@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/src/lint/post-synth/fixtures/TF032/positive-sidecar.tf

@@ -0,0 +1,197 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/govuk-forms/forms-admin
+# Path: .review_apps/ecs_task_definition.tf
+# Commit: b338d4386619e3379a2555d65b8cfdf5d786905c
+# Licence: MIT
+# Copyright (c) 2022 Crown Copyright (Government Digital Service). MIT licence: https://github.com/govuk-forms/forms-admin/blob/b338d4386619e3379a2555d65b8cfdf5d786905c/LICENSE
+# Copied verbatim below this header. Fires once on the postgres sidecar's literal POSTGRES_PASSWORD; the two containers whose environment is local.forms_admin_env_vars are not determined. The traefik dockerLabels keys are templates, which the reader drops without losing the rest.
+
+locals {
+  logs_stream_prefix = "${data.terraform_remote_state.review.outputs.review_apps_log_group_name}/pr-${var.pull_request_number}"
+
+  # try() so that deploys succeed before the review environment state has
+  # published the assets outputs
+  assets_bucket_name        = try(data.terraform_remote_state.review.outputs.assets_bucket_name, "govuk-forms-review-assets")
+  forms_admin_task_role_arn = try(data.terraform_remote_state.review.outputs.forms_admin_task_role_arn, null)
+
+  review_app_hostname = "pr-${var.pull_request_number}.admin.review.forms.service.gov.uk"
+
+  forms_admin_startup_commands = [
+    "echo $PATH",
+    "bundle install",
+    "echo $PATH",
+    "bin/rails db:prepare",
+    "bin/rails s -b 0.0.0.0"
+  ]
+
+  forms_admin_shell_script = join(" && ", local.forms_admin_startup_commands)
+
+  forms_admin_env_vars = [
+    { name = "DATABASE_URL", value = "postgres://postgres:postgres@127.0.0.1:5432" },
+    { name = "EMAIL", value = "review-app-submissions@review.forms.service.gov.uk" },
+    { name = "GOVUK_APP_DOMAIN", value = "publishing.service.gov.uk" },
+    { name = "PORT", value = "3000" },
+    { name = "RAILS_DEVELOPMENT_HOSTS", value = "pr-${var.pull_request_number}.admin.review.forms.service.gov.uk" },
+    { name = "RAILS_ENV", value = "production" },
+    { name = "SECRET_KEY_BASE", value = "unsecured_secret_key_material" },
+    { name = "SETTINGS__ACT_AS_USER_ENABLED", value = "true" },
+    { name = "SETTINGS__AUTH_PROVIDER", value = "developer" },
+    { name = "SETTINGS__AWS__ASSETS_S3_BUCKET_NAME", value = local.assets_bucket_name },
+    { name = "SETTINGS__FORMS_ENV", value = "review" },
+    { name = "SETTINGS__FORMS_RUNNER__URL", value = "https://forms.service.gov.uk" },
+  ]
+}
+
+resource "aws_ecs_task_definition" "task" {
+  family = "forms-admin-pr-${var.pull_request_number}"
+
+  network_mode = "awsvpc"
+  cpu          = 256
+  memory       = 1024
+
+  requires_compatibilities = ["FARGATE"]
+
+  runtime_platform {
+    operating_system_family = "LINUX"
+    cpu_architecture        = "ARM64"
+  }
+
+  execution_role_arn = data.terraform_remote_state.review.outputs.ecs_task_execution_role_arn
+
+  # Gives the app permission to upload brand assets to the assets bucket
+  task_role_arn = local.forms_admin_task_role_arn
+
+  container_definitions = jsonencode([
+
+    # forms-admin
+    {
+      name        = "forms-admin"
+      image       = var.forms_admin_container_image
+      command     = []
+      essential   = true
+      environment = local.forms_admin_env_vars
+      # Uploaded files are buffered to tempfiles, and the app user cannot
+      # write to a volume mounted at /tmp, so the root filesystem cannot be
+      # read-only
+      readonlyRootFilesystem = false
+
+      dockerLabels = {
