@intentius/chant-lexicon-terraform 0.124.31 → 0.124.32

package/dist/lint/audit-lineage.js

@@ -0,0 +1,442 @@
+const TFSEC_V061 = "https://github.com/aquasecurity/tfsec/blob/v0.61.3/docs/checks/general/secrets";
+/** tflint's official language ruleset. */
+const TFLINT_RULES = "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules";
+/** The community ruleset with the richest set of language rules outside the official one. */
+const REDEPLOY_RULES = "https://github.com/RedeployAB/tflint-ruleset-redeploy/blob/main/docs/rules";
+export const terraformAuditLineage = {
+    TF027: [
+        {
+            tool: "choudoufu",
+            rule: "RulePolicyScope",
+            url: "https://github.com/INTENTIUS/choudoufu/blob/main/internal/live/lint/policy.go",
+            relation: "extends",
+        },
+    ],
+    TF024: [
+        {
+            tool: "choudoufu",
+            rule: "RuleStateBackend",
+            url: "https://github.com/INTENTIUS/choudoufu/blob/main/internal/live/lint/issue.go",
+            relation: "equivalent",
+        },
+    ],
+    TF002: [
+        {
+            tool: "tflint-ruleset-terraform",
+            rule: "terraform_required_providers",
+            url: "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_required_providers.md",
+            relation: "equivalent",
+        },
+        {
+            tool: "terraform-sentinel-policies",
+            rule: "require-all-providers-have-version-constraint",
+            url: "https://github.com/hashicorp/terraform-sentinel-policies/tree/main/cloud-agnostic",
+            relation: "equivalent",
+        },
+        {
+            tool: "aws-terraform-prescriptive-guidance",
+            rule: "Add automated version checks",
+            url: "https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/version.html#add-automated-version-checks",
+            relation: "equivalent",
+        },
+    ],
+    // Sentinel's restrict-terraform-versions checks that required_version is
+    // within an allowed range, not that it is present at all: a narrower
+    // question than TF003's, so "overlaps" rather than "equivalent" (#2109).
+    TF003: [
+        {
+            tool: "tflint-ruleset-terraform",
+            rule: "terraform_required_version",
+            url: "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_required_version.md",
+            relation: "equivalent",
+        },
+        {
+            tool: "terraform-sentinel-policies",
+            rule: "restrict-terraform-versions",
+            url: "https://github.com/hashicorp/terraform-sentinel-policies/tree/main/cloud-agnostic",
+            relation: "overlaps",
+        },
+        {
+            tool: "hashicorp-style-guide",
+            rule: "Version pinning",
+            url: "https://developer.hashicorp.com/terraform/language/style#version-pinning",
+            relation: "overlaps",
+        },
+    ],
+    TF004: [
+        {
+            tool: "tflint-ruleset-terraform",
+            rule: "terraform_module_version",
+            url: "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_module_version.md",
+            relation: "equivalent",
+        },
+        {
+            tool: "checkov",
+            rule: "CKV_TF_2",
+            url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/module/generic/RevisionVersionTag.py",
+            relation: "equivalent",
+        },
+    ],
+    // checkov's CKV_TF_1 accepts any `?ref=`/`&ref=` matching `[?&](ref=).*(\d\.\d).*`,
+    // which a branch literally named `v1.2-dev` passes; TF005 requires a full
+    // semver tag or a 40-hex SHA, so "extends" (a strict superset), not
+    // "equivalent". KICS's query only matches the `git::` prefix, not the
+    // github.com/bitbucket.org shorthands or scp-style sources TF005 also
+    // covers, so "overlaps" (#2109).
