@intentius/chant-lexicon-terraform 0.100.0 → 0.102.0

package/dist/rules/tf030.ts

@@ -0,0 +1,290 @@
+/**
+ * TF030: a security group rule opens a sensitive port to the whole internet.
+ *
+ * The native Terraform counterpart of the aws lexicon's WAW019 (#2285, under
+ * #2284), with the same port list and the same two open CIDRs. It cannot be a
+ * bridge to WAW019: the probe (docs/design/waw-hcl-fidelity-probe.md) ran the
+ * shipped WAW019 over a root opening 22, 3389, 3306 and 5432 to the world and
+ * got nothing back, because none of the three Terraform shapes looks like
+ * CloudFormation's `SecurityGroupIngress[].CidrIp`:
+ *
+ * - `ingress` on `aws_security_group`. The AWS provider types it as an
+ *   attribute, `set(object({...}))`, not a nested block, though HCL lets it
+ *   be written either way. hcl2json renders both spellings as one array of
+ *   rule objects, so one reader covers both. `cidr_blocks` and
+ *   `ipv6_cidr_blocks` are lists where CloudFormation has a scalar.
+ * - `aws_security_group_rule`, which is ingress only when `type = "ingress"`.
+ * - `aws_vpc_security_group_ingress_rule`, which spells the CIDR as the
+ *   scalars `cidr_ipv4` / `cidr_ipv6` and the protocol as `ip_protocol`.
+ *
+ * A rule is reported when three things are all proved by literals: it is
+ * ingress, a CIDR is `0.0.0.0/0` or `::/0`, and its ports reach a sensitive
+ * port. Protocol `-1` (or `"all"`) reaches every port whatever `from_port` and
+ * `to_port` say. `tcp`, `udp`, `6` and `17` reach the ports between
+ * `from_port` and `to_port` inclusive, so `0`-`65535` reaches all four.
+ * Anything else (`icmp`, `icmpv6`, a protocol number like `50`) has no ports
+ * and is never reported.
+ *
+ * Nothing here evaluates an expression. When the answer hangs on a value the
+ * parse hands back as a reference or a template (`cidr_blocks =
+ * var.allowed`, `from_port = var.ssh_port`, `ingress = local.rules`, a
+ * `dynamic "ingress"` block), the rule emits one `info` finding that starts
+ * `Not determined:` and names the attributes, per the convention fixed on
+ * #2284. It never guesses a warning or an error out of something it could
+ * not read. A fact that settles the rule on its own still settles it, so
+ * `cidr_blocks = var.x` on port 443 is silent: no CIDR makes 443 sensitive.
+ *
+ * Absence is safe for this rule, which is the easy case of #2284's
+ * three-valued question. An `aws_security_group` with no `ingress` admits
+ * nothing (the provider default is no rules), and its rules may live in
+ * standalone resources, which this check reads in their own right.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { RESOURCE_TYPE, type BlockBody } from "../../hcl/parse";
+import { attr } from "../../hcl/value";
+import { blocksOfType, nestedBodies, type TerraformBlock } from "./blocks";
+
+/** The ports WAW019 treats as sensitive, with the name a message gives each. */
+export const SENSITIVE_PORTS: ReadonlyMap<number, string> = new Map([
+  [22, "SSH"],
+  [3389, "RDP"],
+  [3306, "MySQL"],
+  [5432, "PostgreSQL"],
+]);
+
+/** The two CIDRs that mean "every address". */
+export const OPEN_CIDRS: ReadonlySet<string> = new Set(["0.0.0.0/0", "::/0"]);
+
+/** Protocols whose rules carry a port range. */
+const PORTED_PROTOCOLS = new Set(["tcp", "udp", "6", "17"]);
+/** Protocols that mean every protocol and therefore every port. */
+const ALL_PROTOCOLS = new Set(["-1", "all"]);
+
+/**
+ * A three-valued answer. `unknown` carries the sentence fragments that say
+ * which attribute could not be read and what it holds.
