@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/src/__fixtures__/config-blocks/app/main.tf

@@ -0,0 +1,61 @@
+# The four configuration blocks that become entities (chant #4458): two
+# `moved` blocks, an `import`, a `removed` and a `check` with a scoped `data`
+# block. `aws_instance.old`, `module.legacy` and `aws_instance.gone` are not
+# declared here, by design: that is what a `from` names.
+
+variable "region" {
+  type = string
+}
+
+resource "aws_instance" "web" {
+  ami           = "ami-123"
+  instance_type = "t3.micro"
+}
+
+resource "aws_lb" "front" {
+  name = "front"
+}
+
+module "network" {
+  source = "./modules/network"
+}
+
+# A root-level data source with the same address as the check's scoped one.
+# The check's assertion reads its own, so no edge lands here from it.
+data "http" "site" {
+  url = "https://example.com"
+}
+
+moved {
+  from = aws_instance.old
+  to   = aws_instance.web
+}
+
+moved {
+  from = module.legacy
+  to   = module.network
+}
+
+import {
+  to = aws_lb.front
+  id = "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/front/abc"
+}
+
+removed {
+  from = aws_instance.gone
+
+  lifecycle {
+    destroy = false
+  }
+}
+
+check "health" {
+  data "http" "site" {
+    url = "https://${aws_lb.front.dns_name}/healthz"
+  }
+
+  assert {
+    condition     = data.http.site.status_code == 200
+    error_message = "front is down in ${var.region}"
+  }
+}

package/src/__fixtures__/config-blocks/app/modules/network/main.tf

@@ -0,0 +1,4 @@
+variable "cidr" {
+  type    = string
+  default = "10.0.0.0/16"
+}

package/src/__fixtures__/config-blocks/app-json/main.tf.json

@@ -0,0 +1,39 @@
+{
+  "//": "The config blocks of ../app/main.tf in Terraform's JSON syntax (chant#4457, chant#4458): each becomes the entity its HCL form does.",
+  "variable": {
+    "region": { "type": "string" }
+  },
+  "resource": {
+    "aws_instance": {
+      "web": { "ami": "ami-123", "instance_type": "t3.micro" }
+    },
+    "aws_lb": {
+      "front": { "name": "front" }
+    }
+  },
+  "moved": [
+    { "from": "aws_instance.old", "to": "aws_instance.web" },
+    { "from": "module.legacy", "to": "module.network" }
+  ],
+  "import": {
+    "to": "aws_lb.front",
+    "id": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/front/abc"
+  },
+  "removed": {
+    "from": "aws_instance.gone",
+    "lifecycle": { "destroy": false }
+  },
+  "check": {
+    "health": {
+      "data": {
+        "http": {
+          "site": { "url": "https://${aws_lb.front.dns_name}/healthz" }
+        }
+      },
+      "assert": {
+        "condition": "${data.http.site.status_code == 200}",
+        "error_message": "front is down in ${var.region}"
+      }
+    }
+  }
+}

package/src/__fixtures__/config-files/shadow/main.tf

@@ -0,0 +1,3 @@
+resource "aws_s3_bucket" "from_tf" {
+  bucket = "terraform-reads-this"
+}

package/src/__fixtures__/config-files/shadow/main.tofu

@@ -0,0 +1,3 @@
+resource "aws_s3_bucket" "from_tofu" {
+  bucket = "tofu-reads-this"
+}

package/src/__fixtures__/config-files/shadow/other.tf

@@ -0,0 +1,3 @@
+output "kept" {
+  value = "other.tf has no other.tofu, so both binaries read it"
+}

package/src/__fixtures__/config-files/tf/main.tf

@@ -0,0 +1,11 @@
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets-${var.region}"
+  tags = {
+    team = "web"
+  }
+}

package/src/__fixtures__/config-files/tf-json/main.tf.json

@@ -0,0 +1,18 @@
+{
+  "variable": {
+    "region": {
+      "type": "string",
+      "default": "us-east-1"
+    }
+  },
+  "resource": {
+    "aws_s3_bucket": {
+      "assets": {
+        "bucket": "assets-${var.region}",
+        "tags": {
+          "team": "web"
+        }
+      }
+    }
+  }
+}

package/src/__fixtures__/config-files/tofu/main.tofu

@@ -0,0 +1,11 @@
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets-${var.region}"
+  tags = {
+    team = "web"
+  }
+}

package/src/__fixtures__/config-files/tofu-json/main.tofu.json

@@ -0,0 +1,18 @@
+{
+  "variable": {
+    "region": {
+      "type": "string",
+      "default": "us-east-1"
+    }
+  },
+  "resource": {
+    "aws_s3_bucket": {
+      "assets": {
+        "bucket": "assets-${var.region}",
+        "tags": {
+          "team": "web"
+        }
+      }
+    }
+  }
+}

