@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/src/lint/post-synth/tf034.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadFixture } from "./fixtures/load";
+import { tf034 } from "./tf034";
+
+async function inline(source: string): Promise<PostSynthContext> {
+  const entities = await blocksToEntities([{ name: "main.tf", source }], "app");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+const verdicts = (d: PostSynthDiagnostic[]) => d.map((x) => `${x.severity} ${x.entity}`).sort();
+
+describe("TF034 over vendored real-world fixtures", () => {
+  test("a key from a managed KMS alias is silent (covidgreen/covid-green-infra)", async () => {
+    expect(tf034.check(await loadFixture("TF034", "negative"))).toEqual([]);
+  });
+
+  test('kms_master_key_id = "" is a warning (KICS test corpus)', async () => {
+    const diags = tf034.check(await loadFixture("TF034", "positive"));
+    expect(verdicts(diags)).toEqual(["warning TF034/aws_sns_topic.user_updates"]);
+    expect(diags[0]).toMatchObject({ checkId: "TF034", lexicon: "terraform" });
+    expect(diags[0].message).toContain('sets `kms_master_key_id = ""`');
+  });
+
+  test("a topic with no key is a warning: absence is insecure for SNS (radian-software/riju)", async () => {
+    const diags = tf034.check(await loadFixture("TF034", "positive-absent"));
+    expect(verdicts(diags)).toEqual(["warning TF034/aws_sns_topic.riju"]);
+    expect(diags[0].message).toContain("does not set `kms_master_key_id`");
+  });
+});
+
+describe("TF034 cases the fixtures do not isolate", () => {
+  test("the AWS managed alias, a template with literal text and a data source attribute are keys", async () => {
+    const diags = tf034.check(
+      await inline(`
+resource "aws_sns_topic" "managed" {
+  kms_master_key_id = "alias/aws/sns"
+}
+resource "aws_sns_topic" "templated" {
+  kms_master_key_id = "alias/\${var.env}-sns"
+}
+resource "aws_sns_topic" "data" {
+  kms_master_key_id = data.aws_kms_key.sns.arn
+}`),
+    );
+    expect(diags).toEqual([]);
+  });
+
+  test("a variable, a conditional or a bare interpolation is not determined", async () => {
+    const diags = tf034.check(
+      await inline(`
+resource "aws_sns_topic" "v" {
+  kms_master_key_id = var.kms_key_id
+}
+resource "aws_sns_topic" "c" {
+  kms_master_key_id = var.encrypt ? aws_kms_key.k.arn : null
+}
+resource "aws_sns_topic" "t" {
+  kms_master_key_id = "\${var.a}\${var.b}"
+}`),
+    );
+    expect(verdicts(diags)).toEqual(["info app/aws_sns_topic.c", "info app/aws_sns_topic.t", "info app/aws_sns_topic.v"]);
+    for (const d of diags) expect(d.message).toMatch(/^Not determined: /);
+  });
+
+  test("kms_master_key_id = null is the same as absent", async () => {
+    const diags = tf034.check(await inline(`resource "aws_sns_topic" "n" {\n  kms_master_key_id = null\n}`));
+    expect(verdicts(diags)).toEqual(["warning app/aws_sns_topic.n"]);
+  });
+});

package/src/lint/post-synth/tf034.ts

@@ -0,0 +1,63 @@
+/**
+ * TF034: an SNS topic has no server-side encryption (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW025, written natively.
+ *
+ * Absence is insecure for this resource, and the rule reports it.
+ * `aws_sns_topic.kms_master_key_id` (provider `internal/service/sns/topic.go`,
+ * v6.67.0) is optional with no default, and SNS has no service-owned
+ * encryption that applies when no key is named: server-side encryption
+ * (https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html)
+ * is on only when the topic names a KMS key, either the AWS managed
+ * `alias/aws/sns` or a customer managed key. Unlike SQS (TF035), no AWS
+ * default turns it on for new topics. A literal `kms_master_key_id = ""`
+ * names no key and is the same finding.