+ */
+type Answer<T> = { state: "yes"; value: T } | { state: "no" } | { state: "unknown"; why: string[] };
+
+const NO = { state: "no" } as const;
+
+/**
+ * An expression as its author wrote it. hcl2json wraps a bare reference in
+ * `${...}` (`var.x` arrives as `"${var.x}"`), so a message quoting the raw
+ * value would show a spelling that is not in the file.
+ */
+function shown(raw: unknown): string {
+  const s = typeof raw === "string" ? raw : JSON.stringify(raw);
+  const whole = /^\$\{([\s\S]*)\}$/.exec(s);
+  return whole && !whole[1].includes("${") ? whole[1].trim() : s;
+}
+
+function unknown(name: string, raw: unknown): { state: "unknown"; why: string[] } {
+  return { state: "unknown", why: [`\`${name}\` is \`${shown(raw)}\``] };
+}
+
+/** Does a string carry an interpolation, i.e. is it something the parse did not evaluate? */
+function isExpression(value: string): boolean {
+  return value.includes("${");
+}
+
+/**
+ * Which open CIDR, if any, a rule admits. List attributes (`cidr_blocks`,
+ * `ipv6_cidr_blocks`) and scalar ones (`cidr_ipv4`, `cidr_ipv6`) both pass
+ * through here: a scalar literal is read as a one-element list.
+ */
+function openCidr(body: BlockBody, names: readonly string[]): Answer<string> {
+  const why: string[] = [];
+  for (const name of names) {
+    const a = attr(body, name);
+    if (a.kind === "absent") continue;
+    if (a.kind !== "literal") {
+      why.push(...unknown(name, a.raw).why);
+      continue;
+    }
+    const items = Array.isArray(a.value) ? a.value : [a.value];
+    for (const item of items) {
+      if (typeof item !== "string") continue;
+      if (OPEN_CIDRS.has(item.trim())) return { state: "yes", value: item.trim() };
+      if (isExpression(item)) why.push(`an element of \`${name}\` is \`${shown(item)}\``);
+    }
+  }
+  return why.length > 0 ? { state: "unknown", why } : NO;
+}
+
+/** A literal port: a number, or a numeric string, which hcl2json passes through when the source quotes it. */
+function literalPort(body: BlockBody, name: string): Answer<number> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { state: "unknown", why: [`\`${name}\` is not set`] };
+  if (a.kind !== "literal") return unknown(name, a.raw);
+  const n = typeof a.value === "number" ? a.value : typeof a.value === "string" ? Number(a.value.trim()) : NaN;
+  return Number.isInteger(n) ? { state: "yes", value: n } : unknown(name, a.raw);
+}
+
+/** What a rule's ports reach: every port, a closed range, or nothing port-shaped. */
+interface Reach {
+  /** `null` for protocol `-1`/`all`, which reaches every port whatever the range says. */
+  range: [number, number] | null;
+  /** The sensitive ports inside the reach, in list order. */
+  ports: number[];
+}
+
+function sensitiveReach(body: BlockBody, protocolName: string): Answer<Reach> {
+  const p = attr(body, protocolName);
+  let protocol = "tcp"; // the provider requires a protocol; a body without one is read as port-scoped
+  if (p.kind === "reference" || p.kind === "template") return unknown(protocolName, p.raw);
+  if (p.kind === "literal") protocol = String(p.value).trim().toLowerCase();
+
+  if (ALL_PROTOCOLS.has(protocol)) return { state: "yes", value: { range: null, ports: [...SENSITIVE_PORTS.keys()] } };
+  if (!PORTED_PROTOCOLS.has(protocol)) return NO;
+
+  const from = literalPort(body, "from_port");
+  const to = literalPort(body, "to_port");
+  if (from.state !== "yes" || to.state !== "yes") {
+    const why = [...(from.state === "unknown" ? from.why : []), ...(to.state === "unknown" ? to.why : [])];
+    return { state: "unknown", why };
+  }
+  const ports = [...SENSITIVE_PORTS.keys()].sort((a, b) => a - b).filter((port) => from.value <= port && port <= to.value);
