@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/src/lint/post-synth/tf032.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { tf032 } from "./tf032";
+import { loadFixture } from "./fixtures/load";
+import { blocksToEntities } from "../../hcl/parse";
+
+async function ctxOf(source: string): Promise<PostSynthContext> {
+  const entities = await blocksToEntities([{ name: "main.tf", source }], "TF032");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+const errors = (d: PostSynthDiagnostic[]) => d.filter((x) => x.severity === "error");
+const infos = (d: PostSynthDiagnostic[]) => d.filter((x) => x.severity === "info");
+
+/** One task definition around a container_definitions expression. */
+const task = (defs: string) => `resource "aws_ecs_task_definition" "t" {\n  family = "t"\n  container_definitions = ${defs}\n}\n`;
+
+describe("TF032: plaintext credential in an ECS container definition", () => {
+  test("fires on each literal credential in a jsonencode'd environment (edstem paylink-platform)", async () => {
+    const diags = tf032.check(await loadFixture("TF032", "positive"));
+    expect(errors(diags).map((d) => d.message.match(/passes "([^"]+)"/)?.[1])).toEqual(["DB_PASSWORD", "PAYMENT_API_KEY"]);
+    // `image = "${var.ecr_repo}:latest"` is an unknown leaf, not a reason to give up on the container.
+    expect(infos(diags)).toHaveLength(0);
+    for (const d of errors(diags)) {
+      expect(d.checkId).toBe("TF032");
+      expect(d.entity).toBe("TF032/aws_ecs_task_definition.api");
+      expect(d.message).toContain("redacted");
+      expect(d.message).not.toContain("Pl-Pr0d-Db-2025!");
+      expect(d.message).not.toContain("pk_live_");
+    }
+  });
+
+  test("reads a heredoc with no interpolation as JSON (trivy-checks' failing example)", async () => {
+    const diags = tf032.check(await loadFixture("TF032", "positive-heredoc"));
+    expect(errors(diags)).toHaveLength(1);
+    expect(errors(diags)[0].message).toContain('"DATABASE_PASSWORD"');
+    expect(errors(diags)[0].message).toContain('container "my_service"');
+  });
+
+  test("fires on a literal sidecar password and reports the local-fed environments as not determined (govuk forms-admin)", async () => {
+    const diags = tf032.check(await loadFixture("TF032", "positive-sidecar"));
+    expect(errors(diags)).toHaveLength(1);
+    expect(errors(diags)[0].message).toContain('container "postgres" passes "POSTGRES_PASSWORD"');
+    const nd = infos(diags);
+    expect(nd).toHaveLength(2);
+    for (const d of nd) {
+      expect(d.message.startsWith("Not determined:")).toBe(true);
+      expect(d.message).toContain("`environment`");
+    }
+    expect(nd.map((d) => d.message.match(/container "([^"]+)"/)?.[1])).toEqual(["forms-admin", "forms-admin-seeding"]);
+  });
+
+  test("is silent when credentials come through secrets (vapor penny-bot)", async () => {
+    expect(tf032.check(await loadFixture("TF032", "negative"))).toEqual([]);
+  });
+
+  test("is silent on trivy-checks' passing example", async () => {
+    expect(tf032.check(await loadFixture("TF032", "negative-heredoc"))).toEqual([]);
+  });
+
+  test("a reference value is not a literal, a container with no environment is not insecure (testdrivenio)", async () => {
+    const diags = tf032.check(await loadFixture("TF032", "negative-references"));
+    expect(errors(diags)).toEqual([]);
+    // The one task whose definitions are `data.template_file.app.rendered`.
