@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/src/lint/post-synth/fixtures/TF005/positive-branch.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git?ref=main"
+}

package/src/lint/post-synth/fixtures/TF005/positive-non-semver.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git?ref=some-feature"
+}

package/src/lint/post-synth/fixtures/TF005/positive.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git"
+}

package/src/lint/post-synth/fixtures/TF006/negative.tf

@@ -0,0 +1,5 @@
+variable "deploy_token" {
+  type        = string
+  description = "Token the deploy job authenticates with"
+  sensitive   = true
+}

package/src/lint/post-synth/fixtures/TF006/positive-empty-default.tf

@@ -0,0 +1,11 @@
+variable "blank_token" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
+variable "null_token" {
+  type      = string
+  sensitive = true
+  default   = null
+}

package/src/lint/post-synth/fixtures/TF006/positive.tf

@@ -0,0 +1,6 @@
+variable "deploy_token" {
+  type        = string
+  description = "Token the deploy job authenticates with"
+  sensitive   = true
+  default     = "carried-over-from-the-old-staging-account"
+}

package/src/lint/post-synth/fixtures/TF007/negative.tf

@@ -0,0 +1,10 @@
+variable "db_password" {
+  type        = string
+  description = "Password for the application database user"
+  sensitive   = true
+}
+
+locals {
+  ci_token = var.ci_token
+  region   = "us-east-1"
+}

package/src/lint/post-synth/fixtures/TF007/positive.tf

@@ -0,0 +1,9 @@
+variable "db_password" {
+  type        = string
+  description = "Password for the application database user"
+  default     = "hunter2-prod-db"
+}
+
+locals {
+  ci_token = "ghp_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8"
+}

package/src/lint/post-synth/fixtures/TF008/negative-variable.tf

@@ -0,0 +1,10 @@
+provider "vault" {
+  address = "https://vault.internal:8200"
+  token   = var.vault_token
+}
+
+provider "postgresql" {
+  host     = "db.internal"
+  username = "terraform"
+  password = data.aws_secretsmanager_secret_version.db.secret_string
+}

package/src/lint/post-synth/fixtures/TF008/negative.tf

@@ -0,0 +1,8 @@
+provider "aws" {
+  region = "eu-west-1"
+}
+
+provider "google" {
+  project     = "acme-prod"
+  credentials = "keys/terraform-deployer.json"
+}

package/src/lint/post-synth/fixtures/TF008/positive-other-provider.tf

@@ -0,0 +1,10 @@
+provider "vault" {
+  address = "https://vault.internal:8200"
+  token   = "9Rk2QpZ7mXt4LbW1nY6cV3dF"
+}
+
+provider "postgresql" {
+  host     = "db.internal"
+  username = "terraform"
+  password = "9Rk2QpZ7mXt4LbW1"
+}

package/src/lint/post-synth/fixtures/TF008/positive.tf

@@ -0,0 +1,5 @@
+provider "aws" {
+  region     = "eu-west-1"
+  access_key = "AKIA2E0XYZ4PQRSTUVWX"
+  secret_key = "8Jd0hVn2XqB7sLtR4mYcE1zPgWfKa5UiQ3oNrTbA"
+}

package/src/lint/post-synth/fixtures/TF009/negative.tf

@@ -0,0 +1,10 @@
+variable "db_password" {
+  type        = string
+  description = "Password for the application database user"
+  sensitive   = true
+}
+
+variable "db_password_arn" {
+  type        = string
+  description = "Secrets Manager ARN the password is read from"
+}

package/src/lint/post-synth/fixtures/TF009/positive.tf

@@ -0,0 +1,4 @@
+variable "db_password" {
+  type        = string
+  description = "Password for the application database user"
+}

package/src/lint/post-synth/fixtures/TF010/negative.tf

@@ -0,0 +1,5 @@
+variable "instance_count" {
+  type        = number
+  description = "How many web instances to run"
+  default     = 3
+}

package/src/lint/post-synth/fixtures/TF010/positive.tf

@@ -0,0 +1,4 @@
+variable "instance_count" {
+  description = "How many web instances to run"
+  default     = 3
+}

