@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/src/hcl/suppressions.ts

@@ -27,9 +27,9 @@
 import type { SuppressionDirective, SuppressionIds } from "@intentius/chant/lint/suppressions";
 
 /** A block header keyword with zero labels (`terraform {`, `locals {`). */
-const BARE_RE = /^\s*(terraform|locals)\s*\{/;
+const BARE_RE = /^\s*(terraform|locals|remote_state)\s*\{/;
 /** One label (`provider "aws" {`, `module "vpc" {`, `variable "x" {`, `output "x" {`). */
-const ONE_LABEL_RE = /^\s*(provider|module|variable|output)\s+"([^"]*)"\s*\{/;
+const ONE_LABEL_RE = /^\s*(provider|module|variable|output|dependency|generate)\s+"([^"]*)"\s*\{/;
 /** Two labels (`resource "aws_s3_bucket" "assets" {`, `data "aws_ami" "x" {`). */
 const TWO_LABEL_RE = /^\s*(resource|data)\s+"([^"]*)"\s+"([^"]*)"\s*\{/;
 
@@ -43,6 +43,12 @@ function addressFor(keyword: string, labels: string[]): string {
       return "terraform";
     case "locals":
       return "locals";
+    case "remote_state":
+      return "remote_state";
+    case "dependency":
+      return `dependency.${labels[0]}`;
+    case "generate":
+      return `generate.${labels[0]}`;
     case "provider":
       return `provider.${labels[0]}`;
     case "module":

package/src/index.ts

@@ -1,6 +1,18 @@
 // Plugin
 export { terraformPlugin } from "./plugin";
 
+// The `terraform-apply` component verb (#3049), contributed to core's
+// capability-plugin seam. Core loads `terraformCapabilityPlugin` when a
+// project's chant.config lists this lexicon, so a component can deploy a root
+// and a fan-out can run many of them in gated waves.
+export {
+  terraformCapabilityPlugin,
+  terraformApplyCapability,
+  TERRAFORM_VERB_FAMILIES,
+  type TerraformApplyStepInput,
+  type TerraformApplyStepOutput,
+} from "./components/capability-plugin";
+
 // Serializer
 export { terraformSerializer } from "./serializer";
 
@@ -55,6 +67,7 @@ export {
   choudoufuLiveLs,
   choudoufuLiveCheck,
   choudoufuAdopt,
+  terraformPinRollout,
 } from "./op/builders";
 
 // The adoption ledger over `live-plan -json`'s document (#2105). Pure, and
@@ -90,6 +103,11 @@ export type {
 export { TerraformAdoptOp } from "./composites/terraform-adopt-op";
 export type { TerraformAdoptOpConfig, TerraformAdoptOpResources } from "./composites/terraform-adopt-op";
 
+// One pin-bump PR per wave (#3189). The pin edit, wave plan and rollout run
+// are in the `@intentius/chant-lexicon-terraform/pin` subpath.
+export { TerraformPinRolloutOp } from "./composites/terraform-pin-rollout-op";
+export type { TerraformPinRolloutOpConfig, TerraformPinRolloutOpResources } from "./composites/terraform-pin-rollout-op";
+
 // Live observation over `terraform show -json` (#2087). The plugin reaches
 // `describeResources` through a dynamic import; the ownership keys are here
 // because `ownershipChannel` declares them eagerly.

package/src/lint/audit-catalog.ts

@@ -17,12 +17,60 @@ const HASHICORP_STYLE_VARIABLES: Authority = {
   url: "https://developer.hashicorp.com/terraform/language/style#variables",
 };
 
