@intentius/chant-lexicon-terraform 0.100.0 → 0.102.0

package/src/lint/post-synth/fixtures/estate-2284/clean/main.tf

@@ -0,0 +1,132 @@
+# Epic #2284 acceptance estate, clean root. Written for chant, not vendored.
+# The same estate as ../violating with every finding fixed, and with the
+# provider-default cases left as real estates leave them: an SQS queue that
+# sets no encryption attribute (encrypted by AWS's SSE-SQS default), an EBS
+# volume that leaves `encrypted` unset but depends on an enabled
+# `aws_ebs_encryption_by_default`, an SNS topic on the AWS managed key, and an
+# ECR repository that keeps `latest` mutable through an exclusion filter.
+# TF030 to TF037 report nothing here (src/lint/post-synth/estate-2284.test.ts).
+
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "acme-terraform-state"
+    key    = "payments/terraform.tfstate"
+    region = "eu-west-1"
+  }
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "eu-west-1"
+}
+
+# TF030: HTTPS from anywhere, SSH from the VPC only.
+resource "aws_security_group" "web" {
+  name   = "web"
+  vpc_id = "vpc-0a1b2c3d4e5f60718"
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["10.0.0.0/8"]
+  }
+}
+
+# TF031: named actions on named resources.
+data "aws_iam_policy_document" "deployer" {
+  statement {
+    actions   = ["ecs:UpdateService", "ecs:DescribeServices"]
+    resources = [aws_ecs_task_definition.api.arn]
+  }
+}
+
+resource "aws_iam_policy" "deployer" {
+  name   = "deployer"
+  policy = data.aws_iam_policy_document.deployer.json
+}
+
+# TF032: the password comes from Secrets Manager.
+resource "aws_ecs_task_definition" "api" {
+  family                   = "payments-api"
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+  cpu                      = "512"
+  memory                   = "1024"
+
+  container_definitions = jsonencode([{
+    name  = "api"
+    image = "public.ecr.aws/acme/payments-api:1.4.2"
+    environment = [
+      { name = "LOG_LEVEL", value = "info" }
+    ]
+    secrets = [
+      { name = "DB_PASSWORD", valueFrom = "arn:aws:secretsmanager:eu-west-1:111122223333:secret:ledger-db" }
+    ]
+  }])
+}
+
+# TF033: encrypted storage.
+resource "aws_db_instance" "ledger" {
+  identifier          = "ledger"
+  engine              = "postgres"
+  instance_class      = "db.t4g.medium"
+  allocated_storage   = 50
+  username            = "ledger"
+  password            = var.db_password
+  storage_encrypted   = true
+  skip_final_snapshot = true
+}
+
+variable "db_password" {
+  type      = string
+  sensitive = true
+}
+
+# TF034: the AWS managed key.
+resource "aws_sns_topic" "alerts" {
+  name              = "payments-alerts"
+  kms_master_key_id = "alias/aws/sns"
+}
+
+# TF035: provider default. No encryption attribute; SQS encrypts new queues
+# with SSE-SQS.
+resource "aws_sqs_queue" "settlements" {
+  name = "settlements"
+}
+
+# TF036: provider default. `encrypted` unset, the Region's encryption by
+# default turned on first.
+resource "aws_ebs_encryption_by_default" "on" {}
+
+resource "aws_ebs_volume" "scratch" {
+  availability_zone = "eu-west-1a"
+  size              = 100
+  depends_on        = [aws_ebs_encryption_by_default.on]
+}
+
+# TF037: immutable tags, with `latest` as the one written-down exception.
+resource "aws_ecr_repository" "api" {
+  name                 = "payments-api"
+  image_tag_mutability = "IMMUTABLE_WITH_EXCLUSION"
+
+  image_tag_mutability_exclusion_filter {
+    filter      = "latest"
+    filter_type = "WILDCARD"
+  }
+}