package/src/lint/post-synth/fixtures/TF011/negative.tf

@@ -0,0 +1,5 @@
+variable "region" {
+  type        = string
+  description = "Region every resource in this root is created in"
+  default     = "eu-west-1"
+}

package/src/lint/post-synth/fixtures/TF011/positive-blank.tf

@@ -0,0 +1,5 @@
+variable "region" {
+  type        = string
+  description = "   "
+  default     = "eu-west-1"
+}

package/src/lint/post-synth/fixtures/TF011/positive.tf

@@ -0,0 +1,4 @@
+variable "region" {
+  type    = string
+  default = "eu-west-1"
+}

package/src/lint/post-synth/fixtures/TF012/negative.tf

@@ -0,0 +1,4 @@
+output "bucket_name" {
+  description = "Name of the bucket the site is served from"
+  value       = aws_s3_bucket.assets.bucket
+}

package/src/lint/post-synth/fixtures/TF012/positive.tf

@@ -0,0 +1,3 @@
+output "bucket_name" {
+  value = aws_s3_bucket.assets.bucket
+}

package/src/lint/post-synth/fixtures/TF013/negative.tf

@@ -0,0 +1,8 @@
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  lifecycle {
+    ignore_changes = [tags, user_data]
+  }
+}

package/src/lint/post-synth/fixtures/TF013/positive-data.tf

@@ -0,0 +1,8 @@
+data "aws_ami" "base" {
+  most_recent = true
+  owners      = ["amazon"]
+
+  lifecycle {
+    ignore_changes = all
+  }
+}

package/src/lint/post-synth/fixtures/TF013/positive.tf

@@ -0,0 +1,8 @@
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  lifecycle {
+    ignore_changes = all
+  }
+}

package/src/lint/post-synth/fixtures/TF014/negative/main.tf

@@ -0,0 +1,26 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+provider "aws" {
+  alias  = "replica"
+  region = "eu-west-1"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+  bucket = "assets"
+
+  providers = {
+    aws         = aws
+    aws.replica = aws.replica
+  }
+}

package/src/lint/post-synth/fixtures/TF014/negative/modules/cdn/main.tf

@@ -0,0 +1,19 @@
+# An `alias`-only provider block declares a slot the caller fills through
+# `providers = { aws.replica = aws.replica }`. It configures nothing, so TF014
+# leaves it alone.
+provider "aws" {
+  alias = "replica"
+}
+
+variable "bucket" {
+  type = string
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = var.bucket
+}
+
+resource "aws_s3_bucket" "replica" {
+  provider = aws.replica
+  bucket   = "${var.bucket}-replica"
+}

package/src/lint/post-synth/fixtures/TF014/positive/main.tf

@@ -0,0 +1,16 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+  bucket = "assets"
+}

package/src/lint/post-synth/fixtures/TF014/positive/modules/cdn/main.tf

@@ -0,0 +1,15 @@
+# The provider block TF014 reports: this module configures its own region, so
+# its caller cannot point it anywhere else, and Terraform cannot remove the
+# module without deleting the provider its own destroy needs.
+provider "aws" {
+  region  = "us-east-1"
+  profile = "cdn"
+}
+
+variable "bucket" {
+  type = string
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = var.bucket
+}

package/src/lint/post-synth/fixtures/TF015/negative/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "app/terraform.tfstate"
+    region = "us-east-1"
+  }
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+}

package/src/lint/post-synth/fixtures/TF015/negative/modules/cdn/main.tf

@@ -0,0 +1,16 @@
+# A child module's terraform block is welcome to constrain versions. It just
+# may not say where state lives.
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets"
+}

package/src/lint/post-synth/fixtures/TF015/positive/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "app/terraform.tfstate"
+    region = "us-east-1"
+  }
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+}

package/src/lint/post-synth/fixtures/TF015/positive/modules/cdn/main.tf

@@ -0,0 +1,14 @@
+# This directory used to be a root module and kept its backend when it became
+# a child. State belongs to the root that calls it, so the block below is the
+# TF015 finding. `required_version` beside it is fine and is not reported.
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "local" {
+    path = "cdn.tfstate"
+  }
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets"
+}