+    expect(infos(diags)).toHaveLength(1);
+    expect(infos(diags)[0].entity).toBe("TF032/aws_ecs_task_definition.app");
+    expect(infos(diags)[0].message).toMatch(/^Not determined: .*data\.template_file\.app\.rendered/);
+  });
+
+  describe("not determined, never a warning", () => {
+    test.each([
+      ["file()", 'file("service.json")', /call to file\(\)/],
+      ["templatefile()", 'templatefile("defs.tpl", { image = var.image })', /call to templatefile\(\)/],
+      ["a local", "local.container_definitions", /reference `local\.container_definitions`/],
+      ["jsonencode(concat(...))", "jsonencode(concat([{ name = \"a\" }], var.extra))", /jsonencode argument holds/],
+      ["a heredoc with interpolation", '<<EOT\n[{"name":"a","image":"${var.image}"}]\nEOT', /interpolation/],
+    ])("%s", async (_label, defs, reason) => {
+      const diags = tf032.check(await ctxOf(task(defs)));
+      expect(diags).toHaveLength(1);
+      expect(diags[0].severity).toBe("info");
+      expect(diags[0].message.startsWith("Not determined:")).toBe(true);
+      expect(diags[0].message).toMatch(reason);
+    });
+
+    test("an environment entry that is itself an expression", async () => {
+      const diags = tf032.check(
+        await ctxOf(task('jsonencode([{ name = "a", environment = [{ name = "MODE", value = "api" }, local.extra_env] }])')),
+      );
+      expect(diags).toHaveLength(1);
+      expect(diags[0].severity).toBe("info");
+      expect(diags[0].message).toContain('container "a"');
+    });
+  });
+
+  test("the same name through secrets does not fire; a secret-named literal in environment does", async () => {
+    const viaSecrets = task(
+      'jsonencode([{ name = "a", secrets = [{ name = "DB_PASSWORD", valueFrom = "arn:aws:ssm:eu-west-1:123456789012:parameter/db" }] }])',
+    );
+    expect(tf032.check(await ctxOf(viaSecrets))).toEqual([]);
+    const viaEnv = task('jsonencode([{ name = "a", environment = [{ name = "DB_PASSWORD", value = "s3cr3t-Pa55word" }] }])');
+    expect(errors(tf032.check(await ctxOf(viaEnv)))).toHaveLength(1);
+  });
+
+  test("short values, placeholders and lookalike names are not credentials", async () => {
+    const defs = task(
+      'jsonencode([{ name = "a", environment = [' +
+        '{ name = "PASSWORD_MIN_LENGTH", value = "8" },' +
+        '{ name = "DB_PASSWORD", value = "changeme-please" },' +
+        '{ name = "TOKENIZER", value = "wordpiece-uncased" },' +
+        '{ name = "DB_SECRET_ARN", value = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:db" }' +
+        "] }])",
+    );
+    expect(tf032.check(await ctxOf(defs))).toEqual([]);
+  });
+
+  test("a credential-shaped value fires whatever it is called", async () => {
+    const defs = task('jsonencode([{ name = "a", environment = [{ name = "UPSTREAM", value = "AKIAIOSFODNN7EXAMPLF" }] }])');
+    const diags = errors(tf032.check(await ctxOf(defs)));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("shape of a credential");
+  });
+
+  test("only aws_ecs_task_definition is read", async () => {
+    const src = 'resource "aws_ecs_service" "s" {\n  name = "s"\n  container_definitions = local.x\n}\n';
+    expect(tf032.check(await ctxOf(src))).toEqual([]);
+  });
+});

package/src/lint/post-synth/tf032.ts

@@ -0,0 +1,226 @@
+/**
+ * TF032: an ECS container definition passes a credential as a plaintext
+ * environment value.
+ *
+ * The Terraform counterpart of the aws lexicon's WAW046. A value under a
+ * container's `environment` is stored verbatim in the task definition: it is
+ * readable by anyone with `ecs:DescribeTaskDefinition`, it shows in the
+ * console, and it is in Terraform state and plan output. ECS has a field for
+ * exactly this, `secrets`, whose `valueFrom` is a Secrets Manager or SSM
+ * Parameter Store ARN that the agent resolves at task start. A credential
+ * belongs there.
+ *
+ * Why this is a native rule and not WAW046 through a bridge
+ * (docs/design/waw-hcl-fidelity-probe.md): `container_definitions` is a JSON
+ * string. In HCL it is almost always `jsonencode([...])`, which hcl2json hands
+ * back as the call's unevaluated source text, so the structure WAW046 reads
+ * does not exist in the parse until something reads that text.
+ * `../../hcl/jsonencode.ts` does, for literal structure only, and never
+ * evaluates anything.
