@intentius/chant-lexicon-terraform 0.100.0 → 0.102.0

package/src/lint/audit-lineage.ts

@@ -56,7 +56,7 @@
  * | `tflint-ruleset-redeploy` | tflint-ruleset-redeploy | https://github.com/RedeployAB/tflint-ruleset-redeploy | 0BSD | scanner | Community ruleset; richest source of language-level rules outside the official set. Sweep: indexed from `docs/rules/README.md`, same table shape (33 rules). |
  * | `tflint-ruleset-avm` | tflint-ruleset-avm | https://github.com/Azure/tflint-ruleset-avm | MIT | scanner | Azure Verified Modules conformance; two of its 33 rules are provider-agnostic. Sweep: indexed from the repository-root `RULES.md`, since `docs/` holds pages for only two rules (33 rules). |
  * | `tfsec` | tfsec | https://github.com/aquasecurity/tfsec | MIT | scanner | Historical: not archived but effectively frozen (no release since 2025-05); its docs site 404s above v0.61.x, so cite pinned repository paths (`github.com/aquasecurity/tfsec/blob/master/docs/checks/...`), not the docs site. Sweep: indexed from the root `rules.md` on `master`, a flat table of all 152 check ids, because `docs/checks` nests a directory per provider, service and check. |
- * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. Sweep: not registered in `PRIOR_ART` (no rule cites it yet) and its `long_id`s live in Rego metadata under `checks/<kind>/<provider>/<service>/`, with no flat index. |
+ * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. Sweep: registered in `PRIOR_ART` since TF030 (#2285) cited `aws-ec2-no-public-ingress-sgr` (TF032 also cites `aws-ecs-no-plaintext-secrets`, AWS-0036), but not swept: its `long_id`s live in Rego metadata under `checks/<kind>/<provider>/<service>/`, with no flat index. Check a cited id is live: TF031's counterpart, `aws-iam-no-policy-wildcards`, is a `deprecated: true` stub with no rule body, so TF031 does not cite it. |
  * | `terraform-sentinel-policies` | HashiCorp reference Sentinel policies | https://github.com/hashicorp/terraform-sentinel-policies | MPL-2.0 | specification | HashiCorp's own example policy set; ships zero rules baked into HCP Terraform itself, so treat a cited policy as a documented pattern (`specification`) unless a future entry runs it as a real check (`scanner`); the `kind` union allows either. Sweep: indexed by listing the five per-cloud directories, whose `.sentinel` filenames are the policy ids credits cite (73 policies); the repository publishes no index page. |
  * | `choudoufu` | choudoufu | https://github.com/INTENTIUS/choudoufu | MPL-2.0 | scanner | Its `internal/live/lint` package; experimental, AWS-only. Sweep: unsweepable, its rule ids are Go constants in `internal/live/lint/issue.go` and it publishes no rule index. |
  * | `hashicorp-style-guide` | HashiCorp Terraform style guide | https://developer.hashicorp.com/terraform/language/style | n/a | specification | Sweep: unsweepable, one prose page of recommendations with no rule ids; a credit quotes the sentence and links its fragment. |
@@ -401,4 +401,158 @@ export const terraformAuditLineage: Record<string, Lineage[]> = {
     },
     { tool: "kics", rule: "a88baa34-e2ad-44ea-ad6f-8cac87bc7c71", url: "https://docs.kics.io/latest/secrets/", relation: "overlaps" },
   ],
+  TF030: [
+    // Every credit overlaps; none is equivalent. TF030 is WAW019's port list
+    // (22, 3389, 3306, 5432) on 0.0.0.0/0 or ::/0, read across the three
+    // Terraform shapes. Checkov checks one port per id and, unlike TF030,
+    // reads tcp 0-0 as every port and passes any rule with `self = true`.
+    // tfsec flags a /0 on any port; trivy-checks only SSH and RDP; KICS a
+    // longer port list; the Sentinel policies only `aws_security_group_rule`
+    // with an exact `to_port`. Each upstream id was read from its source on
+    // 2026-10-02 (checkov `AbsSecurityGroupUnrestrictedIngress.py`, trivy-checks
+    // `no_public_ingress_sgr.rego` metadata, KICS `metadata.json`, tfsec
+    // `rules.md`).
+    { tool: "checkov", rule: "CKV_AWS_24", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_25", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    {
+      tool: "tfsec",
+      rule: "aws-vpc-no-public-ingress-sgr",
+      url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/vpc/no-public-ingress-sgr/index.md",