+        "traefik.http.middlewares.forms-admin-pr-${var.pull_request_number}.basicauth.users" : data.terraform_remote_state.review.outputs.traefik_basic_auth_credentials
+
+        "traefik.http.routers.forms-admin-pr-${var.pull_request_number}.rule" : "Host(`${local.review_app_hostname}`)",
+        "traefik.http.routers.forms-admin-pr-${var.pull_request_number}.service" : "forms-admin-pr-${var.pull_request_number}",
+        "traefik.http.routers.forms-admin-pr-${var.pull_request_number}.middlewares" : "forms-admin-pr-${var.pull_request_number}@ecs"
+
+        "traefik.http.services.forms-admin-pr-${var.pull_request_number}.loadbalancer.server.port" : "3000",
+        "traefik.http.services.forms-admin-pr-${var.pull_request_number}.loadbalancer.healthcheck.path" : "/up",
+        "traefik.enable" : "true",
+      },
+
+      portMappings = [
+        {
+          containerPort = 3000
+          hostPort      = 3000
+          protocol      = "tcp"
+          appProtocol   = "http"
+        }
+      ]
+
+      mountPoints    = []
+      systemControls = []
+      volumesFrom    = []
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = data.terraform_remote_state.review.outputs.review_apps_log_group_name
+          awslogs-region        = "eu-west-2"
+          awslogs-stream-prefix = "${local.logs_stream_prefix}/forms-admin"
+        }
+      }
+
+      healthCheck = {
+        command     = ["CMD-SHELL", "wget -O - 'http://localhost:3000/up' || exit 1"]
+        interval    = 30
+        retries     = 5
+        startPeriod = 180
+        timeout     = 5
+      }
+
+      dependsOn = [
+        {
+          containerName = "postgres"
+          condition     = "HEALTHY"
+        }
+      ]
+    },
+
+    # postgres
+    {
+      name      = "postgres"
+      image     = "public.ecr.aws/docker/library/postgres:16.6"
+      command   = []
+      essential = true
+
+      portMappings = [
+        {
+          containerPort = 5432
+          hostPort      = 5432
+          protocol      = "tcp"
+        }
+      ]
+
+      mountPoints    = []
+      systemControls = []
+      volumesFrom    = []
+
+      environment = [
+        { name = "POSTGRES_PASSWORD", value = "postgres" }
+      ]
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = data.terraform_remote_state.review.outputs.review_apps_log_group_name
+          awslogs-region        = "eu-west-2"
+          awslogs-stream-prefix = "${local.logs_stream_prefix}/postgres"
+        }
+      }
+
+      healthCheck = {
+        command  = ["CMD-SHELL", "psql -h localhost -p 5432 -U postgres -c \"SELECT current_timestamp - pg_postmaster_start_time();\""]
+        interval = 30
+        retries  = 3
+        timeout  = 5
+      }
+    },
+
+    # forms-admin-seeding
+    {
+      name                   = "forms-admin-seeding"
+      image                  = var.forms_admin_container_image
+      command                = ["rake", "db:create", "db:migrate", "db:seed"]
+      essential              = false
+      environment            = local.forms_admin_env_vars
+      readonlyRootFilesystem = true
+
+      mountPoints    = []
+      systemControls = []
+      volumesFrom    = []
+
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          awslogs-group         = data.terraform_remote_state.review.outputs.review_apps_log_group_name
+          awslogs-region        = "eu-west-2"
+          awslogs-stream-prefix = "${local.logs_stream_prefix}/forms-admin-seeding"
+        }
+      }
+
+      dependsOn = [
+        {
+          containerName = "postgres"
+          condition     = "HEALTHY"
+        }
+      ]
+    },
+  ])
+}

