@intentius/chant-lexicon-terraform 0.124.31 → 0.124.33

package/dist/lint/post-synth/tf001.js

@@ -0,0 +1,138 @@
+/**
+ * TF001: a root module keeps its state on local disk.
+ *
+ * Two ways a root gets there, and this reports both (#2218). A `terraform`
+ * block with no `backend "<type>"` and no `cloud {}` falls back to the local
+ * backend implicitly. A `backend "local"` block asks for the same backend by
+ * name. Either way `terraform.tfstate` lands in the working directory, and
+ * that file holds every attribute of every managed resource, secrets
+ * included, and it is not shared, not locked, and not versioned. The first
+ * apply from a second machine or a CI runner starts from an empty state and
+ * proposes to create the estate again.
+ *
+ * So the rule reads the backend block's TYPE LABEL rather than its presence:
+ * the id means "no remote backend", which is what its name, its message and
+ * its page have always argued. `cloud {}` counts as remote (it is Terraform
+ * Cloud / HCP state, held off the machine and locked). Every other backend
+ * type is taken as remote without a list to maintain, since `local` is the
+ * only backend Terraform ships that writes to the working directory.
+ *
+ * A root that keeps local state on purpose says so with a
+ * `# chant-ignore-block: TF001` on the line above its `terraform` block
+ * (chant #2111), which is what the three shipped examples do.
+ *
+ * One diagnostic per root, fired from the root's `terraform` block. A root
+ * with no `terraform` block at all is not flagged: it declares no version
+ * constraints either, and the missing block is a different finding.
+ *
+ * Scope: root modules only (#2112). A child module must NOT declare a
+ * backend, which is the mirror image and TF015's finding, so a descended
+ * module's `terraform` block is skipped here rather than read as if it were
+ * the root's.
+ *
+ * Does not fire on a live root (#2103): a `backend` block is exactly what
+ * choudoufu refuses there (TF024's territory), and the fallback to local
+ * state this check warns about does not apply, since a live root keeps no
+ * state file at all, local or remote.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { TERRAFORM_TYPE } from "../../hcl/parse.js";
+import { attr } from "../../hcl/value.js";
+import { isRootScoped } from "./scope.js";
+/**
+ * `backend`/`cloud` are blocks, so hcl2json encodes them as a value under the
+ * key, structurally the same "literal value under this key" shape `attr()`
+ * (`../../hcl/value.ts`, chant #2113) reads for an ordinary attribute, so
+ * this reads through it rather than re-deriving presence by hand.
+ */
+export function hasBlock(body, key) {
+    const a = attr(body, key);
+    if (a.kind === "absent")
+        return false;
+    if (Array.isArray(a.value))
+        return a.value.length > 0;
+    return typeof a.value === "object" && a.value !== null ? Object.keys(a.value).length > 0 : true;
+}
+/** The one backend type that writes state to the working directory. */
+export const LOCAL_BACKEND = "local";
+/**
+ * The type labels of the `backend` blocks in a `terraform` block body.
+ *
+ * `backend` takes one label, so hcl2json nests it one level deeper than an
+ * unlabelled block: `backend "s3" { bucket = "b" }` is
+ * `{ backend: { s3: [{ bucket: "b" }] } }`, where `cloud { ... }` is just
+ * `{ cloud: [{ ... }] }`. The keys of that inner object are the labels, which
+ * is the only place the type survives the parse. A malformed body that puts
+ * an array or a scalar under `backend` yields no labels, and the caller then
+ * treats the root as having no remote backend, the same verdict a missing
+ * block gets.
+ */
+export function backendTypes(body) {
+    const a = attr(body, "backend");
+    if (a.kind === "absent")
+        return [];
+    const value = a.value;
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return [];
+    return Object.keys(value);
+}
+/**
+ * Whether the body configures state somewhere other than the working
+ * directory: any `backend` block whose type is not `local`, or a `cloud`
+ * block.