+    TF005: [
+        {
+            tool: "tflint-ruleset-terraform",
+            rule: "terraform_module_pinned_source",
+            url: "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_module_pinned_source.md",
+            relation: "equivalent",
+        },
+        {
+            tool: "checkov",
+            rule: "CKV_TF_1",
+            url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/module/generic/RevisionHash.py",
+            relation: "extends",
+        },
+        {
+            tool: "kics",
+            rule: "3a81fc06-566f-492a-91dd-7448e409e2cd",
+            url: "https://docs.kics.io/latest/queries/terraform-queries/3a81fc06-566f-492a-91dd-7448e409e2cd/",
+            relation: "overlaps",
+        },
+    ],
+    TF006: [
+        {
+            tool: "tflint-ruleset-avm",
+            rule: "avm_terraform_sensitive_variable_default_disallowed",
+            url: "https://github.com/Azure/tflint-ruleset-avm/blob/main/docs/basic/avm_terraform_sensitive_variable_default_disallowed.md",
+            relation: "equivalent",
+        },
+    ],
+    TF007: [
+        { tool: "tfsec", rule: "general-secrets-sensitive-in-variable", url: `${TFSEC_V061}/sensitive-in-variable.md`, relation: "equivalent" },
+        { tool: "tfsec", rule: "general-secrets-sensitive-in-local", url: `${TFSEC_V061}/sensitive-in-local.md`, relation: "equivalent" },
+    ],
+    // #2107's rule table credits TF008 with Snyk `SNYK-CC-TF-74` ("Credentials
+    // are configured via provider attributes") alongside these three. That
+    // credit is deliberately absent here, and the absence is the epic's own
+    // decision rather than an oversight: Snyk IaC is a product, not a rule
+    // source, which is why it sits in this file's "deliberately excluded" list
+    // above and has no `PRIOR_ART` entry to cite. The rules have no open
+    // repository behind them, and the public index (security.snyk.io/rules/
+    // cloud) does not even enumerate the legacy `SNYK-CC-TF-*` ids, so a
+    // credit here could not be swept the way every other one in this file is
+    // (scripts/prior-art-sweep.ts). The condition loses nothing by it:
+    // `SNYK-CC-TF-74`, checkov's `CKV_AWS_41` and semgrep's
+    // `aws-provider-static-credentials` are the same check three times over,
+    // and the other two are credited below (#2220).
+    TF008: [
+        { tool: "checkov", rule: "CKV_AWS_41", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "d7b9d850-3e06-4a75-852f-c46c2e92240b", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/d7b9d850-3e06-4a75-852f-c46c2e92240b/", relation: "overlaps" },
+        {
+            tool: "semgrep",
+            rule: "terraform.aws.security.aws-provider-static-credentials",
+            url: "https://github.com/semgrep/semgrep-rules/blob/develop/terraform/aws/security/aws-provider-static-credentials.yaml",
+            relation: "overlaps",
+        },
+    ],
+    TF009: [
+        {
+            tool: "hashicorp-style-guide",
+            rule: "Variables: for sensitive variables, such as passwords and private keys, set the sensitive parameter to true",
+            url: "https://developer.hashicorp.com/terraform/language/style#variables",
+            relation: "equivalent",
+        },
+    ],
+    TF010: [
+        { tool: "tflint-ruleset-terraform", rule: "terraform_typed_variables", url: `${TFLINT_RULES}/terraform_typed_variables.md`, relation: "equivalent" },
+        { tool: "kics", rule: "fc5109bf-01fd-49fb-8bde-4492b543c34a", url: "https://docs.kics.io/latest/queries/terraform-queries/fc5109bf-01fd-49fb-8bde-4492b543c34a/", relation: "equivalent" },
+    ],
+    TF011: [
+        { tool: "tflint-ruleset-terraform", rule: "terraform_documented_variables", url: `${TFLINT_RULES}/terraform_documented_variables.md`, relation: "equivalent" },
+        { tool: "kics", rule: "2a153952-2544-4687-bcc9-cc8fea814a9b", url: "https://docs.kics.io/latest/queries/terraform-queries/2a153952-2544-4687-bcc9-cc8fea814a9b/", relation: "equivalent" },
