commit: 8a0f0bbaf380c6f9110bfe9808311f49aac45cde
+# Licence: Apache-2.0, https://github.com/Checkmarx/kics/blob/8a0f0bbaf380c6f9110bfe9808311f49aac45cde/LICENSE
+# The whole file, unmodified.
+#
+# KICS's own test corpus for "SNS Topic Not Encrypted".
+#
+# TF034: one warning. kms_master_key_id = "" names no key.
+
+resource "aws_sns_topic" "user_updates" {
+  name              = "user-updates-topic"
+  kms_master_key_id = ""
+}

package/src/lint/post-synth/fixtures/TF035/negative-absent.tf

@@ -0,0 +1,43 @@
+# Vendored for TF035 (chant #2288) from https://github.com/cds-snc/notification-terraform
+# Path: aws/common/sqs.tf
+# Commit: f202d882331fa2814170e4a65695291797af282d
+# Licence: MIT, https://github.com/cds-snc/notification-terraform/blob/f202d882331fa2814170e4a65695291797af282d/LICENSE
+# Excerpt: lines 60-73, unmodified.
+#
+# TF035: silent. The queue sets neither sqs_managed_sse_enabled nor kms_master_key_id, so AWS's SSE-SQS default
+# encrypts it. This is the case the bridged WAW026 got wrong on every queue.
+#
+# Copyright (c) 2020 Canadian Digital Service – Service numérique canadien
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_sqs_queue" "eks_notification_canada_cadelivery_receipts" {
+  provider         = aws.core_services
+  name             = "eks-notification-canada-cadelivery-receipts"
+  delay_seconds    = 0
+  max_message_size = var.sqs_max_message_size
+  #4 Days
+  message_retention_seconds  = 345600
+  receive_wait_time_seconds  = 0
+  visibility_timeout_seconds = var.sqs_visibility_timeout_default
+
+  tags = {
+    Environment = var.env
+  }
+}

package/src/lint/post-synth/fixtures/TF035/negative.tf

@@ -0,0 +1,54 @@
+# Vendored for TF035 (chant #2288) from https://github.com/cds-snc/notification-terraform
+# Path: aws/common/sqs.tf
+# Commit: f202d882331fa2814170e4a65695291797af282d
+# Licence: MIT, https://github.com/cds-snc/notification-terraform/blob/f202d882331fa2814170e4a65695291797af282d/LICENSE
+# Excerpt: lines 1-26, unmodified.
+#
+# TF035: silent. Three queues set sqs_managed_sse_enabled = true.
+#
+# Copyright (c) 2020 Canadian Digital Service – Service numérique canadien
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_sqs_queue" "priority_db_tasks_queue" {
+  provider                = aws.core_services
+  name                    = "${var.celery_queue_prefix}-${var.sqs_priority_db_tasks_queue_name}"
+  fifo_queue              = true
+  deduplication_scope     = "messageGroup"
+  fifo_throughput_limit   = "perMessageGroupId"
+  sqs_managed_sse_enabled = true
+  # tfsec:ignore:AWS015 - Queues should be encrypted with customer managed KMS keys
+  # AWS managed encryption is good enough for us
+}
+
+resource "aws_sqs_queue" "normal_db_tasks_queue" {
+  provider                = aws.core_services
+  name                    = "${var.celery_queue_prefix}-${var.sqs_normal_db_tasks_queue_name}"
+  sqs_managed_sse_enabled = true
+  # tfsec:ignore:AWS015 - Queues should be encrypted with customer managed KMS keys
+  # AWS managed encryption is good enough for us
+}
+
+resource "aws_sqs_queue" "bulk_db_tasks_queue" {
+  provider                = aws.core_services
+  name                    = "${var.celery_queue_prefix}-${var.sqs_bulk_db_tasks_queue_name}"
+  sqs_managed_sse_enabled = true
+  # tfsec:ignore:AWS015 - Queues should be encrypted with customer managed KMS keys
+  # AWS managed encryption is good enough for us
+}