package/src/__fixtures__/config-files/tofu-only/main.tofu

@@ -0,0 +1,3 @@
+resource "aws_s3_bucket" "only" {
+  bucket = "only-in-tofu"
+}

package/src/__fixtures__/drift-record/README.md

@@ -0,0 +1,16 @@
+# Drift-record fixtures (#4451)
+
+`live-plan-sections.json` is hand-written in the shape of choudoufu's `live-plan -json`
+(`internal/command/views/live_plan.go`, `LivePlanDocument`) to cover what the recorded
+`../live-plan.json` does not: `foreign[]`, `controller_held[]`, the omission reasons
+`VERIFIED_NOT_IMPORTABLE` and `OUT_OF_SCOPE`, an `UNOWNED` omission with no `unowned[]` row,
+a credentials failure, an omission code chant does not know, and `record` and `cache` bound sources.
+It was not recorded from a run.
+
+`drift-record.test.ts` also reads the recorded fixtures one directory up: `live-plan.json`,
+`live-ls.json`, `show-state.json`, `show-plan.json` and `live-plan-depth/`.
+
+`../drift-rows/` holds two hand-written plans for `drift-rows.test.ts` (#4580), also not recorded
+from a run: `refresh-plan.json`, a stock root's refresh-only plan whose `resource_drift` has an update,
+a delete, a create and a data row, and `live-root-plan.json`, a full plan of a root under live resource
+markers with a create, a delete, an update, both replacement orders, a no-op and two data rows.

package/src/__fixtures__/drift-record/live-plan-sections.json

@@ -0,0 +1,27 @@
+{
+  "estate": "sections-estate",
+  "choudoufu_version": "v0.31.0",
+  "upstream_version": "1.13.0",
+  "bound": [
+    { "addr": "aws_s3_bucket.records", "type": "aws_s3_bucket", "identity": "", "source": "record" },
+    { "addr": "aws_iam_role.app", "type": "aws_iam_role", "identity": "app", "source": "cache" }
+  ],
+  "omissions": [
+    { "addr": "aws_cloudwatch_log_group.orphan_unowned", "reason": "UNOWNED", "detail": "A live aws_cloudwatch_log_group already exists and carries no tofu-estate marker." },
+    { "addr": "aws_instance.verified", "reason": "VERIFIED_NOT_IMPORTABLE", "detail": "The tagging index lists i-0abc for this address and the import read found nothing." },
+    { "addr": "kubernetes_manifest.issuer", "reason": "OUT_OF_SCOPE", "detail": "-target leaves this block out of the plan." },
+    { "addr": "aws_lambda_function.fn", "reason": "FAILED", "detail": "AccessDenied: not authorized to perform lambda:GetFunction" },
+    { "addr": "aws_sqs_queue.later", "reason": "SOMETHING_NEW", "detail": "a reason this chant does not know" }
+  ],
+  "unowned": [],
+  "foreign": [
+    { "type": "aws_s3_bucket", "identity": "arn:aws:s3:::someone-elses", "display_name": "someone-elses", "tofu_estate": "other-estate", "why": "marked for another estate" },
+    { "type": "aws_sqs_queue", "identity": "https://sqs.us-east-1.amazonaws.com/000000000000/loose", "why": "no marker" }
+  ],
+  "adoptable": [],
+  "swept": ["aws_s3_bucket", "aws_sqs_queue"],
+  "controller_held": [
+    { "type": "aws_s3_bucket", "identity": "arn:aws:s3:::ack-made", "controller": "ACK", "held_by": "ACK Bucket default/assets" },
+    { "type": "kubernetes_deployment", "identity": "apps/v1/Deployment/default/web", "kind": "Deployment", "controller": "Helm", "held_by": "Helm release web", "addr": "kubernetes_deployment.legacy" }
+  ]
+}