+        {
+            tool: "terraform-sentinel-policies",
+            rule: "validate-variables-have-descriptions",
+            url: "https://github.com/hashicorp/terraform-sentinel-policies/blob/main/cloud-agnostic/validate-variables-have-descriptions.sentinel",
+            relation: "equivalent",
+        },
+    ],
+    TF012: [
+        { tool: "tflint-ruleset-terraform", rule: "terraform_documented_outputs", url: `${TFLINT_RULES}/terraform_documented_outputs.md`, relation: "equivalent" },
+        { tool: "kics", rule: "59312e8a-a64e-41e7-a252-618533dd1ea8", url: "https://docs.kics.io/latest/queries/terraform-queries/59312e8a-a64e-41e7-a252-618533dd1ea8/", relation: "equivalent" },
+    ],
+    TF013: [
+        { tool: "tflint-ruleset-redeploy", rule: "terraform_ignore_changes_all", url: `${REDEPLOY_RULES}/terraform_ignore_changes_all.md`, relation: "equivalent" },
+    ],
+    // The two vendor documents below (and the one on TF015, and the HashiCorp
+    // style guide on TF021) are `Lineage` entries, not `RuleMeta.authority`
+    // ones, though #2107's table calls them "authority". `authority` is not a
+    // free-standing "this document says so" field: an authority citation forces
+    // `category: "security"` (`packages/core/src/audit/catalog.ts`), and
+    // `catalog.test.ts` binds the two together in both directions, "an
+    // authority citation always means security" and "authority citations only
+    // attach to merge-worthy entries". A provider block in a child module is a
+    // structural rule, not a security finding, so citing these guides as
+    // authority would have relabelled three rules as security to get a citation
+    // rendered. Lineage carries the same URLs and never touches tier or
+    // category, so that is where they live (#2112, recorded here by #2220).
+    TF014: [
+        {
+            tool: "tflint-ruleset-avm",
+            rule: "avm_terraform_provider_block_disallowed",
+            url: "https://github.com/Azure/tflint-ruleset-avm/blob/main/docs/basic/avm_terraform_provider_block_disallowed.md",
+            relation: "equivalent",
+        },
+        {
+            tool: "gcp-terraform-best-practices",
+            rule: "Build reusable modules: modules must not configure providers",
+            url: "https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure#reusable-modules",
+            relation: "equivalent",
+        },
+        {
+            tool: "aws-terraform-prescriptive-guidance",
+            rule: "Structure: declare provider configurations in the root module",
+            url: "https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/structure.html",
+            relation: "equivalent",
+        },
+    ],
+    // TF015 has no scanner to credit: no ruleset in the survey checks for a
+    // backend or cloud block inside a child module.
+    // tflint-ruleset-terraform's index has nothing about backends at all,
+    // Redeploy's has nothing either, and AVM's module rules stop at the
+    // provider block TF014 credits. What states the rule is Google Cloud's
+    // reusable-modules guide, so that document is the single credit here, and
+    // the page section says plainly that the credit is a document rather than
+    // a tool (#2112). It is lineage rather than `authority` for the reason on
+    // TF014 above: an authority citation would force `category: "security"` on
+    // a rule about where state configuration belongs.
+    TF015: [
+        {
+            tool: "gcp-terraform-best-practices",
+            rule: "Build reusable modules: state configuration belongs to the root module",
+            url: "https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure#reusable-modules",
+            relation: "equivalent",
+        },
+    ],
+    TF016: [
+        // `overlaps`, not `equivalent`: tflint reports the same `x = "${y}"` form
+        // and also the object-key case (`"${var.k}" = v`), which this rule leaves
+        // alone. See tf016.ts.