+ *
+ * The three answers, per task definition:
+ *
+ * - Readable. `container_definitions` is `jsonencode([...])` whose list and
+ *   containers are literal, or a plain JSON string (a heredoc with no
+ *   interpolation is one). A reference or function call in a leaf
+ *   (`image = var.image`, `value = var.db_password`) does not stop the read:
+ *   that leaf is unknown and the literal fields beside it are still read. An
+ *   environment entry whose value is a reference is skipped, since a
+ *   reference is not a committed literal (TF007 and TF022 judge where the
+ *   referenced value comes from).
+ * - Violation. A readable environment entry whose `value` is a literal string
+ *   and is secret-shaped by `../secret-shape.ts`: a credential-looking name
+ *   with a literal of at least 8 characters that is not a placeholder, or a
+ *   value that is a credential on its own (a vendor key shape, a JWT, a PEM
+ *   key, a high-entropy token) whatever it is called.
+ * - Not determined. `container_definitions` is a reference
+ *   (`local.defs`, `data.template_file.x.rendered`), `file()`,
+ *   `templatefile()`, a heredoc or string with interpolation, a jsonencode
+ *   argument that is not a literal list (`jsonencode(concat(...))`,
+ *   `jsonencode(local.containers)`), or a container whose `environment` is an
+ *   expression (`environment = local.env`). One `info` diagnostic starting
+ *   `Not determined:` per task definition or container, never a warning.
+ *
+ * Absence: a container with no `environment` is not insecure, and a task
+ * definition with no `container_definitions` is not reported (the attribute
+ * is required, so that is a plan error, not this rule's finding). A name in
+ * `secrets` is never reported: `secrets` is not read at all.
+ *
+ * Findings never carry the value, only its length.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { RESOURCE_TYPE } from "../../hcl/parse";
+import { attr } from "../../hcl/value";
+import { isUnknown, readJsonencode } from "../../hcl/jsonencode";
+import { secretShapedAssignment } from "../secret-shape";
+import { blocksOfType, type TerraformBlock } from "./blocks";
+
+const TASK_DEFINITION = "aws_ecs_task_definition";
+
+/** The container definitions of one task definition, or why they cannot be read. */
+export type ContainerDefinitionsRead =
+  | { kind: "readable"; containers: unknown }
+  | { kind: "not-determined"; reason: string }
+  | { kind: "absent" };
+
+/**
+ * Read `container_definitions` as structure without evaluating anything.
+ * `jsonencode(...)` goes through the shared reader with unknown leaves; a
+ * plain string with no interpolation is JSON (a heredoc arrives as one);
+ * everything else is named in the not-determined reason.
+ */
+export function readContainerDefinitions(body: Record<string, unknown>): ContainerDefinitionsRead {
+  const raw = body.container_definitions;
+  if (raw === undefined || raw === null) return { kind: "absent" };
+
+  const encoded = readJsonencode(raw, { unknownLeaves: true });
+  if (encoded.kind === "literal") return { kind: "readable", containers: encoded.value };
+  if (encoded.kind === "not-determined") {
+    return { kind: "not-determined", reason: `its jsonencode argument holds ${encoded.reason}` };
+  }
+
+  if (typeof raw !== "string") return { kind: "not-determined", reason: "it is not a string" };
+  // attr() alone is not enough to call a string literal: its interpolation
+  // pattern tolerates one level of nested braces, so a deeper expression can
+  // read as `literal`. Any `${` at all means the parse did not hand us text.
