@intentius/chant-lexicon-terraform 0.124.44 → 0.124.46

package/src/__fixtures__/capabilities/findings/main.tf

@@ -0,0 +1,225 @@
+# The -findings layer of choudoufu terralith-gen -scale 4 -findings (INTENTIUS/choudoufu#2199),
+# copied from its bastion.tf, data.tf and network.tf, for behold#912 steps 4 and 6 (#4375).
+resource "aws_vpc" "main" {
+  cidr_block = "10.42.0.0/16"
+}
+
+resource "aws_subnet" "main" {
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = "10.42.1.0/24"
+  availability_zone = "us-east-1a"
+
+  tags = {
+    Name = "tl-subnet"
+  }
+}
+
+resource "aws_security_group" "ecs" {
+  name        = "tl-ecs-sg"
+  description = "terralith-gen: shared security group for the container-service layer"
+  vpc_id      = aws_vpc.main.id
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+
+  tags = {
+    Name = "tl-igw"
+  }
+}
+
+resource "aws_subnet" "public" {
+  vpc_id                  = aws_vpc.main.id
+  cidr_block              = "10.42.2.0/24"
+  availability_zone       = "us-east-1a"
+  map_public_ip_on_launch = true
+
+  tags = {
+    Name = "tl-public"
+  }
+}
+
+resource "aws_route_table" "public" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main.id
+  }
+
+  tags = {
+    Name = "tl-public"
+  }
+}
+
+resource "aws_route_table_association" "public" {
+  subnet_id      = aws_subnet.public.id
+  route_table_id = aws_route_table.public.id
+}
+
+resource "aws_security_group" "bastion" {
+  name        = "tl-bastion-sg"
+  description = "terralith-gen: the bastion's security group"
+  vpc_id      = aws_vpc.main.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "bastion_ssh" {
+  security_group_id = aws_security_group.bastion.id
+  description       = "ssh from anywhere"
+  ip_protocol       = "tcp"
+  from_port         = 22
+  to_port           = 22
+  cidr_ipv4         = "0.0.0.0/0"
+}
+
+resource "aws_launch_template" "bastion" {
+  name                   = "tl-bastion"
+  image_id               = "ami-12345678"
+  instance_type          = "t3.micro"
+  vpc_security_group_ids = [aws_security_group.bastion.id]
+
+  # By arn, not name: floci returns the profile by ARN only (issue #2199).
+  iam_instance_profile {
+    arn = aws_iam_instance_profile.app_data.arn
+  }
+}
+
+resource "aws_instance" "bastion" {
+  subnet_id = aws_subnet.public.id
+
+  launch_template {
+    id      = aws_launch_template.bastion.id
+    version = "$Latest"
+  }
+
+  tags = {
+    Name = "tl-bastion"
+  }
+
+  # floci does not return the aws:ec2launchtemplate:id tag the provider
+  # reads this block back from, so without this every plan replaces the
+  # instance (issue #2199).
+  lifecycle {
+    ignore_changes = [launch_template]
+  }
+}
+
+resource "aws_subnet" "db_a" {
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = "10.42.10.0/24"
+  availability_zone = "us-east-1a"
+
+  tags = {
+    Name = "tl-db-a"
+  }
+}
+
+resource "aws_subnet" "db_b" {
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = "10.42.11.0/24"
+  availability_zone = "us-east-1b"
+
+  tags = {
+    Name = "tl-db-b"
+  }
+}
+
+resource "aws_db_subnet_group" "orders" {
+  name       = "tl-orders"
+  subnet_ids = [aws_subnet.db_a.id, aws_subnet.db_b.id]
+}
+
+# storage_encrypted = true forces replacement; identifier and
+# engine_version update in place on provider 6.59.0 (issue #2199).
+resource "aws_db_instance" "orders" {
+  identifier           = "tl-orders"
+  engine               = "postgres"
+  engine_version       = "16.3"
+  instance_class       = "db.t3.micro"
+  allocated_storage    = 20
+  db_name              = "orders"
+  username             = "orders_admin"
+  password             = "emulator-only-not-a-secret"
+  db_subnet_group_name = aws_db_subnet_group.orders.name
+  storage_encrypted    = false
+  skip_final_snapshot  = true
+}
+
+resource "aws_dynamodb_table" "sessions" {
+  name         = "tl-sessions"
+  billing_mode = "PAY_PER_REQUEST"
+  hash_key     = "id"
+
+  attribute {
+    name = "id"
+    type = "S"
+  }
+}
+
+resource "aws_iam_role" "app_data" {
+  name = "tl-app-data-role"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Action    = "sts:AssumeRole"
+      Principal = { Service = "ec2.amazonaws.com" }
+    }]
+  })
+}
+
+resource "aws_iam_policy" "app_data" {
+  name = "tl-app-data"
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:DeleteItem"]
+      Resource = aws_dynamodb_table.sessions.arn
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "app_data" {
+  role       = aws_iam_role.app_data.name
+  policy_arn = aws_iam_policy.app_data.arn
+}
+
+resource "aws_iam_instance_profile" "app_data" {
+  name = "tl-app-data"
+  role = aws_iam_role.app_data.name
+}
+
+# One of the eight team roles with dynamodb actions on Resource = "*" (iam.tf).
+resource "aws_iam_role" "team_0002_role" {
+  name = "tl-team-0002-role"
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Action    = "sts:AssumeRole"
+      Principal = { Service = "lambda.amazonaws.com" }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "team_0002_inline" {
+  name = "tl-team-0002-inline"
+  role = aws_iam_role.team_0002_role.name
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect   = "Allow"
+      Action   = ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem"]
+      Resource = "*"
+    }]
+  })
+}