+        { tool: "tflint-ruleset-terraform", rule: "terraform_deprecated_interpolation", url: `${TFLINT_RULES}/terraform_deprecated_interpolation.md`, relation: "overlaps" },
+    ],
+    TF017: [
+        { tool: "tflint-ruleset-redeploy", rule: "terraform_module_depends_on", url: `${REDEPLOY_RULES}/terraform_module_depends_on.md`, relation: "equivalent" },
+    ],
+    TF018: [
+        { tool: "tflint-ruleset-redeploy", rule: "terraform_output_resource", url: `${REDEPLOY_RULES}/terraform_output_resource.md`, relation: "equivalent" },
+    ],
+    TF019: [
+        { tool: "tflint-ruleset-redeploy", rule: "terraform_redundant_default", url: `${REDEPLOY_RULES}/terraform_redundant_default.md`, relation: "equivalent" },
+    ],
+    TF020: [
+        // `overlaps`: tflint evaluates expressions and reports the same four
+        // kinds of declaration; chant's index is a string scan over hcl2json's
+        // preserved expression strings, so it is generous where tflint is exact
+        // (see hcl/references.ts and tf020.ts).
+        {
+            tool: "tflint-ruleset-terraform",
+            rule: "terraform_unused_declarations",
+            url: `${TFLINT_RULES}/terraform_unused_declarations.md`,
+            relation: "overlaps",
+        },
+    ],
+    TF021: [
+        // Redeploy reports every `count` over a collection; TF021 reports only
+        // the ones that build an identity out of `count.index`, which is a
+        // strict subset, hence `overlaps` on both credits rather than
+        // `equivalent`. choudoufu's own rule is the survey's deepest reading of
+        // the identity-bearing question (#2112). The HashiCorp style guide entry
+        // is lineage rather than `authority` for the reason recorded on TF014: an
+        // authority citation forces `category: "security"`, and `count` versus
+        // `for_each` is not a security finding.
+        {
+            tool: "tflint-ruleset-redeploy",
+            rule: "terraform_prefer_for_each",
+            url: `${REDEPLOY_RULES}/terraform_prefer_for_each.md`,
+            relation: "overlaps",
+        },
+        {
+            tool: "choudoufu",
+            rule: "RuleCountIndex",
+            url: "https://github.com/INTENTIUS/choudoufu/blob/main/internal/live/lint/count_index.go",
+            relation: "overlaps",
+        },
+        {
+            tool: "hashicorp-style-guide",
+            rule: "Resources: use for_each for a dynamic resource count",
+            url: "https://developer.hashicorp.com/terraform/language/style#dynamic-resource-count",
+            relation: "overlaps",
+        },
+    ],
+    TF022: [
+        // tfsec consolidated its three `general/secrets` checks into
+        // `no-plaintext-exposure` in v1, which is the one still in the repository's
+        // `master` docs; `overlaps` because that consolidation also covers the
+        // variable and locals cases TF007 reports separately.
+        {
+            tool: "tfsec",
+            rule: "general-secrets-no-plaintext-exposure",
+            url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/general/secrets/no-plaintext-exposure/index.md",
+            relation: "overlaps",
+        },
+        { tool: "kics", rule: "a88baa34-e2ad-44ea-ad6f-8cac87bc7c71", url: "https://docs.kics.io/latest/secrets/", relation: "overlaps" },
+    ],
+    TF030: [
+        // Every credit overlaps; none is equivalent. TF030 is WAW019's port list
+        // (22, 3389, 3306, 5432) on 0.0.0.0/0 or ::/0, read across the three
+        // Terraform shapes. Checkov checks one port per id and, unlike TF030,
+        // reads tcp 0-0 as every port and passes any rule with `self = true`.
+        // tfsec flags a /0 on any port; trivy-checks only SSH and RDP; KICS a
+        // longer port list; the Sentinel policies only `aws_security_group_rule`
+        // with an exact `to_port`. Each upstream id was read from its source on
+        // 2026-10-02 (checkov `AbsSecurityGroupUnrestrictedIngress.py`, trivy-checks
+        // `no_public_ingress_sgr.rego` metadata, KICS `metadata.json`, tfsec
+        // `rules.md`).
