@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/src/lint/audit-lineage.ts

@@ -15,7 +15,325 @@
  * `terraform_workspace_remote` (a `terraform.workspace` compatibility check
  * against remote execution, a different condition than "no backend is
  * configured at all"). Ship with no lineage rather than invent a credit.
+ *
+ * TF101 (plan-before-apply, `lint/rules/plan-before-apply.ts`) is a source-level
+ * lint rule over chant's own Op builders, not a post-synth check, so it carries
+ * no `RuleMeta`/`Lineage` entry here at all: this file's `Record` only ever
+ * keys post-synth check ids. Its own page section (docs/pages/lint-rules.mdx)
+ * says the same thing directly: no tool anywhere models "this plan file traces
+ * back to a specific preceding plan step", because that is a question about
+ * chant's own DSL, not about a Terraform root.
+ *
+ * ## The survey registry
+ *
+ * #2107 ran three research passes over every serious Terraform lint, scan and
+ * policy tool (1,888 lines, 222 cited URLs, attached to that issue as
+ * comments). The tools and documents below are what the survey found worth
+ * crediting from across that research. #2108 added none of them to
+ * `PRIOR_ART`: `packages/core/src/audit/catalog.test.ts`'s "every registered
+ * tool is credited" test fails on an entry no shipped rule cites yet, and
+ * neither TF001 nor TF101 cites anything. #2109 (TF002-TF005) is the first to
+ * draw from this list: `tflint-ruleset-terraform`, `terraform-sentinel-policies`,
+ * `hashicorp-style-guide` and `aws-terraform-prescriptive-guidance` are now in
+ * `PRIOR_ART`, spelled exactly as below. `checkov` and `kics` were already
+ * registered (other lexicons cite them); TF004 and TF005 are the first
+ * Terraform rules to. Each later rule issue adds the remaining entries it
+ * needs the first time a shipped rule cites them: #2112 (TF014, TF015, TF020,
+ * TF021) added `gcp-terraform-best-practices`, the last row of the table below
+ * that no shipped rule had cited yet.
+ *
+ * | Key | Name | URL | Licence | Kind | Note |
+ * |---|---|---|---|---|---|
+ * | `tflint` | tflint | https://github.com/terraform-linters/tflint | MPL-2.0 (its `terraform` package is BUSL-1.1; binaries are bound by both) | scanner | The plugin host; ships no language rules of its own. |
+ * | `tflint-ruleset-terraform` | tflint-ruleset-terraform | https://github.com/terraform-linters/tflint-ruleset-terraform | MPL-2.0 | scanner | The official language-level ruleset, bundled into tflint. |
+ * | `tflint-ruleset-redeploy` | tflint-ruleset-redeploy | https://github.com/RedeployAB/tflint-ruleset-redeploy | 0BSD | scanner | Community ruleset; richest source of language-level rules outside the official set. |
+ * | `tflint-ruleset-avm` | tflint-ruleset-avm | https://github.com/Azure/tflint-ruleset-avm | MIT | scanner | Azure Verified Modules conformance; two of its 33 rules are provider-agnostic. |
+ * | `tfsec` | tfsec | https://github.com/aquasecurity/tfsec | MIT | scanner | Historical: not archived but effectively frozen (no release since 2025-05); its docs site 404s above v0.61.x, so cite pinned repository paths (`github.com/aquasecurity/tfsec/blob/master/docs/checks/...`), not the docs site. |
+ * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. |
+ * | `terraform-sentinel-policies` | HashiCorp reference Sentinel policies | https://github.com/hashicorp/terraform-sentinel-policies | MPL-2.0 | specification | HashiCorp's own example policy set; ships zero rules baked into HCP Terraform itself, so treat a cited policy as a documented pattern (`specification`) unless a future entry runs it as a real check (`scanner`); the `kind` union allows either. |
+ * | `choudoufu` | choudoufu | https://github.com/INTENTIUS/choudoufu | MPL-2.0 | scanner | Its `internal/live/lint` package; experimental, AWS-only. |
+ * | `hashicorp-style-guide` | HashiCorp Terraform style guide | https://developer.hashicorp.com/terraform/language/style | n/a | specification | |
+ * | `gcp-terraform-best-practices` | Google Cloud Terraform best-practices series | https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure | n/a | specification | A multi-page series; cite the specific page's fragment. |
+ * | `aws-terraform-prescriptive-guidance` | AWS prescriptive guidance for Terraform | https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/ | n/a | specification | |
+ *
+ * Deliberately excluded, per the survey: Terrascan and regula (both archived,
+ * do not build on dead projects); Snyk IaC (a product, not a rule source);
+ * semgrep (no SPDX id: its engine is LGPL-2.1 but its rules ship under the
+ * proprietary Semgrep Rules License v1.0, which forbids redistribution; cite
+ * it by name in prose if a rule's idea comes from it, never register it in
+ * `PRIOR_ART` with an SPDX licence).
+ *
+ * TF024 (#2103, live root declares a backend/cloud block) credits choudoufu's
+ * own `RuleStateBackend`, `internal/live/lint/issue.go` of
+ * github.com/INTENTIUS/choudoufu: the identical condition, checked the same
+ * way this fork checks it at `init` before any command runs. TF025 (a live
+ * root's non-default `terraform.workspace`) has no entry: its workspace half
+ * is refused at the CLI argument-parsing layer there
+ * (`internal/command/live_mode.go`), not by a dedicated lint rule under
+ * `internal/live/lint`, so there is no `Rule*` constant to point at.
+ *
+ * TF026 (#2106, a live root's `delete: "never"` against its `policy` block's
+ * `undeclared_tagged` verb) has no entry either, the same reason TF001 has
+ * none: choudoufu's own `internal/live/lint` package checks a policy block
+ * for internal validity (`RulePolicyVerb`: an unrecognized or wrong-quadrant
+ * verb; `RulePolicyScope`: `undeclared_untagged = "delete"` with no `scope`
+ * block), never against a `delete: "never" | "owned-only" | "gated"`
+ * classification, because choudoufu has no such classification — that
+ * vocabulary is chant's own, shared across lexicons (`lexicons/k8s/src/op/
+ * activities/kubectl.ts`'s `ApplyDeleteMode`, `packages/core/src/op/
+ * activities/apply.ts`'s `DeleteMode`), applied here to a tool that does not
+ * itself carry the concept. Ship with no lineage rather than invent a credit.
  */
 import type { Lineage } from "@intentius/chant/audit/catalog";
 