+      relation: "overlaps",
+    },
+    {
+      tool: "trivy-checks",
+      rule: "aws-ec2-no-public-ingress-sgr",
+      url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ec2/no_public_ingress_sgr.rego",
+      relation: "overlaps",
+    },
+    {
+      tool: "kics",
+      rule: "381c3f2a-ef6f-4eff-99f7-b169cda3422c",
+      url: "https://docs.kics.io/latest/queries/terraform-queries/aws/381c3f2a-ef6f-4eff-99f7-b169cda3422c/",
+      relation: "overlaps",
+    },
+    {
+      tool: "terraform-sentinel-policies",
+      rule: "restrict-ingress-sg-rule-ssh",
+      url: "https://github.com/hashicorp/terraform-sentinel-policies/blob/main/aws/restrict-ingress-sg-rule-ssh.sentinel",
+      relation: "overlaps",
+    },
+    {
+      tool: "terraform-sentinel-policies",
+      rule: "restrict-ingress-sg-rule-rdp",
+      url: "https://github.com/hashicorp/terraform-sentinel-policies/blob/main/aws/restrict-ingress-sg-rule-rdp.sentinel",
+      relation: "overlaps",
+    },
+  ],
+  // tfsec's check also flags a service wildcard (`s3:*`), which TF031 does
+  // not, so "overlaps". checkov splits the condition four ways: CKV_AWS_63
+  // (Action "*" on the policy resources, plus aws_ssoadmin_permission_set_
+  // inline_policy, which TF031 does not read) and CKV_AWS_49 (the same on the
+  // data source, which TF031 extends with Resource "*"); CKV_AWS_355/356 ask
+  // cloudsplaining whether Resource "*" meets a RESTRICTABLE action, a
+  // narrower test than TF031's literal one. trivy-checks has no credit:
+  // `aws-iam-no-policy-wildcards` (AWS-0057) survives there only as a
+  // `deprecated: true` metadata stub with no rule body, added by
+  // aquasecurity/trivy-checks c292eb6737e0 ("add removed Go checks as
+  // deprecated"), so it checks nothing to be equivalent to (#2286).
+  TF031: [
+    {
+      tool: "tfsec",
+      rule: "aws-iam-no-policy-wildcards",
+      url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/iam/no-policy-wildcards/index.md",
+      relation: "overlaps",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_AWS_63",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py",
+      relation: "overlaps",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_AWS_49",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py",
+      relation: "extends",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_AWS_355",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py",
+      relation: "overlaps",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_AWS_356",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/ResourcePolicyDocument.py",
+      relation: "overlaps",
+    },
+  ],
+  // tfsec's `aws-ecs-no-plaintext-secrets` and its successor in trivy-checks
+  // (`long_id` aws-ecs-no-plaintext-secrets, AVD-AWS-0036) fire on the same
+  // condition: an environment entry whose name is sensitive or whose value a
+  // secret scanner flags. `overlaps`, not `equivalent`, because both evaluate
+  // the definition first and so also read what TF032 reports as not
+  // determined, and their name list differs from secret-shape.ts's. Checkov
+  // has no Terraform check for ECS environment values (its ECS checks cover
+  // privilege, read-only root, host process, task role and EFS encryption,
+  // `checkov/terraform/checks/resource/aws/ECS*.py`), so it gets no credit.
+  TF032: [
+    {
+      tool: "tfsec",
+      rule: "aws-ecs-no-plaintext-secrets",
+      url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/ecs/no-plaintext-secrets/index.md",
+      relation: "overlaps",
+    },
+    {
+      tool: "trivy-checks",
+      rule: "aws-ecs-no-plaintext-secrets",
+      url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ecs/no_plaintext_secrets.rego",
+      relation: "overlaps",
+    },
+  ],
+  // TF033-TF037 (#2288). Every tool below reports an absent attribute the
+  // same as an insecure one, which is right for SNS (TF034) and ECR (TF037)
+  // and wrong for the rest: SQS encrypts new queues by default, an unset
+  // EBS `encrypted` follows the Region's encryption by default, and Aurora
+  // encrypts new clusters whatever `storage_encrypted` says. Where chant's
+  // answer to absence differs the credit is "overlaps"; where it agrees and