+ *
+ * Present and secure: a non-empty literal, an attribute of a managed resource
+ * or data source (`aws_kms_key.sns.arn`, `aws_kms_alias.sns.arn`), or a
+ * template with literal text. Not determined: a variable, local, module
+ * output, conditional or function call, any of which can be `null` or `""`.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { finding, notDetermined, readKeySet, resourcesOfType } from "./flat-attributes";
+
+const ID = "TF034";
+
+export const tf034: PostSynthCheck = {
+  id: "TF034",
+  description: "SNS topic has no server-side encryption",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const block of resourcesOfType(ctx, "aws_sns_topic")) {
+      const key = readKeySet(block.body, "kms_master_key_id");
+      if (key.kind === "known" && key.value !== "") continue;
+      if (key.kind === "unknown") {
+        out.push(
+          notDetermined(
+            ID,
+            block,
+            key.reason,
+            "TF034 does not evaluate expressions, so it cannot tell whether this names a KMS key or is null.",
+          ),
+        );
+        continue;
+      }
+      const how = key.kind === "absent" ? "does not set `kms_master_key_id`" : 'sets `kms_master_key_id = ""`';
+      out.push(
+        finding(
+          ID,
+          "warning",
+          block,
+          `${how}, so SNS stores its messages without server-side encryption; no AWS default encrypts a topic that ` +
+            'names no key. Set `kms_master_key_id` to a customer managed key, or to `"alias/aws/sns"` for the AWS ' +
+            "managed one.",
+        ),
+      );
+    }
+    return out;
+  },
+};

package/src/lint/post-synth/tf035.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadFixture } from "./fixtures/load";
+import { tf035 } from "./tf035";
+
+async function inline(source: string): Promise<PostSynthContext> {
+  const entities = await blocksToEntities([{ name: "main.tf", source }], "app");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+const verdicts = (d: PostSynthDiagnostic[]) => d.map((x) => `${x.severity} ${x.entity}`).sort();
+
+describe("TF035 over vendored real-world fixtures (cds-snc/notification-terraform)", () => {
+  test("sqs_managed_sse_enabled = true is silent", async () => {
+    expect(tf035.check(await loadFixture("TF035", "negative"))).toEqual([]);
+  });
+
+  test("sqs_managed_sse_enabled = false with no key is a warning", async () => {
+    const diags = tf035.check(await loadFixture("TF035", "positive"));
+    expect(verdicts(diags)).toEqual(["warning TF035/aws_sqs_queue.notify_internal_tasks_queue"]);
+    expect(diags[0]).toMatchObject({ checkId: "TF035", lexicon: "terraform" });
+  });
+
+  test("a queue that sets neither attribute is silent: AWS encrypts it with SSE-SQS by default", async () => {
+    expect(tf035.check(await loadFixture("TF035", "negative-absent"))).toEqual([]);
+  });
+});
+
+describe("TF035 cases the fixtures do not isolate", () => {
+  test("a KMS key beside sqs_managed_sse_enabled = false, or a variable key alone, is encrypted", async () => {
+    const diags = tf035.check(
+      await inline(`
+resource "aws_sqs_queue" "kms" {
+  kms_master_key_id = "alias/aws/sqs"
+}
+resource "aws_sqs_queue" "managed_key" {
+  kms_master_key_id = aws_kms_key.sqs.arn
+}
+resource "aws_sqs_queue" "var_key_default_sse" {
+  kms_master_key_id = var.kms_key
+}`),
+    );
+    expect(diags).toEqual([]);
+  });
+
+  test("an expression for sqs_managed_sse_enabled, or a variable key beside false, is not determined", async () => {
+    const diags = tf035.check(
+      await inline(`
+resource "aws_sqs_queue" "sse_var" {
+  sqs_managed_sse_enabled = var.sse
+}
+resource "aws_sqs_queue" "off_var_key" {
+  sqs_managed_sse_enabled = false
+  kms_master_key_id       = var.kms_key
+}
+resource "aws_sqs_queue" "off_empty_key" {
+  sqs_managed_sse_enabled = false
+  kms_master_key_id       = ""
+}`),
+    );
+    expect(verdicts(diags)).toEqual([
+      "info app/aws_sqs_queue.off_var_key",
+      "info app/aws_sqs_queue.sse_var",
+      "warning app/aws_sqs_queue.off_empty_key",
+    ]);
+  });
+});

package/src/lint/post-synth/tf035.ts

@@ -0,0 +1,74 @@
+/**
+ * TF035: an SQS queue turns its server-side encryption off (chant #2288,
+ * epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW026, and the case that
+ * shows why the five flat rules could not be bridged. WAW026 reports a queue
+ * with neither `SqsManagedSseEnabled: true` nor `KmsMasterKeyId`. Bridged onto
+ * HCL, that reports every correctly encrypted queue in an estate
+ * (docs/design/waw-hcl-fidelity-probe.md).
