@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/src/lint/post-synth/fixtures/TF015/positive/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "app/terraform.tfstate"
+    region = "us-east-1"
+  }
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+}

package/src/lint/post-synth/fixtures/TF015/positive/modules/cdn/main.tf

@@ -0,0 +1,14 @@
+# This directory used to be a root module and kept its backend when it became
+# a child. State belongs to the root that calls it, so the block below is the
+# TF015 finding. `required_version` beside it is fine and is not reported.
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "local" {
+    path = "cdn.tfstate"
+  }
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets"
+}

package/src/lint/post-synth/fixtures/TF016/negative-template.tf

@@ -0,0 +1,7 @@
+resource "aws_s3_bucket" "assets" {
+  bucket = "${var.project}-assets"
+}
+
+resource "aws_s3_bucket" "logs" {
+  bucket = "logs-${var.project}"
+}

package/src/lint/post-synth/fixtures/TF016/negative.tf

@@ -0,0 +1,16 @@
+variable "assets_bucket" {
+  type        = string
+  description = "Name of the bucket the site is served from"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = var.assets_bucket
+  tags = {
+    name = "${var.assets_bucket}-assets"
+  }
+}
+
+output "assets_bucket_arn" {
+  description = "ARN of the assets bucket"
+  value       = aws_s3_bucket.assets.arn
+}

package/src/lint/post-synth/fixtures/TF016/positive-shared-file.tf

@@ -0,0 +1,12 @@
+resource "aws_s3_bucket" "assets" {
+  bucket = "${var.assets_bucket}"
+}
+
+resource "aws_s3_bucket" "logs" {
+  bucket = var.logs_bucket
+}
+
+output "assets_bucket" {
+  description = "Name of the assets bucket"
+  value       = aws_s3_bucket.assets.bucket
+}

package/src/lint/post-synth/fixtures/TF016/positive.tf

@@ -0,0 +1,13 @@
+variable "assets_bucket" {
+  type        = string
+  description = "Name of the bucket the site is served from"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "${var.assets_bucket}"
+}
+
+output "assets_bucket_arn" {
+  description = "ARN of the assets bucket"
+  value       = "${aws_s3_bucket.assets.arn}"
+}

package/src/lint/post-synth/fixtures/TF017/negative.tf

@@ -0,0 +1,4 @@
+module "cdn" {
+  source = "./modules/cdn"
+  bucket = aws_s3_bucket.assets.bucket
+}

package/src/lint/post-synth/fixtures/TF017/positive.tf

@@ -0,0 +1,5 @@
+module "cdn" {
+  source     = "./modules/cdn"
+  bucket     = aws_s3_bucket.assets.bucket
+  depends_on = [aws_s3_bucket.assets]
+}

package/src/lint/post-synth/fixtures/TF018/negative.tf

@@ -0,0 +1,9 @@
+output "web_instance_id" {
+  description = "Id of the web instance"
+  value       = aws_instance.web.id
+}
+
+output "cdn" {
+  description = "Everything the cdn module returns"
+  value       = module.cdn
+}

package/src/lint/post-synth/fixtures/TF018/positive-data.tf

@@ -0,0 +1,9 @@
+output "base_ami" {
+  description = "The whole AMI data source"
+  value       = data.aws_ami.base
+}
+
+output "base_ami_id" {
+  description = "Id of the base AMI"
+  value       = data.aws_ami.base.id
+}

package/src/lint/post-synth/fixtures/TF018/positive.tf

@@ -0,0 +1,4 @@
+output "web_instance" {
+  description = "The web instance"
+  value       = aws_instance.web
+}

package/src/lint/post-synth/fixtures/TF019/negative.tf

@@ -0,0 +1,14 @@
+variable "log_level" {
+  type        = string
+  description = "Log level the application starts with"
+  default     = "info"
+}
+
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  lifecycle {
+    prevent_destroy = var.protect_instances
+  }
+}