+        { tool: "checkov", rule: "CKV_AWS_24", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_AWS_25", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        {
+            tool: "tfsec",
+            rule: "aws-vpc-no-public-ingress-sgr",
+            url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/vpc/no-public-ingress-sgr/index.md",
+            relation: "overlaps",
+        },
+        {
+            tool: "trivy-checks",
+            rule: "aws-ec2-no-public-ingress-sgr",
+            url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ec2/no_public_ingress_sgr.rego",
+            relation: "overlaps",
+        },
+        {
+            tool: "kics",
+            rule: "381c3f2a-ef6f-4eff-99f7-b169cda3422c",
+            url: "https://docs.kics.io/latest/queries/terraform-queries/aws/381c3f2a-ef6f-4eff-99f7-b169cda3422c/",
+            relation: "overlaps",
+        },
+        {
+            tool: "terraform-sentinel-policies",
+            rule: "restrict-ingress-sg-rule-ssh",
+            url: "https://github.com/hashicorp/terraform-sentinel-policies/blob/main/aws/restrict-ingress-sg-rule-ssh.sentinel",
+            relation: "overlaps",
+        },
+        {
+            tool: "terraform-sentinel-policies",
+            rule: "restrict-ingress-sg-rule-rdp",
+            url: "https://github.com/hashicorp/terraform-sentinel-policies/blob/main/aws/restrict-ingress-sg-rule-rdp.sentinel",
+            relation: "overlaps",
+        },
+    ],
+    // tfsec's check also flags a service wildcard (`s3:*`), which TF031 does
+    // not, so "overlaps". checkov splits the condition four ways: CKV_AWS_63
+    // (Action "*" on the policy resources, plus aws_ssoadmin_permission_set_
+    // inline_policy, which TF031 does not read) and CKV_AWS_49 (the same on the
+    // data source, which TF031 extends with Resource "*"); CKV_AWS_355/356 ask
+    // cloudsplaining whether Resource "*" meets a RESTRICTABLE action, a
+    // narrower test than TF031's literal one. trivy-checks has no credit:
+    // `aws-iam-no-policy-wildcards` (AWS-0057) survives there only as a
+    // `deprecated: true` metadata stub with no rule body, added by
+    // aquasecurity/trivy-checks c292eb6737e0 ("add removed Go checks as
+    // deprecated"), so it checks nothing to be equivalent to (#2286).
+    TF031: [
+        {
+            tool: "tfsec",
+            rule: "aws-iam-no-policy-wildcards",
+            url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/iam/no-policy-wildcards/index.md",
+            relation: "overlaps",
+        },
+        {
+            tool: "checkov",
+            rule: "CKV_AWS_63",
+            url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarActionPolicyDocument.py",
+            relation: "overlaps",
+        },
+        {
+            tool: "checkov",
+            rule: "CKV_AWS_49",
+            url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py",
+            relation: "extends",
+        },
+        {
+            tool: "checkov",
+            rule: "CKV_AWS_355",
+            url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/IAMStarResourcePolicyDocument.py",
+            relation: "overlaps",
+        },
+        {
+            tool: "checkov",
+            rule: "CKV_AWS_356",
+            url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/data/aws/ResourcePolicyDocument.py",
+            relation: "overlaps",
+        },
+    ],
+    // tfsec's `aws-ecs-no-plaintext-secrets` and its successor in trivy-checks
+    // (`long_id` aws-ecs-no-plaintext-secrets, AVD-AWS-0036) fire on the same
+    // condition: an environment entry whose name is sensitive or whose value a
+    // secret scanner flags. `overlaps`, not `equivalent`, because both evaluate
+    // the definition first and so also read what TF032 reports as not
+    // determined, and their name list differs from secret-shape.ts's. Checkov
+    // has no Terraform check for ECS environment values (its ECS checks cover
+    // privilege, read-only root, host process, task role and EFS encryption,
+    // `checkov/terraform/checks/resource/aws/ECS*.py`), so it gets no credit.
