@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/src/lint/post-synth/blocks.ts

@@ -0,0 +1,109 @@
+/**
+ * Shared reading helpers for the single-block post-synth checks (#2110).
+ *
+ * Thirteen of the fourteen rules in that issue do the same three things: pick
+ * the entities of one block type out of `ctx.entities`, read one attribute of
+ * each body, and report. This module is those three things, so a rule file is
+ * its condition and its message and nothing else. It exports no
+ * `PostSynthCheck`, so the generated barrel skips it (see
+ * `packages/core/src/codegen/generate-post-synth-barrel.ts`).
+ */
+
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import type { BlockBody, TerraformEntity } from "../../hcl/parse";
+
+/** One parsed block, with the entity key the diagnostic reports against. */
+export interface TerraformBlock {
+  /** `ctx.entities` key: `<root>/<address>`. */
+  key: string;
+  address: string;
+  body: BlockBody;
+  file: string;
+  root: string;
+  /** The raw text of the file this block came from (see `TerraformEntity.props`). */
+  source: string;
+}
+
+/** Every block of one entity type, in `ctx.entities` order. */
+export function blocksOfType(ctx: PostSynthContext, entityType: string): TerraformBlock[] {
+  const blocks: TerraformBlock[] = [];
+  for (const [key, entity] of ctx.entities) {
+    if (entity.entityType !== entityType) continue;
+    if (!isResourceDeclarable(entity)) continue;
+    const props = (entity as TerraformEntity).props as Partial<TerraformEntity["props"]>;
+    blocks.push({
+      key,
+      address: typeof props.address === "string" ? props.address : key,
+      body: (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody,
+      file: typeof props.file === "string" ? props.file : "",
+      root: typeof props.root === "string" ? props.root : "",
+      source: typeof props.source === "string" ? props.source : "",
+    });
+  }
+  return blocks;
+}
+
+/** Blocks of several types at once, in the order the types are given. */
+export function blocksOfTypes(ctx: PostSynthContext, entityTypes: string[]): TerraformBlock[] {
+  return entityTypes.flatMap((t) => blocksOfType(ctx, t));
+}
+
+/** The name half of a `var.<name>` / `output.<name>` address. */
+export function blockName(address: string): string {
+  const dot = address.indexOf(".");
+  return dot === -1 ? address : address.slice(dot + 1);
+}
+
+/**
+ * The bodies of a nested block (`lifecycle`, `validation`, a provider's
+ * `assume_role`). hcl2json encodes a repeatable block as an array of bodies
+ * and a singleton as a bare object, so both are normalized to an array here.
+ */
+export function nestedBodies(body: BlockBody, key: string): BlockBody[] {
+  const value = body[key];
+  if (Array.isArray(value)) return value.filter((v): v is BlockBody => typeof v === "object" && v !== null && !Array.isArray(v));
+  if (typeof value === "object" && value !== null) return [value as BlockBody];
+  return [];
+}
+
+/** Is this attribute value a string that says nothing? */
+export function isBlank(value: unknown): boolean {
+  return value === undefined || value === null || (typeof value === "string" && value.trim() === "");
+}
+
+/** One scalar attribute found by {@link walkAttributes}. */
+export interface Attribute {
+  /** The attribute's own name (the last path segment). */
+  name: string;
+  /** Dotted path from the block body, e.g. `connection.password`. */
+  path: string;
+  value: unknown;
+}
+
+/**
+ * Every scalar attribute in a block body, descending through nested blocks so
+ * a credential inside `connection {}` or `assume_role {}` is not invisible.
+ * Depth-limited: a Terraform block nests a handful of levels at most, and an
+ * unbounded walk over a large body buys nothing.
+ */
+export function walkAttributes(body: BlockBody, maxDepth = 3): Attribute[] {
+  const out: Attribute[] = [];
+  const visit = (value: unknown, path: string, name: string, depth: number): void => {
+    if (Array.isArray(value)) {
+      if (depth > maxDepth) return;
+      for (const item of value) visit(item, path, name, depth);
+      return;
+    }
+    if (typeof value === "object" && value !== null) {
+      if (depth >= maxDepth) return;
+      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+        visit(v, path === "" ? k : `${path}.${k}`, k, depth + 1);
+      }
+      return;
+    }
+    if (path !== "") out.push({ name, path, value });
+  };
+  visit(body, "", "", 0);
+  return out;
+}