package/src/lint/post-synth/fixtures/TF016/negative-template.tf

@@ -0,0 +1,7 @@
+resource "aws_s3_bucket" "assets" {
+  bucket = "${var.project}-assets"
+}
+
+resource "aws_s3_bucket" "logs" {
+  bucket = "logs-${var.project}"
+}

package/src/lint/post-synth/fixtures/TF016/negative.tf

@@ -0,0 +1,16 @@
+variable "assets_bucket" {
+  type        = string
+  description = "Name of the bucket the site is served from"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = var.assets_bucket
+  tags = {
+    name = "${var.assets_bucket}-assets"
+  }
+}
+
+output "assets_bucket_arn" {
+  description = "ARN of the assets bucket"
+  value       = aws_s3_bucket.assets.arn
+}

package/src/lint/post-synth/fixtures/TF016/positive-shared-file.tf

@@ -0,0 +1,12 @@
+resource "aws_s3_bucket" "assets" {
+  bucket = "${var.assets_bucket}"
+}
+
+resource "aws_s3_bucket" "logs" {
+  bucket = var.logs_bucket
+}
+
+output "assets_bucket" {
+  description = "Name of the assets bucket"
+  value       = aws_s3_bucket.assets.bucket
+}

package/src/lint/post-synth/fixtures/TF016/positive.tf

@@ -0,0 +1,13 @@
+variable "assets_bucket" {
+  type        = string
+  description = "Name of the bucket the site is served from"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "${var.assets_bucket}"
+}
+
+output "assets_bucket_arn" {
+  description = "ARN of the assets bucket"
+  value       = "${aws_s3_bucket.assets.arn}"
+}

package/src/lint/post-synth/fixtures/TF017/negative.tf

@@ -0,0 +1,4 @@
+module "cdn" {
+  source = "./modules/cdn"
+  bucket = aws_s3_bucket.assets.bucket
+}

package/src/lint/post-synth/fixtures/TF017/positive.tf

@@ -0,0 +1,5 @@
+module "cdn" {
+  source     = "./modules/cdn"
+  bucket     = aws_s3_bucket.assets.bucket
+  depends_on = [aws_s3_bucket.assets]
+}

package/src/lint/post-synth/fixtures/TF018/negative.tf

@@ -0,0 +1,9 @@
+output "web_instance_id" {
+  description = "Id of the web instance"
+  value       = aws_instance.web.id
+}
+
+output "cdn" {
+  description = "Everything the cdn module returns"
+  value       = module.cdn
+}

package/src/lint/post-synth/fixtures/TF018/positive-data.tf

@@ -0,0 +1,9 @@
+output "base_ami" {
+  description = "The whole AMI data source"
+  value       = data.aws_ami.base
+}
+
+output "base_ami_id" {
+  description = "Id of the base AMI"
+  value       = data.aws_ami.base.id
+}

package/src/lint/post-synth/fixtures/TF018/positive.tf

@@ -0,0 +1,4 @@
+output "web_instance" {
+  description = "The web instance"
+  value       = aws_instance.web
+}

package/src/lint/post-synth/fixtures/TF019/negative.tf

@@ -0,0 +1,14 @@
+variable "log_level" {
+  type        = string
+  description = "Log level the application starts with"
+  default     = "info"
+}
+
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  lifecycle {
+    prevent_destroy = var.protect_instances
+  }
+}

package/src/lint/post-synth/fixtures/TF019/positive-output.tf

@@ -0,0 +1,5 @@
+output "endpoint" {
+  description = "Endpoint the application is served from"
+  value       = aws_lb.web.dns_name
+  ephemeral   = false
+}

package/src/lint/post-synth/fixtures/TF019/positive.tf

@@ -0,0 +1,16 @@
+variable "log_level" {
+  type        = string
+  description = "Log level the application starts with"
+  default     = "info"
+  sensitive   = false
+}
+
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  lifecycle {
+    prevent_destroy       = false
+    create_before_destroy = false
+  }
+}