package/src/lint/post-synth/fixtures/estate-2284/violating/main.tf

@@ -0,0 +1,112 @@
+# Epic #2284 acceptance estate, violating root. Written for chant, not
+# vendored: the fidelity probe's fixtures (docs/design/waw-hcl-fidelity-probe.md)
+# were never committed, so this root carries one violation per rule, TF030 to
+# TF037, each written the way a real estate writes it. `chant audit` over this
+# directory reports every one of them (src/lint/post-synth/estate-2284.test.ts).
+
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "acme-terraform-state"
+    key    = "payments/terraform.tfstate"
+    region = "eu-west-1"
+  }
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "eu-west-1"
+}
+
+# TF030: SSH open to the world.
+resource "aws_security_group" "bastion" {
+  name   = "bastion"
+  vpc_id = "vpc-0a1b2c3d4e5f60718"
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+# TF031: an admin policy.
+resource "aws_iam_policy" "deployer" {
+  name = "deployer"
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = "*"
+        Resource = "*"
+      },
+    ]
+  })
+}
+
+# TF032: a database password in a container's environment.
+resource "aws_ecs_task_definition" "api" {
+  family                   = "payments-api"
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+  cpu                      = "512"
+  memory                   = "1024"
+
+  container_definitions = jsonencode([{
+    name  = "api"
+    image = "public.ecr.aws/acme/payments-api:1.4.2"
+    environment = [
+      { name = "LOG_LEVEL", value = "info" },
+      { name = "DB_PASSWORD", value = "Pm-Pr0d-Db-2026!" }
+    ]
+  }])
+}
+
+# TF033: storage encryption written off.
+resource "aws_db_instance" "ledger" {
+  identifier          = "ledger"
+  engine              = "postgres"
+  instance_class      = "db.t4g.medium"
+  allocated_storage   = 50
+  username            = "ledger"
+  password            = var.db_password
+  storage_encrypted   = false
+  skip_final_snapshot = true
+}
+
+variable "db_password" {
+  type      = string
+  sensitive = true
+}
+
+# TF034: a topic that names no key.
+resource "aws_sns_topic" "alerts" {
+  name = "payments-alerts"
+}
+
+# TF035: SSE-SQS turned off.
+resource "aws_sqs_queue" "settlements" {
+  name                    = "settlements"
+  sqs_managed_sse_enabled = false
+}
+
+# TF036: a volume that asks not to be encrypted.
+resource "aws_ebs_volume" "scratch" {
+  availability_zone = "eu-west-1a"
+  size              = 100
+  encrypted         = false
+}
+
+# TF037: a repository left at the provider default, MUTABLE.
+resource "aws_ecr_repository" "api" {
+  name = "payments-api"
+}