+  // the condition is the same, "equivalent". The ECR credits are "overlaps"
+  // too: none of them knows provider v6's `IMMUTABLE_WITH_EXCLUSION`, which
+  // TF037 passes and they report. trivy-checks ids are the live
+  // Rego checks (not `deprecated` stubs) at aquasecurity/trivy-checks
+  // 71c05d02845c. tfsec has no TF036 credit: its frozen `rules.md`, which
+  // the prior-art sweep indexes, no longer lists an EBS volume check.
+  TF033: [
+    { tool: "tfsec", rule: "aws-rds-encrypt-instance-storage-data", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/rds/encrypt-instance-storage-data/index.md", relation: "overlaps" },
+    { tool: "tfsec", rule: "aws-rds-encrypt-cluster-storage-data", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/rds/encrypt-cluster-storage-data/index.md", relation: "overlaps" },
+    { tool: "trivy-checks", rule: "aws-rds-encrypt-instance-storage-data", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/rds/encrypt_instance_storage_data.rego", relation: "overlaps" },
+    { tool: "trivy-checks", rule: "aws-rds-encrypt-cluster-storage-data", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/rds/encrypt_cluster_storage_data.rego", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_16", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEncryption.py", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_96", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AuroraEncryption.py", relation: "overlaps" },
+    { tool: "kics", rule: "08bd0760-8752-44e1-9779-7bb369b2b4e4", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/08bd0760-8752-44e1-9779-7bb369b2b4e4/", relation: "overlaps" },
+  ],
+  TF034: [
+    { tool: "tfsec", rule: "aws-sns-enable-topic-encryption", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/sns/enable-topic-encryption/index.md", relation: "equivalent" },
+    { tool: "trivy-checks", rule: "aws-sns-enable-topic-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/sns/enable_topic_encryption.rego", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_26", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSTopicEncryption.py", relation: "equivalent" },
+    { tool: "kics", rule: "28545147-2fc6-42d5-a1f9-cf226658e591", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/28545147-2fc6-42d5-a1f9-cf226658e591/", relation: "equivalent" },
+  ],
+  TF035: [
+    { tool: "tfsec", rule: "aws-sqs-enable-queue-encryption", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/sqs/enable-queue-encryption/index.md", relation: "overlaps" },
+    { tool: "trivy-checks", rule: "aws-sqs-enable-queue-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/sqs/enable_queue_encryption.rego", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_27", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueueEncryption.py", relation: "overlaps" },
+    { tool: "kics", rule: "6e8849c1-3aa7-40e3-9063-b85ee300f29f", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/6e8849c1-3aa7-40e3-9063-b85ee300f29f/", relation: "overlaps" },
+  ],
+  TF036: [
+    { tool: "trivy-checks", rule: "aws-ec2-enable-volume-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ec2/enable_volume_encryption.rego", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_3", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSEncryption.py", relation: "overlaps" },
+    { tool: "kics", rule: "cc997676-481b-4e93-aa81-d19f8c5e9b12", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/cc997676-481b-4e93-aa81-d19f8c5e9b12/", relation: "overlaps" },
+  ],
+  TF037: [
+    { tool: "tfsec", rule: "aws-ecr-enforce-immutable-repository", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/ecr/enforce-immutable-repository/index.md", relation: "overlaps" },
+    { tool: "trivy-checks", rule: "aws-ecr-enforce-immutable-repository", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ecr/enforce_immutable_repository.rego", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_51", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRImmutableTags.py", relation: "overlaps" },
+    { tool: "kics", rule: "d1846b12-20c5-4d45-8798-fc35b79268eb", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/d1846b12-20c5-4d45-8798-fc35b79268eb/", relation: "overlaps" },
+  ],
 };

