@skaleagents/swarm 0.6.13 → 0.6.15

package/dist/iac/parse.d.ts

@@ -33,5 +33,6 @@ export declare function looksLikeBicep(content: string): boolean;
 export declare function looksLikeArm(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;
+export declare function terraformJsonencodeValue(expression: string): unknown | undefined;
 export declare function looksLikeServerless(content: string): boolean;
 export declare function looksLikeIamPolicy(content: string): boolean;

package/dist/iac/parse.js

@@ -139,7 +139,7 @@ export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
         /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
 }
-const terraformExpressionWarning = "Terraform expressions are not evaluated. Findings use literal values and declared settings.";
+const terraformExpressionWarning = "Same-file variable and local literals are resolved. A string of those references and format of known literals are resolved. Other functions and expressions are not evaluated.";
 export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
@@ -412,11 +412,12 @@ export function parseIac(content, requested = "auto") {
                 Array.isArray(root.Resources) ||
                 typeof root.Resources !== "object")
                 throw new ScanInputError("CloudFormation requires a Resources mapping.");
+            const parameters = cloudFormationParameterLiterals(root);
             for (const [name, raw] of Object.entries(object(root.Resources))) {
                 const value = object(raw);
                 if (typeof value.Type !== "string")
                     throw new ScanInputError("Each CloudFormation resource requires a Type.");
-                add(name, value.Type, value, ["Resources", name]);
+                add(name, value.Type, resolveCloudFormationRefs(value, parameters), ["Resources", name]);
             }
         }
         else if (format === "terraform") {
@@ -467,7 +468,10 @@ export function parseIac(content, requested = "auto") {
         throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, an ARM template, Serverless Framework, or a standalone IAM policy.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
-    if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
+    if (format === "cloudformation" &&
+        /(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\bRef\s*:)/.test(content))
+        warnings.push("Same-file parameter defaults are resolved. A simple Fn::Sub of those parameters is resolved. Other functions are not evaluated.");
+    else if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
 }
@@ -1403,6 +1407,139 @@ function parseAzure(content, format) {
         warnings: [azureExpressionWarning],
     };
 }
+function parameterNameIsSecret(name) {
+    const normalized = name.replace(/-/g, "_");
+    return (/(?:^|_)(?:password|passwd|secret|token)$/i.test(normalized) ||
+        /(?:^|_)(?:api_?key|auth_token|access_key|private_key)$/i.test(normalized) ||
+        /(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?key|private[_-]?key|token)$/i.test(name));
+}
+function cloudFormationParameterLiterals(root) {
+    const defaults = new Map();
+    const secretNames = new Set();
+    for (const [name, raw] of Object.entries(object(root.Parameters))) {
+        const body = object(raw);
+        if (!("Default" in body))
+            continue;
+        const value = body.Default;
+        if (typeof value !== "string" && typeof value !== "boolean" && typeof value !== "number")
+            continue;
+        defaults.set(name, value);
+        if (typeof value === "string" && value.trim() !== "" && parameterNameIsSecret(name))
+            secretNames.add(name);
+    }
+    return { defaults, secretNames };
+}
+function cloudFormationRefName(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([key]) => key !== "__referencedSecrets");
+    if (entries.length !== 1)
+        return undefined;
+    const [key, name] = entries[0];
+    if (key !== "Ref" || typeof name !== "string" || name.trim() === "")
+        return undefined;
+    return name;
+}
+function cloudFormationIntrinsic(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    return Object.keys(value).some((key) => key === "Fn::Sub" || key === "Fn::Join" || key === "Fn::FindInMap" || key.startsWith("Fn::"));
+}
+function cloudFormationSubTemplate(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([key]) => key !== "__referencedSecrets");
+    if (entries.length !== 1)
+        return undefined;
+    const [key, template] = entries[0];
+    if (key !== "Fn::Sub" || typeof template !== "string")
+        return undefined;
+    return template;
+}
+function substituteKnownParameters(template, parameters) {
+    let unresolved = false;
+    let secret = false;
+    const text = template.replace(/\$\{(!?)([^}]*)\}/g, (full, literalMark, rawName) => {
+        if (literalMark === "!")
+            return `\${${rawName}}`;
+        const name = rawName.trim();
+        if (!parameters.defaults.has(name)) {
+            unresolved = true;
+            return full;
+        }
+        if (parameters.secretNames.has(name))
+            secret = true;
+        return String(parameters.defaults.get(name));
+    });
+    if (unresolved)
+        return undefined;
+    return { text, secret };
+}
+function resolveCloudFormationRefs(value, parameters) {
+    const secretPaths = [];
+    const resolved = resolveCloudFormationValue(value, parameters, [], secretPaths);
+    if (secretPaths.length > 0 &&
+        resolved &&
+        typeof resolved === "object" &&
+        !Array.isArray(resolved)) {
+        Object.defineProperty(resolved, "__referencedSecrets", {
+            enumerable: false,
+            configurable: true,
+            value: secretPaths,
+        });
+    }
+    return object(resolved);
+}