+ */
+export function hasRemoteBackend(body) {
+    if (hasBlock(body, "cloud"))
+        return true;
+    return backendTypes(body).some((type) => type !== LOCAL_BACKEND);
+}
+export const tf001 = {
+    id: "TF001",
+    description: "Root module declares no remote backend",
+    check(ctx) {
+        const diagnostics = [];
+        /** Root name to the entity key of the first `terraform` block seen for it. */
+        const flagged = new Set();
+        for (const [name, entity] of ctx.entities) {
+            if (entity.entityType !== TERRAFORM_TYPE)
+                continue;
+            if (!isResourceDeclarable(entity) || !isRootScoped(entity))
+                continue;
+            const props = entity.props;
+            if (props.mode === "live")
+                continue;
+            const root = typeof props.root === "string" ? props.root : "";
+            if (flagged.has(root))
+                continue;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            if (hasRemoteBackend(body))
+                continue;
+            // What the root actually declares, so the message names it rather than
+            // saying "no remote backend" over a block the reader can see.
+            const found = backendTypes(body).includes(LOCAL_BACKEND)
+                ? 'the backend it declares is `backend "local"`'
+                : "there is no backend block at all";
+            flagged.add(root);
+            diagnostics.push({
+                checkId: "TF001",
+                severity: "warning",
+                message: `Root module "${root}" declares no remote backend: ${found}. State is a ` +
+                    "terraform.tfstate in the working directory, which is unshared, unlocked and holds every " +
+                    'resource attribute in plaintext. Declare a `backend "<type>"` naming a remote type (`s3`, ' +
+                    "`gcs`, `azurerm`, `http`) or a `cloud {}` block, or keep the local state on purpose with a " +
+                    "`# chant-ignore-block: TF001` above the terraform block.",
+                entity: name,
+                lexicon: "terraform",
+                // The missing-resource shape (chant #2113): there is no remote
+                // `backend`/`cloud` block to point at, only the root that lacks one.
+                // `entity` above still names the `terraform` block this fired from (by
+                // convenience, not because that block is what's wrong), so `missing`
+                // is what a suppression should key on instead. `kind` stays `backend`
+                // in both cases: what is absent is a remote backend, whether or not a
+                // `backend "local"` block is sitting where one should be.
+                missing: { kind: "backend", scope: root },
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf002.js

@@ -0,0 +1,143 @@
+/**
+ * TF002: a provider a root implies has no `required_providers` entry, or an
+ * incomplete one.
+ *
+ * A provider is implied two ways: an explicit `provider "<name>" {}` block,
+ * or a resource/data type prefix (`aws_instance` implies `aws`, up to the
+ * first underscore, the same heuristic tflint's `terraform_required_providers`
+ * reads via `GetProviderRefs()`). The `terraform` builtin (the provider
+ * behind `terraform_remote_state`) is never implied: it has no registry
+ * entry to require. Every implied provider needs a `required_providers`
+ * entry that is an object carrying both `source` and `version`, since the old
+ * shorthand form (`aws = "~> 4.0"`, a bare string) has neither and fires the
+ * same as a missing entry.
+ *
+ * Fires once per incomplete or missing provider, not once per resource: two
+ * resources implying the same unconstrained provider produce one diagnostic.
+ * Anchored on whichever entity first implied the provider, preferring an
+ * explicit `provider` block over a resource/data type, so the diagnostic
+ * points at the most specific place a fix belongs.
+ *
+ * A root with no `terraform` block at all is out of scope, same as TF001:
+ * the missing block is that rule's finding, not this one's.
+ *
+ * Scope: root modules only (#2112). A child module's own `required_providers`
+ * are the child's business, and its resources are constrained by the root's
+ * block at plan time, so folding a descended module's blocks into this pass
+ * would both credit the root with requirements it never declared and judge it
+ * on providers it never named.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isRootScoped } from "./scope.js";
+import { DATA_TYPE, PROVIDER_TYPE, RESOURCE_TYPE, TERRAFORM_TYPE, } from "../../hcl/parse.js";
+/** The `terraform` provider backs `terraform_remote_state`; it ships with the binary, not the registry. */
+const BUILTIN_PROVIDERS = new Set(["terraform"]);
+function providerNameFromType(type) {
+    return type.split("_")[0];
+}
+/** One implied provider name to the entity key that first implied it in file order. */
+export function impliedProviders(entities, root) {
+    const implied = new Map();
+    const fromProviderBlock = new Set();
+    for (const [key, entity] of entities) {
