@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/src/lint/post-synth/fixtures/TF036/negative.tf

@@ -0,0 +1,61 @@
+# Vendored for TF036 (chant #2288) from https://github.com/ned1313/terraform-tuesdays
+# Path: 2021-04-13-AWS-KMS/ebs/main.tf
+# Commit: 7651f6028ba18f01ad0273a15169e4058025c944
+# Licence: MIT, https://github.com/ned1313/terraform-tuesdays/blob/7651f6028ba18f01ad0273a15169e4058025c944/LICENSE
+# The whole file, unmodified.
+#
+# TF036: silent. The volume sets encrypted = true with a customer managed kms_key_id.
+#
+# Copyright (c) 2020 Ned Bellavance
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 3.0"
+    }
+  }
+}
+
+# Configure the AWS Provider
+provider "aws" {
+  region = var.region
+}
+
+variable "region" {
+  type = string
+  default = "us-east-1"
+}
+
+data "aws_availability_zones" "azs" {
+  state = "available"
+}
+
+resource "aws_kms_key" "ebs" {
+  description = "EBS key"
+}
+
+resource "aws_ebs_volume" "encrypted" {
+  availability_zone = data.aws_availability_zones.azs.names[0]
+  size              = 40
+  encrypted = true
+  kms_key_id = aws_kms_key.ebs.arn
+}

package/src/lint/post-synth/fixtures/TF036/not-determined.tf

@@ -0,0 +1,28 @@
+# Vendored for TF036 (chant #2288) from https://github.com/bridgecrewio/terragoat
+# Path: terraform/aws/ec2.tf
+# Commit: 729f8da62c6a85ce4af5ad3d123de97776d954c4
+# Licence: Apache-2.0, https://github.com/bridgecrewio/terragoat/blob/729f8da62c6a85ce4af5ad3d123de97776d954c4/LICENSE
+# Excerpt: lines 34-51, unmodified.
+#
+# TF036: one info, Not determined. The volume does not set encrypted, so whether it is encrypted depends on the
+# Region's EBS encryption by default. The commented-out line in the source records why TerraGoat left
+# encrypted = false out: "Setting this causes the volume to be recreated on apply".
+
+resource "aws_ebs_volume" "web_host_storage" {
+  # unencrypted volume
+  availability_zone = "${var.region}a"
+  #encrypted         = false  # Setting this causes the volume to be recreated on apply 
+  size = 1
+  tags = merge({
+    Name = "${local.resource_prefix.value}-ebs"
+    }, {
+    git_commit           = "d3439f0f2af62f6fa3521e14d6c27819ef8f12e1"
+    git_file             = "terraform/aws/ec2.tf"
+    git_last_modified_at = "2021-05-02 11:17:26"
+    git_last_modified_by = "nimrodkor@users.noreply.github.com"
+    git_modifiers        = "nimrodkor"
+    git_org              = "bridgecrewio"
+    git_repo             = "terragoat"
+    yor_trace            = "c5509daf-10f0-46af-9e03-41989212521d"
+  })
+}

package/src/lint/post-synth/fixtures/TF036/positive.tf

@@ -0,0 +1,38 @@
+# Vendored for TF036 (chant #2288) from https://github.com/stelligent/config-lint
+# Path: example-files/config/volumes.tf
+# Commit: 8e87d18df9df2413a3bf3f57a3ceaf17a2140da9
+# Licence: MIT, https://github.com/stelligent/config-lint/blob/8e87d18df9df2413a3bf3f57a3ceaf17a2140da9/LICENSE.md
+# Excerpt: lines 9-16, unmodified.
+#
+# config-lint's own example files.
+#
+# TF036: one warning. encrypted = false.
+#
+# Copyright (c) 2018-2020 Stelligent
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+resource "aws_ebs_volume" "vol2" {
+    availability_zone = "us-west-2a"
+    size = 40
+    tags {
+        Name = "HelloWorld"
+    }
+    encrypted = false
+}