+  if (!raw.includes("${")) {
+    try {
+      return { kind: "readable", containers: JSON.parse(raw) };
+    } catch {
+      return { kind: "not-determined", reason: "it is a string that is not valid JSON" };
+    }
+  }
+  return { kind: "not-determined", reason: describeExpression(raw) };
+}
+
+/** Name the expression an unreadable `container_definitions` holds, for the message. */
+function describeExpression(raw: string): string {
+  const a = attr({ v: raw }, "v");
+  if (a.kind === "reference" && a.refs?.[0] !== undefined) {
+    const expr = a.refs[0];
+    const call = /^([a-z_][a-z0-9_]*)\s*\(/i.exec(expr);
+    if (call) return `it is a call to ${call[1]}(), which this rule does not evaluate`;
+    return `it is the reference \`${expr}\`, whose value is not in this module's source`;
+  }
+  return "it is a string or heredoc with interpolation, which this rule does not evaluate";
+}
+
+/** A container's display name: its literal `name`, else its position. */
+function containerName(container: Record<string, unknown>, index: number): string {
+  return typeof container.name === "string" ? container.name : `#${index}`;
+}
+
+function notDetermined(block: TerraformBlock, what: string, reason: string): PostSynthDiagnostic {
+  return {
+    checkId: "TF032",
+    severity: "info",
+    message:
+      `Not determined: "${block.address}" ${what}: ${reason}. TF032 reads only literal structure, ` +
+      "so a plaintext credential in it can be neither found nor ruled out.",
+    entity: block.key,
+    lexicon: "terraform",
+  };
+}
+
+export function checkEcsPlaintextCredentials(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const block of blocksOfType(ctx, RESOURCE_TYPE)) {
+    if (!block.address.startsWith(`${TASK_DEFINITION}.`)) continue;
+
+    const read = readContainerDefinitions(block.body);
+    if (read.kind === "absent") continue;
+    if (read.kind === "not-determined") {
+      diagnostics.push(notDetermined(block, "`container_definitions`", read.reason));
+      continue;
+    }
+    // A literal that is not a list is not a valid container_definitions; the
+    // provider rejects it at plan, and there is no environment to read.
+    if (!Array.isArray(read.containers)) continue;
+
+    read.containers.forEach((container, index) => {
+      if (isUnknown(container)) {
+        diagnostics.push(
+          notDetermined(block, `container #${index} of \`container_definitions\``, `it is ${container.reason}`),
+        );
+        return;
+      }
+      if (typeof container !== "object" || container === null || Array.isArray(container)) return;
+      const c = container as Record<string, unknown>;
+      const name = containerName(c, index);
+
+      const env = c.environment;
+      if (env === undefined || env === null) return;
+      if (isUnknown(env)) {
+        diagnostics.push(notDetermined(block, `container "${name}" \`environment\``, `it is ${env.reason}`));
+        return;
+      }
+      if (!Array.isArray(env)) return;
+
+      const unreadable: string[] = [];
+      for (const entry of env) {
+        if (isUnknown(entry)) {
+          unreadable.push(entry.reason);
+          continue;
+        }
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+        const e = entry as Record<string, unknown>;
+        if (isUnknown(e.name)) {
+          // A computed variable name could be anything, so the entry is
+          // unreadable only when it also carries a literal value to judge.
+          if (typeof e.value === "string") unreadable.push(e.name.reason);
+          continue;
+        }
+        if (typeof e.name !== "string") continue;
+        // A reference value is the remediation's neighbour, not a literal:
+        // skipped. Numbers and booleans are not credentials.
+        if (typeof e.value !== "string") continue;
+
+        const shape = secretShapedAssignment(e.name, e.value);
+        if (!shape) continue;
+        const why =
+          shape.reason === "name"
+            ? "its name reads like a credential"
+            : "the value has the shape of a credential";
+        diagnostics.push({
+          checkId: "TF032",
+          severity: "error",
+          message:
+            `"${block.address}" container "${name}" passes "${e.name}" as a plaintext environment value ` +
+            `(${shape.length} characters, redacted here; ${why}). It is stored in the task definition, ` +
+            "visible to anyone who can describe it, and in state and plan output. Move it to the " +
+            "container's `secrets` with a `valueFrom` naming a Secrets Manager secret or SSM parameter, " +
+            "and rotate the committed value.",
+          entity: block.key,
+          lexicon: "terraform",
+        });
+      }
+
+      if (unreadable.length > 0) {
+        diagnostics.push(
+          notDetermined(
+            block,
+            `container "${name}" \`environment\``,
+            `${unreadable.length} entr${unreadable.length === 1 ? "y is" : "ies are"} not literal (${unreadable[0]})`,
+          ),
+        );
+      }
+    });
+  }
+
+  return diagnostics;
+}
+
+export const tf032: PostSynthCheck = {
+  id: "TF032",