-export const terraformAuditLineage: Record<string, Lineage[]> = {};
+const TFSEC_V061 = "https://github.com/aquasecurity/tfsec/blob/v0.61.3/docs/checks/general/secrets";
+/** tflint's official language ruleset. */
+const TFLINT_RULES = "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules";
+/** The community ruleset with the richest set of language rules outside the official one. */
+const REDEPLOY_RULES = "https://github.com/RedeployAB/tflint-ruleset-redeploy/blob/main/docs/rules";
+
+export const terraformAuditLineage: Record<string, Lineage[]> = {
+  TF024: [
+    {
+      tool: "choudoufu",
+      rule: "RuleStateBackend",
+      url: "https://github.com/INTENTIUS/choudoufu/blob/main/internal/live/lint/issue.go",
+      relation: "equivalent",
+    },
+  ],
+  TF002: [
+    {
+      tool: "tflint-ruleset-terraform",
+      rule: "terraform_required_providers",
+      url: "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_required_providers.md",
+      relation: "equivalent",
+    },
+    {
+      tool: "terraform-sentinel-policies",
+      rule: "require-all-providers-have-version-constraint",
+      url: "https://github.com/hashicorp/terraform-sentinel-policies/tree/main/cloud-agnostic",
+      relation: "equivalent",
+    },
+    {
+      tool: "aws-terraform-prescriptive-guidance",
+      rule: "Add automated version checks",
+      url: "https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/version.html#add-automated-version-checks",
+      relation: "equivalent",
+    },
+  ],
+  // Sentinel's restrict-terraform-versions checks that required_version is
+  // within an allowed range, not that it is present at all: a narrower
+  // question than TF003's, so "overlaps" rather than "equivalent" (#2109).
+  TF003: [
+    {
+      tool: "tflint-ruleset-terraform",
+      rule: "terraform_required_version",
+      url: "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_required_version.md",
+      relation: "equivalent",
+    },
+    {
+      tool: "terraform-sentinel-policies",
+      rule: "restrict-terraform-versions",
+      url: "https://github.com/hashicorp/terraform-sentinel-policies/tree/main/cloud-agnostic",
+      relation: "overlaps",
+    },
+    {
+      tool: "hashicorp-style-guide",
+      rule: "Version pinning",
+      url: "https://developer.hashicorp.com/terraform/language/style#version-pinning",
+      relation: "overlaps",
+    },
+  ],
+  TF004: [
+    {
+      tool: "tflint-ruleset-terraform",
+      rule: "terraform_module_version",
+      url: "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_module_version.md",
+      relation: "equivalent",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_TF_2",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/module/generic/RevisionVersionTag.py",
+      relation: "equivalent",
+    },
+  ],
+  // checkov's CKV_TF_1 accepts any `?ref=`/`&ref=` matching `[?&](ref=).*(\d\.\d).*`,
+  // which a branch literally named `v1.2-dev` passes; TF005 requires a full
+  // semver tag or a 40-hex SHA, so "extends" (a strict superset), not
+  // "equivalent". KICS's query only matches the `git::` prefix, not the
+  // github.com/bitbucket.org shorthands or scp-style sources TF005 also
+  // covers, so "overlaps" (#2109).
+  TF005: [
+    {
+      tool: "tflint-ruleset-terraform",
+      rule: "terraform_module_pinned_source",
+      url: "https://github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/terraform_module_pinned_source.md",
+      relation: "equivalent",
+    },
+    {
+      tool: "checkov",
+      rule: "CKV_TF_1",
+      url: "https://github.com/bridgecrewio/checkov/blob/main/checkov/terraform/checks/module/generic/RevisionHash.py",
+      relation: "extends",
+    },
+    {
+      tool: "kics",
+      rule: "3a81fc06-566f-492a-91dd-7448e409e2cd",
+      url: "https://docs.kics.io/latest/queries/terraform-queries/3a81fc06-566f-492a-91dd-7448e409e2cd/",