+const AWS_IAM_LEAST_PRIVILEGE: Authority = {
+  name: "AWS IAM security best practices (Apply least-privilege permissions)",
+  url: "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege",
+};
+
+// TF032's authority: the ECS developer guide's own instruction for credentials,
+// which is the remediation the rule's message gives.
+const ECS_SENSITIVE_DATA: Authority = {
+  name: "Amazon ECS Developer Guide: Pass sensitive data to an Amazon ECS container",
+  url: "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data.html",
+};
+
+// TF033-TF037 (#2288) cite the AWS service guide page that states the
+// encryption or immutability control each rule checks.
+const AWS_RDS_ENCRYPTION: Authority = {
+  name: "Amazon RDS User Guide: Encrypting Amazon RDS resources",
+  url: "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html",
+};
+
+const AWS_SNS_SSE: Authority = {
+  name: "Amazon SNS Developer Guide: Securing Amazon SNS data with server-side encryption",
+  url: "https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html",
+};
+
+const AWS_SQS_SSE: Authority = {
+  name: "Amazon SQS Developer Guide: Encryption at rest in Amazon SQS",
+  url: "https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html",
+};
+
+const AWS_EBS_ENCRYPTION: Authority = {
+  name: "Amazon EBS User Guide: Amazon EBS encryption",
+  url: "https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html",
+};
+
+const AWS_ECR_TAG_IMMUTABILITY: Authority = {
+  name: "Amazon ECR User Guide: Preventing image tags from being overwritten",
+  url: "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html",
+};
+
 // The vendor guides behind TF014, TF015 and TF021 are credited as lineage in
 // ./audit-lineage.ts, not as `authority` here. `authority` is reserved for
 // security rules that fail a merge (packages/core/src/audit/catalog.test.ts
 // holds both halves of that invariant), and these three are correctness and
 // best-practice rules (#2112).
 