package/src/lint/post-synth/fixtures/TF020/negative.tf

@@ -0,0 +1,43 @@
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "retention_days" {
+  type = number
+
+  validation {
+    condition     = var.retention_days > 0
+    error_message = "retention_days must be positive."
+  }
+}
+
+locals {
+  common_tags = { Team = "platform" }
+  bucket_name = "assets"
+}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+}
+
+provider "aws" {
+  alias  = "replica"
+  region = "eu-west-1"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = local.bucket_name
+  region = var.region
+  tags   = local.common_tags
+}
+
+resource "aws_s3_bucket" "replica" {
+  provider = aws.replica
+  bucket   = "${local.bucket_name}-replica"
+}
+
+resource "aws_instance" "web" {
+  ami                    = data.aws_ami.ubuntu.id
+  log_retention_in_days  = var.retention_days
+}

package/src/lint/post-synth/fixtures/TF020/positive.tf

@@ -0,0 +1,32 @@
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "retention_days" {
+  type = number
+
+  validation {
+    condition     = var.retention_days > 0
+    error_message = "retention_days must be positive."
+  }
+}
+
+locals {
+  common_tags = { Team = "platform" }
+  bucket_name = "assets"
+}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+}
+
+provider "aws" {
+  alias  = "replica"
+  region = "eu-west-1"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = local.bucket_name
+  region = var.region
+}

package/src/lint/post-synth/fixtures/TF020/scoped/main.tf

@@ -0,0 +1,21 @@
+# The root's `var.region` is referenced only by the module call, which is
+# still a reference: the scope of a variable is the module that declares it.
+# The child module's own `var.unused_in_child` is referenced by nothing in the
+# child, and the root's use of the name `region` says nothing about it.
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+}
+
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+  region = var.region
+}

package/src/lint/post-synth/fixtures/TF020/scoped/modules/cdn/main.tf

@@ -0,0 +1,13 @@
+variable "region" {
+  type = string
+}
+
+variable "unused_in_child" {
+  type    = string
+  default = "nothing here reads this"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets"
+  region = var.region
+}

package/src/lint/post-synth/fixtures/TF021/negative.tf

@@ -0,0 +1,31 @@
+variable "enabled" {
+  type = bool
+}
+
+variable "subnets" {
+  type = list(string)
+}
+
+# A count used as a switch. `for_each` does not replace this idiom, so it is
+# never reported.
+resource "aws_instance" "bastion" {
+  count         = var.enabled ? 1 : 0
+  instance_type = "t3.micro"
+  tags = {
+    Name = "bastion"
+  }
+}
+
+# Plural, but `count.index` only picks a subnet out of a list. Reindexing is
+# harmless here: no instance's identity moves.
+resource "aws_instance" "web" {
+  count         = length(var.subnets)
+  instance_type = "t3.micro"
+  subnet_id     = var.subnets[count.index]
+}
+
+# Already addressed by a stable key.
+resource "aws_s3_bucket" "assets" {
+  for_each = toset(["primary", "replica"])
+  bucket   = "assets-${each.key}"
+}

package/src/lint/post-synth/fixtures/TF021/positive-length.tf

@@ -0,0 +1,8 @@
+variable "subnets" {
+  type = list(string)
+}
+
+resource "aws_s3_bucket" "logs" {
+  count  = length(var.subnets)
+  bucket = "logs-${count.index}"
+}

package/src/lint/post-synth/fixtures/TF021/positive.tf

@@ -0,0 +1,8 @@
+resource "aws_instance" "web" {
+  count         = 3
+  instance_type = "t3.micro"
+
+  tags = {
+    Name = "web-${count.index}"
+  }
+}

package/src/lint/post-synth/fixtures/TF022/negative-locator.tf

@@ -0,0 +1,7 @@
+resource "aws_ecs_task_definition" "app" {
+  family = "app"
+
+  secret_arn      = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:prod/app/db-AbCdEf"
+  api_key_id      = "ak-0f3c1d9e"
+  private_key_path = "/etc/ssl/private/app.pem"
+}