+  return ports.length > 0 ? { state: "yes", value: { range: [from.value, to.value], ports } } : NO;
+}
+
+/** Is a standalone `aws_security_group_rule` an ingress rule? */
+function isIngress(body: BlockBody): Answer<true> {
+  const t = attr(body, "type");
+  if (t.kind === "absent") return NO;
+  if (t.kind !== "literal") return unknown("type", t.raw);
+  return String(t.value).trim().toLowerCase() === "ingress" ? { state: "yes", value: true } : NO;
+}
+
+/** The outcome for one ingress rule, from its three facts. */
+type Verdict =
+  | { state: "open"; cidr: string; reach: Reach }
+  | { state: "closed" }
+  | { state: "unknown"; why: string[] };
+
+function judge(ingress: Answer<true>, cidr: Answer<string>, reach: Answer<Reach>): Verdict {
+  // One proved "no" settles it: whatever the unread values hold, this rule
+  // cannot open a sensitive port to the world.
+  if (ingress.state === "no" || cidr.state === "no" || reach.state === "no") return { state: "closed" };
+  const why = [ingress, cidr, reach].flatMap((a) => (a.state === "unknown" ? a.why : []));
+  if (why.length > 0) return { state: "unknown", why };
+  if (cidr.state !== "yes" || reach.state !== "yes") return { state: "closed" }; // unreachable; narrows the types
+  return { state: "open", cidr: cidr.value, reach: reach.value };
+}
+
+const INGRESS: Answer<true> = { state: "yes", value: true };
+
+/** An inline rule of an `aws_security_group` (block or attribute syntax, same shape after the parse). */
+function judgeInline(rule: BlockBody): Verdict {
+  return judge(INGRESS, openCidr(rule, ["cidr_blocks", "ipv6_cidr_blocks"]), sensitiveReach(rule, "protocol"));
+}
+
+/** "a, b and c" */
+function listed(items: string[]): string {
+  return items.length <= 1 ? items.join("") : `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
+
+function describeReach(reach: Reach): string {
+  if (reach.range === null) return "every port (protocol -1), SSH, RDP, MySQL and PostgreSQL among them";
+  const [from, to] = reach.range;
+  if (from === to) return `port ${from} (${SENSITIVE_PORTS.get(from)})`;
+  return `ports ${from}-${to}, which include ${listed(reach.ports.map((p) => `${SENSITIVE_PORTS.get(p)} (${p})`))}`;
+}
+
+export const tf030: PostSynthCheck = {
+  id: "TF030",
+  description: "Security group rule allows unrestricted ingress on a sensitive port",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    const report = (block: TerraformBlock, where: string, verdict: Verdict): void => {
+      const subject = where === "" ? `"${block.address}"` : `"${block.address}" ${where}`;
+      if (verdict.state === "open") {
+        diagnostics.push({
+          checkId: "TF030",
+          severity: "error",
+          message:
+            `${subject} allows ingress from ${verdict.cidr} on ${describeReach(verdict.reach)}. ` +
+            "Anyone on the internet can reach it. Restrict the CIDR to the sources that need it, or " +
+            "reach the host through a bastion, a VPN or SSM Session Manager instead.",
+          entity: block.key,
+          lexicon: "terraform",
+        });
+      } else if (verdict.state === "unknown") {
+        diagnostics.push({
+          checkId: "TF030",
+          severity: "info",
+          message:
+            `Not determined: ${subject}: ${verdict.why.join("; ")}. TF030 does not evaluate expressions, ` +
+            "so it cannot tell whether this rule opens SSH, RDP, MySQL or PostgreSQL to 0.0.0.0/0 or ::/0. " +
+            "Check the value the expression resolves to.",
+          entity: block.key,
+          lexicon: "terraform",
+        });
+      }
+    };
+
+    for (const block of blocksOfType(ctx, RESOURCE_TYPE)) {
+      const type = block.address.slice(0, block.address.indexOf("."));