package/src/lint/post-synth/fixtures/TF032/positive.tf

@@ -0,0 +1,54 @@
+# Vendored for TF032 (chant #2287). Source: https://github.com/edstem-tech/paylink-platform
+# Path: terraform/ecs.tf
+# Commit: 2bbcbcce09434286cf90d20f69df0bd3ffa4cd00
+# Licence: MIT
+# Copyright (c) 2025 EdStem. MIT licence: permission notice at https://github.com/edstem-tech/paylink-platform/blob/2bbcbcce09434286cf90d20f69df0bd3ffa4cd00/LICENSE
+# Copied verbatim below this header. Fires twice: DB_PASSWORD and PAYMENT_API_KEY are literals in environment.
+
+resource "aws_ecs_cluster" "main" {
+  name = "paylink-prod"
+}
+
+resource "aws_ecs_task_definition" "api" {
+  family                   = "paylink-api"
+  network_mode             = "awsvpc"
+  requires_compatibilities = ["FARGATE"]
+  cpu                      = "1024"
+  memory                   = "2048"
+  task_role_arn            = aws_iam_role.task.arn
+  execution_role_arn       = aws_iam_role.execution.arn
+
+  container_definitions = jsonencode([{
+    name  = "api"
+    image = "${var.ecr_repo}:latest"
+
+    portMappings = [{ containerPort = 8080 }]
+
+    environment = [
+      { name = "SPRING_PROFILES_ACTIVE", value = "prod" },
+      { name = "DB_PASSWORD", value = "Pl-Pr0d-Db-2025!" },
+      { name = "PAYMENT_API_KEY", value = "pk_live_4RtYuIoP2aSdF6gH8jK" }
+    ]
+
+    healthCheck = {
+      command  = ["CMD-SHELL", "curl -f http://localhost:8080/actuator/health || exit 1"]
+      interval = 10
+      timeout  = 2
+      retries  = 3
+    }
+  }])
+}
+
+resource "aws_ecs_service" "api" {
+  name            = "paylink-api"
+  cluster         = aws_ecs_cluster.main.id
+  task_definition = aws_ecs_task_definition.api.arn
+  desired_count   = 2
+  launch_type     = "FARGATE"
+
+  network_configuration {
+    subnets          = aws_subnet.public[*].id
+    security_groups  = [aws_security_group.service.id]
+    assign_public_ip = true
+  }
+}

package/src/lint/post-synth/fixtures/TF033/negative.tf

@@ -0,0 +1,39 @@
+# Vendored for TF033 (chant #2288) from https://github.com/tmknom/example-pragmatic-terraform
+# Path: 13/4.tf
+# Commit: 7043f9216cf7fb55b3c5e9cd1926fe5da04a3ddb
+# Licence: Apache-2.0, https://github.com/tmknom/example-pragmatic-terraform/blob/7043f9216cf7fb55b3c5e9cd1926fe5da04a3ddb/LICENSE
+# The whole file, unmodified.
+#
+# TF033: silent. A MySQL DB instance with storage_encrypted = true and a customer managed kms_key_id.
+
+resource "aws_db_instance" "example" {
+  identifier                 = "example"
+  engine                     = "mysql"
+  engine_version             = "5.7.25"
+  instance_class             = "db.t3.small"
+  allocated_storage          = 20
+  max_allocated_storage      = 100
+  storage_type               = "gp2"
+  storage_encrypted          = true
+  kms_key_id                 = aws_kms_key.example.arn
+  username                   = "admin"
+  password                   = "VeryStrongPassword!"
+  multi_az                   = true
+  publicly_accessible        = false
+  backup_window              = "09:10-09:40"
+  backup_retention_period    = 30
+  maintenance_window         = "mon:10:10-mon:10:40"
+  auto_minor_version_upgrade = false
+  deletion_protection        = true
+  skip_final_snapshot        = false
+  port                       = 3306
+  apply_immediately          = false
+  vpc_security_group_ids     = [module.mysql_sg.security_group_id]
+  parameter_group_name       = aws_db_parameter_group.example.name
+  option_group_name          = aws_db_option_group.example.name
+  db_subnet_group_name       = aws_db_subnet_group.example.name
+
+  lifecycle {
+    ignore_changes = [password]
+  }
+}

package/src/lint/post-synth/fixtures/TF033/not-determined-aurora.tf

@@ -0,0 +1,25 @@
+# Vendored for TF033 (chant #2288) from https://github.com/bridgecrewio/terragoat
+# Path: terraform/aws/rds.tf
+# Commit: 729f8da62c6a85ce4af5ad3d123de97776d954c4
+# Licence: Apache-2.0, https://github.com/bridgecrewio/terragoat/blob/729f8da62c6a85ce4af5ad3d123de97776d954c4/LICENSE
+# Excerpt: lines 1-15, unmodified.
+#
+# TF033: one info, Not determined. An aws_rds_cluster with no engine (Aurora; provider v5 defaulted it to "aurora")
+# and no storage_encrypted. AWS encrypts Aurora clusters created on or after 2026-02-16 whatever the
+# configuration says, and the configuration does not say when this one was created.
+
+resource "aws_rds_cluster" "app1-rds-cluster" {
+  cluster_identifier      = "app1-rds-cluster"
+  allocated_storage       = 10
+  backup_retention_period = 0
+  tags = {
+    git_commit           = "079fe74f6b96d887c245664fbd8cf676c92f20e5"
+    git_file             = "terraform/aws/rds.tf"
+    git_last_modified_at = "2021-12-08 23:26:32"
+    git_last_modified_by = "tron47@gmail.com"
+    git_modifiers        = "tron47"
+    git_org              = "matansha"
+    git_repo             = "terragoat"
+    yor_trace            = "b6f2c2ec-0715-46a0-83d4-502e588826d1"
+  }
+}