+        if (!isResourceDeclarable(entity) || !isRootScoped(entity))
+            continue;
+        const props = entity.props;
+        if (props.root !== root)
+            continue;
+        const address = typeof props.address === "string" ? props.address : "";
+        if (entity.entityType === PROVIDER_TYPE) {
+            const name = address.slice("provider.".length);
+            if (BUILTIN_PROVIDERS.has(name))
+                continue;
+            implied.set(name, key);
+            fromProviderBlock.add(name);
+        }
+        else if (entity.entityType === RESOURCE_TYPE) {
+            const type = address.split(".")[0] ?? "";
+            const name = providerNameFromType(type);
+            if (BUILTIN_PROVIDERS.has(name) || fromProviderBlock.has(name))
+                continue;
+            if (!implied.has(name))
+                implied.set(name, key);
+        }
+        else if (entity.entityType === DATA_TYPE) {
+            const type = address.split(".")[1] ?? "";
+            const name = providerNameFromType(type);
+            if (BUILTIN_PROVIDERS.has(name) || fromProviderBlock.has(name))
+                continue;
+            if (!implied.has(name))
+                implied.set(name, key);
+        }
+    }
+    return implied;
+}
+/** `required_providers` is a nested block: hcl2json encodes it as a one-element array of `{name: entry}`. */
+function requiredProvidersMap(body) {
+    const merged = {};
+    const blocks = body.required_providers;
+    if (!Array.isArray(blocks))
+        return merged;
+    for (const block of blocks) {
+        if (typeof block === "object" && block !== null)
+            Object.assign(merged, block);
+    }
+    return merged;
+}
+/** Why a `required_providers` entry is incomplete, or `undefined` if it's fine. */
+function entryProblem(entry) {
+    if (entry === undefined)
+        return "no `required_providers` entry";
+    if (typeof entry === "string")
+        return "the legacy shorthand form (a bare version string), which carries no `source`";
+    if (typeof entry !== "object" || entry === null)
+        return "an entry that is not a valid object";
+    const obj = entry;
+    const missing = [];
+    if (typeof obj.source !== "string" || obj.source === "")
+        missing.push("`source`");
+    if (typeof obj.version !== "string" || obj.version === "")
+        missing.push("`version`");
+    return missing.length > 0 ? `an entry missing ${missing.join(" and ")}` : undefined;
+}
+export const tf002 = {
+    id: "TF002",
+    description: "A provider the root implies has no required_providers entry, or an incomplete one",
+    check(ctx) {
+        const diagnostics = [];
+        const roots = new Set();
+        const requiredByRoot = new Map();
+        for (const entity of ctx.entities.values()) {
+            if (entity.entityType !== TERRAFORM_TYPE || !isResourceDeclarable(entity))
+                continue;
+            if (!isRootScoped(entity))
+                continue;
+            const props = entity.props;
+            const root = typeof props.root === "string" ? props.root : "";
+            roots.add(root);
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const merged = requiredByRoot.get(root) ?? {};
+            Object.assign(merged, requiredProvidersMap(body));
+            requiredByRoot.set(root, merged);
+        }
+        for (const root of [...roots].sort()) {
+            const required = requiredByRoot.get(root) ?? {};
+            const implied = impliedProviders(ctx.entities, root);
+            for (const name of [...implied.keys()].sort()) {
+                const problem = entryProblem(required[name]);
+                if (!problem)
+                    continue;
+                diagnostics.push({
+                    checkId: "TF002",
+                    severity: "warning",
+                    message: `Provider "${name}" is used in root module "${root}" but has ${problem} in ` +
+                        "`required_providers`. Add `source` and `version` for it in the terraform block's " +
+                        "`required_providers`, so a future provider release can't silently change behavior.",
+                    entity: implied.get(name),
+                    lexicon: "terraform",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf003.js

@@ -0,0 +1,60 @@
+/**
+ * TF003: a root's `terraform` block has no `required_version`.
+ *
+ * Sits on the same `terraform` block TF001 already walks. Without
+ * `required_version`, a root can be applied by whatever Terraform binary
+ * happens to be on the runner's `PATH`, and a binary upgrade that changes
+ * behavior (a provider protocol bump, a changed default) surfaces as a
+ * surprise plan diff instead of a version-check failure before anything runs.
+ *
+ * One diagnostic per root, fired once even if the root spreads its
+ * `terraform` block across several files (a legacy-config split into
+ * `terraform.tf` and `versions.tf`, say). A root with no `terraform` block
+ * at all is out of scope, same as TF001 and TF002: the missing block is
+ * their finding, not this one's.