package/src/lint/post-synth/fixtures/TF001/negative-cloud.tf

@@ -0,0 +1,28 @@
+# Terraform Cloud / HCP holds the state, so there is no terraform.tfstate on
+# the machine that runs the plan. `cloud {}` counts as remote for TF001.
+terraform {
+  required_version = ">= 1.5.0"
+
+  cloud {
+    organization = "acme"
+
+    workspaces {
+      name = "app"
+    }
+  }
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+  }
+}
+
+provider "null" {}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}

package/src/lint/post-synth/fixtures/TF001/negative.tf

@@ -0,0 +1,30 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "app/terraform.tfstate"
+    region = "us-east-1"
+  }
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+  }
+}
+
+provider "null" {}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}
+
+resource "null_resource" "second" {
+  triggers = {
+    name = "second"
+  }
+}

package/src/lint/post-synth/fixtures/TF001/positive-local.tf

@@ -0,0 +1,31 @@
+# `backend "local"` is the local backend asked for by name: the same
+# terraform.tfstate in the working directory a root with no backend block
+# falls back to. TF001 reports it for that reason (#2218).
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+  }
+}
+
+provider "null" {}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}
+
+resource "null_resource" "second" {
+  triggers = {
+    name = "second"
+  }
+}

package/src/lint/post-synth/fixtures/TF001/positive.tf

@@ -0,0 +1,24 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+  }
+}
+
+provider "null" {}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}
+
+resource "null_resource" "second" {
+  triggers = {
+    name = "second"
+  }
+}

package/src/lint/post-synth/fixtures/TF002/negative.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_instance" "web" {
+  ami = "ami-123"
+}

package/src/lint/post-synth/fixtures/TF002/positive-legacy.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    aws = "~> 4.0"
+  }
+}
+
+resource "aws_instance" "web" {
+  ami = "ami-123"
+}

package/src/lint/post-synth/fixtures/TF002/positive-no-version.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+}
+
+resource "aws_instance" "web" {
+  ami = "ami-123"
+}

package/src/lint/post-synth/fixtures/TF002/positive.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_version = ">= 1.5.0"
+}
+
+resource "google_compute_instance" "vm" {
+  name = "vm"
+}

package/src/lint/post-synth/fixtures/TF003/negative.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}

package/src/lint/post-synth/fixtures/TF003/positive.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}

package/src/lint/post-synth/fixtures/TF004/negative-git.tf

@@ -0,0 +1,3 @@
+module "git" {
+  source = "git::https://example.com/vpc.git?ref=v1.2.0"
+}

package/src/lint/post-synth/fixtures/TF004/negative-local.tf

@@ -0,0 +1,3 @@
+module "local" {
+  source = "./modules/local"
+}

package/src/lint/post-synth/fixtures/TF004/negative.tf

@@ -0,0 +1,4 @@
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "~> 5.0"
+}

package/src/lint/post-synth/fixtures/TF004/positive.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "terraform-aws-modules/vpc/aws"
+}

package/src/lint/post-synth/fixtures/TF005/negative-local.tf

@@ -0,0 +1,3 @@
+module "local" {
+  source = "./modules/local"
+}

package/src/lint/post-synth/fixtures/TF005/negative-registry.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "terraform-aws-modules/vpc/aws"
+}

package/src/lint/post-synth/fixtures/TF005/negative-sha.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git?ref=abcdef1234567890abcdef1234567890abcdef12"
+}

package/src/lint/post-synth/fixtures/TF005/negative.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git?ref=v1.2.0"
+}