+    TF032: [
+        {
+            tool: "tfsec",
+            rule: "aws-ecs-no-plaintext-secrets",
+            url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/ecs/no-plaintext-secrets/index.md",
+            relation: "overlaps",
+        },
+        {
+            tool: "trivy-checks",
+            rule: "aws-ecs-no-plaintext-secrets",
+            url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ecs/no_plaintext_secrets.rego",
+            relation: "overlaps",
+        },
+    ],
+    // TF033-TF037 (#2288). Every tool below reports an absent attribute the
+    // same as an insecure one, which is right for SNS (TF034) and ECR (TF037)
+    // and wrong for the rest: SQS encrypts new queues by default, an unset
+    // EBS `encrypted` follows the Region's encryption by default, and Aurora
+    // encrypts new clusters whatever `storage_encrypted` says. Where chant's
+    // answer to absence differs the credit is "overlaps"; where it agrees and
+    // the condition is the same, "equivalent". The ECR credits are "overlaps"
+    // too: none of them knows provider v6's `IMMUTABLE_WITH_EXCLUSION`, which
+    // TF037 passes and they report. trivy-checks ids are the live
+    // Rego checks (not `deprecated` stubs) at aquasecurity/trivy-checks
+    // 71c05d02845c. tfsec has no TF036 credit: its frozen `rules.md`, which
+    // the prior-art sweep indexes, no longer lists an EBS volume check.
+    TF033: [
+        { tool: "tfsec", rule: "aws-rds-encrypt-instance-storage-data", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/rds/encrypt-instance-storage-data/index.md", relation: "overlaps" },
+        { tool: "tfsec", rule: "aws-rds-encrypt-cluster-storage-data", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/rds/encrypt-cluster-storage-data/index.md", relation: "overlaps" },
+        { tool: "trivy-checks", rule: "aws-rds-encrypt-instance-storage-data", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/rds/encrypt_instance_storage_data.rego", relation: "overlaps" },
+        { tool: "trivy-checks", rule: "aws-rds-encrypt-cluster-storage-data", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/rds/encrypt_cluster_storage_data.rego", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_AWS_16", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/RDSEncryption.py", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_AWS_96", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/AuroraEncryption.py", relation: "overlaps" },
+        { tool: "kics", rule: "08bd0760-8752-44e1-9779-7bb369b2b4e4", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/08bd0760-8752-44e1-9779-7bb369b2b4e4/", relation: "overlaps" },
+    ],
+    TF034: [
+        { tool: "tfsec", rule: "aws-sns-enable-topic-encryption", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/sns/enable-topic-encryption/index.md", relation: "equivalent" },
+        { tool: "trivy-checks", rule: "aws-sns-enable-topic-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/sns/enable_topic_encryption.rego", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AWS_26", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SNSTopicEncryption.py", relation: "equivalent" },
+        { tool: "kics", rule: "28545147-2fc6-42d5-a1f9-cf226658e591", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/28545147-2fc6-42d5-a1f9-cf226658e591/", relation: "equivalent" },
+    ],
+    TF035: [
+        { tool: "tfsec", rule: "aws-sqs-enable-queue-encryption", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/sqs/enable-queue-encryption/index.md", relation: "overlaps" },
+        { tool: "trivy-checks", rule: "aws-sqs-enable-queue-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/sqs/enable_queue_encryption.rego", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_AWS_27", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/SQSQueueEncryption.py", relation: "overlaps" },
+        { tool: "kics", rule: "6e8849c1-3aa7-40e3-9063-b85ee300f29f", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/6e8849c1-3aa7-40e3-9063-b85ee300f29f/", relation: "overlaps" },
+    ],
+    TF036: [
+        { tool: "trivy-checks", rule: "aws-ec2-enable-volume-encryption", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ec2/enable_volume_encryption.rego", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_AWS_3", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/EBSEncryption.py", relation: "overlaps" },
+        { tool: "kics", rule: "cc997676-481b-4e93-aa81-d19f8c5e9b12", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/cc997676-481b-4e93-aa81-d19f8c5e9b12/", relation: "overlaps" },
+    ],
+    TF037: [
+        { tool: "tfsec", rule: "aws-ecr-enforce-immutable-repository", url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/aws/ecr/enforce-immutable-repository/index.md", relation: "overlaps" },
+        { tool: "trivy-checks", rule: "aws-ecr-enforce-immutable-repository", url: "https://github.com/aquasecurity/trivy-checks/blob/main/checks/cloud/aws/ecr/enforce_immutable_repository.rego", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_AWS_51", url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/resource/aws/ECRImmutableTags.py", relation: "overlaps" },
+        { tool: "kics", rule: "d1846b12-20c5-4d45-8798-fc35b79268eb", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/d1846b12-20c5-4d45-8798-fc35b79268eb/", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/blocks.js

@@ -0,0 +1,87 @@
+/**
+ * Shared reading helpers for the single-block post-synth checks (#2110).