+ *
+ * Scope: root modules only (#2112). A child module may legitimately leave
+ * `required_version` to the root that calls it, so a descended module's
+ * `terraform` block is skipped here.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isRootScoped } from "./scope.js";
+import { TERRAFORM_TYPE } from "../../hcl/parse.js";
+function hasRequiredVersion(body) {
+    return typeof body.required_version === "string" && body.required_version.trim() !== "";
+}
+export const tf003 = {
+    id: "TF003",
+    description: "Root module's terraform block has no required_version",
+    check(ctx) {
+        const diagnostics = [];
+        /** Root name to the entity key of its first `terraform` block, and whether any block for it declares `required_version`. */
+        const seen = new Map();
+        for (const [key, entity] of ctx.entities) {
+            if (entity.entityType !== TERRAFORM_TYPE || !isResourceDeclarable(entity))
+                continue;
+            if (!isRootScoped(entity))
+                continue;
+            const props = entity.props;
+            const root = typeof props.root === "string" ? props.root : "";
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const existing = seen.get(root);
+            const hasVersion = (existing?.hasVersion ?? false) || hasRequiredVersion(body);
+            seen.set(root, { anchor: existing?.anchor ?? key, hasVersion });
+        }
+        for (const [root, { anchor, hasVersion }] of [...seen].sort(([a], [b]) => a.localeCompare(b))) {
+            if (hasVersion)
+                continue;
+            diagnostics.push({
+                checkId: "TF003",
+                severity: "warning",
+                message: `Root module "${root}"'s terraform block has no \`required_version\`. Without it, ` +
+                    "an upgraded Terraform binary can change behavior with no version-check failure to " +
+                    "flag it first. Add `required_version = \">= <lowest supported version>\"`.",
+                entity: anchor,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf004.js

@@ -0,0 +1,54 @@
+/**
+ * TF004: a registry-sourced `module` block has no `version`.
+ *
+ * "Registry-sourced" means `source` parses as a Terraform module registry
+ * address (`classifyModuleSource`, `./module-source.ts`): a bare
+ * `namespace/name/target-system`, or a hostname-prefixed
+ * `host/namespace/name/target-system`. Without `version`, `terraform init`
+ * always resolves to the newest release that satisfies no constraint at
+ * all, so an upstream module release can change what a root provisions with
+ * no local edit and no diff to review first.
+ *
+ * A local (`./`, `../`) or git/hg source is never flagged here: git/hg is
+ * TF005's territory, and a local source cannot carry a registry version at
+ * all. One diagnostic per module block.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE } from "../../hcl/parse.js";
+import { classifyModuleSource } from "./module-source.js";
+export const tf004 = {
+    id: "TF004",
+    description: "Registry-sourced module block has no version",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [key, entity] of ctx.entities) {
+            if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const source = typeof body.source === "string" ? body.source : undefined;
+            if (source === undefined)
+                continue;
+            if (classifyModuleSource(source).kind !== "registry")
+                continue;
+            const version = body.version;
+            if (typeof version === "string" && version.trim() !== "")
+                continue;
+            const address = typeof props.address === "string" ? props.address : key;
+            diagnostics.push({
+                checkId: "TF004",
+                severity: "warning",
+                message: `Module "${address}" sources "${source}" from a registry with no \`version\`. ` +
+                    "`terraform init` resolves to the newest release with no constraint to hold it back. " +
+                    "Add a `version` constraint (e.g. `~> 5.0`).",
+                entity: key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf005.js

@@ -0,0 +1,68 @@
+/**
+ * TF005: a git or hg `module` source with no `?ref=`, or a `?ref=` that
+ * isn't tight enough to call pinned.
+ *
+ * "Git or hg" is `classifyModuleSource`'s `"git"` kind (`./module-source.ts`):
+ * an explicit `git::`/`hg::` prefix, the bare `github.com`/`bitbucket.org`
+ * shorthands, an scp-style `git@host:path`, or anything ending in `.git`.
+ * A ref counts as pinned only if it is a semver-shaped tag or a full 40-hex
+ * commit SHA (`isPinnedRef`), stricter than checkov's `CKV_TF_1`/`CKV_TF_2`,
+ * which accept any `?ref=` containing `\d\.\d` (so `v1.2-dev` passes there;
+ * it does not here, and the rule's page section says so). A ref matching a
+ * well-known mutable branch name (`main`, `master`, `develop`, `trunk`) gets
+ * its own, more specific message, since that's the exact case tflint's
+ * `flexible` style (the style this rule ships; see the page section for what
+ * `semver` style would add) already reports on.