+ *
+ * Absence is secure for this resource, and the rule does not report it.
+ * `sqs_managed_sse_enabled` is optional and computed (provider
+ * `internal/service/sqs/queue.go`, v6.67.0), and the provider docs say
+ * Terraform "will only perform drift detection of its value when present in
+ * a configuration". Since October 2022 SQS encrypts every new queue with
+ * SSE-SQS unless the request turns it off
+ * (https://aws.amazon.com/blogs/compute/announcing-server-side-encryption-with-amazon-simple-queue-service-managed-encryption-keys-sse-sqs-by-default/),
+ * and the provider creates queues over HTTPS, so a queue that sets neither
+ * attribute is encrypted. A queue created before that date and never
+ * changed can still be unencrypted; the configuration cannot show that, and
+ * TF035 does not guess it.
+ *
+ * The finding: `sqs_managed_sse_enabled = false` with no KMS key. Present and
+ * secure: `sqs_managed_sse_enabled = true`, or a `kms_master_key_id` that is
+ * a non-empty literal, a managed key's attribute, or a template with literal
+ * text. Not determined: `sqs_managed_sse_enabled` from an expression with no
+ * key, or a key from a variable beside `sqs_managed_sse_enabled = false`.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { finding, notDetermined, readBool, readKeySet, resourcesOfType } from "./flat-attributes";
+
+const ID = "TF035";
+
+const TAIL = "TF035 does not evaluate expressions, so it cannot tell whether this queue encrypts its messages.";
+
+export const tf035: PostSynthCheck = {
+  id: "TF035",
+  description: "SQS queue turns server-side encryption off",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const block of resourcesOfType(ctx, "aws_sqs_queue")) {
+      const key = readKeySet(block.body, "kms_master_key_id");
+      const sse = readBool(block.body, "sqs_managed_sse_enabled");
+      if (key.kind === "known" && key.value !== "") continue;
+      if (sse.kind === "known" && sse.value) continue;
+      // Neither attribute turns encryption off: AWS's SSE-SQS default applies.
+      if (sse.kind === "absent") continue;
+
+      if (sse.kind === "unknown") {
+        out.push(notDetermined(ID, block, `${sse.reason} and names no KMS key`, TAIL));
+        continue;
+      }
+      if (key.kind === "unknown") {
+        out.push(notDetermined(ID, block, `sets \`sqs_managed_sse_enabled = false\` and ${key.reason}`, TAIL));
+        continue;
+      }
+      out.push(
+        finding(
+          ID,
+          "warning",
+          block,
+          "sets `sqs_managed_sse_enabled = false` and names no KMS key, which turns off the SSE-SQS encryption AWS " +
+            "applies to new queues by default, so messages are stored unencrypted. Remove the line (the default is " +
+            'encrypted), set it to `true`, or set `kms_master_key_id` (`"alias/aws/sqs"` or a customer managed key).',
+        ),
+      );
+    }
+    return out;
+  },
+};

package/src/lint/post-synth/tf036.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadFixture } from "./fixtures/load";
+import { tf036 } from "./tf036";
+
+async function inline(source: string): Promise<PostSynthContext> {
+  const entities = await blocksToEntities([{ name: "main.tf", source }], "app");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+const verdicts = (d: PostSynthDiagnostic[]) => d.map((x) => `${x.severity} ${x.entity}`).sort();
+
+describe("TF036 over vendored real-world fixtures", () => {
+  test("encrypted = true is silent (ned1313/terraform-tuesdays)", async () => {
+    expect(tf036.check(await loadFixture("TF036", "negative"))).toEqual([]);
+  });
+
+  test("encrypted = false is a warning (stelligent/config-lint)", async () => {