package/src/lint/post-synth/fixtures/TF037/negative-exclusion.tf

@@ -0,0 +1,63 @@
+# Vendored for TF037 (chant #2288) from https://github.com/lexicalunit/spellbot
+# Path: infrastructure/app/ecr.tf
+# Commit: 31ea539eff3df6da03195324f8bdd377210c54ec
+# Licence: MIT, https://github.com/lexicalunit/spellbot/blob/31ea539eff3df6da03195324f8bdd377210c54ec/LICENSE.md
+# Excerpt: lines 1-34, unmodified.
+#
+# TF037: silent. IMMUTABLE_WITH_EXCLUSION (provider v6) keeps SHA tags immutable and names the four moving
+# tags that stay mutable.
+#
+# Copyright (c) 2026 spellbot@lexicalunit.com
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+# ECR repository for SpellBot application
+resource "aws_ecr_repository" "spellbot" {
+  name = "spellbot-app"
+
+  # SHA-tagged images (the artifacts ECS actually pulls) are immutable. The
+  # moving aliases below are rewritten by the deploy workflow on every push
+  # and so must remain mutable.
+  image_tag_mutability = "IMMUTABLE_WITH_EXCLUSION"
+
+  image_tag_mutability_exclusion_filter {
+    filter      = "stage"
+    filter_type = "WILDCARD"
+  }
+  image_tag_mutability_exclusion_filter {
+    filter      = "prod"
+    filter_type = "WILDCARD"
+  }
+  image_tag_mutability_exclusion_filter {
+    filter      = "latest"
+    filter_type = "WILDCARD"
+  }
+  image_tag_mutability_exclusion_filter {
+    filter      = "pr-*"
+    filter_type = "WILDCARD"
+  }
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  tags = {
+    Name = "spellbot-ecr"
+  }
+}

package/src/lint/post-synth/fixtures/TF037/negative.tf

@@ -0,0 +1,27 @@
+# Vendored for TF037 (chant #2288) from https://github.com/aws-samples/sample-scribe-ai
+# Path: iac/ecr.tf
+# Commit: 384cb260f7e57797bc7275b72db5b2b262eee858
+# Licence: MIT-0, https://github.com/aws-samples/sample-scribe-ai/blob/384cb260f7e57797bc7275b72db5b2b262eee858/LICENSE
+# The whole file, unmodified.
+#
+# TF037: silent. Both repositories set image_tag_mutability = "IMMUTABLE".
+
+resource "aws_ecr_repository" "main" {
+  name                 = var.name
+  image_tag_mutability = "IMMUTABLE"
+  force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}
+
+resource "aws_ecr_repository" "lambda" {
+  name                 = "${var.name}-events"
+  image_tag_mutability = "IMMUTABLE"
+  force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}

package/src/lint/post-synth/fixtures/TF037/not-determined.tf

@@ -0,0 +1,27 @@
+# Vendored for TF037 (chant #2288) from https://github.com/turnerlabs/terraform-ecs-fargate
+# Path: base/ecr.tf
+# Commit: e51d5f3bafdaa7cb29527da979a006d0b7bb1dfb
+# Licence: Apache-2.0, https://github.com/turnerlabs/terraform-ecs-fargate/blob/e51d5f3bafdaa7cb29527da979a006d0b7bb1dfb/LICENSE
+# Excerpt: lines 1-18, unmodified.
+#
+# TF037: one info, Not determined. image_tag_mutability = var.image_tag_mutability. The variable's default is
+# "IMMUTABLE", but a caller can override it, and TF037 does not evaluate variables.
+
+/*
+ * ecr.tf
+ * Creates a Amazon Elastic Container Registry (ECR) for the application
+ * https://aws.amazon.com/ecr/
+ */
+
+# The tag mutability setting for the repository (defaults to IMMUTABLE)
+variable "image_tag_mutability" {
+  type        = string
+  default     = "IMMUTABLE"
+  description = "The tag mutability setting for the repository (defaults to IMMUTABLE)"
+}
+
+# create an ECR repo at the app/image level
+resource "aws_ecr_repository" "app" {
+  name                 = var.app
+  image_tag_mutability = var.image_tag_mutability
+}