+
+      if (type === "aws_security_group") {
+        const ingress = attr(block.body, "ingress");
+        if (ingress.kind === "reference" || ingress.kind === "template") {
+          report(block, "", { state: "unknown", why: unknown("ingress", ingress.raw).why });
+        } else if (ingress.kind === "literal") {
+          const rules = Array.isArray(ingress.value) ? ingress.value : [ingress.value];
+          rules.forEach((rule, i) => {
+            const where = `ingress rule ${i + 1}`;
+            if (typeof rule === "object" && rule !== null && !Array.isArray(rule)) {
+              report(block, where, judgeInline(rule as BlockBody));
+            } else {
+              report(block, where, unknown(`ingress[${i}]`, rule));
+            }
+          });
+        }
+        // A `dynamic "ingress"` block's rules come from its for_each, which is
+        // not evaluated. Its content still settles the case where no element
+        // could be open (a private CIDR literal, a non-sensitive port).
+        for (const dyn of nestedBodies(block.body, "dynamic")) {
+          for (const generator of nestedBodies(dyn, "ingress")) {
+            for (const content of nestedBodies(generator, "content")) {
+              const verdict = judgeInline(content);
+              if (verdict.state === "closed") continue;
+              const why = verdict.state === "unknown" ? verdict.why : [];
+              report(block, 'dynamic "ingress"', {
+                state: "unknown",
+                why: [`its rules come from \`for_each = ${shown(generator.for_each)}\``, ...why],
+              });
+            }
+          }
+        }
+        // No `ingress` at all: the group admits nothing. Absence is safe here.
+        continue;
+      }
+
+      if (type === "aws_security_group_rule") {
+        report(
+          block,
+          "",
+          judge(isIngress(block.body), openCidr(block.body, ["cidr_blocks", "ipv6_cidr_blocks"]), sensitiveReach(block.body, "protocol")),
+        );
+        continue;
+      }
+
+      if (type === "aws_vpc_security_group_ingress_rule") {
+        report(block, "", judge(INGRESS, openCidr(block.body, ["cidr_ipv4", "cidr_ipv6"]), sensitiveReach(block.body, "ip_protocol")));
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/tf031.ts

@@ -0,0 +1,370 @@
+/**
+ * TF031: an IAM policy allows a wildcard Action or a wildcard Resource
+ * (chant #2286, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW020, written natively
+ * against the parsed HCL rather than bridged (docs/design/waw-hcl-fidelity-probe.md
+ * explains why a bridge reported nothing here). WAW020 flags `Action: "*"`
+ * only; this rule also flags `Resource: "*"`, as #2286 asks and as tfsec's
+ * `aws-iam-no-policy-wildcards` does.
+ *
+ * What it reads. A policy argument in Terraform is a string, and hcl2json
+ * hands it over unevaluated, so the rule reads three shapes and no others:
+ *
+ * - `jsonencode({...})`: hcl2json keeps the call as the one string
+ *   `"${jsonencode({...})}"` with HCL object syntax inside. `readJsonencode`
+ *   (`../../hcl/jsonencode.ts`) reads the literal parts of that argument as
+ *   structure, leaving each expression in it as an opaque leaf.
+ * - a literal string, which is what a heredoc with no interpolation becomes in
+ *   the parse: the JSON text itself, read with `JSON.parse`.
+ * - a `data "aws_iam_policy_document"` block, whose `statement { actions,
+ *   resources, effect }` arrive as plain structure. A policy argument that is
+ *   exactly `data.aws_iam_policy_document.<name>.json` (or `.minified_json`)
+ *   naming a document declared in the same module is not reported again: the
+ *   document is checked where it is declared.
