@intentius/chant-lexicon-terraform 0.100.0 → 0.102.0

package/dist/rules/tf032.ts

@@ -0,0 +1,226 @@
+/**
+ * TF032: an ECS container definition passes a credential as a plaintext
+ * environment value.
+ *
+ * The Terraform counterpart of the aws lexicon's WAW046. A value under a
+ * container's `environment` is stored verbatim in the task definition: it is
+ * readable by anyone with `ecs:DescribeTaskDefinition`, it shows in the
+ * console, and it is in Terraform state and plan output. ECS has a field for
+ * exactly this, `secrets`, whose `valueFrom` is a Secrets Manager or SSM
+ * Parameter Store ARN that the agent resolves at task start. A credential
+ * belongs there.
+ *
+ * Why this is a native rule and not WAW046 through a bridge
+ * (docs/design/waw-hcl-fidelity-probe.md): `container_definitions` is a JSON
+ * string. In HCL it is almost always `jsonencode([...])`, which hcl2json hands
+ * back as the call's unevaluated source text, so the structure WAW046 reads
+ * does not exist in the parse until something reads that text.
+ * `../../hcl/jsonencode.ts` does, for literal structure only, and never
+ * evaluates anything.
+ *
+ * The three answers, per task definition:
+ *
+ * - Readable. `container_definitions` is `jsonencode([...])` whose list and
+ *   containers are literal, or a plain JSON string (a heredoc with no
+ *   interpolation is one). A reference or function call in a leaf
+ *   (`image = var.image`, `value = var.db_password`) does not stop the read:
+ *   that leaf is unknown and the literal fields beside it are still read. An
+ *   environment entry whose value is a reference is skipped, since a
+ *   reference is not a committed literal (TF007 and TF022 judge where the
+ *   referenced value comes from).
+ * - Violation. A readable environment entry whose `value` is a literal string
+ *   and is secret-shaped by `../secret-shape.ts`: a credential-looking name
+ *   with a literal of at least 8 characters that is not a placeholder, or a
+ *   value that is a credential on its own (a vendor key shape, a JWT, a PEM
+ *   key, a high-entropy token) whatever it is called.
+ * - Not determined. `container_definitions` is a reference
+ *   (`local.defs`, `data.template_file.x.rendered`), `file()`,
+ *   `templatefile()`, a heredoc or string with interpolation, a jsonencode
+ *   argument that is not a literal list (`jsonencode(concat(...))`,
+ *   `jsonencode(local.containers)`), or a container whose `environment` is an
+ *   expression (`environment = local.env`). One `info` diagnostic starting
+ *   `Not determined:` per task definition or container, never a warning.
+ *
+ * Absence: a container with no `environment` is not insecure, and a task
+ * definition with no `container_definitions` is not reported (the attribute
+ * is required, so that is a plan error, not this rule's finding). A name in
+ * `secrets` is never reported: `secrets` is not read at all.
+ *
+ * Findings never carry the value, only its length.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { RESOURCE_TYPE } from "../../hcl/parse";
+import { attr } from "../../hcl/value";
+import { isUnknown, readJsonencode } from "../../hcl/jsonencode";
+import { secretShapedAssignment } from "../secret-shape";
+import { blocksOfType, type TerraformBlock } from "./blocks";
+
+const TASK_DEFINITION = "aws_ecs_task_definition";
+
+/** The container definitions of one task definition, or why they cannot be read. */
+export type ContainerDefinitionsRead =
+  | { kind: "readable"; containers: unknown }
+  | { kind: "not-determined"; reason: string }
+  | { kind: "absent" };
+
+/**
+ * Read `container_definitions` as structure without evaluating anything.
+ * `jsonencode(...)` goes through the shared reader with unknown leaves; a
+ * plain string with no interpolation is JSON (a heredoc arrives as one);
+ * everything else is named in the not-determined reason.