+    const diags = tf036.check(await loadFixture("TF036", "positive"));
+    expect(verdicts(diags)).toEqual(["warning TF036/aws_ebs_volume.vol2"]);
+    expect(diags[0]).toMatchObject({ checkId: "TF036", lexicon: "terraform" });
+    expect(diags[0].message).toContain("replace it on every apply");
+  });
+
+  test("a volume that does not set encrypted is not determined (bridgecrewio/terragoat)", async () => {
+    const diags = tf036.check(await loadFixture("TF036", "not-determined"));
+    expect(verdicts(diags)).toEqual(["info TF036/aws_ebs_volume.web_host_storage"]);
+    expect(diags[0].message).toMatch(/^Not determined: .*EBS encryption by default/);
+  });
+});
+
+describe("TF036 cases the fixtures do not isolate", () => {
+  test("depends_on an enabled aws_ebs_encryption_by_default settles absence", async () => {
+    const diags = tf036.check(
+      await inline(`
+resource "aws_ebs_encryption_by_default" "on" {}
+resource "aws_ebs_volume" "ordered" {
+  availability_zone = "eu-west-1a"
+  size              = 10
+  depends_on        = [aws_ebs_encryption_by_default.on]
+}
+resource "aws_ebs_volume" "unordered" {
+  availability_zone = "eu-west-1a"
+  size              = 10
+}`),
+    );
+    expect(verdicts(diags)).toEqual(["info app/aws_ebs_volume.unordered"]);
+    expect(diags[0].message).toContain("`aws_ebs_encryption_by_default.on` turns the default on in this module");
+  });
+
+  test("a disabled default, or one on another provider, does not settle it", async () => {
+    const diags = tf036.check(
+      await inline(`
+resource "aws_ebs_encryption_by_default" "off" {
+  enabled = false
+}
+resource "aws_ebs_encryption_by_default" "west" {
+  provider = aws.west
+}
+resource "aws_ebs_volume" "a" {
+  size       = 10
+  depends_on = [aws_ebs_encryption_by_default.off]
+}
+resource "aws_ebs_volume" "b" {
+  size       = 10
+  depends_on = [aws_ebs_encryption_by_default.west]
+}`),
+    );
+    expect(verdicts(diags)).toEqual(["info app/aws_ebs_volume.a", "info app/aws_ebs_volume.b"]);
+  });
+
+  test("snapshot_id is named in the reason; an encrypted expression is not determined", async () => {
+    const diags = tf036.check(
+      await inline(`
+resource "aws_ebs_volume" "snap" {
+  snapshot_id = aws_ebs_snapshot.s.id
+}
+resource "aws_ebs_volume" "v" {
+  size      = 10
+  encrypted = var.encrypted
+}`),
+    );
+    expect(verdicts(diags)).toEqual(["info app/aws_ebs_volume.snap", "info app/aws_ebs_volume.v"]);
+    expect(diags.find((d) => d.entity === "app/aws_ebs_volume.snap")!.message).toContain("`snapshot_id`");
+  });
+});

package/src/lint/post-synth/tf036.ts

@@ -0,0 +1,119 @@
+/**
+ * TF036: an EBS volume does not ask for encryption (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW028, written natively.
+ *
+ * Absence is not determined for this resource. `aws_ebs_volume.encrypted` is
+ * optional, computed and force-new (provider `internal/service/ec2/
+ * ebs_volume.go`, v6.67.0). Whether a volume created without it is encrypted
+ * depends on the Region's EBS encryption by default
+ * (https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html),
+ * which is account state the parse cannot see, and a volume built from
+ * `snapshot_id` also follows its snapshot. So an unset `encrypted` emits one
+ * `info` diagnostic, not a finding.
+ *
+ * One configuration does settle absence: the volume `depends_on` an
+ * `aws_ebs_encryption_by_default` in the same module whose `enabled` is
+ * absent (the provider default is `true`) or literal `true`, on the same
+ * `provider` and `region`. The `depends_on` matters: without it Terraform may
+ * create the volume before it turns the default on, and the default "has no
+ * effect on existing EBS volumes".