package/src/lint/post-synth/flat-attributes.ts

@@ -0,0 +1,146 @@
+/**
+ * Shared reading helpers for TF033-TF037, the five flat encryption and
+ * immutability rules (chant #2288, epic #2284).
+ *
+ * Each of those rules reads one or two scalar attributes of one resource type
+ * and answers a three-valued question: the literal proves the resource
+ * secure, the literal proves it insecure, or the parse cannot tell. This
+ * module is the reading half; each rule file holds its own answer for
+ * absence, because that answer differs per resource (see each rule's doc
+ * comment and its section of `docs/pages/lint-rules.mdx`). It exports no
+ * `PostSynthCheck`, so the generated barrel skips it.
+ */
+
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { RESOURCE_TYPE, type BlockBody } from "../../hcl/parse";
+import { attr } from "../../hcl/value";
+import { blocksOfType, nestedBodies, type TerraformBlock } from "./blocks";
+
+/** What one attribute read settles. `reason` says why a value could not be read. */
+export type Read<T> = { kind: "known"; value: T } | { kind: "absent" } | { kind: "unknown"; reason: string };
+
+/** Every `resource` block of one provider type (`aws_sqs_queue`), in entity order. */
+export function resourcesOfType(ctx: PostSynthContext, type: string): TerraformBlock[] {
+  return blocksOfType(ctx, RESOURCE_TYPE).filter((b) => b.address.startsWith(`${type}.`));
+}
+
+/** One expression, for a message: `var.encrypted`, or the template text. */
+function describe(name: string, raw: unknown, refs: string[] | undefined, kind: "reference" | "template"): string {
+  return kind === "reference"
+    ? `\`${name}\` is an expression (${refs?.[0] ?? String(raw)})`
+    : `\`${name}\` is a template string ("${String(raw)}")`;
+}
+
+/**
+ * A bool attribute. Terraform converts the strings `"true"` and `"false"` to
+ * bool, so those read as the bool they convert to. Any other literal (a
+ * number, a list) is a plan-time type error, not this rule's concern, and
+ * reads as unknown.
+ */
+export function readBool(body: BlockBody, name: string): Read<boolean> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "reference" || a.kind === "template") {
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, a.kind) };
+  }
+  if (typeof a.value === "boolean") return { kind: "known", value: a.value };
+  if (a.value === "true" || a.value === "false") return { kind: "known", value: a.value === "true" };
+  return { kind: "unknown", reason: `\`${name}\` is not a bool (${JSON.stringify(a.value)})` };
+}
+
+/** A string attribute, literal or not. */
+export function readString(body: BlockBody, name: string): Read<string> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "reference" || a.kind === "template") {
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, a.kind) };
+  }
+  if (typeof a.value === "string") return { kind: "known", value: a.value };
+  return { kind: "unknown", reason: `\`${name}\` is not a string (${JSON.stringify(a.value)})` };
+}
+
+/** Expression roots that name an input or a computed value, not a managed object. */
+const VALUE_ROOTS = new Set(["var", "local", "module", "each", "count", "path", "terraform", "self"]);
+
+/** `aws_kms_key.sns.arn`, `data.aws_kms_alias.sqs.target_key_arn`, with an optional index or splat. */
+const OBJECT_ATTRIBUTE = /^(?:data\.)?([a-z][a-z0-9_]*)\.[A-Za-z_][\w-]*(?:\[[^\]]*\])?(?:\.[A-Za-z_][\w-]*|\[[^\]]*\])+$/;
+
+/** Every `${...}` span in a template, as `attr()` finds them. */
+const SPANS = /\$\{(?:[^{}]|\{[^{}]*\})*\}/g;
+
+/**
+ * Whether a key-like argument (`kms_master_key_id`) is set to something.
+ *
+ * - absent, or `null`: `absent`.
+ * - a literal: `known`, with the string (`""` is a value, and a rule decides
+ *   what an empty key means).
+ * - an attribute of a managed resource or data source (`aws_kms_key.x.arn`):
+ *   `known` and non-empty. The provider computes a key's id or ARN; it is
+ *   never the empty string, so the key is set whatever its value turns out to
+ *   be.
+ * - a template with literal text (`"alias/${var.env}-sns"`): `known` and
+ *   non-empty, for the same reason.
+ * - anything else (`var.kms_key`, `local.key`, a conditional, a function
+ *   call): `unknown`. A variable can be `null` or `""`.
+ */
+export function readKeySet(body: BlockBody, name: string): Read<string> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "literal") {
+    return typeof a.value === "string"
+      ? { kind: "known", value: a.value }
+      : { kind: "unknown", reason: `\`${name}\` is not a string (${JSON.stringify(a.value)})` };
+  }
+  const raw = String(a.raw);
+  if (a.kind === "template") {
+    if (raw.replace(SPANS, "").length > 0) return { kind: "known", value: raw };
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, "template") };
+  }
+  const expr = (a.refs?.[0] ?? "").trim();
+  const m = OBJECT_ATTRIBUTE.exec(expr);
+  if (m && !VALUE_ROOTS.has(m[1])) return { kind: "known", value: raw };
+  return { kind: "unknown", reason: describe(name, a.raw, a.refs, "reference") };
+}
+
+/**
+ * Whether an argument that names a source (`snapshot_identifier`,
+ * `replicate_source_db`) or a nested block (`restore_to_point_in_time`) is
+ * given. The provider reads these with `GetOk`, so a literal `""` is the same
+ * as leaving the argument out; anything else, a reference included, is given.
+ */
+export function isGiven(body: BlockBody, name: string): boolean {
+  const a = attr(body, name);
+  if (a.kind === "absent") return false;
+  if (a.kind === "literal") {
+    if (a.value === "" || a.value === false) return false;
+    if (Array.isArray(a.value)) return a.value.length > 0;
+  }
+  return true;
+}
+
+/** The bodies of a nested block, re-exported for the rule files. */
+export { nestedBodies };
+
+/** A finding the literal proves. */
+export function finding(
+  checkId: string,
+  severity: "error" | "warning",
+  block: TerraformBlock,
+  message: string,
+): PostSynthDiagnostic {
+  return { checkId, severity, message: `"${block.address}" ${message}`, entity: block.key, lexicon: "terraform" };
+}
+
+/**
+ * The one `info` diagnostic a rule emits when it cannot read the value it
+ * needs. The message starts `Not determined:`, as #2284 fixed for TF030-TF037.
+ */
+export function notDetermined(checkId: string, block: TerraformBlock, reason: string, tail: string): PostSynthDiagnostic {
+  return {
+    checkId,
+    severity: "info",
+    message: `Not determined: "${block.address}" ${reason}. ${tail}`,
+    entity: block.key,
+    lexicon: "terraform",
+  };
+}

package/src/lint/post-synth/index.ts

@@ -28,6 +28,14 @@ import { tf026 } from "./tf026";
 import { tf027 } from "./tf027";
 import { tf028 } from "./tf028";
 import { tf029 } from "./tf029";
+import { tf030 } from "./tf030";
+import { tf031 } from "./tf031";
+import { tf032 } from "./tf032";
+import { tf033 } from "./tf033";
+import { tf034 } from "./tf034";
+import { tf035 } from "./tf035";
+import { tf036 } from "./tf036";
+import { tf037 } from "./tf037";
 