package/src/__fixtures__/capabilities/ledger/main.tf

@@ -0,0 +1,265 @@
+# "ledger": the Terraform form of the estate chant#4361 measured the rule language on (#4375).
+terraform {
+  required_providers {
+    aws = { source = "hashicorp/aws", version = "~> 6.0" }
+  }
+}
+provider "aws" { region = "us-east-1" }
+
+locals {
+  ami        = "ami-0f3f13f145e66a0a3"
+  restricted = { "data-classification" = "restricted" }
+}
+
+# network
+resource "aws_vpc" "vpc" { cidr_block = "10.0.0.0/16" }
+resource "aws_subnet" "public" {
+  vpc_id     = aws_vpc.vpc.id
+  cidr_block = "10.0.0.0/24"
+}
+resource "aws_subnet" "private" {
+  vpc_id     = aws_vpc.vpc.id
+  cidr_block = "10.0.1.0/24"
+}
+resource "aws_internet_gateway" "igw" { vpc_id = aws_vpc.vpc.id }
+resource "aws_route_table" "public" { vpc_id = aws_vpc.vpc.id }
+resource "aws_route_table" "private" { vpc_id = aws_vpc.vpc.id }
+resource "aws_route" "public_default" {
+  route_table_id         = aws_route_table.public.id
+  destination_cidr_block = "0.0.0.0/0"
+  gateway_id             = aws_internet_gateway.igw.id
+}
+resource "aws_route_table_association" "public" {
+  route_table_id = aws_route_table.public.id
+  subnet_id      = aws_subnet.public.id
+}
+resource "aws_route_table_association" "private" {
+  route_table_id = aws_route_table.private.id
+  subnet_id      = aws_subnet.private.id
+}
+
+resource "aws_security_group" "web" {
+  description = "web"
+  vpc_id      = aws_vpc.vpc.id
+  ingress {
+    protocol    = "tcp"
+    from_port   = 443
+    to_port     = 443
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+  ingress {
+    protocol    = "tcp"
+    from_port   = 22
+    to_port     = 22
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+resource "aws_security_group" "app" {
+  description = "app"
+  vpc_id      = aws_vpc.vpc.id
+}
+resource "aws_vpc_security_group_ingress_rule" "app_from_web" {
+  security_group_id            = aws_security_group.app.id
+  ip_protocol                  = "tcp"
+  from_port                    = 8080
+  to_port                      = 8080
+  referenced_security_group_id = aws_security_group.web.id
+}
+resource "aws_security_group" "db" {
+  description = "db"
+  vpc_id      = aws_vpc.vpc.id
+  ingress {
+    protocol        = "tcp"
+    from_port       = 5432
+    to_port         = 5432
+    security_groups = [aws_security_group.app.id]
+  }
+}
+
+# data
+resource "aws_s3_bucket" "assets" {}
+resource "aws_s3_bucket" "customer_data" { tags = local.restricted }
+resource "aws_dynamodb_table" "orders" {
+  name         = "orders"
+  hash_key     = "id"
+  billing_mode = "PAY_PER_REQUEST"
+  attribute {
+    name = "id"
+    type = "S"
+  }
+}
+resource "aws_secretsmanager_secret" "db" { name = "ledger-db" }
+resource "aws_secretsmanager_secret_version" "db" {
+  secret_id     = aws_secretsmanager_secret.db.id
+  secret_string = "generated-elsewhere"
+}
+resource "aws_db_instance" "customers" {
+  engine                 = "postgres"
+  instance_class         = "db.t3.micro"
+  allocated_storage      = 20
+  username               = "ledger"
+  password               = aws_secretsmanager_secret_version.db.secret_string
+  vpc_security_group_ids = [aws_security_group.db.id]
+  publicly_accessible    = false
+  storage_encrypted      = true
+  tags                   = { "data-classification" = "restricted" }
+}
+
+# identity
+data "aws_iam_policy_document" "ec2_trust" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["ec2.amazonaws.com"]
+    }
+  }
+}
+resource "aws_iam_role" "web" { assume_role_policy = data.aws_iam_policy_document.ec2_trust.json }
+resource "aws_iam_role" "deploy" {
+  assume_role_policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = { AWS = aws_iam_role.web.arn }, Action = "sts:AssumeRole" }]
+  })
+}
+resource "aws_iam_role_policy" "web" {
+  name = "web"
+  role = aws_iam_role.web.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      { Effect = "Allow", Action = "s3:GetObject", Resource = "${aws_s3_bucket.assets.arn}/*" },
+      { Effect = "Allow", Action = "sts:AssumeRole", Resource = aws_iam_role.deploy.arn },
+    ]
+  })
+}
+resource "aws_iam_policy" "deploy" {
+  name = "deploy"
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      { Effect = "Allow", Action = "s3:*", Resource = [aws_s3_bucket.customer_data.arn, "${aws_s3_bucket.customer_data.arn}/*"] },