+ *
+ * The three-valued answer. A finding needs a literal that proves it: an
+ * `Allow` statement (the data source's default effect, or a literal
+ * `"Allow"`) whose Action or Resource is the literal `"*"` or a list holding
+ * it. A `Deny` statement never fires; `Deny` with `Action = "*"` is the usual
+ * guard rail. When the value the rule needs is not readable (a reference, a
+ * `file()` or `templatefile()` call, a template, a for-expression, a
+ * `dynamic "statement"`), the rule emits one `info` diagnostic starting
+ * `Not determined:` that names the attribute and why, and never a warning.
+ * A value that cannot be `"*"` whatever it evaluates to is not "not
+ * determined": an attribute of a managed resource or data source
+ * (`aws_s3_bucket.logs.arn`) or a template whose literal text already
+ * differs from `*` (`"arn:aws:s3:::${var.bucket}/*"`) is read as scoped.
+ *
+ * Absence. A resource with no policy argument, or a role with no
+ * `inline_policy`, is unconfigured, not insecure, and is not reported.
+ *
+ * In scope: `aws_iam_policy.policy`, `aws_iam_role_policy.policy`,
+ * `aws_iam_user_policy.policy`, `aws_iam_group_policy.policy`,
+ * `aws_iam_role.inline_policy[].policy`, `aws_iam_role.assume_role_policy`
+ * (WAW020 walks `AssumeRolePolicyDocument` too) and the
+ * `aws_iam_policy_document` data source. Resource-based policies (S3, SQS,
+ * KMS, VPC endpoint) are out of scope: there `Resource: "*"` usually means
+ * "this resource" and the risk sits in `Principal`.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { DATA_TYPE, RESOURCE_TYPE, scopeOfKey, type BlockBody } from "../../hcl/parse";
+import { attr } from "../../hcl/value";
+import { hasUnknownKeys, isUnknown, readJsonencode } from "../../hcl/jsonencode";
+import { blocksOfType, nestedBodies, type TerraformBlock } from "./blocks";
+
+/** Resource type to the string-valued policy arguments it carries. */
+const POLICY_ARGUMENTS: Record<string, readonly string[]> = {
+  aws_iam_policy: ["policy"],
+  aws_iam_role_policy: ["policy"],
+  aws_iam_user_policy: ["policy"],
+  aws_iam_group_policy: ["policy"],
+  aws_iam_role: ["assume_role_policy"],
+};
+
+const POLICY_DOCUMENT = "aws_iam_policy_document";
+
+/** One readable value's answer to "is this `*`?". */
+type Star = { kind: "star" } | { kind: "no" } | { kind: "unknown"; reason: string };
+
+const NO: Star = { kind: "no" };
+const STAR: Star = { kind: "star" };
+
+/** A statement that proves a wildcard. */
+interface Hit {
+  /** 1-based statement position within its document. */
+  index: number;
+  sid?: string;
+  fields: string[];
+}
+
+/** What reading one document found. */
+interface DocumentRead {
+  hits: Hit[];
+  unknown: string[];
+}
+
+/** Expression roots that name an input or a computed value, not a managed object. */
+const VALUE_ROOTS = new Set(["var", "local", "module", "each", "count", "path", "terraform", "self"]);
+
+/** `aws_s3_bucket.logs.arn`, `data.aws_caller_identity.current.account_id`, with optional index or splat. */
+const OBJECT_ATTRIBUTE = /^(?:data\.)?([a-z][a-z0-9_]*)\.[A-Za-z_][\w-]*(?:\[[^\]]*\])?(?:\.[A-Za-z_][\w-]*|\[[^\]]*\])+$/;
+
+const SPANS = /[$%]\{(?:[^{}]|\{[^{}]*\})*\}/g;
+
+/**
+ * Whether an expression the rule cannot evaluate could still be `*`. A
+ * resource or data source attribute is a provider-computed ARN or id, never
+ * `*`; a template is `*` only if its literal text is nothing but `*`.