+  description: "ECS container definition passes a credential as a plaintext environment value",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcsPlaintextCredentials(ctx);
+  },
+};

package/src/lint/post-synth/tf033.test.ts

@@ -0,0 +1,126 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadFixture } from "./fixtures/load";
+import { tf033 } from "./tf033";
+
+async function inline(source: string): Promise<PostSynthContext> {
+  const entities = await blocksToEntities([{ name: "main.tf", source }], "app");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+const verdicts = (d: PostSynthDiagnostic[]) => d.map((x) => `${x.severity} ${x.entity}`).sort();
+
+describe("TF033 over vendored real-world fixtures", () => {
+  test("storage_encrypted = true is silent (tmknom/example-pragmatic-terraform)", async () => {
+    expect(tf033.check(await loadFixture("TF033", "negative"))).toEqual([]);
+  });
+
+  test("storage_encrypted = false is an error (bridgecrewio/terragoat)", async () => {
+    const diags = tf033.check(await loadFixture("TF033", "positive"));
+    expect(verdicts(diags)).toEqual(["error TF033/aws_db_instance.default"]);
+    expect(diags[0]).toMatchObject({ checkId: "TF033", lexicon: "terraform" });
+    expect(diags[0].message).toContain("sets `storage_encrypted = false`");
+  });
+
+  test("an instance that does not set storage_encrypted is an error; snapshot_identifier = \"\" is no source (zoitech)", async () => {
+    const diags = tf033.check(await loadFixture("TF033", "positive-absent"));
+    expect(verdicts(diags)).toEqual(["error TF033/aws_db_instance.postgres"]);
+    expect(diags[0].message).toContain("the provider default is `false`");
+  });
+
+  test("an Aurora cluster without storage_encrypted is not determined (bridgecrewio/terragoat)", async () => {
+    const diags = tf033.check(await loadFixture("TF033", "not-determined-aurora"));
+    expect(verdicts(diags)).toEqual(["info TF033/aws_rds_cluster.app1-rds-cluster"]);
+    expect(diags[0].message).toMatch(/^Not determined: /);
+    expect(diags[0].message).toContain("2026-02-16");
+  });
+});
+
+describe("TF033 cases the fixtures do not isolate", () => {
+  test("an instance created from a source is not determined unless storage_encrypted = true", async () => {
+    const diags = tf033.check(
+      await inline(`
+resource "aws_db_instance" "replica" {
+  replicate_source_db = aws_db_instance.primary.identifier
+}
+resource "aws_db_instance" "restored" {
+  snapshot_identifier = "rds:prod-2026-01-01"
+  storage_encrypted   = false
+}
+resource "aws_db_instance" "pitr" {
+  restore_to_point_in_time {
+    use_latest_restorable_time = true
+  }
+}
+resource "aws_db_instance" "explicit" {
+  snapshot_identifier = "rds:prod-2026-01-01"
+  storage_encrypted   = true
+}`),
+    );
+    expect(verdicts(diags)).toEqual([
+      "info app/aws_db_instance.pitr",
+      "info app/aws_db_instance.replica",
+      "info app/aws_db_instance.restored",
+    ]);
+    expect(diags.find((d) => d.entity === "app/aws_db_instance.replica")!.message).toContain("`replicate_source_db`");
+  });
+
+  test("a storage_encrypted expression is not determined; the string \"true\" is true", async () => {
+    const diags = tf033.check(
+      await inline(`
+resource "aws_db_instance" "v" {
+  storage_encrypted = var.encrypted
+}
+resource "aws_db_instance" "s" {
+  storage_encrypted = "true"
+}`),
+    );
+    expect(verdicts(diags)).toEqual(["info app/aws_db_instance.v"]);
+    expect(diags[0].message).toContain("`storage_encrypted` is an expression (var.encrypted)");
+  });
+
+  test("a Multi-AZ DB cluster defaults to unencrypted; Aurora false and an engine expression are not determined", async () => {
+    const diags = tf033.check(
+      await inline(`
+resource "aws_rds_cluster" "multi_az" {
+  engine                    = "postgres"
+  db_cluster_instance_class = "db.r6gd.large"
+}
+resource "aws_rds_cluster" "multi_az_off" {
+  engine            = "mysql"
+  storage_encrypted = false
+}
+resource "aws_rds_cluster" "aurora_off" {
+  engine            = "aurora-postgresql"
+  storage_encrypted = false
+}
+resource "aws_rds_cluster" "engine_var" {
+  engine = var.engine
+}
+resource "aws_rds_cluster" "restored" {
+  engine              = "postgres"
+  snapshot_identifier = "arn:aws:rds:eu-west-1:111122223333:cluster-snapshot:x"
+}
+resource "aws_rds_cluster" "serverless_v1" {
+  engine      = "aurora-mysql"
+  engine_mode = "serverless"
+}
+resource "aws_rds_cluster" "on" {
+  engine            = "postgres"
+  storage_encrypted = true
+}`),
+    );
+    expect(verdicts(diags)).toEqual([
+      "error app/aws_rds_cluster.multi_az",
+      "error app/aws_rds_cluster.multi_az_off",
+      "info app/aws_rds_cluster.aurora_off",
+      "info app/aws_rds_cluster.engine_var",
+      "info app/aws_rds_cluster.restored",
+    ]);
+  });
+
+  test("aws_rds_cluster_instance is never read", async () => {
+    expect(tf033.check(await inline(`resource "aws_rds_cluster_instance" "i" { cluster_identifier = "c" }`))).toEqual([]);
+  });
+});

package/src/lint/post-synth/tf033.ts

@@ -0,0 +1,160 @@
+/**
+ * TF033: an RDS DB instance or cluster does not encrypt its storage
+ * (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW021, written natively.