+ */
+export function readContainerDefinitions(body: Record<string, unknown>): ContainerDefinitionsRead {
+  const raw = body.container_definitions;
+  if (raw === undefined || raw === null) return { kind: "absent" };
+
+  const encoded = readJsonencode(raw, { unknownLeaves: true });
+  if (encoded.kind === "literal") return { kind: "readable", containers: encoded.value };
+  if (encoded.kind === "not-determined") {
+    return { kind: "not-determined", reason: `its jsonencode argument holds ${encoded.reason}` };
+  }
+
+  if (typeof raw !== "string") return { kind: "not-determined", reason: "it is not a string" };
+  // attr() alone is not enough to call a string literal: its interpolation
+  // pattern tolerates one level of nested braces, so a deeper expression can
+  // read as `literal`. Any `${` at all means the parse did not hand us text.
+  if (!raw.includes("${")) {
+    try {
+      return { kind: "readable", containers: JSON.parse(raw) };
+    } catch {
+      return { kind: "not-determined", reason: "it is a string that is not valid JSON" };
+    }
+  }
+  return { kind: "not-determined", reason: describeExpression(raw) };
+}
+
+/** Name the expression an unreadable `container_definitions` holds, for the message. */
+function describeExpression(raw: string): string {
+  const a = attr({ v: raw }, "v");
+  if (a.kind === "reference" && a.refs?.[0] !== undefined) {
+    const expr = a.refs[0];
+    const call = /^([a-z_][a-z0-9_]*)\s*\(/i.exec(expr);
+    if (call) return `it is a call to ${call[1]}(), which this rule does not evaluate`;
+    return `it is the reference \`${expr}\`, whose value is not in this module's source`;
+  }
+  return "it is a string or heredoc with interpolation, which this rule does not evaluate";
+}
+
+/** A container's display name: its literal `name`, else its position. */
+function containerName(container: Record<string, unknown>, index: number): string {
+  return typeof container.name === "string" ? container.name : `#${index}`;
+}
+
+function notDetermined(block: TerraformBlock, what: string, reason: string): PostSynthDiagnostic {
+  return {
+    checkId: "TF032",
+    severity: "info",
+    message:
+      `Not determined: "${block.address}" ${what}: ${reason}. TF032 reads only literal structure, ` +
+      "so a plaintext credential in it can be neither found nor ruled out.",
+    entity: block.key,
+    lexicon: "terraform",
+  };
+}
+
+export function checkEcsPlaintextCredentials(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const block of blocksOfType(ctx, RESOURCE_TYPE)) {
+    if (!block.address.startsWith(`${TASK_DEFINITION}.`)) continue;
+
+    const read = readContainerDefinitions(block.body);
+    if (read.kind === "absent") continue;
+    if (read.kind === "not-determined") {
+      diagnostics.push(notDetermined(block, "`container_definitions`", read.reason));
+      continue;
+    }
+    // A literal that is not a list is not a valid container_definitions; the
+    // provider rejects it at plan, and there is no environment to read.
+    if (!Array.isArray(read.containers)) continue;
+
+    read.containers.forEach((container, index) => {
+      if (isUnknown(container)) {
+        diagnostics.push(
+          notDetermined(block, `container #${index} of \`container_definitions\``, `it is ${container.reason}`),
+        );
+        return;
+      }
+      if (typeof container !== "object" || container === null || Array.isArray(container)) return;
+      const c = container as Record<string, unknown>;
+      const name = containerName(c, index);
+
+      const env = c.environment;
+      if (env === undefined || env === null) return;
+      if (isUnknown(env)) {
+        diagnostics.push(notDetermined(block, `container "${name}" \`environment\``, `it is ${env.reason}`));
+        return;
+      }
+      if (!Array.isArray(env)) return;
+
+      const unreadable: string[] = [];
+      for (const entry of env) {
+        if (isUnknown(entry)) {
+          unreadable.push(entry.reason);
+          continue;
+        }
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+        const e = entry as Record<string, unknown>;
+        if (isUnknown(e.name)) {
+          // A computed variable name could be anything, so the entry is
+          // unreadable only when it also carries a literal value to judge.