package/src/lint/post-synth/estate-2284.test.ts

@@ -0,0 +1,68 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import { auditFiles, type AuditFinding, type ChecksProvider, type EntitiesProvider } from "@intentius/chant/audit/core";
+import { discoverByDetection, type DetectPlugin } from "@intentius/chant/audit/discover";
+import { terraformPlugin } from "../../plugin";
+import { postSynthChecks } from "./index";
+
+/**
+ * Epic #2284's definition of done, run through `chant audit`'s terraform path
+ * (real discovery, the plugin's `auditEntities` parse, every post-synth check
+ * in the barrel) over the two estate roots in `fixtures/estate-2284/`. The
+ * violating root holds one violation per rule, TF030 to TF037; the clean root
+ * holds the same estate fixed, with the provider-default cases (an SQS queue
+ * with no encryption attribute, an EBS volume behind an enabled
+ * `aws_ebs_encryption_by_default`) left as real estates leave them.
+ */
+const estate = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "estate-2284");
+
+const terraformDetectPlugin: DetectPlugin = { name: "terraform" };
+const checksProvider: ChecksProvider = async (lexicon) =>
+  lexicon === "terraform" ? (terraformPlugin.postSynthChecks?.() ?? []) : [];
+const entitiesProvider: EntitiesProvider = async (lexicon) =>
+  lexicon === "terraform" ? terraformPlugin.auditEntities?.bind(terraformPlugin) : undefined;
+
+async function audit(root: "violating" | "clean"): Promise<AuditFinding[]> {
+  return auditFiles(discoverByDetection(join(estate, root), [terraformDetectPlugin]), { checksProvider, entitiesProvider });
+}
+
+/** The rule each violating resource is written for. */
+const EXPECTED: Record<string, string> = {
+  TF030: "aws_security_group.bastion",
+  TF031: "aws_iam_policy.deployer",
+  TF032: "aws_ecs_task_definition.api",
+  TF033: "aws_db_instance.ledger",
+  TF034: "aws_sns_topic.alerts",
+  TF035: "aws_sqs_queue.settlements",
+  TF036: "aws_ebs_volume.scratch",
+  TF037: "aws_ecr_repository.api",
+};
+
+const FAMILY = /^TF03[0-7]$/;
+
+describe("epic #2284 acceptance: chant audit over the estate roots", () => {
+  test("every rule TF030 to TF037 is in the barrel", () => {
+    const shipped = new Set(postSynthChecks.map((c) => c.id));
+    expect(Object.keys(EXPECTED).filter((id) => !shipped.has(id))).toEqual([]);
+  });
+
+  for (const [id, address] of Object.entries(EXPECTED)) {
+    test(`the violating root reports ${id} on ${address}`, async () => {
+      const findings = (await audit("violating")).filter((f) => f.checkId === id);
+      expect(findings.map((f) => f.entity)).toEqual([`audit-root/${address}`]);
+      expect(["error", "warning"]).toContain(findings[0]!.severity);
+    });
+  }
+
+  test("the violating root reports nothing TF030 to TF037 cannot prove", async () => {
+    const family = (await audit("violating")).filter((f) => FAMILY.test(f.checkId));
+    expect(family.filter((f) => f.severity === "info")).toEqual([]);
+    expect(family.map((f) => f.checkId).sort()).toEqual(Object.keys(EXPECTED));
+  });
+
+  test("the clean root, provider-default cases included, reports nothing from TF030 to TF037", async () => {
+    const family = (await audit("clean")).filter((f) => FAMILY.test(f.checkId));
+    expect(family).toEqual([]);
+  });
+});