package/src/lint/post-synth/fixtures/TF005/positive-branch.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git?ref=main"
+}

package/src/lint/post-synth/fixtures/TF005/positive-non-semver.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git?ref=some-feature"
+}

package/src/lint/post-synth/fixtures/TF005/positive.tf

@@ -0,0 +1,3 @@
+module "vpc" {
+  source = "git::https://example.com/vpc.git"
+}

package/src/lint/post-synth/fixtures/TF006/negative.tf

@@ -0,0 +1,5 @@
+variable "deploy_token" {
+  type        = string
+  description = "Token the deploy job authenticates with"
+  sensitive   = true
+}

package/src/lint/post-synth/fixtures/TF006/positive-empty-default.tf

@@ -0,0 +1,11 @@
+variable "blank_token" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
+variable "null_token" {
+  type      = string
+  sensitive = true
+  default   = null
+}

package/src/lint/post-synth/fixtures/TF006/positive.tf

@@ -0,0 +1,6 @@
+variable "deploy_token" {
+  type        = string
+  description = "Token the deploy job authenticates with"
+  sensitive   = true
+  default     = "carried-over-from-the-old-staging-account"
+}

package/src/lint/post-synth/fixtures/TF007/negative.tf

@@ -0,0 +1,10 @@
+variable "db_password" {
+  type        = string
+  description = "Password for the application database user"
+  sensitive   = true
+}
+
+locals {
+  ci_token = var.ci_token
+  region   = "us-east-1"
+}

package/src/lint/post-synth/fixtures/TF007/positive.tf

@@ -0,0 +1,9 @@
+variable "db_password" {
+  type        = string
+  description = "Password for the application database user"
+  default     = "hunter2-prod-db"
+}
+
+locals {
+  ci_token = "ghp_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8"
+}

package/src/lint/post-synth/fixtures/TF008/negative-variable.tf

@@ -0,0 +1,10 @@
+provider "vault" {
+  address = "https://vault.internal:8200"
+  token   = var.vault_token
+}
+
+provider "postgresql" {
+  host     = "db.internal"
+  username = "terraform"
+  password = data.aws_secretsmanager_secret_version.db.secret_string
+}

package/src/lint/post-synth/fixtures/TF008/negative.tf

@@ -0,0 +1,8 @@
+provider "aws" {
+  region = "eu-west-1"
+}
+
+provider "google" {
+  project     = "acme-prod"
+  credentials = "keys/terraform-deployer.json"
+}

package/src/lint/post-synth/fixtures/TF008/positive-other-provider.tf

@@ -0,0 +1,10 @@
+provider "vault" {
+  address = "https://vault.internal:8200"
+  token   = "9Rk2QpZ7mXt4LbW1nY6cV3dF"
+}
+
+provider "postgresql" {
+  host     = "db.internal"
+  username = "terraform"
+  password = "9Rk2QpZ7mXt4LbW1"
+}

package/src/lint/post-synth/fixtures/TF008/positive.tf

@@ -0,0 +1,5 @@
+provider "aws" {
+  region     = "eu-west-1"
+  access_key = "AKIA2E0XYZ4PQRSTUVWX"
+  secret_key = "8Jd0hVn2XqB7sLtR4mYcE1zPgWfKa5UiQ3oNrTbA"
+}

package/src/lint/post-synth/fixtures/TF009/negative.tf

@@ -0,0 +1,10 @@
+variable "db_password" {
+  type        = string
+  description = "Password for the application database user"
+  sensitive   = true
+}
+
+variable "db_password_arn" {
+  type        = string
+  description = "Secrets Manager ARN the password is read from"
+}

package/src/lint/post-synth/fixtures/TF009/positive.tf

@@ -0,0 +1,4 @@
+variable "db_password" {
+  type        = string
+  description = "Password for the application database user"
+}