package/src/lint/post-synth/fixtures/TF037/positive-absent.tf

@@ -0,0 +1,15 @@
+# Vendored for TF037 (chant #2288) from https://github.com/outerbounds/terraform-aws-metaflow
+# Path: ecr.tf
+# Commit: b56935a87aa623bf9c9d91efe22c54338dcef5a3
+# Licence: Apache-2.0, https://github.com/outerbounds/terraform-aws-metaflow/blob/b56935a87aa623bf9c9d91efe22c54338dcef5a3/LICENSE
+# The whole file, unmodified.
+#
+# TF037: one error. The repository does not set image_tag_mutability, and the provider default is MUTABLE.
+
+resource "aws_ecr_repository" "metaflow_batch_image" {
+  count = var.enable_custom_batch_container_registry ? 1 : 0
+
+  name = local.metaflow_batch_image_name
+
+  tags = var.tags
+}

package/src/lint/post-synth/fixtures/TF037/positive.tf

@@ -0,0 +1,26 @@
+# Vendored for TF037 (chant #2288) from https://github.com/bridgecrewio/terragoat
+# Path: terraform/aws/ecr.tf
+# Commit: 729f8da62c6a85ce4af5ad3d123de97776d954c4
+# Licence: Apache-2.0, https://github.com/bridgecrewio/terragoat/blob/729f8da62c6a85ce4af5ad3d123de97776d954c4/LICENSE
+# Excerpt: lines 1-18, unmodified.
+#
+# TF037: one error. image_tag_mutability = "MUTABLE".
+
+resource aws_ecr_repository "repository" {
+  name                 = "${local.resource_prefix.value}-repository"
+  image_tag_mutability = "MUTABLE"
+
+
+  tags = merge({
+    Name = "${local.resource_prefix.value}-repository"
+    }, {
+    git_commit           = "e6d83b21346fe85d4fe28b16c0b2f1e0662eb1d7"
+    git_file             = "terraform/aws/ecr.tf"
+    git_last_modified_at = "2023-04-27 12:47:51"
+    git_last_modified_by = "nadler@paloaltonetworks.com"
+    git_modifiers        = "nadler/nimrodkor"
+    git_org              = "bridgecrewio"
+    git_repo             = "terragoat"
+    yor_trace            = "7a3ec657-fa54-4aa2-8467-5d08d6c90bc2"
+  })
+}

package/src/lint/post-synth/fixtures/TF038/positive.tf

@@ -0,0 +1,3 @@
+module "network" {
+  source = "oci://registry.example.com/platform/network"
+}

package/src/lint/post-synth/fixtures/TF039/positive.tf

@@ -0,0 +1,4 @@
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "~> 5.0"
+}

package/src/lint/post-synth/fixtures/TF041/negative/terragrunt.hcl

@@ -0,0 +1,12 @@
+dependency "vpc" {
+  config_path = "../vpc"
+
+  mock_outputs = {
+    vpc_id = "vpc-00000000"
+  }
+  mock_outputs_allowed_terraform_commands = ["validate", "plan"]
+}
+
+dependency "db" {
+  config_path = "../db"
+}

package/src/lint/post-synth/fixtures/TF041/positive/terragrunt.hcl

@@ -0,0 +1,7 @@
+dependency "vpc" {
+  config_path = "../vpc"
+
+  mock_outputs = {
+    vpc_id = "vpc-00000000"
+  }
+}

package/src/lint/post-synth/fixtures/TF041/positive-apply/terragrunt.hcl

@@ -0,0 +1,8 @@
+dependency "vpc" {
+  config_path = "../vpc"
+
+  mock_outputs = {
+    vpc_id = "vpc-00000000"
+  }
+  mock_outputs_allowed_terraform_commands = ["validate", "plan", "apply"]
+}