package/src/lint/post-synth/fixtures/TF035/positive.tf

@@ -0,0 +1,37 @@
+# Vendored for TF035 (chant #2288) from https://github.com/cds-snc/notification-terraform
+# Path: aws/common/sqs.tf
+# Commit: f202d882331fa2814170e4a65695291797af282d
+# Licence: MIT, https://github.com/cds-snc/notification-terraform/blob/f202d882331fa2814170e4a65695291797af282d/LICENSE
+# Excerpt: lines 28-36, unmodified.
+#
+# TF035: one warning. sqs_managed_sse_enabled = false with no kms_master_key_id turns off the SSE-SQS default.
+#
+# Copyright (c) 2020 Canadian Digital Service – Service numérique canadien
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_sqs_queue" "notify_internal_tasks_queue" {
+  provider = aws.core_services
+  name     = "${var.celery_queue_prefix}notify-internal-tasks"
+  # This queue was created outside of terraform and has this value set to false in staging and production.
+  sqs_managed_sse_enabled = false
+  max_message_size        = var.sqs_max_message_size
+  # This queue was created outside of terraform and has this value set to default in staging and production.
+  visibility_timeout_seconds = var.sqs_visibility_timeout_default
+}

package/src/lint/post-synth/fixtures/TF036/negative.tf

@@ -0,0 +1,61 @@
+# Vendored for TF036 (chant #2288) from https://github.com/ned1313/terraform-tuesdays
+# Path: 2021-04-13-AWS-KMS/ebs/main.tf
+# Commit: 7651f6028ba18f01ad0273a15169e4058025c944
+# Licence: MIT, https://github.com/ned1313/terraform-tuesdays/blob/7651f6028ba18f01ad0273a15169e4058025c944/LICENSE
+# The whole file, unmodified.
+#
+# TF036: silent. The volume sets encrypted = true with a customer managed kms_key_id.
+#
+# Copyright (c) 2020 Ned Bellavance
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 3.0"
+    }
+  }
+}
+
+# Configure the AWS Provider
+provider "aws" {
+  region = var.region
+}
+
+variable "region" {
+  type = string
+  default = "us-east-1"
+}
+
+data "aws_availability_zones" "azs" {
+  state = "available"
+}
+
+resource "aws_kms_key" "ebs" {
+  description = "EBS key"
+}
+
+resource "aws_ebs_volume" "encrypted" {
+  availability_zone = data.aws_availability_zones.azs.names[0]
+  size              = 40
+  encrypted = true
+  kms_key_id = aws_kms_key.ebs.arn
+}

package/src/lint/post-synth/fixtures/TF036/not-determined.tf

@@ -0,0 +1,28 @@
+# Vendored for TF036 (chant #2288) from https://github.com/bridgecrewio/terragoat
+# Path: terraform/aws/ec2.tf
+# Commit: 729f8da62c6a85ce4af5ad3d123de97776d954c4
+# Licence: Apache-2.0, https://github.com/bridgecrewio/terragoat/blob/729f8da62c6a85ce4af5ad3d123de97776d954c4/LICENSE
+# Excerpt: lines 34-51, unmodified.
+#
+# TF036: one info, Not determined. The volume does not set encrypted, so whether it is encrypted depends on the
+# Region's EBS encryption by default. The commented-out line in the source records why TerraGoat left
+# encrypted = false out: "Setting this causes the volume to be recreated on apply".
+
+resource "aws_ebs_volume" "web_host_storage" {
+  # unencrypted volume
+  availability_zone = "${var.region}a"
+  #encrypted         = false  # Setting this causes the volume to be recreated on apply 
+  size = 1
+  tags = merge({
+    Name = "${local.resource_prefix.value}-ebs"
+    }, {
+    git_commit           = "d3439f0f2af62f6fa3521e14d6c27819ef8f12e1"
+    git_file             = "terraform/aws/ec2.tf"
+    git_last_modified_at = "2021-05-02 11:17:26"
+    git_last_modified_by = "nimrodkor@users.noreply.github.com"
+    git_modifiers        = "nimrodkor"
+    git_org              = "bridgecrewio"
+    git_repo             = "terragoat"
+    yor_trace            = "c5509daf-10f0-46af-9e03-41989212521d"
+  })
+}