+ *
+ * `encrypted = false` is a finding even though encryption by default would
+ * override it. The literal is wrong either way: with the default off the
+ * volume is unencrypted, and with it on AWS encrypts the volume anyway ("you
+ * cannot disable it for individual volumes"), the volume no longer matches
+ * the configuration, and because `encrypted` forces replacement Terraform
+ * plans to replace it on every apply.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { scopeOfKey } from "../../hcl/parse";
+import type { TerraformBlock } from "./blocks";
+import { finding, isGiven, notDetermined, readBool, resourcesOfType } from "./flat-attributes";
+
+const ID = "TF036";
+const DEFAULT_TYPE = "aws_ebs_encryption_by_default";
+
+/** The `aws_ebs_encryption_by_default.<name>` addresses a volume's `depends_on` names. */
+function dependsOnDefaults(block: TerraformBlock): string[] {
+  const deps = block.body.depends_on;
+  if (!Array.isArray(deps)) return [];
+  const out: string[] = [];
+  for (const d of deps) {
+    if (typeof d !== "string") continue;
+    const m = /^\$\{\s*(aws_ebs_encryption_by_default\.[A-Za-z_][\w-]*)\s*\}$/.exec(d) ?? /^(aws_ebs_encryption_by_default\.[A-Za-z_][\w-]*)$/.exec(d);
+    if (m) out.push(m[1]);
+  }
+  return out;
+}
+
+/** Same provider configuration and Region, compared as written. */
+function sameTarget(a: TerraformBlock, b: TerraformBlock): boolean {
+  return a.body.provider === b.body.provider && a.body.region === b.body.region;
+}
+
+export const tf036: PostSynthCheck = {
+  id: "TF036",
+  description: "EBS volume does not ask for encryption",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    const defaults = resourcesOfType(ctx, DEFAULT_TYPE);
+
+    for (const block of resourcesOfType(ctx, "aws_ebs_volume")) {
+      const encrypted = readBool(block.body, "encrypted");
+      if (encrypted.kind === "known" && encrypted.value) continue;
+      if (encrypted.kind === "known") {
+        out.push(
+          finding(
+            ID,
+            "warning",
+            block,
+            "sets `encrypted = false`. With the Region's EBS encryption by default off, the volume is unencrypted; " +
+              "with it on, AWS encrypts the volume anyway and, because `encrypted` forces replacement, Terraform " +
+              "plans to replace it on every apply. Set `encrypted = true` (and `kms_key_id` for a customer managed " +
+              "key), or remove the line.",
+          ),
+        );
+        continue;
+      }
+      if (encrypted.kind === "unknown") {
+        out.push(
+          notDetermined(ID, block, encrypted.reason, "TF036 does not evaluate expressions, so it cannot tell whether this volume is encrypted."),
+        );
+        continue;
+      }
+
+      const scope = scopeOfKey(block.key);
+      const inScope = defaults.filter((d) => scopeOfKey(d.key) === scope && sameTarget(d, block));
+      const enabled = inScope.filter((d) => {
+        const e = readBool(d.body, "enabled");
+        return e.kind === "absent" || (e.kind === "known" && e.value);
+      });
+      const named = new Set(dependsOnDefaults(block));
+      if (enabled.some((d) => named.has(d.address))) continue;
+
+      const parts = ["does not set `encrypted`"];
+      if (isGiven(block.body, "snapshot_id")) parts.push("and is built from `snapshot_id`, whose encryption it inherits");
+      const reason =
+        `${parts.join(" ")}, so whether it is encrypted depends on the Region's EBS encryption by default, which is ` +
+        "account state" +
+        (enabled.length > 0
+          ? `. \`${enabled[0].address}\` turns the default on in this module, but the volume does not \`depends_on\` it, so it may be created first`
+          : "");
+      out.push(
+        notDetermined(
+          ID,
+          block,
+          reason,
+          "Set `encrypted = true` to make the answer explicit, or add `depends_on` naming an enabled " +
+            "`aws_ebs_encryption_by_default`.",