+ *
+ * A local (`./`, `../`) source is never flagged: it can't be pinned to a
+ * ref at all, and checkov's own module-pinning checks return `UNKNOWN`
+ * (not a failure) for the same reason. A registry source is TF004's
+ * territory, not this rule's; the two never fire on the same module block.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE } from "../../hcl/parse.js";
+import { classifyModuleSource, isDefaultBranch, isPinnedRef } from "./module-source.js";
+export const tf005 = {
+    id: "TF005",
+    description: "Git/hg module source is unpinned, or pinned to a mutable ref",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [key, entity] of ctx.entities) {
+            if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const source = typeof body.source === "string" ? body.source : undefined;
+            if (source === undefined)
+                continue;
+            const classified = classifyModuleSource(source);
+            if (classified.kind !== "git")
+                continue;
+            const address = typeof props.address === "string" ? props.address : key;
+            let message;
+            if (!classified.ref) {
+                message = `Module "${address}" sources "${source}" from git/hg with no \`?ref=\`. Add one pinned to a tag or a full commit SHA.`;
+            }
+            else if (isDefaultBranch(classified.ref)) {
+                message = `Module "${address}" sources "${source}" pinned to "${classified.ref}", a mutable branch. Pin to a tag or a full commit SHA instead.`;
+            }
+            else if (!isPinnedRef(classified.ref)) {
+                message = `Module "${address}" sources "${source}" pinned to "${classified.ref}", which is neither a tag nor a full commit SHA and can move. Pin to a tag or a full commit SHA instead.`;
+            }
+            if (!message)
+                continue;
+            diagnostics.push({
+                checkId: "TF005",
+                severity: "warning",
+                message,
+                entity: key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf006.js

@@ -0,0 +1,43 @@
+/**
+ * TF006: a `sensitive = true` variable carries a `default`.
+ *
+ * Marking a variable sensitive is a statement that its value must not be seen.
+ * A default is a value committed to the repository, so the two together are a
+ * contradiction: the secret is in git, and the `sensitive` flag only hides it
+ * from plan output, where it was never the exposure. It is also the shape that
+ * survives longest, because every environment that forgets to pass the variable
+ * silently gets the committed one.
+ *
+ * Any default counts, not only a secret-shaped one. `default = ""` and
+ * `default = null` are the two that look harmless, and both make a required
+ * secret optional, which is the other half of the failure.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import { VARIABLE_TYPE } from "../../hcl/parse.js";
+import { blockName, blocksOfType } from "./blocks.js";
+export const tf006 = {
+    id: "TF006",
+    description: "Sensitive variable declares a default value",
+    check(ctx) {
+        const diagnostics = [];
+        for (const block of blocksOfType(ctx, VARIABLE_TYPE)) {
+            if (block.body.sensitive !== true)
+                continue;
+            if (!("default" in block.body))
+                continue;
+            diagnostics.push({
+                checkId: "TF006",
+                severity: "error",
+                message: `Variable "${blockName(block.address)}" is marked \`sensitive = true\` and declares a ` +
+                    "`default`. A default is committed to the repository, so the value the variable is meant " +
+                    "to protect is already public. Drop the default and require the value to be passed in.",
+                entity: block.key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf007.js

@@ -0,0 +1,66 @@
+/**
+ * TF007: a variable default or a `locals` value holds a secret-shaped literal.
+ *
+ * This is the check tfsec shipped as `general-secrets-sensitive-in-variable`
+ * and `general-secrets-sensitive-in-local`, and that trivy dropped when it
+ * absorbed tfsec. #2107's survey found no maintained tool that has it today.