+/**
+ * The document WAW019 cites for the same finding in the aws lexicon, named
+ * without the em-dash its entry there carries (the docs prose lint counts them).
+ */
+const AWS_SECURITY_PILLAR: Authority = {
+  name: "AWS Well-Architected Framework, Security Pillar",
+  url: "https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html",
+};
+
 export const terraformAuditCatalog: Record<string, RuleMeta> = {
   TF001: {
     id: "TF001",
@@ -321,6 +369,188 @@ export const terraformAuditCatalog: Record<string, RuleMeta> = {
       "pointed at whatever vault owns the credential, and rotate what was committed.",
     yamlBased: false,
   },
+  TF030: {
+    id: "TF030",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title: "Security group rule allows unrestricted ingress on a sensitive port",
+    remediation:
+      "Restrict the CIDR on SSH, RDP, MySQL and PostgreSQL ports to the sources that need them, or reach " +
+      "the host through a bastion, a VPN or SSM Session Manager.",
+    authority: [AWS_SECURITY_PILLAR],
+    yamlBased: false,
+  },
+  TF031: {
+    id: "TF031",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title: "IAM policy allows a wildcard Action or Resource",
+    remediation:
+      "Name the actions the workload calls and the ARNs it touches. For the few actions that accept only " +
+      'Resource "*" (`ecr:GetAuthorizationToken`, `sts:GetCallerIdentity`), keep that statement on its own and ' +
+      "suppress it with `# chant-ignore-block: TF031`. A policy TF031 reports as not determined is built from " +
+      "an expression; it is not a finding.",
+    authority: [AWS_IAM_LEAST_PRIVILEGE],
+    yamlBased: false,
+  },
+  TF032: {
+    id: "TF032",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title: "ECS container definition passes a credential as a plaintext environment value",
+    remediation:
+      "Move the value from the container's `environment` to its `secrets`, with a `valueFrom` naming a " +
+      "Secrets Manager secret or SSM parameter, and rotate the committed value.",
+    authority: [ECS_SENSITIVE_DATA],
+    yamlBased: false,
+  },
+  TF033: {
+    id: "TF033",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title: "RDS DB instance or cluster storage is not encrypted",
+    remediation:
+      "Set `storage_encrypted = true` (and `kms_key_id` for a customer managed key). An existing database cannot be " +
+      "encrypted in place: restore an encrypted copy of a snapshot. An Aurora cluster, or a database created from a " +
+      "snapshot or replica, is reported as not determined, not as a finding.",
+    authority: [AWS_RDS_ENCRYPTION],
+    yamlBased: false,
+  },
+  TF034: {
+    id: "TF034",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title: "SNS topic has no server-side encryption",
+    remediation:
+      'Set `kms_master_key_id` to a customer managed KMS key, or to `"alias/aws/sns"` for the AWS managed one. No AWS ' +
+      "default encrypts a topic that names no key.",
+    authority: [AWS_SNS_SSE],
+    yamlBased: false,
+  },
+  TF035: {
+    id: "TF035",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title: "SQS queue turns server-side encryption off",
+    remediation:
+      "Remove `sqs_managed_sse_enabled = false` (new queues are encrypted with SSE-SQS by default), set it to `true`, " +
+      "or set `kms_master_key_id`. A queue that sets neither attribute is encrypted and is not reported.",
+    authority: [AWS_SQS_SSE],
+    yamlBased: false,
+  },
+  TF036: {
+    id: "TF036",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title: "EBS volume does not ask for encryption",
+    remediation:
+      "Set `encrypted = true` (and `kms_key_id` for a customer managed key). A volume that leaves `encrypted` unset " +
+      "depends on the Region's EBS encryption by default and is reported as not determined, not as a finding.",
+    authority: [AWS_EBS_ENCRYPTION],
+    yamlBased: false,
+  },
+  TF037: {
+    id: "TF037",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title: "ECR repository allows mutable image tags",
+    remediation:
+      'Set `image_tag_mutability = "IMMUTABLE"`, or `"IMMUTABLE_WITH_EXCLUSION"` with an ' +
+      "`image_tag_mutability_exclusion_filter` naming the few moving tags (`latest`) that must stay mutable. The " +
+      "provider default is `MUTABLE`.",
+    authority: [AWS_ECR_TAG_IMMUTABILITY],
+    yamlBased: false,
+  },
+  TF038: {
+    id: "TF038",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "correctness",
+    title: "OCI module source has no tag or digest, or a mutable tag",
+    remediation:
+      "Pin the `oci://` source with `?digest=sha256:...` (a digest cannot move) or an exact version tag " +
+      "(`?tag=1.4.0`). A source with no tag pulls `latest`.",
+    yamlBased: false,
+  },
+  TF039: {
+    id: "TF039",
+    tier: "report-only",
+    fixKind: "guidance",
+    category: "best-practice",
+    title: "Registry module version is a range, not an exact version",
+    remediation: 'Set an exact `version` (`version = "1.4.0"`) for projects that pin modules. Off by default.',
+    yamlBased: false,
+  },
+  TF040: {
+    id: "TF040",
+    tier: "report-only",
+    fixKind: "guidance",
+    category: "best-practice",
+    title: "Root has no committed .terraform.lock.hcl",
+    remediation:
+      "Run `terraform init` in the root and commit the `.terraform.lock.hcl` it writes. Off by default; " +
+      "checked only where the root's directory is known.",
+    yamlBased: false,
+  },
+  TF041: {
+    id: "TF041",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "correctness",
+    title: "Terragrunt dependency lets mock_outputs stand in for apply",
+    remediation:
+      'Set `mock_outputs_allowed_terraform_commands = ["validate", "plan"]` on every `dependency` that sets `mock_outputs`. ' +
+      "Terragrunt reads a missing or empty list as every command, apply included.",
+    yamlBased: false,
+  },
+  TF042: {
+    id: "TF042",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "correctness",
+    title: "Terragrunt dependency sets skip_outputs together with mock_outputs",
+    remediation:
+      "Drop `skip_outputs`, or pass the values as `inputs`. With `skip_outputs = true` the upstream outputs are never read, so every run uses the mocks.",
+    yamlBased: false,
+  },
+  TF043: {
+    id: "TF043",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "correctness",
+    title: "Terragrunt terraform.source names no version (git ref, tfr version or oci tag)",
+    remediation:
+      "Pin the source: `?ref=` for git, `?version=` for `tfr://`, `?digest=` or `?tag=` for `oci://`.",
+    yamlBased: false,
+  },
+  TF044: {
+    id: "TF044",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "correctness",
+    title: "Terragrunt config keeps state in a local backend",
+    remediation:
+      'Use a shared backend (S3, GCS) in `remote_state`. State written by `backend = "local"` stays on the runner and is lost with it.',
+    yamlBased: false,
+  },
+  TF045: {
+    id: "TF045",
+    tier: "report-only",
+    fixKind: "guidance",
+    category: "best-practice",
+    title: "No Terragrunt config sets terragrunt_version_constraint",
+    remediation:
+      'Set `terragrunt_version_constraint = ">= 1.1.0"` in the root config. Off by default; judged only across the configs scanned.',
+    yamlBased: false,
+  },
 };
 