+ * WAW021 reads a template chant synthesized, where `StorageEncrypted` absent
+ * means false. Reading somebody else's HCL, absence means different things
+ * for the two resources and for how the database is created, so each case is
+ * decided here against the provider schema and the AWS default.
+ *
+ * `aws_db_instance` (provider `internal/service/rds/instance.go`, v6.67.0):
+ * `storage_encrypted` is optional, not computed, and the docs say "The
+ * default is `false` if not specified". The plain create path and `s3_import`
+ * send `StorageEncrypted: d.Get("storage_encrypted")`, so absent means false
+ * and is reported. The replica (`replicate_source_db`), snapshot
+ * (`snapshot_identifier`) and point-in-time (`restore_to_point_in_time`)
+ * paths never send it: the new instance takes its encryption from the source
+ * (and a cross-region replica from `kms_key_id`). For those the rule cannot
+ * know, and says so, unless `storage_encrypted = true` is written down.
+ *
+ * `aws_rds_cluster` (`cluster.go`): `storage_encrypted` is optional and
+ * computed, sent only when set, and "Terraform will only perform drift
+ * detection if a configuration value is provided". Two engine families:
+ *
+ * - Aurora (`engine` `aurora-mysql`/`aurora-postgresql`, or absent, which
+ *   provider v5 defaulted to `aurora`). Since 2026-02-16 AWS encrypts every
+ *   new Aurora cluster at rest with an AWS-owned key whatever
+ *   `StorageEncrypted` says, and reports `StorageEncrypted: false` with
+ *   `StorageEncryptionType: sse-rds` for it. A cluster created before that
+ *   date with storage encryption off is unencrypted, and the configuration
+ *   does not say when its cluster was created. So an Aurora cluster with
+ *   `storage_encrypted` absent or `false` is not determined, not a finding.
+ *   `engine_mode = "serverless"` (Serverless v1) was always encrypted and
+ *   is not reported at all.
+ * - Multi-AZ DB clusters (`engine` `mysql`/`postgres`): the default is
+ *   `false` and nothing changed it, so absent or `false` is a finding,
+ *   unless the cluster is restored or replicated from a source
+ *   (`snapshot_identifier`, `restore_to_point_in_time`,
+ *   `replication_source_identifier`, `global_cluster_identifier`), which
+ *   again decides the encryption.