package/src/__fixtures__/drift-rows/live-root-plan.json

@@ -0,0 +1,70 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.8",
+  "resource_drift": [
+    {
+      "address": "aws_s3_bucket.ignored",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "change": { "actions": ["update"], "before": { "bucket": "ignored" }, "after": { "bucket": "ignored-too" } }
+    }
+  ],
+  "resource_changes": [
+    {
+      "address": "aws_s3_bucket.assets",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "assets",
+      "change": { "actions": ["create"], "before": null, "after": { "bucket": "acme-assets" }, "after_unknown": { "arn": true, "id": true } }
+    },
+    {
+      "address": "aws_sqs_queue.stray",
+      "mode": "managed",
+      "type": "aws_sqs_queue",
+      "name": "stray",
+      "change": { "actions": ["delete"], "before": { "name": "acme-stray", "id": "https://sqs.local/000000000000/acme-stray" }, "after": null }
+    },
+    {
+      "address": "aws_lambda_function.api",
+      "mode": "managed",
+      "type": "aws_lambda_function",
+      "name": "api",
+      "change": { "actions": ["update"], "before": { "function_name": "acme-api", "memory_size": 256, "version": "7" }, "after": { "function_name": "acme-api", "memory_size": 512 }, "after_unknown": { "version": true } }
+    },
+    {
+      "address": "aws_iam_role.deployer",
+      "mode": "managed",
+      "type": "aws_iam_role",
+      "name": "deployer",
+      "change": { "actions": ["delete", "create"], "before": { "name": "acme-deployer-old", "arn": "arn:aws:iam::000000000000:role/acme-deployer-old" }, "after": { "name": "acme-deployer" }, "after_unknown": { "arn": true } }
+    },
+    {
+      "address": "aws_security_group.edge",
+      "mode": "managed",
+      "type": "aws_security_group",
+      "name": "edge",
+      "change": { "actions": ["create", "delete"], "before": { "name": "", "id": "sg-0001" }, "after": { "name": "" }, "after_unknown": { "id": true } }
+    },
+    {
+      "address": "aws_s3_bucket.steady",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "steady",
+      "change": { "actions": ["no-op"], "before": { "bucket": "acme-steady" }, "after": { "bucket": "acme-steady" } }
+    },
+    {
+      "address": "data.aws_region.here",
+      "mode": "data",
+      "type": "aws_region",
+      "name": "here",
+      "change": { "actions": ["read"], "before": null, "after": { "name": "us-east-1" } }
+    },
+    {
+      "address": "data.aws_caller_identity.me",
+      "mode": "data",
+      "type": "aws_caller_identity",
+      "name": "me",
+      "change": { "actions": ["update"], "before": { "account_id": "000000000000" }, "after": { "account_id": "000000000001" } }
+    }
+  ]
+}

package/src/__fixtures__/drift-rows/refresh-plan.json

@@ -0,0 +1,61 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.8",
+  "prior_state": {
+    "values": {
+      "root_module": {
+        "resources": [
+          { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "values": { "bucket": "acme-logs", "tags": { "team": "data" } } },
+          { "address": "aws_lambda_function.worker", "mode": "managed", "type": "aws_lambda_function", "values": { "function_name": "acme-worker", "memory_size": 128 } },
+          { "address": "aws_iam_role.runner", "mode": "managed", "type": "aws_iam_role", "values": { "name": "acme-runner", "arn": "arn:aws:iam::000000000000:role/acme-runner" } }
+        ]
+      }
+    }
+  },
+  "resource_drift": [
+    {
+      "address": "aws_s3_bucket.logs",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "logs",
+      "change": { "actions": ["update"], "before": { "bucket": "acme-logs", "tags": { "team": "data" } }, "after": { "bucket": "acme-logs", "tags": { "team": "ops" } } }
+    },
+    {
+      "address": "aws_lambda_function.worker",
+      "mode": "managed",
+      "type": "aws_lambda_function",
+      "name": "worker",
+      "change": { "actions": ["delete"], "before": { "function_name": "acme-worker", "memory_size": 128 }, "after": null }
+    },
+    {
+      "address": "aws_sqs_queue.jobs",
+      "mode": "managed",
+      "type": "aws_sqs_queue",
+      "name": "jobs",
+      "change": { "actions": ["create"], "before": null, "after": { "name": "acme-jobs", "id": "https://sqs.local/000000000000/acme-jobs" } }
+    },
+    {
+      "address": "aws_iam_role.runner",
+      "mode": "managed",
+      "type": "aws_iam_role",
+      "name": "runner",
+      "change": { "actions": ["update"], "before": { "name": "", "arn": "arn:aws:iam::000000000000:role/acme-runner" }, "after": { "name": "", "arn": "arn:aws:iam::000000000000:role/acme-runner", "max_session_duration": 7200 } }
+    },
+    {
+      "address": "data.aws_caller_identity.me",
+      "mode": "data",
+      "type": "aws_caller_identity",
+      "name": "me",
+      "change": { "actions": ["update"], "before": { "account_id": "000000000000" }, "after": { "account_id": "000000000001" } }
+    }
+  ],
+  "resource_changes": [
+    {
+      "address": "aws_s3_bucket.logs",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "logs",
+      "change": { "actions": ["no-op"], "before": { "bucket": "acme-logs", "tags": { "team": "ops" } }, "after": { "bucket": "acme-logs", "tags": { "team": "ops" } } }
+    }
+  ]
+}

