@intentius/chant-lexicon-terraform 0.124.51 → 0.124.54

package/src/__fixtures__/config-blocks/app/main.tf

@@ -0,0 +1,61 @@
+# The four configuration blocks that become entities (chant #4458): two
+# `moved` blocks, an `import`, a `removed` and a `check` with a scoped `data`
+# block. `aws_instance.old`, `module.legacy` and `aws_instance.gone` are not
+# declared here, by design: that is what a `from` names.
+
+variable "region" {
+  type = string
+}
+
+resource "aws_instance" "web" {
+  ami           = "ami-123"
+  instance_type = "t3.micro"
+}
+
+resource "aws_lb" "front" {
+  name = "front"
+}
+
+module "network" {
+  source = "./modules/network"
+}
+
+# A root-level data source with the same address as the check's scoped one.
+# The check's assertion reads its own, so no edge lands here from it.
+data "http" "site" {
+  url = "https://example.com"
+}
+
+moved {
+  from = aws_instance.old
+  to   = aws_instance.web
+}
+
+moved {
+  from = module.legacy
+  to   = module.network
+}
+
+import {
+  to = aws_lb.front
+  id = "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/front/abc"
+}
+
+removed {
+  from = aws_instance.gone
+
+  lifecycle {
+    destroy = false
+  }
+}
+
+check "health" {
+  data "http" "site" {
+    url = "https://${aws_lb.front.dns_name}/healthz"
+  }
+
+  assert {
+    condition     = data.http.site.status_code == 200
+    error_message = "front is down in ${var.region}"
+  }
+}

package/src/__fixtures__/config-blocks/app/modules/network/main.tf

@@ -0,0 +1,4 @@
+variable "cidr" {
+  type    = string
+  default = "10.0.0.0/16"
+}

package/src/__fixtures__/config-blocks/app-json/main.tf.json

@@ -0,0 +1,39 @@
+{
+  "//": "The config blocks of ../app/main.tf in Terraform's JSON syntax (chant#4457, chant#4458): each becomes the entity its HCL form does.",
+  "variable": {
+    "region": { "type": "string" }
+  },
+  "resource": {
+    "aws_instance": {
+      "web": { "ami": "ami-123", "instance_type": "t3.micro" }
+    },
+    "aws_lb": {
+      "front": { "name": "front" }
+    }
+  },
+  "moved": [
+    { "from": "aws_instance.old", "to": "aws_instance.web" },
+    { "from": "module.legacy", "to": "module.network" }
+  ],
+  "import": {
+    "to": "aws_lb.front",
+    "id": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/front/abc"
+  },
+  "removed": {
+    "from": "aws_instance.gone",
+    "lifecycle": { "destroy": false }
+  },
+  "check": {
+    "health": {
+      "data": {
+        "http": {
+          "site": { "url": "https://${aws_lb.front.dns_name}/healthz" }
+        }
+      },
+      "assert": {
+        "condition": "${data.http.site.status_code == 200}",
+        "error_message": "front is down in ${var.region}"
+      }
+    }
+  }
+}

package/src/__fixtures__/config-files/shadow/main.tf

@@ -0,0 +1,3 @@
+resource "aws_s3_bucket" "from_tf" {
+  bucket = "terraform-reads-this"
+}

package/src/__fixtures__/config-files/shadow/main.tofu

@@ -0,0 +1,3 @@
+resource "aws_s3_bucket" "from_tofu" {
+  bucket = "tofu-reads-this"
+}

package/src/__fixtures__/config-files/shadow/other.tf

@@ -0,0 +1,3 @@
+output "kept" {
+  value = "other.tf has no other.tofu, so both binaries read it"
+}

package/src/__fixtures__/config-files/tf/main.tf

@@ -0,0 +1,11 @@
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets-${var.region}"
+  tags = {
+    team = "web"
+  }
+}

package/src/__fixtures__/config-files/tf-json/main.tf.json

@@ -0,0 +1,18 @@
+{
+  "variable": {
+    "region": {
+      "type": "string",
+      "default": "us-east-1"
+    }
+  },
+  "resource": {
+    "aws_s3_bucket": {
+      "assets": {
+        "bucket": "assets-${var.region}",
+        "tags": {
+          "team": "web"
+        }
+      }
+    }
+  }
+}

package/src/__fixtures__/config-files/tofu/main.tofu

@@ -0,0 +1,11 @@
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets-${var.region}"
+  tags = {
+    team = "web"
+  }
+}