+      relation: "overlaps",
+    },
+  ],
+  TF006: [
+    {
+      tool: "tflint-ruleset-avm",
+      rule: "avm_terraform_sensitive_variable_default_disallowed",
+      url: "https://github.com/Azure/tflint-ruleset-avm/blob/main/docs/basic/avm_terraform_sensitive_variable_default_disallowed.md",
+      relation: "equivalent",
+    },
+  ],
+  TF007: [
+    { tool: "tfsec", rule: "general-secrets-sensitive-in-variable", url: `${TFSEC_V061}/sensitive-in-variable.md`, relation: "equivalent" },
+    { tool: "tfsec", rule: "general-secrets-sensitive-in-local", url: `${TFSEC_V061}/sensitive-in-local.md`, relation: "equivalent" },
+  ],
+  TF008: [
+    { tool: "checkov", rule: "CKV_AWS_41", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    { tool: "kics", rule: "d7b9d850-3e06-4a75-852f-c46c2e92240b", url: "https://docs.kics.io/latest/queries/terraform-queries/aws/d7b9d850-3e06-4a75-852f-c46c2e92240b/", relation: "overlaps" },
+    {
+      tool: "semgrep",
+      rule: "terraform.aws.security.aws-provider-static-credentials",
+      url: "https://github.com/semgrep/semgrep-rules/blob/develop/terraform/aws/security/aws-provider-static-credentials.yaml",
+      relation: "overlaps",
+    },
+  ],
+  TF009: [
+    {
+      tool: "hashicorp-style-guide",
+      rule: "Variables: for sensitive variables, such as passwords and private keys, set the sensitive parameter to true",
+      url: "https://developer.hashicorp.com/terraform/language/style#variables",
+      relation: "equivalent",
+    },
+  ],
+  TF010: [
+    { tool: "tflint-ruleset-terraform", rule: "terraform_typed_variables", url: `${TFLINT_RULES}/terraform_typed_variables.md`, relation: "equivalent" },
+    { tool: "kics", rule: "fc5109bf-01fd-49fb-8bde-4492b543c34a", url: "https://docs.kics.io/latest/queries/terraform-queries/fc5109bf-01fd-49fb-8bde-4492b543c34a/", relation: "equivalent" },
+  ],
+  TF011: [
+    { tool: "tflint-ruleset-terraform", rule: "terraform_documented_variables", url: `${TFLINT_RULES}/terraform_documented_variables.md`, relation: "equivalent" },
+    { tool: "kics", rule: "2a153952-2544-4687-bcc9-cc8fea814a9b", url: "https://docs.kics.io/latest/queries/terraform-queries/2a153952-2544-4687-bcc9-cc8fea814a9b/", relation: "equivalent" },
+    {
+      tool: "terraform-sentinel-policies",
+      rule: "validate-variables-have-descriptions",
+      url: "https://github.com/hashicorp/terraform-sentinel-policies/blob/main/cloud-agnostic/validate-variables-have-descriptions.sentinel",
+      relation: "equivalent",
+    },
+  ],
+  TF012: [
+    { tool: "tflint-ruleset-terraform", rule: "terraform_documented_outputs", url: `${TFLINT_RULES}/terraform_documented_outputs.md`, relation: "equivalent" },
+    { tool: "kics", rule: "59312e8a-a64e-41e7-a252-618533dd1ea8", url: "https://docs.kics.io/latest/queries/terraform-queries/59312e8a-a64e-41e7-a252-618533dd1ea8/", relation: "equivalent" },
+  ],
+  TF013: [
+    { tool: "tflint-ruleset-redeploy", rule: "terraform_ignore_changes_all", url: `${REDEPLOY_RULES}/terraform_ignore_changes_all.md`, relation: "equivalent" },
+  ],
+  TF014: [
+    {
+      tool: "tflint-ruleset-avm",
+      rule: "avm_terraform_provider_block_disallowed",
+      url: "https://github.com/Azure/tflint-ruleset-avm/blob/main/docs/basic/avm_terraform_provider_block_disallowed.md",
+      relation: "equivalent",
+    },
+    {
+      tool: "gcp-terraform-best-practices",
+      rule: "Build reusable modules: modules must not configure providers",
+      url: "https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure#reusable-modules",
+      relation: "equivalent",
+    },
+    {
+      tool: "aws-terraform-prescriptive-guidance",
+      rule: "Structure: declare provider configurations in the root module",
+      url: "https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/structure.html",
+      relation: "equivalent",