package/src/__fixtures__/instance-forms/app/main.tf

@@ -0,0 +1,110 @@
+# The expansion forms #4489 counts (literal locals, length() of a local, and
+# a bool variable choosing between two whole numbers), and the forms that
+# stay one node, each with its rollup reason.
+
+variable "on" {
+  type    = bool
+  default = true
+}
+
+variable "off" {
+  type    = bool
+  default = false
+}
+
+variable "tags" {
+  type    = map(string)
+  default = { a = "1" }
+}
+
+variable "unknown" {
+  type = number
+}
+
+variable "flag" {
+  type = bool
+}
+
+locals {
+  replicas = 2
+  zones    = ["x", "y", "z"]
+  names    = ["p", "q"]
+  ports    = { http = 80, https = 443 }
+  from_var = var.on
+  computed = var.unknown
+}
+
+resource "aws_eip" "local_count" {
+  count  = local.replicas
+  domain = "vpc"
+}
+
+resource "aws_sqs_queue" "local_length" {
+  count = length(local.zones)
+  name  = local.zones[count.index]
+}
+
+resource "aws_s3_bucket" "local_set" {
+  for_each = toset(local.names)
+  bucket   = each.key
+}
+
+resource "aws_lb_listener" "local_map" {
+  for_each = local.ports
+  port     = each.value
+}
+
+resource "aws_sns_topic" "enabled" {
+  count = var.on ? 1 : 0
+  name  = "enabled"
+}
+
+resource "aws_sns_topic" "disabled" {
+  count = var.off ? 1 : 0
+  name  = "disabled"
+}
+
+resource "aws_sns_topic" "local_flag" {
+  count = local.from_var ? 2 : 0
+  name  = "local-flag"
+}
+
+resource "aws_sns_topic" "flag_unknown" {
+  count = var.flag ? 1 : 0
+  name  = "flag-unknown"
+}
+
+resource "aws_sns_topic" "local_unknown" {
+  count = local.computed
+  name  = "local-unknown"
+}
+
+resource "aws_iam_user" "merged" {
+  for_each = merge(var.tags, { b = "2" })
+  name     = each.key
+}
+
+resource "aws_iam_group" "each" {
+  for_each = each.value
+  name     = each.key
+}
+
+resource "aws_iam_role" "for_expr" {
+  for_each = { for k, v in var.tags : k => v }
+  name     = each.key
+}
+
+resource "aws_iam_policy" "arith" {
+  count = local.replicas + 1
+  name  = "arith"
+}
+
+resource "aws_eip" "too_many" {
+  count  = 300
+  domain = "vpc"
+}
+
+module "svc" {
+  source = "./modules/svc"
+  count  = var.unknown
+}

package/src/__fixtures__/instance-forms/app/modules/svc/main.tf

@@ -0,0 +1,3 @@
+resource "aws_iam_role" "runner" {
+  name = "runner"
+}

package/src/__fixtures__/instance-vars/app/main.tf

@@ -0,0 +1,52 @@
+# Expansions the declared graph counts from variables, and blocks under
+# expanded module calls (chant #4486). `n` defaults to 1 and terraform.tfvars
+# sets it to 3, so a read that took the default would count one instance.
+
+variable "n" {
+  type    = number
+  default = 1
+}
+
+variable "names" {
+  type    = set(string)
+  default = ["a", "b"]
+}
+
+variable "zones" {
+  type    = list(string)
+  default = ["x", "y"]
+}
+
+variable "unknown" {
+  type = number
+}
+
+resource "aws_eip" "pool" {
+  count  = var.n
+  domain = "vpc"
+}
+
+resource "aws_s3_bucket" "named" {
+  for_each = var.names
+  bucket   = each.key
+}
+
+resource "aws_sqs_queue" "zoned" {
+  count = length(var.zones)
+  name  = var.zones[count.index]
+}
+
+resource "aws_sns_topic" "uncounted" {
+  count = var.unknown
+}
+
+module "app" {
+  source = "./modules/app"
+  count  = 2
+  size   = var.n
+}
+
+module "edge" {
+  source   = "./modules/edge"
+  for_each = toset(["east", "west"])
+}

package/src/__fixtures__/instance-vars/app/modules/app/main.tf

@@ -0,0 +1,12 @@
+variable "size" {
+  type = number
+}
+
+resource "aws_instance" "web" {
+  count         = var.size
+  instance_type = "t3.micro"
+}
+
+resource "aws_iam_role" "runner" {
+  name = "runner"
+}

package/src/__fixtures__/instance-vars/app/modules/edge/main.tf

@@ -0,0 +1,3 @@
+resource "aws_route53_record" "front" {
+  name = "front"
+}

package/src/__fixtures__/instance-vars/app/terraform.tfvars

@@ -0,0 +1 @@
+n = 3