package/src/lint/post-synth/fixtures/TF030/negative-rules.tf

@@ -0,0 +1,45 @@
+# Vendored for TF030 from https://github.com/aws-samples/aws-cloudwan-workshop-code
+# Path: terraform/modules/compute/main.tf
+# Commit: 1a331e8782b6cccdc5d0bb4ed28c45594445cc2f
+# Licence: MIT-0, https://github.com/aws-samples/aws-cloudwan-workshop-code/blob/1a331e8782b6cccdc5d0bb4ed28c45594445cc2f/LICENSE
+# Excerpt: lines 1-37, unmodified.
+#
+# TF030: silent. A group with no ingress at all (closed, not unknown), ICMP from 0.0.0.0/0 (no ports), SSH from a referenced security group rather than a CIDR, and an all-traffic egress rule.
+
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
+
+# --- modules/compute/main.tf ---
+
+# ---------- EC2 INSTANCES ----------
+# Security Group
+resource "aws_security_group" "instance_sg" {
+  name        = "${var.vpc_name}-instance-security-group-${var.project_name}"
+  description = "EC2 Instance Security Group"
+  vpc_id      = var.vpc_information.vpc_attributes.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "allowing_ingress_icmp" {
+  security_group_id = aws_security_group.instance_sg.id
+
+  from_port   = -1
+  to_port     = -1
+  ip_protocol = "icmp"
+  cidr_ipv4   = "0.0.0.0/0"
+}
+
+resource "aws_vpc_security_group_ingress_rule" "allowing_ingress_eic" {
+  security_group_id = aws_security_group.instance_sg.id
+
+  from_port                    = 22
+  to_port                      = 22
+  ip_protocol                  = "tcp"
+  referenced_security_group_id = aws_security_group.eic_sg.id
+}
+
+resource "aws_vpc_security_group_egress_rule" "allowing_egress_any" {
+  security_group_id = aws_security_group.instance_sg.id
+
+  ip_protocol = "-1"
+  cidr_ipv4   = "0.0.0.0/0"
+}

package/src/lint/post-synth/fixtures/TF030/negative.tf

@@ -0,0 +1,55 @@
+# Vendored for TF030 from https://github.com/aws-samples/web-hosting-architecture-examples-for-china-region-terraform
+# Path: eks/security-groups.tf
+# Commit: 718a45d536672e7f5f4e1fa6011e3acb27ab4f5a
+# Licence: MIT-0, https://github.com/aws-samples/web-hosting-architecture-examples-for-china-region-terraform/blob/718a45d536672e7f5f4e1fa6011e3acb27ab4f5a/LICENSE
+# The whole file, unmodified.
+#
+# TF030: silent. Every group opens 22, but only to private ranges.
+
+
+resource "aws_security_group" "worker_group_mgmt_one" {
+  name_prefix = "worker_group_mgmt_one"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {
+    from_port = 22
+    to_port   = 22
+    protocol  = "tcp"
+
+    cidr_blocks = [
+      "10.0.0.0/8",
+    ]
+  }
+}
+
+resource "aws_security_group" "worker_group_mgmt_two" {
+  name_prefix = "worker_group_mgmt_two"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {
+    from_port = 22
+    to_port   = 22
+    protocol  = "tcp"
+
+    cidr_blocks = [
+      "192.168.0.0/16",
+    ]
+  }
+}
+
+resource "aws_security_group" "all_worker_mgmt" {
+  name_prefix = "all_worker_management"
+  vpc_id      = module.vpc.vpc_id
+
+  ingress {
+    from_port = 22
+    to_port   = 22
+    protocol  = "tcp"
+
+    cidr_blocks = [
+      "10.0.0.0/8",
+      "172.16.0.0/12",
+      "192.168.0.0/16",
+    ]
+  }
+}