+      { Effect = "Allow", Action = "secretsmanager:GetSecretValue", Resource = aws_secretsmanager_secret.db.arn },
+    ]
+  })
+}
+resource "aws_iam_role_policy_attachment" "deploy" {
+  role       = aws_iam_role.deploy.name
+  policy_arn = aws_iam_policy.deploy.arn
+}
+resource "aws_iam_role" "worker" {
+  assume_role_policy = data.aws_iam_policy_document.ec2_trust.json
+  inline_policy {
+    name = "worker"
+    policy = jsonencode({
+      Version = "2012-10-17"
+      Statement = [
+        { Effect = "Allow", Action = "secretsmanager:GetSecretValue", Resource = aws_secretsmanager_secret.db.arn },
+        { Effect = "Allow", Action = ["dynamodb:GetItem", "dynamodb:PutItem"], Resource = aws_dynamodb_table.orders.arn },
+      ]
+    })
+  }
+}
+resource "aws_iam_role" "reporter" {
+  assume_role_policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = { Service = "lambda.amazonaws.com" }, Action = "sts:AssumeRole" }]
+  })
+}
+resource "aws_iam_policy" "report_read" {
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      { Effect = "Allow", Action = "s3:GetObject", Resource = "${aws_s3_bucket.customer_data.arn}/*" },
+      { Effect = "Allow", Action = "logs:*", Resource = "*" },
+    ]
+  })
+}
+resource "aws_iam_role_policy_attachment" "report_read" {
+  role       = aws_iam_role.reporter.name
+  policy_arn = aws_iam_policy.report_read.arn
+}
+resource "aws_iam_role" "batch" {
+  assume_role_policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = { Service = "lambda.amazonaws.com" }, Action = "sts:AssumeRole" }]
+  })
+}
+resource "aws_iam_role_policy" "batch" {
+  role = aws_iam_role.batch.id
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Action = "sts:AssumeRole", Resource = "arn:aws:iam::123456789012:role/audit" }]
+  })
+}
+resource "aws_iam_role" "audit" {
+  name = "audit"
+  assume_role_policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = { AWS = aws_iam_role.batch.arn }, Action = "sts:AssumeRole" }]
+  })
+}
+resource "aws_iam_role_policy" "audit" {
+  role = aws_iam_role.audit.id
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Action = "dynamodb:Scan", Resource = aws_dynamodb_table.orders.arn }]
+  })
+}
+resource "aws_s3_bucket_policy" "assets" {
+  bucket = aws_s3_bucket.assets.id
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = { AWS = aws_iam_role.worker.arn }, Action = "s3:GetObject", Resource = "${aws_s3_bucket.assets.arn}/*" }]
+  })
+}
+
+# compute
+resource "aws_iam_instance_profile" "web" { role = aws_iam_role.web.name }
+resource "aws_iam_instance_profile" "worker" { role = aws_iam_role.worker.name }
+resource "aws_launch_template" "web" {
+  image_id               = local.ami
+  instance_type          = "t3.micro"
+  vpc_security_group_ids = [aws_security_group.web.id]
+}
+resource "aws_instance" "web" {
+  launch_template {
+    id      = aws_launch_template.web.id
+    version = "1"
+  }
+  subnet_id            = aws_subnet.public.id
+  iam_instance_profile = aws_iam_instance_profile.web.name
+}
+resource "aws_instance" "worker" {
+  ami                    = local.ami
+  instance_type          = "t3.micro"
+  subnet_id              = aws_subnet.private.id
+  vpc_security_group_ids = [aws_security_group.app.id]
+  iam_instance_profile   = aws_iam_instance_profile.worker.name
+}
+# in a public subnet, but nothing on the internet is allowed in
+resource "aws_instance" "admin_box" {
+  ami                    = local.ami
+  instance_type          = "t3.micro"
+  subnet_id              = aws_subnet.public.id
+  vpc_security_group_ids = [aws_security_group.app.id]
+  iam_instance_profile   = aws_iam_instance_profile.worker.name
+}
+resource "aws_lambda_function" "reporter" {
+  function_name = "reporter"
+  runtime       = "nodejs22.x"
+  handler       = "index.handler"
+  role          = aws_iam_role.reporter.arn
+  filename      = "fn.zip"
+}
+resource "aws_lambda_function_url" "reporter" {
+  function_name      = aws_lambda_function.reporter.function_name
+  authorization_type = "NONE"
+}
+resource "aws_lambda_function" "batch" {
+  function_name = "batch"
+  runtime       = "nodejs22.x"
+  handler       = "index.handler"
+  role          = aws_iam_role.batch.arn
+  filename      = "fn.zip"
+}