package/src/__fixtures__/config-files/tofu-json/main.tofu.json

@@ -0,0 +1,18 @@
+{
+  "variable": {
+    "region": {
+      "type": "string",
+      "default": "us-east-1"
+    }
+  },
+  "resource": {
+    "aws_s3_bucket": {
+      "assets": {
+        "bucket": "assets-${var.region}",
+        "tags": {
+          "team": "web"
+        }
+      }
+    }
+  }
+}

package/src/__fixtures__/config-files/tofu-only/main.tofu

@@ -0,0 +1,3 @@
+resource "aws_s3_bucket" "only" {
+  bucket = "only-in-tofu"
+}

package/src/__fixtures__/drift-record/README.md

@@ -0,0 +1,11 @@
+# Drift-record fixtures (#4451)
+
+`live-plan-sections.json` is hand-written in the shape of choudoufu's `live-plan -json`
+(`internal/command/views/live_plan.go`, `LivePlanDocument`) to cover what the recorded
+`../live-plan.json` does not: `foreign[]`, `controller_held[]`, the omission reasons
+`VERIFIED_NOT_IMPORTABLE` and `OUT_OF_SCOPE`, an `UNOWNED` omission with no `unowned[]` row,
+a credentials failure, an omission code chant does not know, and `record` and `cache` bound sources.
+It was not recorded from a run.
+
+`drift-record.test.ts` also reads the recorded fixtures one directory up: `live-plan.json`,
+`live-ls.json`, `show-state.json`, `show-plan.json` and `live-plan-depth/`.

package/src/__fixtures__/drift-record/live-plan-sections.json

@@ -0,0 +1,27 @@
+{
+  "estate": "sections-estate",
+  "choudoufu_version": "v0.31.0",
+  "upstream_version": "1.13.0",
+  "bound": [
+    { "addr": "aws_s3_bucket.records", "type": "aws_s3_bucket", "identity": "", "source": "record" },
+    { "addr": "aws_iam_role.app", "type": "aws_iam_role", "identity": "app", "source": "cache" }
+  ],
+  "omissions": [
+    { "addr": "aws_cloudwatch_log_group.orphan_unowned", "reason": "UNOWNED", "detail": "A live aws_cloudwatch_log_group already exists and carries no tofu-estate marker." },
+    { "addr": "aws_instance.verified", "reason": "VERIFIED_NOT_IMPORTABLE", "detail": "The tagging index lists i-0abc for this address and the import read found nothing." },
+    { "addr": "kubernetes_manifest.issuer", "reason": "OUT_OF_SCOPE", "detail": "-target leaves this block out of the plan." },
+    { "addr": "aws_lambda_function.fn", "reason": "FAILED", "detail": "AccessDenied: not authorized to perform lambda:GetFunction" },
+    { "addr": "aws_sqs_queue.later", "reason": "SOMETHING_NEW", "detail": "a reason this chant does not know" }
+  ],
+  "unowned": [],
+  "foreign": [
+    { "type": "aws_s3_bucket", "identity": "arn:aws:s3:::someone-elses", "display_name": "someone-elses", "tofu_estate": "other-estate", "why": "marked for another estate" },
+    { "type": "aws_sqs_queue", "identity": "https://sqs.us-east-1.amazonaws.com/000000000000/loose", "why": "no marker" }
+  ],
+  "adoptable": [],
+  "swept": ["aws_s3_bucket", "aws_sqs_queue"],
+  "controller_held": [
+    { "type": "aws_s3_bucket", "identity": "arn:aws:s3:::ack-made", "controller": "ACK", "held_by": "ACK Bucket default/assets" },
+    { "type": "kubernetes_deployment", "identity": "apps/v1/Deployment/default/web", "kind": "Deployment", "controller": "Helm", "held_by": "Helm release web", "addr": "kubernetes_deployment.legacy" }
+  ]
+}