+ *
+ * Thirteen of the fourteen rules in that issue do the same three things: pick
+ * the entities of one block type out of `ctx.entities`, read one attribute of
+ * each body, and report. This module is those three things, so a rule file is
+ * its condition and its message and nothing else. It exports no
+ * `PostSynthCheck`, so the generated barrel skips it (see
+ * `packages/core/src/codegen/generate-post-synth-barrel.ts`).
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+/** Every block of one entity type, in `ctx.entities` order. */
+export function blocksOfType(ctx, entityType) {
+    const blocks = [];
+    for (const [key, entity] of ctx.entities) {
+        if (entity.entityType !== entityType)
+            continue;
+        if (!isResourceDeclarable(entity))
+            continue;
+        const props = entity.props;
+        blocks.push({
+            key,
+            address: typeof props.address === "string" ? props.address : key,
+            body: (typeof props.body === "object" && props.body !== null ? props.body : {}),
+            file: typeof props.file === "string" ? props.file : "",
+            root: typeof props.root === "string" ? props.root : "",
+            source: typeof props.source === "string" ? props.source : "",
+        });
+    }
+    return blocks;
+}
+/** Blocks of several types at once, in the order the types are given. */
+export function blocksOfTypes(ctx, entityTypes) {
+    return entityTypes.flatMap((t) => blocksOfType(ctx, t));
+}
+/** The name half of a `var.<name>` / `output.<name>` address. */
+export function blockName(address) {
+    const dot = address.indexOf(".");
+    return dot === -1 ? address : address.slice(dot + 1);
+}
+/**
+ * The bodies of a nested block (`lifecycle`, `validation`, a provider's
+ * `assume_role`). hcl2json encodes a repeatable block as an array of bodies
+ * and a singleton as a bare object, so both are normalized to an array here.
+ */
+export function nestedBodies(body, key) {
+    const value = body[key];
+    if (Array.isArray(value))
+        return value.filter((v) => typeof v === "object" && v !== null && !Array.isArray(v));
+    if (typeof value === "object" && value !== null)
+        return [value];
+    return [];
+}
+/** Is this attribute value a string that says nothing? */
+export function isBlank(value) {
+    return value === undefined || value === null || (typeof value === "string" && value.trim() === "");
+}
+/**
+ * Every scalar attribute in a block body, descending through nested blocks so
+ * a credential inside `connection {}` or `assume_role {}` is not invisible.
+ * Depth-limited: a Terraform block nests a handful of levels at most, and an
+ * unbounded walk over a large body buys nothing.
+ */
+export function walkAttributes(body, maxDepth = 3) {
+    const out = [];
+    const visit = (value, path, name, depth) => {
+        if (Array.isArray(value)) {
+            if (depth > maxDepth)
+                return;
+            for (const item of value)
+                visit(item, path, name, depth);
+            return;
+        }
+        if (typeof value === "object" && value !== null) {
+            if (depth >= maxDepth)
+                return;
+            for (const [k, v] of Object.entries(value)) {
+                visit(v, path === "" ? k : `${path}.${k}`, k, depth + 1);
+            }
+            return;
+        }
+        if (path !== "")
+            out.push({ name, path, value });
+    };
+    visit(body, "", "", 0);
+    return out;
+}

package/dist/lint/post-synth/fixtures/load.js

@@ -0,0 +1,94 @@
+/**
+ * Shared post-synth fixture loader.