package/src/lint/post-synth/fixtures/TF030/not-determined-port.tf

@@ -0,0 +1,28 @@
+# Vendored for TF030 from https://github.com/gruntwork-io/terratest
+# Path: examples/terraform-ssh-example/main.tf
+# Commit: 75a9f881c31f71255b474149edada4a1850bce22
+# Licence: Apache-2.0, https://github.com/gruntwork-io/terratest/blob/75a9f881c31f71255b474149edada4a1850bce22/LICENSE
+# Excerpt: lines 61-80, the aws_security_group.example block, unmodified.
+#
+# TF030: one info, Not determined: the CIDR is 0.0.0.0/0 but from_port and to_port are var.ssh_port. The open egress is not reported.
+
+resource "aws_security_group" "example" {
+  name = var.instance_name
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port = var.ssh_port
+    to_port   = var.ssh_port
+    protocol  = "tcp"
+
+    # To keep this example simple, we allow incoming SSH requests from any IP. In real-world usage, you should only
+    # allow SSH requests from trusted servers, such as a bastion host or VPN server.
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}

package/src/lint/post-synth/fixtures/TF030/not-determined-standalone.tf

@@ -0,0 +1,32 @@
+# Vendored for TF030 from https://github.com/aws-samples/terraform-sample-workshop
+# Path: module_1/one_file_tf/simple_nginx_stack/main.tf
+# Commit: 0a265e356a3cf4fd0f15ba821b7bedf712a32239
+# Licence: MIT-0, https://github.com/aws-samples/terraform-sample-workshop/blob/0a265e356a3cf4fd0f15ba821b7bedf712a32239/LICENSE
+# Excerpt: lines 127-150, unmodified.
+#
+# TF030: one info, Not determined: allow_ssh_internal opens 22 to cidr_blocks = [var.cidr_vpc]. egress_allow_all (protocol "all", 0.0.0.0/0) is egress and is not reported.
+
+resource "aws_security_group" "vpc_security_group" {
+  name   = "aws-${var.vpc_name}-vpc-sg"
+  vpc_id = aws_vpc.vpc.id
+}
+
+resource "aws_security_group_rule" "allow_ssh_internal" {
+  type        = "ingress"
+  from_port   = 22
+  to_port     = 22
+  protocol    = "tcp"
+  cidr_blocks = [var.cidr_vpc]
+
+  security_group_id = aws_security_group.vpc_security_group.id
+}
+
+resource "aws_security_group_rule" "egress_allow_all" {
+  type        = "egress"
+  from_port   = 0
+  to_port     = 65535
+  protocol    = "all"
+  cidr_blocks = ["0.0.0.0/0"]
+
+  security_group_id = aws_security_group.vpc_security_group.id
+}