+    },
+  ],
+  // TF015 has no scanner to credit: no ruleset in the survey checks for a
+  // backend or cloud block inside a child module.
+  // tflint-ruleset-terraform's index has nothing about backends at all,
+  // Redeploy's has nothing either, and AVM's module rules stop at the
+  // provider block TF014 credits. What states the rule is Google Cloud's
+  // reusable-modules guide, so that document is the single credit here, and
+  // the page section says plainly that the credit is a document rather than
+  // a tool (#2112).
+  TF015: [
+    {
+      tool: "gcp-terraform-best-practices",
+      rule: "Build reusable modules: state configuration belongs to the root module",
+      url: "https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure#reusable-modules",
+      relation: "equivalent",
+    },
+  ],
+  TF016: [
+    // `overlaps`, not `equivalent`: tflint reports the same `x = "${y}"` form
+    // and also the object-key case (`"${var.k}" = v`), which this rule leaves
+    // alone. See tf016.ts.
+    { tool: "tflint-ruleset-terraform", rule: "terraform_deprecated_interpolation", url: `${TFLINT_RULES}/terraform_deprecated_interpolation.md`, relation: "overlaps" },
+  ],
+  TF017: [
+    { tool: "tflint-ruleset-redeploy", rule: "terraform_module_depends_on", url: `${REDEPLOY_RULES}/terraform_module_depends_on.md`, relation: "equivalent" },
+  ],
+  TF018: [
+    { tool: "tflint-ruleset-redeploy", rule: "terraform_output_resource", url: `${REDEPLOY_RULES}/terraform_output_resource.md`, relation: "equivalent" },
+  ],
+  TF019: [
+    { tool: "tflint-ruleset-redeploy", rule: "terraform_redundant_default", url: `${REDEPLOY_RULES}/terraform_redundant_default.md`, relation: "equivalent" },
+  ],
+  TF020: [
+    // `overlaps`: tflint evaluates expressions and reports the same four
+    // kinds of declaration; chant's index is a string scan over hcl2json's
+    // preserved expression strings, so it is generous where tflint is exact
+    // (see hcl/references.ts and tf020.ts).
+    {
+      tool: "tflint-ruleset-terraform",
+      rule: "terraform_unused_declarations",
+      url: `${TFLINT_RULES}/terraform_unused_declarations.md`,
+      relation: "overlaps",
+    },
+  ],
+  TF021: [
+    // Redeploy reports every `count` over a collection; TF021 reports only
+    // the ones that build an identity out of `count.index`, which is a
+    // strict subset, hence `overlaps` on both credits rather than
+    // `equivalent`. choudoufu's own rule is the survey's deepest reading of
+    // the identity-bearing question (#2112).
+    {
+      tool: "tflint-ruleset-redeploy",
+      rule: "terraform_prefer_for_each",
+      url: `${REDEPLOY_RULES}/terraform_prefer_for_each.md`,
+      relation: "overlaps",
+    },
+    {
+      tool: "choudoufu",
+      rule: "RuleCountIndex",
+      url: "https://github.com/INTENTIUS/choudoufu/blob/main/internal/live/lint/count_index.go",
+      relation: "overlaps",
+    },
+    {
+      tool: "hashicorp-style-guide",
+      rule: "Resources: use for_each for a dynamic resource count",
+      url: "https://developer.hashicorp.com/terraform/language/style#dynamic-resource-count",
+      relation: "overlaps",
+    },
+  ],
+  TF022: [
+    // tfsec consolidated its three `general/secrets` checks into
+    // `no-plaintext-exposure` in v1, which is the one still in the repository's
+    // `master` docs; `overlaps` because that consolidation also covers the
+    // variable and locals cases TF007 reports separately.
+    {
+      tool: "tfsec",
+      rule: "general-secrets-no-plaintext-exposure",
+      url: "https://github.com/aquasecurity/tfsec/blob/master/docs/checks/general/secrets/no-plaintext-exposure/index.md",
+      relation: "overlaps",
+    },
+    { tool: "kics", rule: "a88baa34-e2ad-44ea-ad6f-8cac87bc7c71", url: "https://docs.kics.io/latest/secrets/", relation: "overlaps" },
+  ],
+};