+          if (typeof e.value === "string") unreadable.push(e.name.reason);
+          continue;
+        }
+        if (typeof e.name !== "string") continue;
+        // A reference value is the remediation's neighbour, not a literal:
+        // skipped. Numbers and booleans are not credentials.
+        if (typeof e.value !== "string") continue;
+
+        const shape = secretShapedAssignment(e.name, e.value);
+        if (!shape) continue;
+        const why =
+          shape.reason === "name"
+            ? "its name reads like a credential"
+            : "the value has the shape of a credential";
+        diagnostics.push({
+          checkId: "TF032",
+          severity: "error",
+          message:
+            `"${block.address}" container "${name}" passes "${e.name}" as a plaintext environment value ` +
+            `(${shape.length} characters, redacted here; ${why}). It is stored in the task definition, ` +
+            "visible to anyone who can describe it, and in state and plan output. Move it to the " +
+            "container's `secrets` with a `valueFrom` naming a Secrets Manager secret or SSM parameter, " +
+            "and rotate the committed value.",
+          entity: block.key,
+          lexicon: "terraform",
+        });
+      }
+
+      if (unreadable.length > 0) {
+        diagnostics.push(
+          notDetermined(
+            block,
+            `container "${name}" \`environment\``,
+            `${unreadable.length} entr${unreadable.length === 1 ? "y is" : "ies are"} not literal (${unreadable[0]})`,
+          ),
+        );
+      }
+    });
+  }
+
+  return diagnostics;
+}
+
+export const tf032: PostSynthCheck = {
+  id: "TF032",
+  description: "ECS container definition passes a credential as a plaintext environment value",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcsPlaintextCredentials(ctx);
+  },
+};

package/dist/rules/tf033.ts

@@ -0,0 +1,160 @@
+/**
+ * TF033: an RDS DB instance or cluster does not encrypt its storage
+ * (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW021, written natively.
+ * WAW021 reads a template chant synthesized, where `StorageEncrypted` absent
+ * means false. Reading somebody else's HCL, absence means different things
+ * for the two resources and for how the database is created, so each case is
+ * decided here against the provider schema and the AWS default.
+ *
+ * `aws_db_instance` (provider `internal/service/rds/instance.go`, v6.67.0):
+ * `storage_encrypted` is optional, not computed, and the docs say "The
+ * default is `false` if not specified". The plain create path and `s3_import`
+ * send `StorageEncrypted: d.Get("storage_encrypted")`, so absent means false
+ * and is reported. The replica (`replicate_source_db`), snapshot
+ * (`snapshot_identifier`) and point-in-time (`restore_to_point_in_time`)
+ * paths never send it: the new instance takes its encryption from the source
+ * (and a cross-region replica from `kms_key_id`). For those the rule cannot
+ * know, and says so, unless `storage_encrypted = true` is written down.
+ *
+ * `aws_rds_cluster` (`cluster.go`): `storage_encrypted` is optional and
+ * computed, sent only when set, and "Terraform will only perform drift
+ * detection if a configuration value is provided". Two engine families:
+ *
+ * - Aurora (`engine` `aurora-mysql`/`aurora-postgresql`, or absent, which
+ *   provider v5 defaulted to `aurora`). Since 2026-02-16 AWS encrypts every
+ *   new Aurora cluster at rest with an AWS-owned key whatever
+ *   `StorageEncrypted` says, and reports `StorageEncrypted: false` with
+ *   `StorageEncryptionType: sse-rds` for it. A cluster created before that
+ *   date with storage encryption off is unencrypted, and the configuration
+ *   does not say when its cluster was created. So an Aurora cluster with
+ *   `storage_encrypted` absent or `false` is not determined, not a finding.
+ *   `engine_mode = "serverless"` (Serverless v1) was always encrypted and
+ *   is not reported at all.
+ * - Multi-AZ DB clusters (`engine` `mysql`/`postgres`): the default is
+ *   `false` and nothing changed it, so absent or `false` is a finding,
+ *   unless the cluster is restored or replicated from a source
+ *   (`snapshot_identifier`, `restore_to_point_in_time`,
+ *   `replication_source_identifier`, `global_cluster_identifier`), which
+ *   again decides the encryption.