package/src/lint/post-synth/fixtures/TF036/positive.tf

@@ -0,0 +1,38 @@
+# Vendored for TF036 (chant #2288) from https://github.com/stelligent/config-lint
+# Path: example-files/config/volumes.tf
+# Commit: 8e87d18df9df2413a3bf3f57a3ceaf17a2140da9
+# Licence: MIT, https://github.com/stelligent/config-lint/blob/8e87d18df9df2413a3bf3f57a3ceaf17a2140da9/LICENSE.md
+# Excerpt: lines 9-16, unmodified.
+#
+# config-lint's own example files.
+#
+# TF036: one warning. encrypted = false.
+#
+# Copyright (c) 2018-2020 Stelligent
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_ebs_volume" "vol2" {
+    availability_zone = "us-west-2a"
+    size = 40
+    tags {
+        Name = "HelloWorld"
+    }
+    encrypted = false
+}

package/src/lint/post-synth/fixtures/TF037/negative-exclusion.tf

@@ -0,0 +1,63 @@
+# Vendored for TF037 (chant #2288) from https://github.com/lexicalunit/spellbot
+# Path: infrastructure/app/ecr.tf
+# Commit: 31ea539eff3df6da03195324f8bdd377210c54ec
+# Licence: MIT, https://github.com/lexicalunit/spellbot/blob/31ea539eff3df6da03195324f8bdd377210c54ec/LICENSE.md
+# Excerpt: lines 1-34, unmodified.
+#
+# TF037: silent. IMMUTABLE_WITH_EXCLUSION (provider v6) keeps SHA tags immutable and names the four moving
+# tags that stay mutable.
+#
+# Copyright (c) 2026 spellbot@lexicalunit.com
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+# ECR repository for SpellBot application
+resource "aws_ecr_repository" "spellbot" {
+  name = "spellbot-app"
+
+  # SHA-tagged images (the artifacts ECS actually pulls) are immutable. The
+  # moving aliases below are rewritten by the deploy workflow on every push
+  # and so must remain mutable.
+  image_tag_mutability = "IMMUTABLE_WITH_EXCLUSION"
+
+  image_tag_mutability_exclusion_filter {
+    filter      = "stage"
+    filter_type = "WILDCARD"
+  }
+  image_tag_mutability_exclusion_filter {
+    filter      = "prod"
+    filter_type = "WILDCARD"
+  }
+  image_tag_mutability_exclusion_filter {
+    filter      = "latest"
+    filter_type = "WILDCARD"
+  }
+  image_tag_mutability_exclusion_filter {
+    filter      = "pr-*"
+    filter_type = "WILDCARD"
+  }
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  tags = {
+    Name = "spellbot-ecr"
+  }
+}

package/src/lint/post-synth/fixtures/TF037/negative.tf

@@ -0,0 +1,27 @@
+# Vendored for TF037 (chant #2288) from https://github.com/aws-samples/sample-scribe-ai
+# Path: iac/ecr.tf
+# Commit: 384cb260f7e57797bc7275b72db5b2b262eee858
+# Licence: MIT-0, https://github.com/aws-samples/sample-scribe-ai/blob/384cb260f7e57797bc7275b72db5b2b262eee858/LICENSE
+# The whole file, unmodified.
+#
+# TF037: silent. Both repositories set image_tag_mutability = "IMMUTABLE".
+
+resource "aws_ecr_repository" "main" {
+  name                 = var.name
+  image_tag_mutability = "IMMUTABLE"
+  force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}
+
+resource "aws_ecr_repository" "lambda" {
+  name                 = "${var.name}-events"
+  image_tag_mutability = "IMMUTABLE"
+  force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}