package/src/lint/post-synth/fixtures/TF033/positive-absent.tf

@@ -0,0 +1,93 @@
+# Vendored for TF033 (chant #2288) from https://github.com/zoitech/terraform-aws-concourse
+# Path: rds.tf
+# Commit: fa3f3c3eecaa9144ea556e52cd3c43bff3bdd510
+# Licence: MIT, https://github.com/zoitech/terraform-aws-concourse/blob/fa3f3c3eecaa9144ea556e52cd3c43bff3bdd510/LICENSE
+# The whole file, unmodified.
+#
+# TF033: one error. aws_db_instance.postgres does not set storage_encrypted, and the provider default is false.
+# Its snapshot_identifier = "" is not a source: the provider reads it with GetOk, so "" is the same as unset.
+#
+# Copyright (c) 2017 Zoi TechCon GmbH
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_db_subnet_group" "postgres" {
+  name       = "${lower(var.prefix)}-private"
+  subnet_ids = var.private_sn
+
+  tags = var.rds_tags
+}
+
+resource "aws_db_parameter_group" "concourse" {
+  name   = "${var.prefix}-concourse-${var.postgres_family}"
+  family = var.postgres_family
+
+  tags = var.rds_tags
+}
+
+resource "aws_db_instance" "postgres" {
+  identifier                = "${lower(var.prefix)}-concourse-db"
+  allocated_storage         = var.concourse_db_storage
+  storage_type              = "gp2"
+  engine                    = "postgres"
+  engine_version            = var.postgres_version
+  instance_class            = var.concourse_db_size
+  username                  = var.postgres_username
+  password                  = local.postgres_password
+  db_subnet_group_name      = aws_db_subnet_group.postgres.id
+  parameter_group_name      = aws_db_parameter_group.concourse.id
+  multi_az                  = var.postgres_multiaz
+  backup_retention_period   = 35
+  maintenance_window        = "Sat:21:00-Sun:00:00"
+  backup_window             = "00:00-02:00"
+  vpc_security_group_ids    = [aws_security_group.RuleGroupWsIn.id]
+  copy_tags_to_snapshot     = true
+  snapshot_identifier       = ""
+  skip_final_snapshot       = true
+  final_snapshot_identifier = "LastSnap"
+  apply_immediately         = true
+
+  lifecycle {
+    prevent_destroy = true
+    ignore_changes  = [engine_version]
+  }
+
+  tags = merge({ Name = "${lower(var.prefix)}-concourse-db"}, var.rds_tags)
+}
+
+# Monitoring of DB events
+resource "aws_sns_topic" "postgres" {
+  name = "${lower(var.prefix)}-rds-topic"
+
+  tags = merge({ Name = "${lower(var.prefix)}-rds-topic"}, var.sns_tags)
+}
+
+resource "aws_db_event_subscription" "postgres" {
+  name      = "${lower(var.prefix)}-rds-sub"
+  sns_topic = aws_sns_topic.postgres.arn
+
+  source_type = "db-instance"
+  source_ids  = [aws_db_instance.postgres.identifier]
+
+  # see here for further event categories
+  event_categories = [
+    "low storage",
+  ]
+}
+