 // Prior art credits, if any, live beside the rules in ./audit-lineage.ts (see

package/src/lint/audit-lineage.ts

@@ -56,7 +56,7 @@
  * | `tflint-ruleset-redeploy` | tflint-ruleset-redeploy | https://github.com/RedeployAB/tflint-ruleset-redeploy | 0BSD | scanner | Community ruleset; richest source of language-level rules outside the official set. Sweep: indexed from `docs/rules/README.md`, same table shape (33 rules). |
  * | `tflint-ruleset-avm` | tflint-ruleset-avm | https://github.com/Azure/tflint-ruleset-avm | MIT | scanner | Azure Verified Modules conformance; two of its 33 rules are provider-agnostic. Sweep: indexed from the repository-root `RULES.md`, since `docs/` holds pages for only two rules (33 rules). |
  * | `tfsec` | tfsec | https://github.com/aquasecurity/tfsec | MIT | scanner | Historical: not archived but effectively frozen (no release since 2025-05); its docs site 404s above v0.61.x, so cite pinned repository paths (`github.com/aquasecurity/tfsec/blob/master/docs/checks/...`), not the docs site. Sweep: indexed from the root `rules.md` on `master`, a flat table of all 152 check ids, because `docs/checks` nests a directory per provider, service and check. |
- * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. Sweep: not registered in `PRIOR_ART` (no rule cites it yet) and its `long_id`s live in Rego metadata under `checks/<kind>/<provider>/<service>/`, with no flat index. |
+ * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. Sweep: registered in `PRIOR_ART` since TF030 (#2285) cited `aws-ec2-no-public-ingress-sgr` (TF032 also cites `aws-ecs-no-plaintext-secrets`, AWS-0036), but not swept: its `long_id`s live in Rego metadata under `checks/<kind>/<provider>/<service>/`, with no flat index. Check a cited id is live: TF031's counterpart, `aws-iam-no-policy-wildcards`, is a `deprecated: true` stub with no rule body, so TF031 does not cite it. |
  * | `terraform-sentinel-policies` | HashiCorp reference Sentinel policies | https://github.com/hashicorp/terraform-sentinel-policies | MPL-2.0 | specification | HashiCorp's own example policy set; ships zero rules baked into HCP Terraform itself, so treat a cited policy as a documented pattern (`specification`) unless a future entry runs it as a real check (`scanner`); the `kind` union allows either. Sweep: indexed by listing the five per-cloud directories, whose `.sentinel` filenames are the policy ids credits cite (73 policies); the repository publishes no index page. |
  * | `choudoufu` | choudoufu | https://github.com/INTENTIUS/choudoufu | MPL-2.0 | scanner | Its `internal/live/lint` package; experimental, AWS-only. Sweep: unsweepable, its rule ids are Go constants in `internal/live/lint/issue.go` and it publishes no rule index. |
  * | `hashicorp-style-guide` | HashiCorp Terraform style guide | https://developer.hashicorp.com/terraform/language/style | n/a | specification | Sweep: unsweepable, one prose page of recommendations with no rule ids; a credit quotes the sentence and links its fragment. |
@@ -401,4 +401,158 @@ export const terraformAuditLineage: Record<string, Lineage[]> = {
     },
     { tool: "kics", rule: "a88baa34-e2ad-44ea-ad6f-8cac87bc7c71", url: "https://docs.kics.io/latest/secrets/", relation: "overlaps" },
   ],
+  TF030: [
+    // Every credit overlaps; none is equivalent. TF030 is WAW019's port list
+    // (22, 3389, 3306, 5432) on 0.0.0.0/0 or ::/0, read across the three
+    // Terraform shapes. Checkov checks one port per id and, unlike TF030,
+    // reads tcp 0-0 as every port and passes any rule with `self = true`.
+    // tfsec flags a /0 on any port; trivy-checks only SSH and RDP; KICS a
+    // longer port list; the Sentinel policies only `aws_security_group_rule`
+    // with an exact `to_port`. Each upstream id was read from its source on
+    // 2026-10-02 (checkov `AbsSecurityGroupUnrestrictedIngress.py`, trivy-checks
+    // `no_public_ingress_sgr.rego` metadata, KICS `metadata.json`, tfsec
+    // `rules.md`).
+    { tool: "checkov", rule: "CKV_AWS_24", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_25", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    {
+      tool: "tfsec",
+      rule: "aws-vpc-no-public-ingress-sgr",
+      url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/vpc/no-public-ingress-sgr/index.md",