package/src/lint/post-synth/fixtures/TF019/positive-output.tf

@@ -0,0 +1,5 @@
+output "endpoint" {
+  description = "Endpoint the application is served from"
+  value       = aws_lb.web.dns_name
+  ephemeral   = false
+}

package/src/lint/post-synth/fixtures/TF019/positive.tf

@@ -0,0 +1,16 @@
+variable "log_level" {
+  type        = string
+  description = "Log level the application starts with"
+  default     = "info"
+  sensitive   = false
+}
+
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  lifecycle {
+    prevent_destroy       = false
+    create_before_destroy = false
+  }
+}

package/src/lint/post-synth/fixtures/TF020/negative.tf

@@ -0,0 +1,43 @@
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "retention_days" {
+  type = number
+
+  validation {
+    condition     = var.retention_days > 0
+    error_message = "retention_days must be positive."
+  }
+}
+
+locals {
+  common_tags = { Team = "platform" }
+  bucket_name = "assets"
+}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+}
+
+provider "aws" {
+  alias  = "replica"
+  region = "eu-west-1"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = local.bucket_name
+  region = var.region
+  tags   = local.common_tags
+}
+
+resource "aws_s3_bucket" "replica" {
+  provider = aws.replica
+  bucket   = "${local.bucket_name}-replica"
+}
+
+resource "aws_instance" "web" {
+  ami                    = data.aws_ami.ubuntu.id
+  log_retention_in_days  = var.retention_days
+}

package/src/lint/post-synth/fixtures/TF020/positive.tf

@@ -0,0 +1,32 @@
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "retention_days" {
+  type = number
+
+  validation {
+    condition     = var.retention_days > 0
+    error_message = "retention_days must be positive."
+  }
+}
+
+locals {
+  common_tags = { Team = "platform" }
+  bucket_name = "assets"
+}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+}
+
+provider "aws" {
+  alias  = "replica"
+  region = "eu-west-1"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = local.bucket_name
+  region = var.region
+}

package/src/lint/post-synth/fixtures/TF020/scoped/main.tf

@@ -0,0 +1,21 @@
+# The root's `var.region` is referenced only by the module call, which is
+# still a reference: the scope of a variable is the module that declares it.
+# The child module's own `var.unused_in_child` is referenced by nothing in the
+# child, and the root's use of the name `region` says nothing about it.
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+  }
+}
+
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+  region = var.region
+}

package/src/lint/post-synth/fixtures/TF020/scoped/modules/cdn/main.tf

@@ -0,0 +1,13 @@
+variable "region" {
+  type = string
+}
+
+variable "unused_in_child" {
+  type    = string
+  default = "nothing here reads this"
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets"
+  region = var.region
+}

package/src/lint/post-synth/fixtures/TF021/negative.tf

@@ -0,0 +1,31 @@
+variable "enabled" {
+  type = bool
+}
+
+variable "subnets" {
+  type = list(string)
+}
+
+# A count used as a switch. `for_each` does not replace this idiom, so it is
+# never reported.
+resource "aws_instance" "bastion" {
+  count         = var.enabled ? 1 : 0
+  instance_type = "t3.micro"
+  tags = {
+    Name = "bastion"
+  }
+}
+
+# Plural, but `count.index` only picks a subnet out of a list. Reindexing is
+# harmless here: no instance's identity moves.
+resource "aws_instance" "web" {
+  count         = length(var.subnets)
+  instance_type = "t3.micro"
+  subnet_id     = var.subnets[count.index]
+}
+
+# Already addressed by a stable key.
+resource "aws_s3_bucket" "assets" {
+  for_each = toset(["primary", "replica"])
+  bucket   = "assets-${each.key}"
+}

package/src/lint/post-synth/fixtures/TF021/positive-length.tf

@@ -0,0 +1,8 @@
+variable "subnets" {
+  type = list(string)
+}
+
+resource "aws_s3_bucket" "logs" {
+  count  = length(var.subnets)
+  bucket = "logs-${count.index}"
+}