+ *
+ * Not checked: `aws_rds_cluster_instance` (its `storage_encrypted` is
+ * computed-only and never appears in a body), `aws_rds_global_cluster`, and
+ * whether the key is customer managed.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import type { BlockBody } from "../../hcl/parse";
+import type { TerraformBlock } from "./blocks";
+import { finding, isGiven, notDetermined, readBool, readString, resourcesOfType, type Read } from "./flat-attributes";
+
+const ID = "TF033";
+
+const NOT_DETERMINED_TAIL =
+  "TF033 does not evaluate expressions or read the source database, so it cannot tell whether this storage is encrypted.";
+
+/** The first source argument a body gives, if any. */
+function sourceOf(body: BlockBody, names: readonly string[]): string | undefined {
+  return names.find((n) => isGiven(body, n));
+}
+
+const INSTANCE_SOURCES = ["replicate_source_db", "snapshot_identifier", "restore_to_point_in_time"] as const;
+const CLUSTER_SOURCES = [
+  "snapshot_identifier",
+  "restore_to_point_in_time",
+  "replication_source_identifier",
+  "global_cluster_identifier",
+] as const;
+
+function unencrypted(block: TerraformBlock, encrypted: Read<boolean>, what: string): PostSynthDiagnostic {
+  const how =
+    encrypted.kind === "absent"
+      ? "does not set `storage_encrypted`, and the provider default is `false`"
+      : "sets `storage_encrypted = false`";
+  return finding(
+    ID,
+    "error",
+    block,
+    `${how}, so the ${what} stores its data unencrypted. Set \`storage_encrypted = true\` (and \`kms_key_id\` for a ` +
+      "customer managed key). Encryption cannot be turned on in place: an existing database is migrated by restoring " +
+      "an encrypted copy of a snapshot.",
+  );
+}
+
+function checkInstance(block: TerraformBlock): PostSynthDiagnostic | undefined {
+  const encrypted = readBool(block.body, "storage_encrypted");
+  if (encrypted.kind === "known" && encrypted.value) return undefined;
+  if (encrypted.kind === "unknown") return notDetermined(ID, block, encrypted.reason, NOT_DETERMINED_TAIL);
+  const source = sourceOf(block.body, INSTANCE_SOURCES);
+  if (source) {
+    return notDetermined(
+      ID,
+      block,
+      `is created from a source (\`${source}\`), and the provider does not send \`storage_encrypted\` on that path: ` +
+        "the instance takes its encryption from the source",
+      NOT_DETERMINED_TAIL,
+    );
+  }
+  return unencrypted(block, encrypted, "DB instance");
+}
+
+function checkCluster(block: TerraformBlock): PostSynthDiagnostic | undefined {
+  const encrypted = readBool(block.body, "storage_encrypted");
+  if (encrypted.kind === "known" && encrypted.value) return undefined;
+  if (encrypted.kind === "unknown") return notDetermined(ID, block, encrypted.reason, NOT_DETERMINED_TAIL);
+
+  const engine = readString(block.body, "engine");
+  if (engine.kind === "unknown") {
+    return notDetermined(
+      ID,
+      block,
+      `${engine.reason}, and whether an unset \`storage_encrypted\` means unencrypted depends on the engine`,
+      NOT_DETERMINED_TAIL,
+    );
+  }
+  const aurora = engine.kind === "absent" || engine.value.startsWith("aurora");
+  if (aurora) {
+    const mode = readString(block.body, "engine_mode");
+    if (mode.kind === "known" && mode.value === "serverless") return undefined;
+    const set = encrypted.kind === "absent" ? "does not set `storage_encrypted`" : "sets `storage_encrypted = false`";
+    return notDetermined(
+      ID,
+      block,
+      `is an Aurora cluster that ${set}. AWS encrypts every Aurora cluster created on or after 2026-02-16 with an ` +
+        "AWS-owned key whatever this says; one created earlier with storage encryption off is unencrypted, and the " +
+        "configuration does not say when the cluster was created",
+      "Set `storage_encrypted = true` to make the answer explicit.",