+      relation: "overlaps",
+    },
+    {
+      tool: "trivy-checks",
+      rule: "aws-ec2-no-public-ingress-sgr",
+      url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ec2/no_public_ingress_sgr.rego",
+      relation: "overlaps",
+    },
+    {
+      tool: "kics",
+      rule: "381c3f2a-ef6f-4eff-99f7-b169cda3422c",
+      url: "https://docs.kics.io/latest/queries/terraform-queries/aws/381c3f2a-ef6f-4eff-99f7-b169cda3422c/",
+      relation: "overlaps",
+    },
+    {
+      tool: "terraform-sentinel-policies",
+      rule: "restrict-ingress-sg-rule-ssh",
+      url: "https://github.com/hashicorp/terraform-sentinel-policies/blob/main/aws/restrict-ingress-sg-rule-ssh.sentinel",
+      relation: "overlaps",
+    },
+    {
+      tool: "terraform-sentinel-policies",
+      rule: "restrict-ingress-sg-rule-rdp",
+      url: "https://github.com/hashicorp/terraform-sentinel-policies/blob/main/aws/restrict-ingress-sg-rule-rdp.sentinel",
+      relation: "overlaps",
+    },
+  ],
+  // tfsec's check also flags a service wildcard (`s3:*`), which TF031 does
+  // not, so "overlaps". checkov splits the condition four ways: CKV_AWS_63
+  // (Action "*" on the policy resources, plus aws_ssoadmin_permission_set_
+  // inline_policy, which TF031 does not read) and CKV_AWS_49 (the same on the
+  // data source, which TF031 extends with Resource "*"); CKV_AWS_355/356 ask
+  // cloudsplaining whether Resource "*" meets a RESTRICTABLE action, a
+  // narrower test than TF031's literal one. trivy-checks has no credit:
+  // `aws-iam-no-policy-wildcards` (AWS-0057) survives there only as a
+  // `deprecated: true` metadata stub with no rule body, added by
+  // aquasecurity/trivy-checks c292eb6737e0 ("add removed Go checks as
+  // deprecated"), so it checks nothing to be equivalent to (#2286).
+  TF031: [
+    {
+      tool: "tfsec",
+      rule: "aws-iam-no-policy-wildcards",
+      url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/iam/no-policy-wildcards/index.md",
+      relation: "overlaps",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_AWS_63",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py",
+      relation: "overlaps",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_AWS_49",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py",
+      relation: "extends",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_AWS_355",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py",
+      relation: "overlaps",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_AWS_356",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/ResourcePolicyDocument.py",
+      relation: "overlaps",
+    },
+  ],
+  // tfsec's `aws-ecs-no-plaintext-secrets` and its successor in trivy-checks
+  // (`long_id` aws-ecs-no-plaintext-secrets, AVD-AWS-0036) fire on the same
+  // condition: an environment entry whose name is sensitive or whose value a
+  // secret scanner flags. `overlaps`, not `equivalent`, because both evaluate
+  // the definition first and so also read what TF032 reports as not
+  // determined, and their name list differs from secret-shape.ts's. Checkov
+  // has no Terraform check for ECS environment values (its ECS checks cover
+  // privilege, read-only root, host process, task role and EFS encryption,
+  // `checkov/terraform/checks/resource/aws/ECS*.py`), so it gets no credit.
+  TF032: [
+    {
+      tool: "tfsec",
+      rule: "aws-ecs-no-plaintext-secrets",
+      url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/ecs/no-plaintext-secrets/index.md",
+      relation: "overlaps",
+    },
+    {
+      tool: "trivy-checks",
+      rule: "aws-ecs-no-plaintext-secrets",
+      url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ecs/no_plaintext_secrets.rego",
+      relation: "overlaps",
+    },
+  ],
+  // TF033-TF037 (#2288). Every tool below reports an absent attribute the
+  // same as an insecure one, which is right for SNS (TF034) and ECR (TF037)
+  // and wrong for the rest: SQS encrypts new queues by default, an unset
+  // EBS `encrypted` follows the Region's encryption by default, and Aurora
+  // encrypts new clusters whatever `storage_encrypted` says. Where chant's
+  // answer to absence differs the credit is "overlaps"; where it agrees and