+ */
+function couldBeStar(expr: string): boolean {
+  const e = expr.trim();
+  if (e.startsWith('"') && e.endsWith('"') && e.length >= 2) return templateCouldBeStar(e.slice(1, -1));
+  const m = OBJECT_ATTRIBUTE.exec(e);
+  if (m && !VALUE_ROOTS.has(m[1])) return false;
+  return true;
+}
+
+function templateCouldBeStar(text: string): boolean {
+  return /^\**$/.test(text.replace(SPANS, ""));
+}
+
+/** One string from the hcl2json tree (a data source list element or effect). */
+function hclString(value: string, what: string): Star {
+  const a = attr({ v: value }, "v");
+  if (a.kind === "literal") return value === "*" ? STAR : NO;
+  if (a.kind === "reference") {
+    const expr = a.refs?.[0] ?? "";
+    return couldBeStar(expr) ? { kind: "unknown", reason: `${what} is an expression (${expr})` } : NO;
+  }
+  return templateCouldBeStar(value) ? { kind: "unknown", reason: `${what} is a template ("${value}")` } : NO;
+}
+
+/** Action or Resource in a policy JSON tree (from jsonencode or JSON.parse). */
+function jsonStar(value: unknown, field: string): Star {
+  if (value === "*") return STAR;
+  if (isUnknown(value)) {
+    return couldBeStar(value.source) ? { kind: "unknown", reason: `${field} is ${value.reason}` } : NO;
+  }
+  if (Array.isArray(value)) return anyStar(value.map((v) => jsonStar(v, field)));
+  return NO;
+}
+
+/** A list holds `*` if any element does; it is unknown if none does and one could. */
+function anyStar(items: Star[]): Star {
+  if (items.some((s) => s.kind === "star")) return STAR;
+  return items.find((s) => s.kind === "unknown") ?? NO;
+}
+
+type Effect = "allow" | "other" | { unknown: string };
+
+/** Read one statement's Effect, Action and Resource and add what it proves to `out`. */
+function judge(index: number, sid: string | undefined, effect: Effect, action: Star, resource: Star, out: DocumentRead): void {
+  if (effect === "other") return;
+  const fields: string[] = [];
+  if (action.kind === "star") fields.push("Action");
+  if (resource.kind === "star") fields.push("Resource");
+  if (effect !== "allow") {
+    if (fields.length > 0 || action.kind === "unknown" || resource.kind === "unknown") {
+      out.unknown.push(`statement ${index} Effect is ${effect.unknown}`);
+    }
+    return;
+  }
+  if (fields.length > 0) {
+    out.hits.push({ index, sid, fields });
+    return;
+  }
+  for (const s of [action, resource]) if (s.kind === "unknown") out.unknown.push(`statement ${index} ${s.reason}`);
+}
+
+/** A policy document's statements, as JSON structure. */
+function readJsonDocument(doc: unknown, out: DocumentRead): void {
+  if (isUnknown(doc)) {
+    out.unknown.push(`the document is ${doc.reason}`);
+    return;
+  }
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return;
+  const record = doc as Record<string, unknown>;
+  const statement = record.Statement;
+  if (statement === undefined) {
+    if (hasUnknownKeys(record)) out.unknown.push("the document has a key that is an expression");
+    return;
+  }
+  if (isUnknown(statement)) {
+    out.unknown.push(`Statement is ${statement.reason}`);
+    return;
+  }
+  const list = Array.isArray(statement) ? statement : [statement];
+  list.forEach((stmt, i) => {
+    const index = i + 1;
+    if (isUnknown(stmt)) {
+      out.unknown.push(`statement ${index} is ${stmt.reason}`);
+      return;
+    }
+    if (typeof stmt !== "object" || stmt === null || Array.isArray(stmt)) return;
+    const s = stmt as Record<string, unknown>;
+    const missing = s.Effect === undefined || s.Action === undefined || s.Resource === undefined;