package/src/lint/post-synth/fixtures/TF033/positive.tf

@@ -0,0 +1,50 @@
+# Vendored for TF033 (chant #2288) from https://github.com/bridgecrewio/terragoat
+# Path: terraform/aws/db-app.tf
+# Commit: 729f8da62c6a85ce4af5ad3d123de97776d954c4
+# Licence: Apache-2.0, https://github.com/bridgecrewio/terragoat/blob/729f8da62c6a85ce4af5ad3d123de97776d954c4/LICENSE
+# Excerpt: lines 1-42, unmodified.
+#
+# TF033: one error. TerraGoat is a deliberately vulnerable estate; aws_db_instance.default writes storage_encrypted = false.
+
+resource "aws_db_instance" "default" {
+
+  name                   = var.dbname
+  engine                 = "mysql"
+  option_group_name      = aws_db_option_group.default.name
+  parameter_group_name   = aws_db_parameter_group.default.name
+  db_subnet_group_name   = aws_db_subnet_group.default.name
+  vpc_security_group_ids = ["${aws_security_group.default.id}"]
+
+  identifier              = "rds-${local.resource_prefix.value}"
+  engine_version          = "8.0" # Latest major version 
+  instance_class          = "db.t3.micro"
+  allocated_storage       = "20"
+  username                = "admin"
+  password                = var.password
+  apply_immediately       = true
+  multi_az                = false
+  backup_retention_period = 0
+  storage_encrypted       = false
+  skip_final_snapshot     = true
+  monitoring_interval     = 0
+  publicly_accessible     = true
+
+  tags = merge({
+    Name        = "${local.resource_prefix.value}-rds"
+    Environment = local.resource_prefix.value
+    }, {
+    git_commit           = "e6d83b21346fe85d4fe28b16c0b2f1e0662eb1d7"
+    git_file             = "terraform/aws/db-app.tf"
+    git_last_modified_at = "2023-04-27 12:47:51"
+    git_last_modified_by = "nadler@paloaltonetworks.com"
+    git_modifiers        = "nadler/nimrodkor"
+    git_org              = "bridgecrewio"
+    git_repo             = "terragoat"
+    yor_trace            = "47c13290-c2ce-48a7-b666-1b0085effb92"
+  })
+
+  # Ignore password changes from tf plan diff
+  lifecycle {
+    ignore_changes = ["password"]
+  }
+}

package/src/lint/post-synth/fixtures/TF034/negative.tf

@@ -0,0 +1,24 @@
+# Vendored for TF034 (chant #2288) from https://github.com/covidgreen/covid-green-infra
+# Path: sns.tf
+# Commit: 864d159afca9367db21cca05b1e8eb58038bdbd6
+# Licence: Apache-2.0, https://github.com/covidgreen/covid-green-infra/blob/864d159afca9367db21cca05b1e8eb58038bdbd6/LICENSE
+# The whole file, unmodified.
+#
+# TF034: silent. Both topics set kms_master_key_id = aws_kms_alias.sns.arn, an attribute of a managed alias,
+# which is never empty.
+
+resource "aws_sns_topic" "callback_email_notifications" {
+  count = local.enable_callback_email_notifications_count
+
+  name              = "${module.labels.id}-callback-email-notifications"
+  kms_master_key_id = aws_kms_alias.sns.arn
+  tags              = module.labels.tags
+}
+
+resource "aws_sns_topic" "daily_registrations_reporter" {
+  count = local.lambda_daily_registrations_reporter_count
+
+  name              = "${module.labels.id}-daily-registrations-reporter"
+  kms_master_key_id = aws_kms_alias.sns.arn
+  tags              = module.labels.tags
+}

package/src/lint/post-synth/fixtures/TF034/positive-absent.tf

@@ -0,0 +1,36 @@
+# Vendored for TF034 (chant #2288) from https://github.com/radian-software/riju
+# Path: tf/sns.tf
+# Commit: ace9df7cd8f186b869af14d721e055864ed8f3e4
+# Licence: MIT, https://github.com/radian-software/riju/blob/ace9df7cd8f186b869af14d721e055864ed8f3e4/LICENSE.md
+# The whole file, unmodified.
+#
+# TF034: one warning. The topic does not set kms_master_key_id, and no AWS default encrypts a topic that names no key.
+#
+# Copyright (c) 2020–2022 [Radian LLC](https://radian.codes) and
+# contributors
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_sns_topic" "riju" {
+  name = "Riju"
+
+  tags = {
+    BillingSubcategory = "Riju:SNS"
+  }
+}

package/src/lint/post-synth/fixtures/TF034/positive.tf

@@ -0,0 +1,14 @@
+# Vendored for TF034 (chant #2288) from https://github.com/Checkmarx/kics
+# Path: assets/queries/terraform/aws/sns_topic_not_encrypted/test/positive1.tf
+# Commit: 8a0f0bbaf380c6f9110bfe9808311f49aac45cde
+# Licence: Apache-2.0, https://github.com/Checkmarx/kics/blob/8a0f0bbaf380c6f9110bfe9808311f49aac45cde/LICENSE
+# The whole file, unmodified.
+#
+# KICS's own test corpus for "SNS Topic Not Encrypted".
+#
+# TF034: one warning. kms_master_key_id = "" names no key.
+
+resource "aws_sns_topic" "user_updates" {
+  name              = "user-updates-topic"
+  kms_master_key_id = ""
+}