package/src/lint/post-synth/fixtures/TF010/negative.tf

@@ -0,0 +1,5 @@
+variable "instance_count" {
+  type        = number
+  description = "How many web instances to run"
+  default     = 3
+}

package/src/lint/post-synth/fixtures/TF010/positive.tf

@@ -0,0 +1,4 @@
+variable "instance_count" {
+  description = "How many web instances to run"
+  default     = 3
+}

package/src/lint/post-synth/fixtures/TF011/negative.tf

@@ -0,0 +1,5 @@
+variable "region" {
+  type        = string
+  description = "Region every resource in this root is created in"
+  default     = "eu-west-1"
+}

package/src/lint/post-synth/fixtures/TF011/positive-blank.tf

@@ -0,0 +1,5 @@
+variable "region" {
+  type        = string
+  description = "   "
+  default     = "eu-west-1"
+}

package/src/lint/post-synth/fixtures/TF011/positive.tf

@@ -0,0 +1,4 @@
+variable "region" {
+  type    = string
+  default = "eu-west-1"
+}

package/src/lint/post-synth/fixtures/TF012/negative.tf

@@ -0,0 +1,4 @@
+output "bucket_name" {
+  description = "Name of the bucket the site is served from"
+  value       = aws_s3_bucket.assets.bucket
+}

package/src/lint/post-synth/fixtures/TF012/positive.tf

@@ -0,0 +1,3 @@
+output "bucket_name" {
+  value = aws_s3_bucket.assets.bucket
+}

package/src/lint/post-synth/fixtures/TF013/negative.tf

@@ -0,0 +1,8 @@
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  lifecycle {
+    ignore_changes = [tags, user_data]
+  }
+}

package/src/lint/post-synth/fixtures/TF013/positive-data.tf

@@ -0,0 +1,8 @@
+data "aws_ami" "base" {
+  most_recent = true
+  owners      = ["amazon"]
+
+  lifecycle {
+    ignore_changes = all
+  }
+}

package/src/lint/post-synth/fixtures/TF013/positive.tf

@@ -0,0 +1,8 @@
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  lifecycle {
+    ignore_changes = all
+  }
+}

package/src/lint/post-synth/fixtures/TF014/negative/main.tf

@@ -0,0 +1,26 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+provider "aws" {
+  alias  = "replica"
+  region = "eu-west-1"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+  bucket = "assets"
+
+  providers = {
+    aws         = aws
+    aws.replica = aws.replica
+  }
+}

package/src/lint/post-synth/fixtures/TF014/negative/modules/cdn/main.tf

@@ -0,0 +1,19 @@
+# An `alias`-only provider block declares a slot the caller fills through
+# `providers = { aws.replica = aws.replica }`. It configures nothing, so TF014
+# leaves it alone.
+provider "aws" {
+  alias = "replica"
+}
+
+variable "bucket" {
+  type = string
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = var.bucket
+}
+
+resource "aws_s3_bucket" "replica" {
+  provider = aws.replica
+  bucket   = "${var.bucket}-replica"
+}

package/src/lint/post-synth/fixtures/TF014/positive/main.tf

@@ -0,0 +1,16 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+  bucket = "assets"
+}

package/src/lint/post-synth/fixtures/TF014/positive/modules/cdn/main.tf

@@ -0,0 +1,15 @@
+# The provider block TF014 reports: this module configures its own region, so
+# its caller cannot point it anywhere else, and Terraform cannot remove the
+# module without deleting the provider its own destroy needs.
+provider "aws" {
+  region  = "us-east-1"
+  profile = "cdn"
+}
+
+variable "bucket" {
+  type = string
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = var.bucket
+}

package/src/lint/post-synth/fixtures/TF015/negative/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "app/terraform.tfstate"
+    region = "us-east-1"
+  }
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+}

package/src/lint/post-synth/fixtures/TF015/negative/modules/cdn/main.tf

@@ -0,0 +1,16 @@
+# A child module's terraform block is welcome to constrain versions. It just
+# may not say where state lives.
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets"
+}