+    if (hasUnknownKeys(s) && missing) {
+      out.unknown.push(`statement ${index} has a key that is an expression`);
+    }
+    const effect: Effect = isUnknown(s.Effect)
+      ? { unknown: s.Effect.reason }
+      : s.Effect === "Allow"
+        ? "allow"
+        : "other";
+    const sid = typeof s.Sid === "string" && s.Sid !== "" ? s.Sid : undefined;
+    judge(index, sid, effect, jsonStar(s.Action, "Action"), jsonStar(s.Resource, "Resource"), out);
+  });
+}
+
+/** `actions`/`resources` of a policy-document statement block. */
+function hclListStar(body: BlockBody, name: string, field: string): Star {
+  const value = body[name];
+  if (value === undefined || value === null) return NO;
+  if (typeof value === "string") return hclString(value, `\`${name}\``);
+  if (Array.isArray(value)) {
+    return anyStar(value.map((v) => (typeof v === "string" ? hclString(v, `an element of \`${name}\``) : NO)));
+  }
+  return { kind: "unknown", reason: `\`${name}\` is not a list of strings (${field})` };
+}
+
+/** Read the `statement` blocks of a `data "aws_iam_policy_document"`. */
+function readPolicyDocumentBlock(body: BlockBody): DocumentRead {
+  const out: DocumentRead = { hits: [], unknown: [] };
+  nestedBodies(body, "statement").forEach((stmt, i) => {
+    const index = i + 1;
+    const e = attr(stmt, "effect");
+    // `effect` defaults to "Allow" in the provider schema, so absence allows.
+    const effect: Effect =
+      e.kind === "absent"
+        ? "allow"
+        : e.kind === "literal"
+          ? e.value === "Allow"
+            ? "allow"
+            : "other"
+          : { unknown: `an expression (${e.refs?.join(", ") ?? ""})` };
+    const sid = typeof stmt.sid === "string" && attr(stmt, "sid").kind === "literal" && stmt.sid !== "" ? stmt.sid : undefined;
+    judge(index, sid, effect, hclListStar(stmt, "actions", "Action"), hclListStar(stmt, "resources", "Resource"), out);
+  });
+  for (const dyn of nestedBodies(body, "dynamic")) {
+    if (dyn.statement !== undefined && out.hits.length === 0) {
+      out.unknown.push('a `dynamic "statement"` block generates statements from an expression');
+    }
+  }
+  return out;
+}
+
+/** The `data.aws_iam_policy_document.<name>` a policy argument names, when it is exactly its `.json`. */
+const DOCUMENT_JSON = /^data\.aws_iam_policy_document\.([A-Za-z_][\w-]*)\.(?:json|minified_json)$/;
+
+/** Read one string-valued policy argument. `null` when there is nothing to report on (absent, or checked elsewhere). */
+function readPolicyArgument(
+  body: BlockBody,
+  name: string,
+  documentDeclared: (docName: string) => boolean,
+): DocumentRead | null {
+  const a = attr(body, name);
+  if (a.kind === "absent") return null;
+  const out: DocumentRead = { hits: [], unknown: [] };
+
+  const encoded = readJsonencode(a.raw, { unknownLeaves: true });
+  if (encoded.kind === "literal") {
+    readJsonDocument(encoded.value, out);
+    return out;
+  }
+  if (encoded.kind === "not-determined") {
+    out.unknown.push(`it is a jsonencode() call whose argument holds ${encoded.reason}`);
+    return out;
+  }
+
+  if (a.kind === "reference") {
+    const expr = a.refs?.[0] ?? "";
+    const doc = DOCUMENT_JSON.exec(expr);
+    if (doc && documentDeclared(doc[1])) return null;
+    const call = /^([a-z_]+)\s*\(/.exec(expr);
+    out.unknown.push(
+      call
+        ? `it is a ${call[1]}() call, which TF031 does not evaluate`
+        : `it is a reference (${expr}) to a value TF031 cannot read here`,