+    );
+  }
+  const source = sourceOf(block.body, CLUSTER_SOURCES);
+  if (source) {
+    return notDetermined(
+      ID,
+      block,
+      `is created from a source (\`${source}\`), which decides its encryption`,
+      NOT_DETERMINED_TAIL,
+    );
+  }
+  return unencrypted(block, encrypted, "Multi-AZ DB cluster");
+}
+
+export const tf033: PostSynthCheck = {
+  id: "TF033",
+  description: "RDS DB instance or cluster storage is not encrypted",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const block of resourcesOfType(ctx, "aws_db_instance")) {
+      const d = checkInstance(block);
+      if (d) out.push(d);
+    }
+    for (const block of resourcesOfType(ctx, "aws_rds_cluster")) {
+      const d = checkCluster(block);
+      if (d) out.push(d);
+    }
+    return out;
+  },
+};

package/dist/rules/tf034.ts

@@ -0,0 +1,63 @@
+/**
+ * TF034: an SNS topic has no server-side encryption (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW025, written natively.
+ *
+ * Absence is insecure for this resource, and the rule reports it.
+ * `aws_sns_topic.kms_master_key_id` (provider `internal/service/sns/topic.go`,
+ * v6.67.0) is optional with no default, and SNS has no service-owned
+ * encryption that applies when no key is named: server-side encryption
+ * (https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html)
+ * is on only when the topic names a KMS key, either the AWS managed
+ * `alias/aws/sns` or a customer managed key. Unlike SQS (TF035), no AWS
+ * default turns it on for new topics. A literal `kms_master_key_id = ""`
+ * names no key and is the same finding.
+ *
+ * Present and secure: a non-empty literal, an attribute of a managed resource
+ * or data source (`aws_kms_key.sns.arn`, `aws_kms_alias.sns.arn`), or a
+ * template with literal text. Not determined: a variable, local, module
+ * output, conditional or function call, any of which can be `null` or `""`.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { finding, notDetermined, readKeySet, resourcesOfType } from "./flat-attributes";
+
+const ID = "TF034";
+
+export const tf034: PostSynthCheck = {
+  id: "TF034",
+  description: "SNS topic has no server-side encryption",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const block of resourcesOfType(ctx, "aws_sns_topic")) {
+      const key = readKeySet(block.body, "kms_master_key_id");
+      if (key.kind === "known" && key.value !== "") continue;
+      if (key.kind === "unknown") {
+        out.push(
+          notDetermined(
+            ID,
+            block,
+            key.reason,
+            "TF034 does not evaluate expressions, so it cannot tell whether this names a KMS key or is null.",
+          ),
+        );
+        continue;
+      }
+      const how = key.kind === "absent" ? "does not set `kms_master_key_id`" : 'sets `kms_master_key_id = ""`';
+      out.push(
+        finding(
+          ID,
+          "warning",
+          block,
+          `${how}, so SNS stores its messages without server-side encryption; no AWS default encrypts a topic that ` +
+            'names no key. Set `kms_master_key_id` to a customer managed key, or to `"alias/aws/sns"` for the AWS ' +
+            "managed one.",
+        ),
+      );
+    }
+    return out;
+  },
+};

package/dist/rules/tf035.ts

@@ -0,0 +1,74 @@
+/**
+ * TF035: an SQS queue turns its server-side encryption off (chant #2288,
+ * epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW026, and the case that
+ * shows why the five flat rules could not be bridged. WAW026 reports a queue
+ * with neither `SqsManagedSseEnabled: true` nor `KmsMasterKeyId`. Bridged onto
+ * HCL, that reports every correctly encrypted queue in an estate
+ * (docs/design/waw-hcl-fidelity-probe.md).
+ *
+ * Absence is secure for this resource, and the rule does not report it.