+        ),
+      );
+    }
+    return out;
+  },
+};

package/src/lint/post-synth/tf037.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadFixture } from "./fixtures/load";
+import { tf037 } from "./tf037";
+
+async function inline(source: string): Promise<PostSynthContext> {
+  const entities = await blocksToEntities([{ name: "main.tf", source }], "app");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+const verdicts = (d: PostSynthDiagnostic[]) => d.map((x) => `${x.severity} ${x.entity}`).sort();
+
+describe("TF037 over vendored real-world fixtures", () => {
+  test("IMMUTABLE is silent (aws-samples/sample-scribe-ai)", async () => {
+    expect(tf037.check(await loadFixture("TF037", "negative"))).toEqual([]);
+  });
+
+  test("IMMUTABLE_WITH_EXCLUSION with named moving tags is silent (lexicalunit/spellbot)", async () => {
+    expect(tf037.check(await loadFixture("TF037", "negative-exclusion"))).toEqual([]);
+  });
+
+  test("MUTABLE is an error (bridgecrewio/terragoat)", async () => {
+    const diags = tf037.check(await loadFixture("TF037", "positive"));
+    expect(verdicts(diags)).toEqual(["error TF037/aws_ecr_repository.repository"]);
+    expect(diags[0]).toMatchObject({ checkId: "TF037", lexicon: "terraform" });
+  });
+
+  test("a repository that does not set image_tag_mutability is an error: the default is MUTABLE (outerbounds)", async () => {
+    const diags = tf037.check(await loadFixture("TF037", "positive-absent"));
+    expect(verdicts(diags)).toEqual(["error TF037/aws_ecr_repository.metaflow_batch_image"]);
+    expect(diags[0].message).toContain("the provider default is `MUTABLE`");
+  });
+
+  test("a variable is not determined, whatever its default (turnerlabs/terraform-ecs-fargate)", async () => {
+    const diags = tf037.check(await loadFixture("TF037", "not-determined"));
+    expect(verdicts(diags)).toEqual(["info TF037/aws_ecr_repository.app"]);
+    expect(diags[0].message).toContain("var.image_tag_mutability");
+  });
+});
+
+describe("TF037 cases the fixtures do not isolate", () => {
+  test("MUTABLE_WITH_EXCLUSION and a match-everything exclusion filter are errors", async () => {
+    const diags = tf037.check(
+      await inline(`
+resource "aws_ecr_repository" "mostly_mutable" {
+  image_tag_mutability = "MUTABLE_WITH_EXCLUSION"
+  image_tag_mutability_exclusion_filter {
+    filter      = "release-*"
+    filter_type = "WILDCARD"
+  }
+}
+resource "aws_ecr_repository" "star" {
+  image_tag_mutability = "IMMUTABLE_WITH_EXCLUSION"
+  image_tag_mutability_exclusion_filter {
+    filter      = "*"
+    filter_type = "WILDCARD"
+  }
+}`),
+    );
+    expect(verdicts(diags)).toEqual(["error app/aws_ecr_repository.mostly_mutable", "error app/aws_ecr_repository.star"]);
+    expect(diags.find((d) => d.entity === "app/aws_ecr_repository.star")!.message).toContain("matches every tag");
+  });
+
+  test("an exclusion filter from an expression or a dynamic block is not determined", async () => {
+    const diags = tf037.check(
+      await inline(`
+resource "aws_ecr_repository" "f" {
+  image_tag_mutability = "IMMUTABLE_WITH_EXCLUSION"
+  image_tag_mutability_exclusion_filter {
+    filter      = var.moving_tag
+    filter_type = "WILDCARD"
+  }
+}
+resource "aws_ecr_repository" "d" {
+  image_tag_mutability = "IMMUTABLE_WITH_EXCLUSION"
+  dynamic "image_tag_mutability_exclusion_filter" {
+    for_each = var.filters
+    content {
+      filter      = image_tag_mutability_exclusion_filter.value
+      filter_type = "WILDCARD"
+    }
+  }
+}`),
+    );
+    expect(verdicts(diags)).toEqual(["info app/aws_ecr_repository.d", "info app/aws_ecr_repository.f"]);
+  });
+});

package/src/lint/post-synth/tf037.ts

@@ -0,0 +1,101 @@
+/**
+ * TF037: an ECR repository lets an image tag be repointed (chant #2288, epic
+ * #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW054, written natively.
+ *
+ * Absence is insecure for this resource, and the rule reports it.