+    );
+    return out;
+  }
+  if (a.kind === "template") {
+    out.unknown.push("it is a template string with interpolations");
+    return out;
+  }
+  if (typeof a.value !== "string") return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(a.value);
+  } catch {
+    out.unknown.push("it is a literal string that does not parse as JSON (a heredoc with template directives, or not a policy)");
+    return out;
+  }
+  readJsonDocument(parsed, out);
+  return out;
+}
+
+function describeHits(hits: Hit[]): string {
+  return hits
+    .map((h) => {
+      const label = h.sid ? `statement ${h.index} (Sid "${h.sid}")` : `statement ${h.index}`;
+      return `${label} allows ${h.fields.map((f) => `${f} "*"`).join(" and ")}`;
+    })
+    .join("; ");
+}
+
+function report(block: TerraformBlock, where: string, read: DocumentRead, diagnostics: PostSynthDiagnostic[]): void {
+  if (read.hits.length > 0) {
+    diagnostics.push({
+      checkId: "TF031",
+      severity: "warning",
+      message:
+        `"${block.address}" ${where}: ${describeHits(read.hits)}. Action "*" grants every AWS action and ` +
+        'Resource "*" reaches every resource in the account, including ones created later. Name the actions ' +
+        "the workload calls and the ARNs it touches. A few actions (ecr:GetAuthorizationToken, " +
+        'sts:GetCallerIdentity) accept only Resource "*"; keep such a statement with a ' +
+        "`# chant-ignore-block: TF031` above the block.",
+      entity: block.key,
+      lexicon: "terraform",
+    });
+    return;
+  }
+  if (read.unknown.length > 0) {
+    const more = read.unknown.length > 1 ? ` (and ${read.unknown.length - 1} more)` : "";
+    diagnostics.push({
+      checkId: "TF031",
+      severity: "info",
+      message:
+        `Not determined: "${block.address}" ${where}: ${read.unknown[0]}${more}. TF031 reads only literal ` +
+        "policy structure and does not evaluate expressions, so it cannot tell whether this policy allows " +
+        'Action "*" or Resource "*".',
+      entity: block.key,
+      lexicon: "terraform",
+    });
+  }
+}
+
+export const tf031: PostSynthCheck = {
+  id: "TF031",
+  description: "IAM policy allows a wildcard Action or Resource",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const documents = blocksOfType(ctx, DATA_TYPE).filter((b) => b.address.startsWith(`data.${POLICY_DOCUMENT}.`));
+    const declared = new Set(documents.map((b) => `${scopeOfKey(b.key)}/${b.address}`));
+
+    for (const block of blocksOfType(ctx, RESOURCE_TYPE)) {
+      const type = block.address.slice(0, block.address.indexOf("."));
+      const names = POLICY_ARGUMENTS[type];
+      if (!names) continue;
+      const scope = scopeOfKey(block.key);
+      const documentDeclared = (name: string): boolean => declared.has(`${scope}/data.${POLICY_DOCUMENT}.${name}`);
+
+      for (const name of names) {
+        const read = readPolicyArgument(block.body, name, documentDeclared);
+        if (read) report(block, `\`${name}\``, read, diagnostics);
+      }
+      if (type === "aws_iam_role") {
+        nestedBodies(block.body, "inline_policy").forEach((inline, i) => {
+          const read = readPolicyArgument(inline, "policy", documentDeclared);
+          if (read) report(block, `\`inline_policy[${i}].policy\``, read, diagnostics);
+        });
+      }
+    }
+
+    for (const block of documents) {
+      report(block, "`statement`", readPolicyDocumentBlock(block.body), diagnostics);
+    }
+
+    return diagnostics;
+  },
+};