package/src/__fixtures__/instance-forms/app/main.tf

@@ -0,0 +1,110 @@
+# The expansion forms #4489 counts (literal locals, length() of a local, and
+# a bool variable choosing between two whole numbers), and the forms that
+# stay one node, each with its rollup reason.
+
+variable "on" {
+  type    = bool
+  default = true
+}
+
+variable "off" {
+  type    = bool
+  default = false
+}
+
+variable "tags" {
+  type    = map(string)
+  default = { a = "1" }
+}
+
+variable "unknown" {
+  type = number
+}
+
+variable "flag" {
+  type = bool
+}
+
+locals {
+  replicas = 2
+  zones    = ["x", "y", "z"]
+  names    = ["p", "q"]
+  ports    = { http = 80, https = 443 }
+  from_var = var.on
+  computed = var.unknown
+}
+
+resource "aws_eip" "local_count" {
+  count  = local.replicas
+  domain = "vpc"
+}
+
+resource "aws_sqs_queue" "local_length" {
+  count = length(local.zones)
+  name  = local.zones[count.index]
+}
+
+resource "aws_s3_bucket" "local_set" {
+  for_each = toset(local.names)
+  bucket   = each.key
+}
+
+resource "aws_lb_listener" "local_map" {
+  for_each = local.ports
+  port     = each.value
+}
+
+resource "aws_sns_topic" "enabled" {
+  count = var.on ? 1 : 0
+  name  = "enabled"
+}
+
+resource "aws_sns_topic" "disabled" {
+  count = var.off ? 1 : 0
+  name  = "disabled"
+}
+
+resource "aws_sns_topic" "local_flag" {
+  count = local.from_var ? 2 : 0
+  name  = "local-flag"
+}
+
+resource "aws_sns_topic" "flag_unknown" {
+  count = var.flag ? 1 : 0
+  name  = "flag-unknown"
+}
+
+resource "aws_sns_topic" "local_unknown" {
+  count = local.computed
+  name  = "local-unknown"
+}
+
+resource "aws_iam_user" "merged" {
+  for_each = merge(var.tags, { b = "2" })
+  name     = each.key
+}
+
+resource "aws_iam_group" "each" {
+  for_each = each.value
+  name     = each.key
+}
+
+resource "aws_iam_role" "for_expr" {
+  for_each = { for k, v in var.tags : k => v }
+  name     = each.key
+}
+
+resource "aws_iam_policy" "arith" {
+  count = local.replicas + 1
+  name  = "arith"
+}
+
+resource "aws_eip" "too_many" {
+  count  = 300
+  domain = "vpc"
+}
+
+module "svc" {
+  source = "./modules/svc"
+  count  = var.unknown
+}

package/src/__fixtures__/instance-forms/app/modules/svc/main.tf

@@ -0,0 +1,3 @@
+resource "aws_iam_role" "runner" {
+  name = "runner"
+}

package/src/__fixtures__/instance-vars/app/main.tf

@@ -0,0 +1,52 @@
+# Expansions the declared graph counts from variables, and blocks under
+# expanded module calls (chant #4486). `n` defaults to 1 and terraform.tfvars
+# sets it to 3, so a read that took the default would count one instance.
+
+variable "n" {
+  type    = number
+  default = 1
+}
+
+variable "names" {
+  type    = set(string)
+  default = ["a", "b"]
+}
+
+variable "zones" {
+  type    = list(string)
+  default = ["x", "y"]
+}
+
+variable "unknown" {
+  type = number
+}
+
+resource "aws_eip" "pool" {
+  count  = var.n
+  domain = "vpc"
+}
+
+resource "aws_s3_bucket" "named" {
+  for_each = var.names
+  bucket   = each.key
+}
+
+resource "aws_sqs_queue" "zoned" {
+  count = length(var.zones)
+  name  = var.zones[count.index]
+}
+
+resource "aws_sns_topic" "uncounted" {
+  count = var.unknown
+}
+
+module "app" {
+  source = "./modules/app"
+  count  = 2
+  size   = var.n
+}
+
+module "edge" {
+  source   = "./modules/edge"
+  for_each = toset(["east", "west"])
+}

package/src/__fixtures__/instance-vars/app/modules/app/main.tf

@@ -0,0 +1,12 @@
+variable "size" {
+  type = number
+}
+
+resource "aws_instance" "web" {
+  count         = var.size
+  instance_type = "t3.micro"
+}
+
+resource "aws_iam_role" "runner" {
+  name = "runner"
+}