+ * `aws_ecr_repository.image_tag_mutability` (provider
+ * `internal/service/ecr/repository.go`, v6.67.0) is optional with
+ * `Default: MUTABLE`, so a repository that does not set it lets anyone with
+ * push access move a tag (`prod`, `v1.4.2`) to different image content after
+ * it was deployed, scanned or signed.
+ *
+ * Provider v6 accepts four values (AWS added the two `_WITH_EXCLUSION` modes
+ * in 2025), and the rule reads them as follows:
+ *
+ * - `IMMUTABLE`: secure.
+ * - `IMMUTABLE_WITH_EXCLUSION`: secure. Tags matching an
+ *   `image_tag_mutability_exclusion_filter` stay mutable, a written-down
+ *   exception such as `latest`. A filter that is nothing but `*` excludes
+ *   every tag, so it is a finding; a filter from an expression is not
+ *   determined.
+ * - `MUTABLE`, absent, and `MUTABLE_WITH_EXCLUSION` (every tag mutable except
+ *   those the filters name): a finding.
+ * - an expression: not determined.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import type { TerraformBlock } from "./blocks";
+import { finding, nestedBodies, notDetermined, readString, resourcesOfType } from "./flat-attributes";
+
+const ID = "TF037";
+
+const FIX =
+  'Set `image_tag_mutability = "IMMUTABLE"` and push a new tag for each build, or `"IMMUTABLE_WITH_EXCLUSION"` with ' +
+  "an `image_tag_mutability_exclusion_filter` for the few moving tags (`latest`) that must stay mutable.";
+
+const TAIL = "TF037 does not evaluate expressions, so it cannot tell whether this repository's tags are immutable.";
+
+/** A diagnostic for an `IMMUTABLE_WITH_EXCLUSION` repository, or nothing. */
+function checkExclusions(block: TerraformBlock): PostSynthDiagnostic | undefined {
+  for (const [i, f] of nestedBodies(block.body, "image_tag_mutability_exclusion_filter").entries()) {
+    const filter = readString(f, "filter");
+    if (filter.kind === "unknown") {
+      return notDetermined(ID, block, `exclusion filter ${i + 1}: ${filter.reason}`, TAIL);
+    }
+    if (filter.kind === "known" && /^\*+$/.test(filter.value)) {
+      return finding(
+        ID,
+        "error",
+        block,
+        `is \`IMMUTABLE_WITH_EXCLUSION\`, but exclusion filter ${i + 1} is "${filter.value}", which matches every tag, ` +
+          `so every tag stays mutable. ${FIX}`,
+      );
+    }
+  }
+  if (nestedBodies(block.body, "dynamic").some((d) => d.image_tag_mutability_exclusion_filter !== undefined)) {
+    return notDetermined(ID, block, 'has a `dynamic "image_tag_mutability_exclusion_filter"` block', TAIL);
+  }
+  return undefined;
+}
+
+export const tf037: PostSynthCheck = {
+  id: "TF037",
+  description: "ECR repository allows mutable image tags",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const block of resourcesOfType(ctx, "aws_ecr_repository")) {
+      const mode = readString(block.body, "image_tag_mutability");
+      if (mode.kind === "unknown") {
+        out.push(notDetermined(ID, block, mode.reason, TAIL));
+        continue;
+      }
+      if (mode.kind === "known" && mode.value === "IMMUTABLE") continue;
+      if (mode.kind === "known" && mode.value === "IMMUTABLE_WITH_EXCLUSION") {
+        const d = checkExclusions(block);
+        if (d) out.push(d);
+        continue;
+      }
+      const how =
+        mode.kind === "absent"
+          ? "does not set `image_tag_mutability`, and the provider default is `MUTABLE`"
+          : mode.value === "MUTABLE_WITH_EXCLUSION"
+            ? "is `MUTABLE_WITH_EXCLUSION`, so every tag the exclusion filters do not name stays mutable"
+            : `sets \`image_tag_mutability = "${mode.value}"\``;
+      out.push(
+        finding(
+          ID,
+          "error",
+          block,
+          `${how}: a pushed tag can later be repointed at different image content, so what was deployed, scanned or ` +
+            `signed under that tag is no longer what it names. ${FIX}`,
+        ),
+      );
+    }
+    return out;
+  },
+};