 export const postSynthChecks: PostSynthCheck[] = [
   tf001,
@@ -58,4 +66,12 @@ export const postSynthChecks: PostSynthCheck[] = [
   tf027,
   tf028,
   tf029,
+  tf030,
+  tf031,
+  tf032,
+  tf033,
+  tf034,
+  tf035,
+  tf036,
+  tf037,
 ];

package/src/lint/post-synth/tf030.test.ts

@@ -0,0 +1,219 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadFixture } from "./fixtures/load";
+import { tf030 } from "./tf030";
+
+async function run(name: string): Promise<PostSynthDiagnostic[]> {
+  return tf030.check(await loadFixture("TF030", name));
+}
+
+/** For the shapes no vendored fixture carries: parse one inline source. */
+async function runInline(source: string): Promise<PostSynthDiagnostic[]> {
+  const entities = await blocksToEntities([{ name: "main.tf", source }], "inline");
+  return tf030.check({ outputs: new Map(), entities } as unknown as PostSynthContext);
+}
+
+const errors = (d: PostSynthDiagnostic[]) => d.filter((x) => x.severity === "error");
+const infos = (d: PostSynthDiagnostic[]) => d.filter((x) => x.severity === "info");
+
+describe("TF030: unrestricted ingress on a sensitive port", () => {
+  describe("fires (vendored fixtures)", () => {
+    test("a nested ingress block opening SSH to 0.0.0.0/0, and not the 8080 rule beside it", async () => {
+      const d = await run("positive-mixed");
+      expect(d).toHaveLength(1);
+      expect(d[0].checkId).toBe("TF030");
+      expect(d[0].severity).toBe("error");
+      expect(d[0].entity).toBe("TF030/aws_security_group.jenkins_port");
+      expect(d[0].message).toContain('"aws_security_group.jenkins_port" ingress rule 2');
+      expect(d[0].message).toContain("0.0.0.0/0 on port 22 (SSH)");
+    });
+
+    test("a port range spanning sensitive ports, and not the 443 rule", async () => {
+      const d = await run("positive");
+      expect(d).toHaveLength(1);
+      expect(d[0].severity).toBe("error");
+      expect(d[0].message).toContain("ingress rule 2");
+      expect(d[0].message).toContain("ports 1025-65535, which include MySQL (3306), RDP (3389) and PostgreSQL (5432)");
+    });
+
+    test("standalone aws_security_group_rule and aws_vpc_security_group_ingress_rule", async () => {
+      const d = await run("positive-standalone");
+      expect(errors(d).map((x) => x.entity).sort()).toEqual([
+        "TF030/aws_security_group_rule.fail",
+        "TF030/aws_vpc_security_group_ingress_rule.fail",
+      ]);
+      expect(d).toHaveLength(2);
+    });
+
+    test("::/0 on IPv6, and protocol -1 in attribute syntax reaching every port", async () => {
+      const d = await run("positive-ipv6");
+      expect(d).toHaveLength(2);
+      const byEntity = new Map(d.map((x) => [x.entity, x]));
+      expect(byEntity.get("TF030/aws_security_group.fail-ipv6")?.message).toContain("from ::/0 on port 22");
+      expect(byEntity.get("TF030/aws_security_group.fail4")?.message).toContain("every port (protocol -1)");
+    });
+  });
+
+  describe("silent (vendored fixtures)", () => {
+    test("SSH open only to private ranges", async () => {
+      expect(await run("negative")).toEqual([]);
+    });
+
+    test("no ingress at all, ICMP from anywhere, SSH from a security group, open egress", async () => {
+      expect(await run("negative-rules")).toEqual([]);
+    });
+  });
+
+  describe("not determined (vendored fixtures)", () => {
+    test("cidr_blocks = var.allowed_ssh_cidrs on port 22 is an info, not an error", async () => {
+      const d = await run("not-determined");
+      expect(errors(d)).toEqual([]);
+      expect(infos(d)).toHaveLength(1);
+      expect(d[0].message).toMatch(/^Not determined: /);
+      expect(d[0].message).toContain("`cidr_blocks` is `var.allowed_ssh_cidrs`");
+    });
+
+    test("an open CIDR on from_port/to_port = var.ssh_port is an info naming both", async () => {
+      const d = await run("not-determined-port");
+      expect(d).toHaveLength(1);
+      expect(d[0].severity).toBe("info");
+      expect(d[0].message).toContain("`from_port` is `var.ssh_port`; `to_port` is `var.ssh_port`");
+    });
+
+    test("a standalone rule with a variable CIDR is an info; the open egress rule is silent", async () => {