+  // the condition is the same, "equivalent". The ECR credits are "overlaps"
+  // too: none of them knows provider v6's `IMMUTABLE_WITH_EXCLUSION`, which
+  // TF037 passes and they report. trivy-checks ids are the live
+  // Rego checks (not `deprecated` stubs) at aquasecurity/trivy-checks
+  // 71c05d02845c. tfsec has no TF036 credit: its frozen `rules.md`, which
+  // the prior-art sweep indexes, no longer lists an EBS volume check.
+  TF033: [
+    { tool: "tfsec", rule: "aws-rds-encrypt-instance-storage-data", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/rds/encrypt-instance-storage-data/index.md", relation: "overlaps" },
+    { tool: "tfsec", rule: "aws-rds-encrypt-cluster-storage-data", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/rds/encrypt-cluster-storage-data/index.md", relation: "overlaps" },
+    { tool: "trivy-checks", rule: "aws-rds-encrypt-instance-storage-data", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/rds/encrypt_instance_storage_data.rego", relation: "overlaps" },
+    { tool: "trivy-checks", rule: "aws-rds-encrypt-cluster-storage-data", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/rds/encrypt_cluster_storage_data.rego", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_16", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEncryption.py", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_96", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AuroraEncryption.py", relation: "overlaps" },
+    { tool: "kics", rule: "08bd0760-8752-44e1-9779-7bb369b2b4e4", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/08bd0760-8752-44e1-9779-7bb369b2b4e4/", relation: "overlaps" },
+  ],
+  TF034: [
+    { tool: "tfsec", rule: "aws-sns-enable-topic-encryption", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/sns/enable-topic-encryption/index.md", relation: "equivalent" },
+    { tool: "trivy-checks", rule: "aws-sns-enable-topic-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/sns/enable_topic_encryption.rego", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_AWS_26", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSTopicEncryption.py", relation: "equivalent" },
+    { tool: "kics", rule: "28545147-2fc6-42d5-a1f9-cf226658e591", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/28545147-2fc6-42d5-a1f9-cf226658e591/", relation: "equivalent" },
+  ],
+  TF035: [
+    { tool: "tfsec", rule: "aws-sqs-enable-queue-encryption", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/sqs/enable-queue-encryption/index.md", relation: "overlaps" },
+    { tool: "trivy-checks", rule: "aws-sqs-enable-queue-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/sqs/enable_queue_encryption.rego", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_27", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueueEncryption.py", relation: "overlaps" },
+    { tool: "kics", rule: "6e8849c1-3aa7-40e3-9063-b85ee300f29f", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/6e8849c1-3aa7-40e3-9063-b85ee300f29f/", relation: "overlaps" },
+  ],
+  TF036: [
+    { tool: "trivy-checks", rule: "aws-ec2-enable-volume-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ec2/enable_volume_encryption.rego", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_3", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSEncryption.py", relation: "overlaps" },
+    { tool: "kics", rule: "cc997676-481b-4e93-aa81-d19f8c5e9b12", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/cc997676-481b-4e93-aa81-d19f8c5e9b12/", relation: "overlaps" },
+  ],
+  TF037: [
+    { tool: "tfsec", rule: "aws-ecr-enforce-immutable-repository", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/ecr/enforce-immutable-repository/index.md", relation: "overlaps" },
+    { tool: "trivy-checks", rule: "aws-ecr-enforce-immutable-repository", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ecr/enforce_immutable_repository.rego", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_AWS_51", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRImmutableTags.py", relation: "overlaps" },
+    { tool: "kics", rule: "d1846b12-20c5-4d45-8798-fc35b79268eb", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/d1846b12-20c5-4d45-8798-fc35b79268eb/", relation: "overlaps" },
+  ],
 };