package/src/__fixtures__/capabilities/package.json

@@ -0,0 +1 @@
+{ "name": "chant-fixture-terraform-capabilities", "version": "0.0.0", "private": true, "type": "module" }

package/src/__fixtures__/effective-topology/chant.config.ts

@@ -0,0 +1,11 @@
+import type { ChantConfig } from "@intentius/chant/config";
+import "@intentius/chant-lexicon-terraform";
+
+export default {
+  lexicons: ["terraform"],
+  terraform: {
+    roots: {
+      net: { dir: "./net" },
+    },
+  },
+} satisfies ChantConfig;

package/src/__fixtures__/effective-topology/net/main.tf

@@ -0,0 +1,176 @@
+# One VPC, three instances. Only `web` is internet-facing with SSH open to the
+# world, and it gets its SSH rule through a launch template's security group.
+# Every way of writing a route to an internet gateway and every way of writing
+# an ingress rule appears exactly once, each on a path a test pins (chant #4362).
+
+resource "aws_vpc" "main" {
+  cidr_block = "10.0.0.0/16"
+}
+
+resource "aws_internet_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+}
+
+# --- Subnets and routing --------------------------------------------------
+
+# public_a routes to the IGW through an INLINE `route` block.
+resource "aws_subnet" "public_a" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.0.1.0/24"
+}
+
+resource "aws_route_table" "public_inline" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.main.id
+  }
+}
+
+resource "aws_route_table_association" "public_a" {
+  subnet_id      = aws_subnet.public_a.id
+  route_table_id = aws_route_table.public_inline.id
+}
+
+# public_b routes to the IGW through a separate `aws_route` resource.
+resource "aws_subnet" "public_b" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.0.2.0/24"
+}
+
+resource "aws_route_table" "public_separate" {
+  vpc_id = aws_vpc.main.id
+}
+
+resource "aws_route" "public_separate_default" {
+  route_table_id         = aws_route_table.public_separate.id
+  destination_cidr_block = "0.0.0.0/0"
+  gateway_id             = aws_internet_gateway.main.id
+}
+
+resource "aws_route_table_association" "public_b" {
+  subnet_id      = aws_subnet.public_b.id
+  route_table_id = aws_route_table.public_separate.id
+}
+
+# private's default route goes to a NAT gateway, which is not internet-facing.
+resource "aws_subnet" "private" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.0.3.0/24"
+}
+
+resource "aws_eip" "nat" {
+  domain = "vpc"
+}
+
+resource "aws_nat_gateway" "main" {
+  allocation_id = aws_eip.nat.id
+  subnet_id     = aws_subnet.public_a.id
+}
+
+resource "aws_route_table" "private" {
+  vpc_id = aws_vpc.main.id
+
+  route {
+    cidr_block     = "0.0.0.0/0"
+    nat_gateway_id = aws_nat_gateway.main.id
+  }
+}
+
+resource "aws_route_table_association" "private" {
+  subnet_id      = aws_subnet.private.id
+  route_table_id = aws_route_table.private.id
+}
+