+ *
+ * Not checked: `aws_rds_cluster_instance` (its `storage_encrypted` is
+ * computed-only and never appears in a body), `aws_rds_global_cluster`, and
+ * whether the key is customer managed.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import type { BlockBody } from "../../hcl/parse";
+import type { TerraformBlock } from "./blocks";
+import { finding, isGiven, notDetermined, readBool, readString, resourcesOfType, type Read } from "./flat-attributes";
+
+const ID = "TF033";
+
+const NOT_DETERMINED_TAIL =
+  "TF033 does not evaluate expressions or read the source database, so it cannot tell whether this storage is encrypted.";
+
+/** The first source argument a body gives, if any. */
+function sourceOf(body: BlockBody, names: readonly string[]): string | undefined {
+  return names.find((n) => isGiven(body, n));
+}
+
+const INSTANCE_SOURCES = ["replicate_source_db", "snapshot_identifier", "restore_to_point_in_time"] as const;
+const CLUSTER_SOURCES = [
+  "snapshot_identifier",
+  "restore_to_point_in_time",
+  "replication_source_identifier",
+  "global_cluster_identifier",
+] as const;
+
+function unencrypted(block: TerraformBlock, encrypted: Read<boolean>, what: string): PostSynthDiagnostic {
+  const how =
+    encrypted.kind === "absent"
+      ? "does not set `storage_encrypted`, and the provider default is `false`"
+      : "sets `storage_encrypted = false`";
+  return finding(
+    ID,
+    "error",
+    block,
+    `${how}, so the ${what} stores its data unencrypted. Set \`storage_encrypted = true\` (and \`kms_key_id\` for a ` +
+      "customer managed key). Encryption cannot be turned on in place: an existing database is migrated by restoring " +
+      "an encrypted copy of a snapshot.",
+  );
+}
+
+function checkInstance(block: TerraformBlock): PostSynthDiagnostic | undefined {
+  const encrypted = readBool(block.body, "storage_encrypted");
+  if (encrypted.kind === "known" && encrypted.value) return undefined;
+  if (encrypted.kind === "unknown") return notDetermined(ID, block, encrypted.reason, NOT_DETERMINED_TAIL);
+  const source = sourceOf(block.body, INSTANCE_SOURCES);
+  if (source) {
+    return notDetermined(
+      ID,
+      block,
+      `is created from a source (\`${source}\`), and the provider does not send \`storage_encrypted\` on that path: ` +
+        "the instance takes its encryption from the source",
+      NOT_DETERMINED_TAIL,
+    );
+  }
+  return unencrypted(block, encrypted, "DB instance");
+}
+
+function checkCluster(block: TerraformBlock): PostSynthDiagnostic | undefined {
+  const encrypted = readBool(block.body, "storage_encrypted");
+  if (encrypted.kind === "known" && encrypted.value) return undefined;
+  if (encrypted.kind === "unknown") return notDetermined(ID, block, encrypted.reason, NOT_DETERMINED_TAIL);
+
+  const engine = readString(block.body, "engine");
+  if (engine.kind === "unknown") {
+    return notDetermined(
+      ID,
+      block,
+      `${engine.reason}, and whether an unset \`storage_encrypted\` means unencrypted depends on the engine`,
+      NOT_DETERMINED_TAIL,
+    );
+  }
+  const aurora = engine.kind === "absent" || engine.value.startsWith("aurora");
+  if (aurora) {
+    const mode = readString(block.body, "engine_mode");
+    if (mode.kind === "known" && mode.value === "serverless") return undefined;
+    const set = encrypted.kind === "absent" ? "does not set `storage_encrypted`" : "sets `storage_encrypted = false`";
+    return notDetermined(
+      ID,
+      block,
+      `is an Aurora cluster that ${set}. AWS encrypts every Aurora cluster created on or after 2026-02-16 with an ` +
+        "AWS-owned key whatever this says; one created earlier with storage encryption off is unencrypted, and the " +
+        "configuration does not say when the cluster was created",
+      "Set `storage_encrypted = true` to make the answer explicit.",
+    );
+  }
+  const source = sourceOf(block.body, CLUSTER_SOURCES);
+  if (source) {
+    return notDetermined(
+      ID,
+      block,
+      `is created from a source (\`${source}\`), which decides its encryption`,
+      NOT_DETERMINED_TAIL,
+    );
+  }
+  return unencrypted(block, encrypted, "Multi-AZ DB cluster");
+}
+
+export const tf033: PostSynthCheck = {
+  id: "TF033",
+  description: "RDS DB instance or cluster storage is not encrypted",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const block of resourcesOfType(ctx, "aws_db_instance")) {
+      const d = checkInstance(block);
+      if (d) out.push(d);
+    }
+    for (const block of resourcesOfType(ctx, "aws_rds_cluster")) {
+      const d = checkCluster(block);
+      if (d) out.push(d);
+    }
+    return out;
+  },
+};