package/src/lint/post-synth/fixtures/TF030/not-determined-vpc-rule.tf

@@ -0,0 +1,21 @@
+# Vendored for TF030 from https://github.com/aws-samples/sample-parallel-computing-service
+# Path: modules/vpc/main.tf
+# Commit: e74e5806f8fa203b268532f9f6c64e649b35708e
+# Licence: MIT-0, https://github.com/aws-samples/sample-parallel-computing-service/blob/e74e5806f8fa203b268532f9f6c64e649b35708e/LICENSE
+# Excerpt: lines 81-93, unmodified. The for_each map it reads, local.pcs_public_security_group_rules.ingress (lines 37-51 of the same file), does open 22 to 0.0.0.0/0.
+#
+# TF030: one info, Not determined: every attribute is each.value.*, so the rule cannot see the open SSH port that the locals declare. This is what the info finding is for.
+
+resource "aws_security_group" "pcs_public" {
+  name   = "${var.project}-public-sg"
+  vpc_id = aws_vpc.pcs.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "pcs_public_allow_ingress" {
+  for_each          = local.pcs_public_security_group_rules.ingress
+  security_group_id = aws_security_group.pcs_public.id
+  cidr_ipv4         = each.value.cidr_ipv4
+  from_port         = each.value.from_port
+  ip_protocol       = each.value.ip_protocol
+  to_port           = each.value.to_port
+}

package/src/lint/post-synth/fixtures/TF030/not-determined.tf

@@ -0,0 +1,39 @@
+# Vendored for TF030 from https://github.com/aws-samples/sample-issac-lab-on-aws
+# Path: main.tf
+# Commit: 50ea76d87d873c1d69bed92c450ab144894f437e
+# Licence: MIT-0, https://github.com/aws-samples/sample-issac-lab-on-aws/blob/50ea76d87d873c1d69bed92c450ab144894f437e/LICENSE
+# Excerpt: lines 116-146, the aws_security_group.isaac block, unmodified.
+#
+# TF030: one info, Not determined: port 22 is open to cidr_blocks = var.allowed_ssh_cidrs, which the parse cannot read. No error.
+
+resource "aws_security_group" "isaac" {
+  name_prefix = "${var.project_name}-sg-"
+  description = "Isaac Lab training instance security group"
+  vpc_id      = aws_vpc.isaac.id
+
+  # SSH
+  ingress {
+    description = "SSH"
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = var.allowed_ssh_cidrs
+  }
+
+  # All outbound
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name    = "${var.project_name}-sg"
+    Project = var.project_name
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}

package/src/lint/post-synth/fixtures/TF030/positive-ipv6.tf

@@ -0,0 +1,44 @@
+# Vendored for TF030 from https://github.com/bridgecrewio/checkov
+# Path: tests/terraform/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/main.tf
+# Commit: 4ef6eb50e33f60d8a204138f08883e12494ac230
+# Licence: Apache-2.0, https://github.com/bridgecrewio/checkov/blob/4ef6eb50e33f60d8a204138f08883e12494ac230/LICENSE
+# Checkov's own test corpus for CKV_AWS_24. Excerpt: lines 63-98, the aws_security_group.fail4 and aws_security_group.fail-ipv6 blocks, unmodified.
+#
+# TF030: two errors: fail4 writes ingress in attribute syntax with protocol "-1" (every port), fail-ipv6 opens 22 to ::/0.
+
+resource "aws_security_group" "fail4" {
+  description = "SG with inline rules"
+  ingress = [
+    {
+      cidr_blocks      = ["0.0.0.0/0"]
+      description      = "Wide Open"
+      from_port        = 0
+      ipv6_cidr_blocks = []
+      prefix_list_ids  = []
+      security_groups  = []
+      protocol         = "-1"
+      self             = false
+      to_port          = 65535
+    }
+  ]
+}
+
+resource "aws_security_group" "fail-ipv6" {
+  name   = "sg-bar"
+  vpc_id = aws_vpc.main.id
+
+  ingress {
+    from_port = 22
+    to_port   = 22
+    protocol  = "tcp"
+    ipv6_cidr_blocks = ["192.168.0.0/16", "::/0"]
+    description = "foo"
+  }
+
+  egress {
+    from_port = 0
+    to_port   = 0
+    protocol  = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}