package/src/lint/audit.test.ts

@@ -208,7 +208,9 @@ describe("every fixture root gets the same verdict from chant audit as from chan
       entities,
       buildResult: { outputs: new Map(), entities, warnings, errors: [], sourceFileCount: entities.size },
     } as unknown as PostSynthContext;
-    return verdictOf((terraformPlugin.postSynthChecks?.() ?? []).flatMap((check) => check.check(ctx)));
+    // An `auditOptIn` check (TF040, #3190) is the one place the audit is meant to
+    // differ from the unfiltered build: it needs `lint.rules` there.
+    return verdictOf((terraformPlugin.postSynthChecks?.() ?? []).filter((check) => !check.auditOptIn).flatMap((check) => check.check(ctx)));
   }
 
   async function auditVerdict(dir: string): Promise<string[]> {

package/src/lint/post-synth/estate-2284.test.ts

@@ -0,0 +1,68 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import { auditFiles, type AuditFinding, type ChecksProvider, type EntitiesProvider } from "@intentius/chant/audit/core";
+import { discoverByDetection, type DetectPlugin } from "@intentius/chant/audit/discover";
+import { terraformPlugin } from "../../plugin";
+import { postSynthChecks } from "./index";
+
+/**
+ * Epic #2284's definition of done, run through `chant audit`'s terraform path
+ * (real discovery, the plugin's `auditEntities` parse, every post-synth check
+ * in the barrel) over the two estate roots in `fixtures/estate-2284/`. The
+ * violating root holds one violation per rule, TF030 to TF037; the clean root
+ * holds the same estate fixed, with the provider-default cases (an SQS queue
+ * with no encryption attribute, an EBS volume behind an enabled
+ * `aws_ebs_encryption_by_default`) left as real estates leave them.
+ */
+const estate = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "estate-2284");
+
+const terraformDetectPlugin: DetectPlugin = { name: "terraform" };
+const checksProvider: ChecksProvider = async (lexicon) =>
+  lexicon === "terraform" ? (terraformPlugin.postSynthChecks?.() ?? []) : [];
+const entitiesProvider: EntitiesProvider = async (lexicon) =>
+  lexicon === "terraform" ? terraformPlugin.auditEntities?.bind(terraformPlugin) : undefined;
+
+async function audit(root: "violating" | "clean"): Promise<AuditFinding[]> {
+  return auditFiles(discoverByDetection(join(estate, root), [terraformDetectPlugin]), { checksProvider, entitiesProvider });
+}
+
+/** The rule each violating resource is written for. */
+const EXPECTED: Record<string, string> = {
+  TF030: "aws_security_group.bastion",
+  TF031: "aws_iam_policy.deployer",
+  TF032: "aws_ecs_task_definition.api",
+  TF033: "aws_db_instance.ledger",
+  TF034: "aws_sns_topic.alerts",
+  TF035: "aws_sqs_queue.settlements",
+  TF036: "aws_ebs_volume.scratch",
+  TF037: "aws_ecr_repository.api",
+};
+
+const FAMILY = /^TF03[0-7]$/;
+
+describe("epic #2284 acceptance: chant audit over the estate roots", () => {
+  test("every rule TF030 to TF037 is in the barrel", () => {
+    const shipped = new Set(postSynthChecks.map((c) => c.id));
+    expect(Object.keys(EXPECTED).filter((id) => !shipped.has(id))).toEqual([]);
+  });
+
+  for (const [id, address] of Object.entries(EXPECTED)) {
+    test(`the violating root reports ${id} on ${address}`, async () => {
+      const findings = (await audit("violating")).filter((f) => f.checkId === id);
+      expect(findings.map((f) => f.entity)).toEqual([`audit-root/${address}`]);
+      expect(["error", "warning"]).toContain(findings[0]!.severity);
+    });
+  }
+
+  test("the violating root reports nothing TF030 to TF037 cannot prove", async () => {
+    const family = (await audit("violating")).filter((f) => FAMILY.test(f.checkId));
+    expect(family.filter((f) => f.severity === "info")).toEqual([]);
+    expect(family.map((f) => f.checkId).sort()).toEqual(Object.keys(EXPECTED));
+  });
+
+  test("the clean root, provider-default cases included, reports nothing from TF030 to TF037", async () => {
+    const family = (await audit("clean")).filter((f) => FAMILY.test(f.checkId));
+    expect(family).toEqual([]);
+  });
+});

package/src/lint/post-synth/fixtures/TF030/negative-rules.tf

@@ -0,0 +1,45 @@
+# Vendored for TF030 from https://github.com/aws-samples/aws-cloudwan-workshop-code
+# Path: terraform/modules/compute/main.tf
+# Commit: 1a331e8782b6cccdc5d0bb4ed28c45594445cc2f
+# Licence: MIT-0, https://github.com/aws-samples/aws-cloudwan-workshop-code/blob/1a331e8782b6cccdc5d0bb4ed28c45594445cc2f/LICENSE
+# Excerpt: lines 1-37, unmodified.
+#
+# TF030: silent. A group with no ingress at all (closed, not unknown), ICMP from 0.0.0.0/0 (no ports), SSH from a referenced security group rather than a CIDR, and an all-traffic egress rule.
+
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
+
+# --- modules/compute/main.tf ---
+
+# ---------- EC2 INSTANCES ----------
+# Security Group
+resource "aws_security_group" "instance_sg" {
+  name        = "${var.vpc_name}-instance-security-group-${var.project_name}"
+  description = "EC2 Instance Security Group"
+  vpc_id      = var.vpc_information.vpc_attributes.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "allowing_ingress_icmp" {
+  security_group_id = aws_security_group.instance_sg.id
+
+  from_port   = -1
+  to_port     = -1
+  ip_protocol = "icmp"
+  cidr_ipv4   = "0.0.0.0/0"
+}
+
+resource "aws_vpc_security_group_ingress_rule" "allowing_ingress_eic" {
+  security_group_id = aws_security_group.instance_sg.id
+
+  from_port                    = 22
+  to_port                      = 22
+  ip_protocol                  = "tcp"
+  referenced_security_group_id = aws_security_group.eic_sg.id
+}
+
+resource "aws_vpc_security_group_egress_rule" "allowing_egress_any" {
+  security_group_id = aws_security_group.instance_sg.id
+
+  ip_protocol = "-1"
+  cidr_ipv4   = "0.0.0.0/0"
+}