package/src/lint/post-synth/fixtures/TF042/negative/terragrunt.hcl

@@ -0,0 +1,13 @@
+dependency "vpc" {
+  config_path  = "../vpc"
+  skip_outputs = true
+}
+
+dependency "db" {
+  config_path  = "../db"
+  skip_outputs = false
+
+  mock_outputs = {
+    endpoint = "db.example.com"
+  }
+}

package/src/lint/post-synth/fixtures/TF042/positive/terragrunt.hcl

@@ -0,0 +1,9 @@
+dependency "vpc" {
+  config_path = "../vpc"
+  skip_outputs = true
+
+  mock_outputs = {
+    vpc_id = "vpc-00000000"
+  }
+  mock_outputs_allowed_terraform_commands = ["validate", "plan"]
+}

package/src/lint/post-synth/fixtures/TF043/negative/terragrunt.hcl

@@ -0,0 +1,3 @@
+terraform {
+  source = "git::https://github.com/example/modules.git//vpc?ref=v1.4.0"
+}

package/src/lint/post-synth/fixtures/TF043/negative-other/terragrunt.hcl

@@ -0,0 +1,3 @@
+terraform {
+  source = "${get_repo_root()}/modules/vpc"
+}

package/src/lint/post-synth/fixtures/TF043/positive-git/terragrunt.hcl

@@ -0,0 +1,3 @@
+terraform {
+  source = "git::https://github.com/example/modules.git//vpc"
+}

package/src/lint/post-synth/fixtures/TF043/positive-oci/terragrunt.hcl

@@ -0,0 +1,3 @@
+terraform {
+  source = "oci://registry.example.com/platform/vpc"
+}

package/src/lint/post-synth/fixtures/TF043/positive-tfr/terragrunt.hcl

@@ -0,0 +1,3 @@
+terraform {
+  source = "tfr:///terraform-aws-modules/vpc/aws"
+}

package/src/lint/post-synth/fixtures/TF044/negative/terragrunt.hcl

@@ -0,0 +1,9 @@
+remote_state {
+  backend = "s3"
+
+  config = {
+    bucket = "example-tfstate"
+    key    = "${path_relative_to_include()}/terraform.tfstate"
+    region = "us-east-1"
+  }
+}

package/src/lint/post-synth/fixtures/TF044/positive/terragrunt.hcl

@@ -0,0 +1,7 @@
+remote_state {
+  backend = "local"
+
+  config = {
+    path = "${get_parent_terragrunt_dir()}/.state/${path_relative_to_include()}/terraform.tfstate"
+  }
+}

package/src/lint/post-synth/fixtures/TF044/positive-generate/terragrunt.hcl

@@ -0,0 +1,9 @@
+generate "backend" {
+  path      = "backend.tf"
+  if_exists = "overwrite"
+  contents  = <<-EOT
+    terraform {
+      backend "local" {}
+    }
+  EOT
+}

package/src/lint/post-synth/fixtures/TF045/negative/root.hcl

@@ -0,0 +1 @@
+terragrunt_version_constraint = ">= 1.1.0"

package/src/lint/post-synth/fixtures/TF045/negative/terragrunt.hcl

@@ -0,0 +1,3 @@
+include "root" {
+  path = find_in_parent_folders("root.hcl")
+}

package/src/lint/post-synth/fixtures/TF045/positive/root.hcl

@@ -0,0 +1,9 @@
+remote_state {
+  backend = "s3"
+
+  config = {
+    bucket = "example-tfstate"
+    key    = "${path_relative_to_include()}/terraform.tfstate"
+    region = "us-east-1"
+  }
+}

package/src/lint/post-synth/fixtures/TF045/positive/terragrunt.hcl

@@ -0,0 +1,3 @@
+include "root" {
+  path = find_in_parent_folders("root.hcl")
+}