package/src/__fixtures__/instance-vars/app/modules/edge/main.tf

@@ -0,0 +1,3 @@
+resource "aws_route53_record" "front" {
+  name = "front"
+}

package/src/__fixtures__/instance-vars/app/terraform.tfvars

@@ -0,0 +1 @@
+n = 3

package/src/__fixtures__/live-module-keyed/live-graph.json

@@ -0,0 +1,259 @@
+{
+  "version": 1,
+  "meta": {
+    "engineGraph": {
+      "format": 1,
+      "engine": {
+        "name": "choudoufu"
+      },
+      "scope": {
+        "kind": "estate",
+        "estate": "module-keyed-estate"
+      },
+      "markerScheme": {
+        "ownerKey": "tofu-estate",
+        "addressKey": "tofu-address",
+        "continuationKeys": [
+          "tofu-address-2",
+          "tofu-address-3",
+          "tofu-address-4"
+        ],
+        "encoding": {
+          "tags": "escaped",
+          "labels": "escaped"
+        }
+      }
+    }
+  },
+  "nodes": [
+    {
+      "id": "module.app.aws_cloudwatch_log_group.logs",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app.aws_cloudwatch_log_group.logs"
+      },
+      "sourceLoc": {
+        "file": "modules/app/main.tf",
+        "line": 15
+      }
+    },
+    {
+      "id": "module.app.aws_eip.pool",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app.aws_eip.pool"
+      },
+      "sourceLoc": {
+        "file": "modules/app/main.tf",
+        "line": 8
+      }
+    },
+    {
+      "id": "module.app[0].aws_cloudwatch_log_group.logs",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[0].aws_cloudwatch_log_group.logs"
+      },
+      "physicalId": "/module-keyed-estate/app-0",
+      "instanceOf": "module.app.aws_cloudwatch_log_group.logs",
+      "instanceScope": "module.app[0]",
+      "facts": {
+        "ownership": "bound",
+        "ownedBy": "name",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "/module-keyed-estate/app-0"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.app[0].aws_eip.pool[0]",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[0].aws_eip.pool[0]"
+      },
+      "physicalId": "eipalloc-0a41c7d2e9b3f5061",
+      "instanceOf": "module.app.aws_eip.pool",
+      "instanceKey": "[0]",
+      "instanceScope": "module.app[0]",
+      "facts": {
+        "ownership": "bound",
+        "markers": {
+          "owner": "module-keyed-estate",
+          "address": "module.app:0.aws_eip.pool:0",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "ownedBy": "marker",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "eipalloc-0a41c7d2e9b3f5061"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.app[0].aws_eip.pool[1]",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[0].aws_eip.pool[1]"
+      },
+      "physicalId": "eipalloc-0b52d8e3fac4061f2",
+      "instanceOf": "module.app.aws_eip.pool",
+      "instanceKey": "[1]",
+      "instanceScope": "module.app[0]",
+      "facts": {
+        "ownership": "bound",
+        "markers": {
+          "owner": "module-keyed-estate",
+          "address": "module.app:0.aws_eip.pool:1",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "ownedBy": "marker",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "eipalloc-0b52d8e3fac4061f2"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.app[1].aws_cloudwatch_log_group.logs",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[1].aws_cloudwatch_log_group.logs"
+      },
+      "instanceOf": "module.app.aws_cloudwatch_log_group.logs",
+      "instanceScope": "module.app[1]",
+      "facts": {
+        "ownership": "pending"
+      }
+    },
+    {
+      "id": "module.app[1].aws_eip.pool[0]",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[1].aws_eip.pool[0]"
+      },
+      "physicalId": "eipalloc-0c63e9f40bd5172a3",
+      "instanceOf": "module.app.aws_eip.pool",
+      "instanceKey": "[0]",
+      "instanceScope": "module.app[1]",
+      "facts": {
+        "ownership": "bound",
+        "markers": {
+          "owner": "module-keyed-estate",
+          "address": "module.app:1.aws_eip.pool:0",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "ownedBy": "marker",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "eipalloc-0c63e9f40bd5172a3"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.app[1].aws_eip.pool[1]",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[1].aws_eip.pool[1]"
+      },
+      "physicalId": "eipalloc-0d74fa051ce6283b4",
+      "instanceOf": "module.app.aws_eip.pool",
+      "instanceKey": "[1]",
+      "instanceScope": "module.app[1]",
+      "facts": {
+        "ownership": "bound",
+        "markers": {
+          "owner": "module-keyed-estate",
+          "address": "module.app:1.aws_eip.pool:1",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "ownedBy": "marker",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "eipalloc-0d74fa051ce6283b4"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.edge.aws_cloudwatch_log_group.front",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.edge.aws_cloudwatch_log_group.front"
+      },
+      "sourceLoc": {
+        "file": "modules/edge/main.tf",
+        "line": 5
+      }
+    },
+    {
+      "id": "module.edge[\"east\"].aws_cloudwatch_log_group.front",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.edge[\"east\"].aws_cloudwatch_log_group.front"
+      },
+      "physicalId": "/module-keyed-estate/edge-east",
+      "instanceOf": "module.edge.aws_cloudwatch_log_group.front",
+      "instanceScope": "module.edge[\"east\"]",
+      "facts": {
+        "ownership": "unowned",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "/module-keyed-estate/edge-east"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.edge[\"west\"].aws_cloudwatch_log_group.front",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.edge[\"west\"].aws_cloudwatch_log_group.front"
+      },
+      "physicalId": "/module-keyed-estate/edge-west",
+      "instanceOf": "module.edge.aws_cloudwatch_log_group.front",
+      "instanceScope": "module.edge[\"west\"]",
+      "facts": {
+        "ownership": "foreign",
+        "markers": {
+          "owner": "other-estate",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "/module-keyed-estate/edge-west"
+          }
+        ]
+      }
+    }
+  ],
+  "edges": [],
+  "groups": {}
+}