+ *
+ * KICS lays its own query fixtures out as `positive.tf`/`negative.tf` pairs
+ * beside the query that tests them (survey, #2107): every query is
+ * externally auditable because a rule and its evidence live in the same
+ * directory. This lexicon adopts that layout: `fixtures/<id>/positive.tf`
+ * triggers the check, `fixtures/<id>/negative.tf` does not, and a rule with
+ * more than one triggering condition adds `positive-<case>.tf` beside them.
+ *
+ * KICS itself scans a whole fixture directory in one pass and tells its
+ * fixtures apart by the file each finding came from. That doesn't transfer
+ * here: TF001 (and most post-synth checks with per-root state, not
+ * per-resource) fire once per *root*, deduplicated by root name, so parsing
+ * `positive.tf` and `negative.tf` together as one root would let whichever
+ * file's terraform block is read first decide the outcome for both, silently
+ * discarding the other. `loadFixture` therefore reads exactly the one named
+ * file and parses it alone, through the same `blocksToEntities` pass
+ * `parseTerraformRootDir` wraps for a real root directory, so sibling
+ * fixtures never mix into one build.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { blocksToEntities } from "../../../hcl/parse.js";
+import { renderTerraformRoots } from "../../../hcl/roots.js";
+const FIXTURES_DIR = dirname(fileURLToPath(import.meta.url));
+/**
+ * Parse `fixtures/<checkId>/<name>.tf` into a {@link PostSynthContext} whose
+ * `entities` are exactly what a real root module of that one file would
+ * produce. `root` (the entity key prefix and the `TerraformEntity.props.root`
+ * value) defaults to `checkId`; pass a distinct value to load two fixtures
+ * into one context under different root names.
+ *
+ * Three lines per fixture in a test:
+ * ```ts
+ * const diags = tf001.check(await loadFixture("TF001", "positive"));
+ * expect(diags).toHaveLength(1);
+ * ```
+ */
+export async function loadFixture(checkId, name, root = checkId) {
+    const file = `${name}.tf`;
+    const source = readFileSync(join(FIXTURES_DIR, checkId, file), "utf-8");
+    const entities = await blocksToEntities([{ name: file, source }], root);
+    return {
+        outputs: new Map(),
+        entities,
+        buildResult: {
+            outputs: new Map(),
+            entities,
+            warnings: [],
+            errors: [],
+            sourceFileCount: 1,
+        },
+    };
+}
+/**
+ * Parse a whole fixture DIRECTORY, `fixtures/<checkId>/<name>/`, the way
+ * `buildRoots()` parses a configured root: its own `.tf` files, then every
+ * local `module` call followed into its directory (chant #2112). A rule about
+ * child modules (TF014, TF015) or about a whole scope's references (TF020)
+ * cannot be shown a single file and still be tested honestly, so its fixture
+ * is a tree:
+ *
+ * ```
+ * fixtures/TF014/positive/main.tf                     # module "cdn" { source = "./modules/cdn" }
+ * fixtures/TF014/positive/modules/cdn/main.tf         # the provider block the rule reports
+ * ```
+ *
+ * The fixture directory is also the project root for the descent, so a
+ * fixture can exercise the outside-the-project refusal with a `../` source
+ * without reaching into the repository around it. `warnings` from the render
+ * lands on `buildResult.warnings`, where the descent's own refusals are
+ * readable by a test.
+ */
+export async function loadTreeFixture(checkId, name, root = checkId, callModuleType) {
+    const dir = join(FIXTURES_DIR, checkId, name);
+    const { entities, warnings } = await renderTerraformRoots({
+        projectRoot: dir,
+        roots: { [root]: { dir } },
+        ...(callModuleType ? { callModuleType } : {}),
+    });
+    return {
+        outputs: new Map(),
+        entities,
+        buildResult: {
+            outputs: new Map(),
+            entities,
+            warnings,
+            errors: [],
+            sourceFileCount: entities.size,
+        },
+    };
+}