package/src/lint/post-synth/fixtures/TF045/unit-only/terragrunt.hcl

@@ -0,0 +1,3 @@
+include "root" {
+  path = find_in_parent_folders("root.hcl")
+}

package/src/lint/post-synth/fixtures/estate-2284/clean/main.tf

@@ -0,0 +1,132 @@
+# Epic #2284 acceptance estate, clean root. Written for chant, not vendored.
+# The same estate as ../violating with every finding fixed, and with the
+# provider-default cases left as real estates leave them: an SQS queue that
+# sets no encryption attribute (encrypted by AWS's SSE-SQS default), an EBS
+# volume that leaves `encrypted` unset but depends on an enabled
+# `aws_ebs_encryption_by_default`, an SNS topic on the AWS managed key, and an
+# ECR repository that keeps `latest` mutable through an exclusion filter.
+# TF030 to TF037 report nothing here (src/lint/post-synth/estate-2284.test.ts).
+
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "acme-terraform-state"
+    key    = "payments/terraform.tfstate"
+    region = "eu-west-1"
+  }
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "eu-west-1"
+}
+
+# TF030: HTTPS from anywhere, SSH from the VPC only.
+resource "aws_security_group" "web" {
+  name   = "web"
+  vpc_id = "vpc-0a1b2c3d4e5f60718"
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["10.0.0.0/8"]
+  }
+}
+
+# TF031: named actions on named resources.
+data "aws_iam_policy_document" "deployer" {
+  statement {
+    actions   = ["ecs:UpdateService", "ecs:DescribeServices"]
+    resources = [aws_ecs_task_definition.api.arn]
+  }
+}
+
+resource "aws_iam_policy" "deployer" {
+  name   = "deployer"
+  policy = data.aws_iam_policy_document.deployer.json
+}
+
+# TF032: the password comes from Secrets Manager.
+resource "aws_ecs_task_definition" "api" {
+  family                   = "payments-api"
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+  cpu                      = "512"
+  memory                   = "1024"
+
+  container_definitions = jsonencode([{
+    name  = "api"
+    image = "public.ecr.aws/acme/payments-api:1.4.2"
+    environment = [
+      { name = "LOG_LEVEL", value = "info" }
+    ]
+    secrets = [
+      { name = "DB_PASSWORD", valueFrom = "arn:aws:secretsmanager:eu-west-1:111122223333:secret:ledger-db" }
+    ]
+  }])
+}
+
+# TF033: encrypted storage.
+resource "aws_db_instance" "ledger" {
+  identifier          = "ledger"
+  engine              = "postgres"
+  instance_class      = "db.t4g.medium"
+  allocated_storage   = 50
+  username            = "ledger"
+  password            = var.db_password
+  storage_encrypted   = true
+  skip_final_snapshot = true
+}
+
+variable "db_password" {
+  type      = string
+  sensitive = true
+}
+
+# TF034: the AWS managed key.
+resource "aws_sns_topic" "alerts" {
+  name              = "payments-alerts"
+  kms_master_key_id = "alias/aws/sns"
+}
+
+# TF035: provider default. No encryption attribute; SQS encrypts new queues
+# with SSE-SQS.
+resource "aws_sqs_queue" "settlements" {
+  name = "settlements"
+}
+
+# TF036: provider default. `encrypted` unset, the Region's encryption by
+# default turned on first.
+resource "aws_ebs_encryption_by_default" "on" {}
+
+resource "aws_ebs_volume" "scratch" {
+  availability_zone = "eu-west-1a"
+  size              = 100
+  depends_on        = [aws_ebs_encryption_by_default.on]
+}
+
+# TF037: immutable tags, with `latest` as the one written-down exception.
+resource "aws_ecr_repository" "api" {
+  name                 = "payments-api"
+  image_tag_mutability = "IMMUTABLE_WITH_EXCLUSION"
+
+  image_tag_mutability_exclusion_filter {
+    filter      = "latest"
+    filter_type = "WILDCARD"
+  }
+}