+# --- Security groups ------------------------------------------------------
+
+# web: SSH open to the world through an INLINE `ingress` block.
+resource "aws_security_group" "web" {
+  vpc_id = aws_vpc.main.id
+
+  ingress {
+    protocol    = "tcp"
+    from_port   = 22
+    to_port     = 22
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    protocol    = "-1"
+    from_port   = 0
+    to_port     = 0
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+# batch: HTTPS through an `aws_vpc_security_group_ingress_rule` resource.
+resource "aws_security_group" "batch" {
+  vpc_id = aws_vpc.main.id
+}
+
+resource "aws_vpc_security_group_ingress_rule" "batch_https" {
+  security_group_id = aws_security_group.batch.id
+  ip_protocol       = "tcp"
+  from_port         = 443
+  to_port           = 443
+  cidr_ipv4         = "0.0.0.0/0"
+}
+
+# db: SSH open to the world through an `aws_security_group_rule` resource. The
+# egress rule beside it is not ingress and must not be counted.
+resource "aws_security_group" "db" {
+  vpc_id = aws_vpc.main.id
+}
+
+resource "aws_security_group_rule" "db_ssh" {
+  type              = "ingress"
+  security_group_id = aws_security_group.db.id
+  protocol          = "tcp"
+  from_port         = 22
+  to_port           = 22
+  cidr_blocks       = ["0.0.0.0/0"]
+}
+
+resource "aws_security_group_rule" "db_egress" {
+  type              = "egress"
+  security_group_id = aws_security_group.db.id
+  protocol          = "-1"
+  from_port         = 0
+  to_port           = 0
+  cidr_blocks       = ["0.0.0.0/0"]
+}
+
+# --- Instances ------------------------------------------------------------
+
+resource "aws_launch_template" "web" {
+  image_id               = "ami-12345678"
+  instance_type          = "t3.micro"
+  vpc_security_group_ids = [aws_security_group.web.id]
+}
+
+# Public, SSH open to the world via the launch template's group. The one match.
+resource "aws_instance" "web" {
+  subnet_id = aws_subnet.public_a.id
+
+  launch_template {
+    id      = aws_launch_template.web.id
+    version = "$Latest"
+  }
+}
+
+# Public (through the aws_route spelling), HTTPS only, group via `security_groups`.
+resource "aws_instance" "batch" {
+  ami             = "ami-12345678"
+  instance_type   = "t3.micro"
+  subnet_id       = aws_subnet.public_b.id
+  security_groups = [aws_security_group.batch.id]
+}
+
+# Private, SSH open to the world via `vpc_security_group_ids`. Not reachable.
+resource "aws_instance" "db" {
+  ami                    = "ami-12345678"
+  instance_type          = "t3.micro"
+  subnet_id              = aws_subnet.private.id
+  vpc_security_group_ids = [aws_security_group.db.id]
+}

package/src/__fixtures__/effective-topology/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "chant-fixture-terraform-effective-topology",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module"
+}