+ * `sqs_managed_sse_enabled` is optional and computed (provider
+ * `internal/service/sqs/queue.go`, v6.67.0), and the provider docs say
+ * Terraform "will only perform drift detection of its value when present in
+ * a configuration". Since October 2022 SQS encrypts every new queue with
+ * SSE-SQS unless the request turns it off
+ * (https://aws.amazon.com/blogs/compute/announcing-server-side-encryption-with-amazon-simple-queue-service-managed-encryption-keys-sse-sqs-by-default/),
+ * and the provider creates queues over HTTPS, so a queue that sets neither
+ * attribute is encrypted. A queue created before that date and never
+ * changed can still be unencrypted; the configuration cannot show that, and
+ * TF035 does not guess it.
+ *
+ * The finding: `sqs_managed_sse_enabled = false` with no KMS key. Present and
+ * secure: `sqs_managed_sse_enabled = true`, or a `kms_master_key_id` that is
+ * a non-empty literal, a managed key's attribute, or a template with literal
+ * text. Not determined: `sqs_managed_sse_enabled` from an expression with no
+ * key, or a key from a variable beside `sqs_managed_sse_enabled = false`.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { finding, notDetermined, readBool, readKeySet, resourcesOfType } from "./flat-attributes";
+
+const ID = "TF035";
+
+const TAIL = "TF035 does not evaluate expressions, so it cannot tell whether this queue encrypts its messages.";
+
+export const tf035: PostSynthCheck = {
+  id: "TF035",
+  description: "SQS queue turns server-side encryption off",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const block of resourcesOfType(ctx, "aws_sqs_queue")) {
+      const key = readKeySet(block.body, "kms_master_key_id");
+      const sse = readBool(block.body, "sqs_managed_sse_enabled");
+      if (key.kind === "known" && key.value !== "") continue;
+      if (sse.kind === "known" && sse.value) continue;
+      // Neither attribute turns encryption off: AWS's SSE-SQS default applies.
+      if (sse.kind === "absent") continue;
+
+      if (sse.kind === "unknown") {
+        out.push(notDetermined(ID, block, `${sse.reason} and names no KMS key`, TAIL));
+        continue;
+      }
+      if (key.kind === "unknown") {
+        out.push(notDetermined(ID, block, `sets \`sqs_managed_sse_enabled = false\` and ${key.reason}`, TAIL));
+        continue;
+      }
+      out.push(
+        finding(
+          ID,
+          "warning",
+          block,
+          "sets `sqs_managed_sse_enabled = false` and names no KMS key, which turns off the SSE-SQS encryption AWS " +
+            "applies to new queues by default, so messages are stored unencrypted. Remove the line (the default is " +
+            'encrypted), set it to `true`, or set `kms_master_key_id` (`"alias/aws/sqs"` or a customer managed key).',
+        ),
+      );
+    }
+    return out;
+  },
+};

package/dist/rules/tf036.ts

@@ -0,0 +1,119 @@
+/**
+ * TF036: an EBS volume does not ask for encryption (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW028, written natively.
+ *
+ * Absence is not determined for this resource. `aws_ebs_volume.encrypted` is
+ * optional, computed and force-new (provider `internal/service/ec2/
+ * ebs_volume.go`, v6.67.0). Whether a volume created without it is encrypted
+ * depends on the Region's EBS encryption by default
+ * (https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html),
+ * which is account state the parse cannot see, and a volume built from
+ * `snapshot_id` also follows its snapshot. So an unset `encrypted` emits one
+ * `info` diagnostic, not a finding.
+ *
+ * One configuration does settle absence: the volume `depends_on` an
+ * `aws_ebs_encryption_by_default` in the same module whose `enabled` is
+ * absent (the provider default is `true`) or literal `true`, on the same
+ * `provider` and `region`. The `depends_on` matters: without it Terraform may
+ * create the volume before it turns the default on, and the default "has no
+ * effect on existing EBS volumes".