package/src/lint/post-synth/fixtures/TF030/positive-mixed.tf

@@ -0,0 +1,36 @@
+# Vendored for TF030 from https://github.com/aws-samples/aws-database-acceleration-toolkit
+# Path: modules/tffiles-jenkins/jenkins.tf
+# Commit: dbb3d2df6a53ef95049e04b7bbe69aa70c607f81
+# Licence: MIT-0, https://github.com/aws-samples/aws-database-acceleration-toolkit/blob/dbb3d2df6a53ef95049e04b7bbe69aa70c607f81/LICENSE
+# Excerpt: lines 38-65, the aws_security_group.jenkins_port block, unmodified.
+#
+# TF030: one error, on the second ingress (port 22 from 0.0.0.0/0). The first ingress opens 8080, which is not on the sensitive list, and the egress is not ingress.
+
+resource "aws_security_group" "jenkins_port" {
+    vpc_id = var.vpc_id
+    provider = aws.primary
+
+    egress {
+        from_port = 0
+        to_port = 0
+        protocol = -1
+        cidr_blocks = ["0.0.0.0/0"]
+    }    
+  
+
+     ingress {
+        from_port = 8080
+        to_port = 8080
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    } 
+
+       ingress {
+        from_port = 22
+        to_port = 22
+        protocol = "tcp"
+        cidr_blocks = ["0.0.0.0/0"]
+    } 
+
+    lifecycle { create_before_destroy = true }
+}

package/src/lint/post-synth/fixtures/TF030/positive-standalone.tf

@@ -0,0 +1,25 @@
+# Vendored for TF030 from https://github.com/bridgecrewio/checkov
+# Path: tests/terraform/checks/resource/aws/example_SecurityGroupUnrestrictedIngress22/main.tf
+# Commit: 4ef6eb50e33f60d8a204138f08883e12494ac230
+# Licence: Apache-2.0, https://github.com/bridgecrewio/checkov/blob/4ef6eb50e33f60d8a204138f08883e12494ac230/LICENSE
+# Checkov's own test corpus for CKV_AWS_24. Excerpt: lines 100-116, the aws_security_group_rule.fail and aws_vpc_security_group_ingress_rule.fail blocks, unmodified.
+#
+# TF030: two errors, one per standalone shape: a 0.0.0.0/0 among other CIDRs on 22, and cidr_ipv4 = "0.0.0.0/0" on 22.
+
+resource "aws_security_group_rule" "fail" {
+  type              = "ingress"
+  from_port         = 22
+  to_port           = 22
+  protocol          = "tcp"
+  cidr_blocks       = ["192.168.0.0/16", "0.0.0.0/0"]
+  security_group_id = aws_security_group.bar-sg.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "fail" {
+  security_group_id = aws_security_group.example.id
+
+  cidr_ipv4   = "0.0.0.0/0"
+  from_port   = 22
+  ip_protocol = "tcp"
+  to_port     = 22
+}

package/src/lint/post-synth/fixtures/TF030/positive.tf

@@ -0,0 +1,43 @@
+# Vendored for TF030 from https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline
+# Path: sec-groups.tf
+# Commit: 68c34a21e966afc11c572677c319f2cc8379ec94
+# Licence: MIT-0, https://github.com/aws-samples/terraform-ec2-image-builder-container-hardening-pipeline/blob/68c34a21e966afc11c572677c319f2cc8379ec94/LICENSE
+# The whole file, unmodified.
+#
+# TF030: one error, on the "Ephemeral" ingress: tcp 1025-65535 from 0.0.0.0/0 spans 3306, 3389 and 5432. The TLS ingress on 443 is not reported.
+
+resource "aws_security_group" "image_builder_sg" {
+  depends_on = [
+    aws_vpc.hardening_pipeline
+  ]
+  name        = "${var.image_name}-sg"
+  description = "Security group for EC2 Image Builder"
+  vpc_id      = aws_vpc.hardening_pipeline.id
+
+  ingress {
+    description = "TLS"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "Ephemeral"
+    from_port   = 1025
+    to_port     = 65535
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    description      = "Allow all eggress"
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
+  }
+
+  tags = local.core_tags
+}