+ *
+ * A committed default or local is a credential in git history, which no later
+ * edit removes, and Terraform copies it into state and into plan output on
+ * every run. Both heuristics in `../secret-shape.ts` count: the name (a
+ * variable called `db_password`) and the value (something shaped like a live
+ * credential whatever it is called). References and interpolations are never
+ * flagged, because passing the value in is the fix.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import { LOCALS_TYPE, VARIABLE_TYPE } from "../../hcl/parse.js";
+import { secretShapedAssignment } from "../secret-shape.js";
+import { blockName, blocksOfType } from "./blocks.js";
+/** Why the value was flagged, in the words of the heuristic that fired. */
+function because(shape) {
+    return shape.reason === "value"
+        ? `the value (${shape.length} characters, redacted here) matches a credential shape`
+        : "the name reads like a credential and the value is a committed literal";
+}
+export const tf007 = {
+    id: "TF007",
+    description: "Secret-shaped literal in a variable default or a locals value",
+    check(ctx) {
+        const diagnostics = [];
+        for (const block of blocksOfType(ctx, VARIABLE_TYPE)) {
+            const name = blockName(block.address);
+            const shape = secretShapedAssignment(name, block.body.default);
+            if (!shape)
+                continue;
+            diagnostics.push({
+                checkId: "TF007",
+                severity: "error",
+                message: `Variable "${name}" defaults to what looks like a secret: ${because(shape)}. A default is ` +
+                    "committed to the repository and copied into state on every run. Remove it, mark the " +
+                    "variable `sensitive = true`, and pass the value from a secret store at apply time.",
+                entity: block.key,
+                lexicon: "terraform",
+            });
+        }
+        for (const block of blocksOfType(ctx, LOCALS_TYPE)) {
+            for (const [name, value] of Object.entries(block.body)) {
+                const shape = secretShapedAssignment(name, value);
+                if (!shape)
+                    continue;
+                diagnostics.push({
+                    checkId: "TF007",
+                    severity: "error",
+                    message: `Local value "${name}" looks like a secret: ${because(shape)}. A local is a committed ` +
+                        "constant with no way to override it per environment. Read the value from a data source " +
+                        "or a sensitive variable instead.",
+                    entity: `${block.key}.${name}`,
+                    lexicon: "terraform",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf008.js

@@ -0,0 +1,64 @@
+/**
+ * TF008: a `provider` block configures a credential inline.
+ *
+ * The most corroborated rule in #2107's survey: checkov (`CKV_AWS_41` and its
+ * `credentials.py` siblings), KICS, Snyk and semgrep all ship a version of it,
+ * and it is the only Terraform-language-shaped check any of Snyk or semgrep
+ * ships at all. Every one of them is written per provider. This one is written
+ * against attribute NAMES, so it covers the providers those tools cover and
+ * the several hundred they do not.
+ *
+ * A credential in a provider block is used by every resource that provider
+ * manages, so it is the highest-value one in the root, and it is read from the
+ * repository by everyone who can clone it. Providers all accept the same
+ * credential through the environment or a shared config file instead.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import { PROVIDER_TYPE } from "../../hcl/parse.js";
+import { isLiteralString, isPlaceholderValue, isSecretName } from "../secret-shape.js";
+import { blockName, blocksOfType, walkAttributes } from "./blocks.js";
+/**
+ * Credential attributes the name heuristic in `../secret-shape.ts` does not
+ * cover on its own. `client_secret` and the `*_key`/`*_token` names it does
+ * cover are not repeated here.
+ */
+const PROVIDER_CREDENTIAL_ATTRS = new Set(["credentials", "client_certificate", "client_key", "shared_credentials_file"]);
+/**
+ * A path, not a credential: `credentials = "keys/service-account.json"` and
+ * `shared_credentials_file = "~/.aws/credentials"` name where the secret lives,
+ * which is what the fix looks like.
+ */
+const FILE_PATH_RE = /^[~./]?[\w./\\-]*\.(json|pem|key|p12|pfx|crt|cer|ini|conf|credentials)$/i;
+export const tf008 = {
+    id: "TF008",
+    description: "Provider block configures a hardcoded credential",
+    check(ctx) {
+        const diagnostics = [];
+        for (const block of blocksOfType(ctx, PROVIDER_TYPE)) {
+            for (const attr of walkAttributes(block.body)) {
+                if (!PROVIDER_CREDENTIAL_ATTRS.has(attr.name) && !isSecretName(attr.name))
+                    continue;
+                if (!isLiteralString(attr.value))
+                    continue;
+                const value = attr.value.trim();
+                if (value === "" || isPlaceholderValue(value) || FILE_PATH_RE.test(value))
+                    continue;
+                diagnostics.push({
+                    checkId: "TF008",
+                    severity: "error",
+                    message: `Provider "${blockName(block.address)}" sets \`${attr.path}\` to a literal value ` +
+                        `(${value.length} characters, redacted here). A credential in a provider block is ` +
+                        "committed to the repository and used by every resource the provider manages. Remove it " +
+                        "and let the provider read the credential from the environment, a shared config file, or " +
+                        "a sensitive variable.",
+                    entity: `${block.key}.${attr.path}`,
+                    lexicon: "terraform",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};