package/src/lint/post-synth/fixtures/TF035/negative-absent.tf

@@ -0,0 +1,43 @@
+# Vendored for TF035 (chant #2288) from https://github.com/cds-snc/notification-terraform
+# Path: aws/common/sqs.tf
+# Commit: f202d882331fa2814170e4a65695291797af282d
+# Licence: MIT, https://github.com/cds-snc/notification-terraform/blob/f202d882331fa2814170e4a65695291797af282d/LICENSE
+# Excerpt: lines 60-73, unmodified.
+#
+# TF035: silent. The queue sets neither sqs_managed_sse_enabled nor kms_master_key_id, so AWS's SSE-SQS default
+# encrypts it. This is the case the bridged WAW026 got wrong on every queue.
+#
+# Copyright (c) 2020 Canadian Digital Service – Service numérique canadien
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_sqs_queue" "eks_notification_canada_cadelivery_receipts" {
+  provider         = aws.core_services
+  name             = "eks-notification-canada-cadelivery-receipts"
+  delay_seconds    = 0
+  max_message_size = var.sqs_max_message_size
+  #4 Days
+  message_retention_seconds  = 345600
+  receive_wait_time_seconds  = 0
+  visibility_timeout_seconds = var.sqs_visibility_timeout_default
+
+  tags = {
+    Environment = var.env
+  }
+}

package/src/lint/post-synth/fixtures/TF035/negative.tf

@@ -0,0 +1,54 @@
+# Vendored for TF035 (chant #2288) from https://github.com/cds-snc/notification-terraform
+# Path: aws/common/sqs.tf
+# Commit: f202d882331fa2814170e4a65695291797af282d
+# Licence: MIT, https://github.com/cds-snc/notification-terraform/blob/f202d882331fa2814170e4a65695291797af282d/LICENSE
+# Excerpt: lines 1-26, unmodified.
+#
+# TF035: silent. Three queues set sqs_managed_sse_enabled = true.
+#
+# Copyright (c) 2020 Canadian Digital Service – Service numérique canadien
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_sqs_queue" "priority_db_tasks_queue" {
+  provider                = aws.core_services
+  name                    = "${var.celery_queue_prefix}-${var.sqs_priority_db_tasks_queue_name}"
+  fifo_queue              = true
+  deduplication_scope     = "messageGroup"
+  fifo_throughput_limit   = "perMessageGroupId"
+  sqs_managed_sse_enabled = true
+  # tfsec:ignore:AWS015 - Queues should be encrypted with customer managed KMS keys
+  # AWS managed encryption is good enough for us
+}
+
+resource "aws_sqs_queue" "normal_db_tasks_queue" {
+  provider                = aws.core_services
+  name                    = "${var.celery_queue_prefix}-${var.sqs_normal_db_tasks_queue_name}"
+  sqs_managed_sse_enabled = true
+  # tfsec:ignore:AWS015 - Queues should be encrypted with customer managed KMS keys
+  # AWS managed encryption is good enough for us
+}
+
+resource "aws_sqs_queue" "bulk_db_tasks_queue" {
+  provider                = aws.core_services
+  name                    = "${var.celery_queue_prefix}-${var.sqs_bulk_db_tasks_queue_name}"
+  sqs_managed_sse_enabled = true
+  # tfsec:ignore:AWS015 - Queues should be encrypted with customer managed KMS keys
+  # AWS managed encryption is good enough for us
+}

package/src/lint/post-synth/fixtures/TF035/positive.tf

@@ -0,0 +1,37 @@
+# Vendored for TF035 (chant #2288) from https://github.com/cds-snc/notification-terraform
+# Path: aws/common/sqs.tf
+# Commit: f202d882331fa2814170e4a65695291797af282d
+# Licence: MIT, https://github.com/cds-snc/notification-terraform/blob/f202d882331fa2814170e4a65695291797af282d/LICENSE
+# Excerpt: lines 28-36, unmodified.
+#
+# TF035: one warning. sqs_managed_sse_enabled = false with no kms_master_key_id turns off the SSE-SQS default.
+#
+# Copyright (c) 2020 Canadian Digital Service – Service numérique canadien
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_sqs_queue" "notify_internal_tasks_queue" {
+  provider = aws.core_services
+  name     = "${var.celery_queue_prefix}notify-internal-tasks"
+  # This queue was created outside of terraform and has this value set to false in staging and production.
+  sqs_managed_sse_enabled = false
+  max_message_size        = var.sqs_max_message_size
+  # This queue was created outside of terraform and has this value set to default in staging and production.
+  visibility_timeout_seconds = var.sqs_visibility_timeout_default
+}