package/src/lint/audit.test.ts

@@ -1,9 +1,13 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { copyFileSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { describe, expect, test } from "vitest";
 import { auditFiles, type ChecksProvider, type EntitiesProvider } from "@intentius/chant/audit/core";
-import { discoverByDetection, type DetectPlugin } from "@intentius/chant/audit/discover";
+import { collectCandidates, discoverByDetection, type DetectPlugin } from "@intentius/chant/audit/discover";
+import { auditTerraformState } from "@intentius/chant/audit/terraform-state";
 import { terraformPlugin } from "../plugin";
+import { postSynthChecks } from "./post-synth";
 
 /**
  * End-to-end audit test (#2085 acceptance): `chant audit` (`auditFiles` on top
@@ -43,3 +47,38 @@ describe("chant audit against a discovered terraform root module", () => {
     expect(findings.filter((f) => f.checkId === "TF001")).toHaveLength(0);
   });
 });
+
+/**
+ * TF023 (#2110) is audit-only: it reads the file list `chant audit` discovers,
+ * never a parsed root module, so it lives in core
+ * (`packages/core/src/audit/terraform-state.ts`) beside the other
+ * lexicon-independent families. These run the two halves it depends on, the
+ * real walk and the real check, over the committed fixture roots.
+ */
+describe("TF023: Terraform state committed to the repository", () => {
+  const tf023 = join(dirname(fileURLToPath(import.meta.url)), "post-synth", "fixtures", "TF023");
+
+  test("fires on a root whose state file is committed beside it", () => {
+    // The fixture ships its state as `state.json`: a tracked `terraform.tfstate`
+    // is exactly what this rule reports, and the repository's own push rules
+    // refuse the name. The test materialises the root the rule is written for.
+    const root = mkdtempSync(join(tmpdir(), "chant-tf023-"));
+    copyFileSync(join(tf023, "positive", "main.tf"), join(root, "main.tf"));
+    copyFileSync(join(tf023, "positive", "state.json"), join(root, "terraform.tfstate"));
+    const findings = auditTerraformState(collectCandidates(root));
+    rmSync(root, { recursive: true, force: true });
+    expect(findings).toHaveLength(1);
+    expect(findings[0].checkId).toBe("TF023");
+    expect(findings[0].file).toBe("terraform.tfstate");
+    expect(findings[0].lexicon).toBe("terraform");
+  });
+
+  test("says nothing about a root that keeps its state remote", () => {
+    expect(auditTerraformState(collectCandidates(join(tf023, "negative")))).toEqual([]);
+  });
+
+  test("never runs during a build: it is not one of this lexicon's post-synth checks", () => {
+    expect(postSynthChecks.map((c) => c.id)).not.toContain("TF023");
+    expect(terraformPlugin.auditCatalog?.()).not.toHaveProperty("TF023");
+  });
+});

package/src/lint/post-synth/blocks.ts

@@ -0,0 +1,109 @@
+/**
+ * Shared reading helpers for the single-block post-synth checks (#2110).
+ *
+ * Thirteen of the fourteen rules in that issue do the same three things: pick
+ * the entities of one block type out of `ctx.entities`, read one attribute of
+ * each body, and report. This module is those three things, so a rule file is
+ * its condition and its message and nothing else. It exports no
+ * `PostSynthCheck`, so the generated barrel skips it (see
+ * `packages/core/src/codegen/generate-post-synth-barrel.ts`).
+ */
+
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import type { BlockBody, TerraformEntity } from "../../hcl/parse";
+
+/** One parsed block, with the entity key the diagnostic reports against. */
+export interface TerraformBlock {