package/src/lint/post-synth/fixtures/TF037/not-determined.tf

@@ -0,0 +1,27 @@
+# Vendored for TF037 (chant #2288) from https://github.com/turnerlabs/terraform-ecs-fargate
+# Path: base/ecr.tf
+# Commit: e51d5f3bafdaa7cb29527da979a006d0b7bb1dfb
+# Licence: Apache-2.0, https://github.com/turnerlabs/terraform-ecs-fargate/blob/e51d5f3bafdaa7cb29527da979a006d0b7bb1dfb/LICENSE
+# Excerpt: lines 1-18, unmodified.
+#
+# TF037: one info, Not determined. image_tag_mutability = var.image_tag_mutability. The variable's default is
+# "IMMUTABLE", but a caller can override it, and TF037 does not evaluate variables.
+
+/*
+ * ecr.tf
+ * Creates a Amazon Elastic Container Registry (ECR) for the application
+ * https://aws.amazon.com/ecr/
+ */
+
+# The tag mutability setting for the repository (defaults to IMMUTABLE)
+variable "image_tag_mutability" {
+  type        = string
+  default     = "IMMUTABLE"
+  description = "The tag mutability setting for the repository (defaults to IMMUTABLE)"
+}
+
+# create an ECR repo at the app/image level
+resource "aws_ecr_repository" "app" {
+  name                 = var.app
+  image_tag_mutability = var.image_tag_mutability
+}

package/src/lint/post-synth/fixtures/TF037/positive-absent.tf

@@ -0,0 +1,15 @@
+# Vendored for TF037 (chant #2288) from https://github.com/outerbounds/terraform-aws-metaflow
+# Path: ecr.tf
+# Commit: b56935a87aa623bf9c9d91efe22c54338dcef5a3
+# Licence: Apache-2.0, https://github.com/outerbounds/terraform-aws-metaflow/blob/b56935a87aa623bf9c9d91efe22c54338dcef5a3/LICENSE
+# The whole file, unmodified.
+#
+# TF037: one error. The repository does not set image_tag_mutability, and the provider default is MUTABLE.
+
+resource "aws_ecr_repository" "metaflow_batch_image" {
+  count = var.enable_custom_batch_container_registry ? 1 : 0
+
+  name = local.metaflow_batch_image_name
+
+  tags = var.tags
+}

package/src/lint/post-synth/fixtures/TF037/positive.tf

@@ -0,0 +1,26 @@
+# Vendored for TF037 (chant #2288) from https://github.com/bridgecrewio/terragoat
+# Path: terraform/aws/ecr.tf
+# Commit: 729f8da62c6a85ce4af5ad3d123de97776d954c4
+# Licence: Apache-2.0, https://github.com/bridgecrewio/terragoat/blob/729f8da62c6a85ce4af5ad3d123de97776d954c4/LICENSE
+# Excerpt: lines 1-18, unmodified.
+#
+# TF037: one error. image_tag_mutability = "MUTABLE".
+
+resource aws_ecr_repository "repository" {
+  name                 = "${local.resource_prefix.value}-repository"
+  image_tag_mutability = "MUTABLE"
+
+
+  tags = merge({
+    Name = "${local.resource_prefix.value}-repository"
+    }, {
+    git_commit           = "e6d83b21346fe85d4fe28b16c0b2f1e0662eb1d7"
+    git_file             = "terraform/aws/ecr.tf"
+    git_last_modified_at = "2023-04-27 12:47:51"
+    git_last_modified_by = "nadler@paloaltonetworks.com"
+    git_modifiers        = "nadler/nimrodkor"
+    git_org              = "bridgecrewio"
+    git_repo             = "terragoat"
+    yor_trace            = "7a3ec657-fa54-4aa2-8467-5d08d6c90bc2"
+  })
+}