+      const d = await run("not-determined-standalone");
+      expect(d).toHaveLength(1);
+      expect(d[0].severity).toBe("info");
+      expect(d[0].entity).toBe("TF030/aws_security_group_rule.allow_ssh_internal");
+      expect(d[0].message).toContain("an element of `cidr_blocks` is `var.cidr_vpc`");
+    });
+
+    test("a for_each over each.value is an info, even though its locals open SSH to the world", async () => {
+      const d = await run("not-determined-vpc-rule");
+      expect(d).toHaveLength(1);
+      expect(d[0].severity).toBe("info");
+      expect(d[0].message).toContain("`cidr_ipv4` is `each.value.cidr_ipv4`");
+      expect(d[0].message).toContain("`ip_protocol` is `each.value.ip_protocol`");
+    });
+  });
+
+  describe("edge cases (inline)", () => {
+    test("a known-safe fact settles the rule even beside an unreadable one", async () => {
+      const d = await runInline(`
+resource "aws_security_group_rule" "https" {
+  type        = "ingress"
+  from_port   = 443
+  to_port     = 443
+  protocol    = "tcp"
+  cidr_blocks = var.allowed
+}
+resource "aws_security_group_rule" "private" {
+  type        = "ingress"
+  from_port   = var.port
+  to_port     = var.port
+  protocol    = "tcp"
+  cidr_blocks = ["10.0.0.0/8"]
+}`);
+      expect(d).toEqual([]);
+    });
+
+    test("egress and an unknown type", async () => {
+      const d = await runInline(`
+resource "aws_security_group_rule" "out" {
+  type        = "egress"
+  from_port   = 22
+  to_port     = 22
+  protocol    = "tcp"
+  cidr_blocks = ["0.0.0.0/0"]
+}
+resource "aws_security_group_rule" "either" {
+  type        = var.direction
+  from_port   = 22
+  to_port     = 22
+  protocol    = "tcp"
+  cidr_blocks = ["0.0.0.0/0"]
+}`);
+      expect(d).toHaveLength(1);
+      expect(d[0].severity).toBe("info");
+      expect(d[0].message).toContain("`type` is `var.direction`");
+    });
+
+    test("protocol written as the number -1, a quoted port, and upper-case TCP", async () => {
+      const d = await runInline(`
+resource "aws_security_group" "a" {
+  ingress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = -1
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+  ingress {
+    from_port        = "5432"
+    to_port          = "5432"
+    protocol         = "TCP"
+    ipv6_cidr_blocks = ["::/0"]
+  }
+}`);
+      expect(errors(d)).toHaveLength(2);
+      expect(d[1].message).toContain("port 5432 (PostgreSQL)");
+    });
+
+    test("tcp 0-0 is port 0, not every port", async () => {
+      const d = await runInline(`
+resource "aws_security_group" "a" {
+  ingress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}`);
+      expect(d).toEqual([]);
+    });
+
+    test("ingress = var.rules and a dynamic ingress block are not determined", async () => {
+      const d = await runInline(`
+resource "aws_security_group" "whole" {
+  ingress = var.rules
+}
+resource "aws_security_group" "dyn" {
+  dynamic "ingress" {
+    for_each = var.ports
+    content {
+      from_port   = ingress.value
+      to_port     = ingress.value
+      protocol    = "tcp"
+      cidr_blocks = ["0.0.0.0/0"]
+    }
+  }
+}
+resource "aws_security_group" "dyn_private" {
+  dynamic "ingress" {
+    for_each = var.ports
+    content {
+      from_port   = ingress.value
+      to_port     = ingress.value
+      protocol    = "tcp"
+      cidr_blocks = ["10.0.0.0/8"]
+    }
+  }
+}`);
+      const byEntity = new Map(d.map((x) => [x.entity, x]));
+      expect([...byEntity.keys()].sort()).toEqual(["inline/aws_security_group.dyn", "inline/aws_security_group.whole"]);
+      expect(d.every((x) => x.severity === "info")).toBe(true);
+      expect(byEntity.get("inline/aws_security_group.whole")?.message).toContain("`ingress` is `var.rules`");
+      expect(byEntity.get("inline/aws_security_group.dyn")?.message).toContain("`for_each = var.ports`");
+    });
+
+    test("a vpc ingress rule with ip_protocol -1 and no ports", async () => {
+      const d = await runInline(`
+resource "aws_vpc_security_group_ingress_rule" "all" {
+  security_group_id = aws_security_group.x.id
+  ip_protocol       = "-1"
+  cidr_ipv6         = "::/0"
+}`);
+      expect(errors(d)).toHaveLength(1);
+    });
+  });
+});