+  /** `ctx.entities` key: `<root>/<address>`. */
+  key: string;
+  address: string;
+  body: BlockBody;
+  file: string;
+  root: string;
+  /** The raw text of the file this block came from (see `TerraformEntity.props`). */
+  source: string;
+}
+
+/** Every block of one entity type, in `ctx.entities` order. */
+export function blocksOfType(ctx: PostSynthContext, entityType: string): TerraformBlock[] {
+  const blocks: TerraformBlock[] = [];
+  for (const [key, entity] of ctx.entities) {
+    if (entity.entityType !== entityType) continue;
+    if (!isResourceDeclarable(entity)) continue;
+    const props = (entity as TerraformEntity).props as Partial<TerraformEntity["props"]>;
+    blocks.push({
+      key,
+      address: typeof props.address === "string" ? props.address : key,
+      body: (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody,
+      file: typeof props.file === "string" ? props.file : "",
+      root: typeof props.root === "string" ? props.root : "",
+      source: typeof props.source === "string" ? props.source : "",
+    });
+  }
+  return blocks;
+}
+
+/** Blocks of several types at once, in the order the types are given. */
+export function blocksOfTypes(ctx: PostSynthContext, entityTypes: string[]): TerraformBlock[] {
+  return entityTypes.flatMap((t) => blocksOfType(ctx, t));
+}
+
+/** The name half of a `var.<name>` / `output.<name>` address. */
+export function blockName(address: string): string {
+  const dot = address.indexOf(".");
+  return dot === -1 ? address : address.slice(dot + 1);
+}
+
+/**
+ * The bodies of a nested block (`lifecycle`, `validation`, a provider's
+ * `assume_role`). hcl2json encodes a repeatable block as an array of bodies
+ * and a singleton as a bare object, so both are normalized to an array here.
+ */
+export function nestedBodies(body: BlockBody, key: string): BlockBody[] {
+  const value = body[key];
+  if (Array.isArray(value)) return value.filter((v): v is BlockBody => typeof v === "object" && v !== null && !Array.isArray(v));
+  if (typeof value === "object" && value !== null) return [value as BlockBody];
+  return [];
+}
+
+/** Is this attribute value a string that says nothing? */
+export function isBlank(value: unknown): boolean {
+  return value === undefined || value === null || (typeof value === "string" && value.trim() === "");
+}
+
+/** One scalar attribute found by {@link walkAttributes}. */
+export interface Attribute {
+  /** The attribute's own name (the last path segment). */
+  name: string;
+  /** Dotted path from the block body, e.g. `connection.password`. */
+  path: string;
+  value: unknown;
+}
+
+/**
+ * Every scalar attribute in a block body, descending through nested blocks so
+ * a credential inside `connection {}` or `assume_role {}` is not invisible.
+ * Depth-limited: a Terraform block nests a handful of levels at most, and an
+ * unbounded walk over a large body buys nothing.
+ */
+export function walkAttributes(body: BlockBody, maxDepth = 3): Attribute[] {
+  const out: Attribute[] = [];
+  const visit = (value: unknown, path: string, name: string, depth: number): void => {
+    if (Array.isArray(value)) {
+      if (depth > maxDepth) return;
+      for (const item of value) visit(item, path, name, depth);
+      return;
+    }
+    if (typeof value === "object" && value !== null) {
+      if (depth >= maxDepth) return;
+      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+        visit(v, path === "" ? k : `${path}.${k}`, k, depth + 1);
+      }
+      return;
+    }
+    if (path !== "") out.push({ name, path, value });
+  };
+  visit(body, "", "", 0);
+  return out;
+}