package/src/lint/post-synth/fixtures/TF021/positive.tf

@@ -0,0 +1,8 @@
+resource "aws_instance" "web" {
+  count         = 3
+  instance_type = "t3.micro"
+
+  tags = {
+    Name = "web-${count.index}"
+  }
+}

package/src/lint/post-synth/fixtures/TF022/negative-locator.tf

@@ -0,0 +1,7 @@
+resource "aws_ecs_task_definition" "app" {
+  family = "app"
+
+  secret_arn      = "arn:aws:secretsmanager:eu-west-1:123456789012:secret:prod/app/db-AbCdEf"
+  api_key_id      = "ak-0f3c1d9e"
+  private_key_path = "/etc/ssl/private/app.pem"
+}

package/src/lint/post-synth/fixtures/TF022/negative.tf

@@ -0,0 +1,10 @@
+data "aws_secretsmanager_secret_version" "db" {
+  secret_id = "prod/app/db"
+}
+
+resource "aws_db_instance" "app" {
+  identifier = "app-prod"
+  engine     = "postgres"
+  username   = "app"
+  password   = data.aws_secretsmanager_secret_version.db.secret_string
+}

package/src/lint/post-synth/fixtures/TF022/positive-nested.tf

@@ -0,0 +1,10 @@
+resource "aws_instance" "web" {
+  ami           = "ami-0c55b159cbfafe1f0"
+  instance_type = "t3.micro"
+
+  connection {
+    type     = "ssh"
+    user     = "ubuntu"
+    password = "B00tstrapP4ssword"
+  }
+}

package/src/lint/post-synth/fixtures/TF022/positive.tf

@@ -0,0 +1,6 @@
+resource "aws_db_instance" "app" {
+  identifier = "app-prod"
+  engine     = "postgres"
+  username   = "app"
+  password   = "Pr0dDbP4ssw0rd"
+}

package/src/lint/post-synth/fixtures/TF023/negative/main.tf

@@ -0,0 +1,15 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "acme-tfstate"
+    key    = "app/terraform.tfstate"
+    region = "eu-west-1"
+  }
+}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}

package/src/lint/post-synth/fixtures/TF023/positive/main.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.5.0"
+}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}

package/src/lint/post-synth/fixtures/TF023/positive/state.json

@@ -0,0 +1,24 @@
+{
+  "version": 4,
+  "terraform_version": "1.5.7",
+  "serial": 3,
+  "lineage": "00000000-0000-0000-0000-000000000000",
+  "outputs": {},
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "null_resource",
+      "name": "first",
+      "provider": "provider[\"registry.terraform.io/hashicorp/null\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "1234567890123456789",
+            "triggers": { "name": "first" }
+          }
+        }
+      ]
+    }
+  ]
+}

package/src/lint/post-synth/fixtures/TF024/live-clean/main.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF024/live-with-backend/main.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "fixture/terraform.tfstate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF024/live-with-cloud/main.tf

@@ -0,0 +1,16 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+
+  cloud {
+    organization = "acme"
+    workspaces {
+      name = "fixture"
+    }
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF025/live-clean/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}

package/src/lint/post-synth/fixtures/TF025/live-with-workspace-ref/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+resource "null_resource" "first" {
+  triggers = {
+    workspace = "${terraform.workspace}"
+  }
+}

package/src/lint/post-synth/fixtures/TF026/live-default/main.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF026/live-explicit-delete/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+
+    policy {
+      undeclared_tagged = "delete"
+    }
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF026/live-keep/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+
+    policy {
+      undeclared_tagged = "keep"
+    }
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF027/live-default/main.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF027/live-untagged-delete/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+
+    policy {
+      undeclared_untagged = "delete"
+    }
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF027/live-untagged-delete-scoped/main.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+
+    scope {
+      region = "us-east-1"
+    }
+
+    policy {
+      undeclared_untagged = "delete"
+    }
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF027/live-untagged-report/main.tf

@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+
+    policy {
+      undeclared_untagged = "report"
+    }
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF028/live/main.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF028/stock/main.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "fixture"
+  }
+}
+
+resource "null_resource" "first" {}