+ *
+ * `encrypted = false` is a finding even though encryption by default would
+ * override it. The literal is wrong either way: with the default off the
+ * volume is unencrypted, and with it on AWS encrypts the volume anyway ("you
+ * cannot disable it for individual volumes"), the volume no longer matches
+ * the configuration, and because `encrypted` forces replacement Terraform
+ * plans to replace it on every apply.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { scopeOfKey } from "../../hcl/parse";
+import type { TerraformBlock } from "./blocks";
+import { finding, isGiven, notDetermined, readBool, resourcesOfType } from "./flat-attributes";
+
+const ID = "TF036";
+const DEFAULT_TYPE = "aws_ebs_encryption_by_default";
+
+/** The `aws_ebs_encryption_by_default.<name>` addresses a volume's `depends_on` names. */
+function dependsOnDefaults(block: TerraformBlock): string[] {
+  const deps = block.body.depends_on;
+  if (!Array.isArray(deps)) return [];
+  const out: string[] = [];
+  for (const d of deps) {
+    if (typeof d !== "string") continue;
+    const m = /^\$\{\s*(aws_ebs_encryption_by_default\.[A-Za-z_][\w-]*)\s*\}$/.exec(d) ?? /^(aws_ebs_encryption_by_default\.[A-Za-z_][\w-]*)$/.exec(d);
+    if (m) out.push(m[1]);
+  }
+  return out;
+}
+
+/** Same provider configuration and Region, compared as written. */
+function sameTarget(a: TerraformBlock, b: TerraformBlock): boolean {
+  return a.body.provider === b.body.provider && a.body.region === b.body.region;
+}
+
+export const tf036: PostSynthCheck = {
+  id: "TF036",
+  description: "EBS volume does not ask for encryption",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    const defaults = resourcesOfType(ctx, DEFAULT_TYPE);
+
+    for (const block of resourcesOfType(ctx, "aws_ebs_volume")) {
+      const encrypted = readBool(block.body, "encrypted");
+      if (encrypted.kind === "known" && encrypted.value) continue;
+      if (encrypted.kind === "known") {
+        out.push(
+          finding(
+            ID,
+            "warning",
+            block,
+            "sets `encrypted = false`. With the Region's EBS encryption by default off, the volume is unencrypted; " +
+              "with it on, AWS encrypts the volume anyway and, because `encrypted` forces replacement, Terraform " +
+              "plans to replace it on every apply. Set `encrypted = true` (and `kms_key_id` for a customer managed " +
+              "key), or remove the line.",
+          ),
+        );
+        continue;
+      }
+      if (encrypted.kind === "unknown") {
+        out.push(
+          notDetermined(ID, block, encrypted.reason, "TF036 does not evaluate expressions, so it cannot tell whether this volume is encrypted."),
+        );
+        continue;
+      }
+
+      const scope = scopeOfKey(block.key);
+      const inScope = defaults.filter((d) => scopeOfKey(d.key) === scope && sameTarget(d, block));
+      const enabled = inScope.filter((d) => {
+        const e = readBool(d.body, "enabled");
+        return e.kind === "absent" || (e.kind === "known" && e.value);
+      });
+      const named = new Set(dependsOnDefaults(block));
+      if (enabled.some((d) => named.has(d.address))) continue;
+
+      const parts = ["does not set `encrypted`"];
+      if (isGiven(block.body, "snapshot_id")) parts.push("and is built from `snapshot_id`, whose encryption it inherits");
+      const reason =
+        `${parts.join(" ")}, so whether it is encrypted depends on the Region's EBS encryption by default, which is ` +
+        "account state" +
+        (enabled.length > 0
+          ? `. \`${enabled[0].address}\` turns the default on in this module, but the volume does not \`depends_on\` it, so it may be created first`
+          : "");
+      out.push(
+        notDetermined(
+          ID,
+          block,
+          reason,
+          "Set `encrypted = true` to make the answer explicit, or add `depends_on` naming an enabled " +
+            "`aws_ebs_encryption_by_default`.",
+        ),
+      );
+    }
+    return out;
+  },
+};