package/src/lint/post-synth/fixtures/TF001/negative.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+  }
+}
+
+provider "null" {}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}
+
+resource "null_resource" "second" {
+  triggers = {
+    name = "second"
+  }
+}

package/src/lint/post-synth/fixtures/TF001/positive.tf

@@ -0,0 +1,24 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+  }
+}
+
+provider "null" {}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}
+
+resource "null_resource" "second" {
+  triggers = {
+    name = "second"
+  }
+}

package/src/lint/post-synth/fixtures/TF002/negative.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "web" {
+  ami = "ami-123"
+}

package/src/lint/post-synth/fixtures/TF002/positive-legacy.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    aws = "~> 4.0"
+  }
+}
+
+resource "aws_instance" "web" {
+  ami = "ami-123"
+}

package/src/lint/post-synth/fixtures/TF002/positive-no-version.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+resource "aws_instance" "web" {
+  ami = "ami-123"
+}

package/src/lint/post-synth/fixtures/TF002/positive.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_version = ">= 1.5.0"
+}
+
+resource "google_compute_instance" "vm" {
+  name = "vm"
+}

package/src/lint/post-synth/fixtures/TF003/negative.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}

package/src/lint/post-synth/fixtures/TF003/positive.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}

package/src/lint/post-synth/fixtures/TF004/negative-git.tf

@@ -0,0 +1,3 @@
+module "git" {
+  source = "git::https://example.com/vpc.git?ref=v1.2.0"
+}

package/src/lint/post-synth/fixtures/TF004/negative-local.tf

@@ -0,0 +1,3 @@
+module "local" {
+  source = "./modules/local"
+}

package/src/lint/post-synth/fixtures/TF004/negative.tf

@@ -0,0 +1,4 @@
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "~> 5.0"
+}

package/src/lint/post-synth/fixtures/TF004/positive.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "terraform-aws-modules/vpc/aws"
+}

package/src/lint/post-synth/fixtures/TF005/negative-local.tf

@@ -0,0 +1,3 @@
+module "local" {
+  source = "./modules/local"
+}

package/src/lint/post-synth/fixtures/TF005/negative-registry.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "terraform-aws-modules/vpc/aws"
+}

package/src/lint/post-synth/fixtures/TF005/negative-sha.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git?ref=abcdef1234567890abcdef1234567890abcdef12"
+}

package/src/lint/post-synth/fixtures/TF005/negative.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git?ref=v1.2.0"
+}