+function resolveCloudFormationValue(value, parameters, path, secretPaths) {
+    const ref = cloudFormationRefName(value);
+    if (ref) {
+        if (!parameters.defaults.has(ref))
+            return value;
+        const literal = parameters.defaults.get(ref);
+        if (parameters.secretNames.has(ref) &&
+            typeof literal === "string" &&
+            literal.trim() !== "")
+            secretPaths.push(path);
+        return literal;
+    }
+    const subTemplate = cloudFormationSubTemplate(value);
+    if (subTemplate !== undefined) {
+        const substituted = substituteKnownParameters(subTemplate, parameters);
+        if (!substituted)
+            return value;
+        if (substituted.secret)
+            secretPaths.push(path);
+        return substituted.text;
+    }
+    if (cloudFormationIntrinsic(value))
+        return value;
+    if (Array.isArray(value))
+        return value.map((item, index) => resolveCloudFormationValue(item, parameters, [...path, index], secretPaths));
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [key, child] of Object.entries(value)) {
+            if (key === "__referencedSecrets")
+                continue;
+            out[key] = resolveCloudFormationValue(child, parameters, [...path, key], secretPaths);
+        }
+        return out;
+    }
+    return value;
+}
+export function terraformJsonencodeValue(expression) {
+    const match = /^\$\{jsonencode\(([\s\S]*)\)\}$/.exec(expression.trim());
+    if (!match)
+        return undefined;
+    try {
+        const [parsed, error] = hcl.parseToObject(`value = ${match[1]}\n`);
+        if (error || !parsed)
+            return undefined;
+        return object(parsed).value;
+    }
+    catch {
+        return undefined;
+    }
+}
 function terraformLocalBlocks(data) {
     const raw = object(data).locals;
     if (Array.isArray(raw))
@@ -1443,8 +1580,8 @@ export function looksLikeIamPolicy(content) {
     const statement = root.Statement ?? root.statement;
     return Array.isArray(statement);
 }
-const serverlessWarning = "The Serverless Framework config is not executed. Conditions are not evaluated.";
-const iamPolicyWarning = "The IAM policy is not executed. Conditions are not evaluated.";
+const serverlessWarning = "The Serverless Framework config is not executed. Other condition operators are not evaluated.";
+const iamPolicyWarning = "The IAM policy is not executed. Other condition operators are not evaluated.";
 function serverlessShapeError() {
     return "Serverless Framework config requires top-level service and provider, plus functions or plugins.";
 }
@@ -1457,6 +1594,29 @@ function effectAllows(body) {
         return true;
     return String(effect).trim().toLowerCase() === "allow";
 }
+const openSourceAddresses = new Set(["0.0.0.0/0", "::/0", "*"]);
+function conditionValueIsOpen(value) {
+    if (typeof value === "string")
+        return openSourceAddresses.has(value.trim());
+    if (Array.isArray(value))
+        return value.some((item) => conditionValueIsOpen(item));
+    return false;
+}
+function sourceAddressAllowsEveryone(body) {
+    if (!effectAllows(body))
+        return false;
+    const condition = object(body.Condition ?? body.condition);
+    let ipAddress;
+    for (const [key, value] of Object.entries(condition)) {
+        if (key.toLowerCase() === "ipaddress") {
+            ipAddress = value;
+            break;
+        }
+    }
+    if (!ipAddress || typeof ipAddress !== "object" || Array.isArray(ipAddress))
+        return false;
+    return Object.values(object(ipAddress)).some((value) => conditionValueIsOpen(value));
+}
 function actionIsOnlyWildcard(body) {
     const action = body.Action ?? body.action ?? body.actions ?? body.Actions;
     if (typeof action === "string")
@@ -1531,14 +1691,16 @@ function parseServerless(content) {
     for (const group of statementGroups(root)) {
         group.statements.forEach((statement, index) => {
             const body = object(statement);
-            if (!effectAllows(body) || !actionIsOnlyWildcard(body))
+            const wildcard = effectAllows(body) && actionIsOnlyWildcard(body);
+            const openSourceIp = sourceAddressAllowsEveryone(body);
+            if (!wildcard && !openSourceIp)
                 return;
             iamCount += 1;
-            const path = [...group.path, index, "Action"];
+            const path = [...group.path, index, openSourceIp && !wildcard ? "Condition" : "Action"];
             resources.push({
                 id: `serverless.iam.${iamCount}`,
                 type: "serverless:iam",
-                value: { wildcard: true },
+                value: { wildcard, openSourceIp },
                 locate: () => yamlLocation(doc, lines, path),
             });
         });
@@ -1599,14 +1761,18 @@ function parseIamPolicy(content) {
     const resources = [];
     statements.forEach((statement, index) => {
         const body = object(statement);
-        if (!effectAllows(body) || !actionIsOnlyWildcard(body))
+        const wildcard = effectAllows(body) && actionIsOnlyWildcard(body);
+        const openSourceIp = sourceAddressAllowsEveryone(body);
+        if (!wildcard && !openSourceIp)
             return;
-        const line = iamStatementLine(content, index);
+        const line = iamStatementLine(content, index, openSourceIp && !wildcard ? "Condition" : "Action");
         resources.push({
             id: `iam.statement.${index + 1}`,
             type: "iam:statement",
-            value: { wildcard: true },
-            locate: () => lineLocation(line, `Statement.${index}.Action`),
+            value: { wildcard, openSourceIp },
+            locate: () => lineLocation(line, openSourceIp && !wildcard
+                ? `Statement.${index}.Condition`
+                : `Statement.${index}.Action`),
         });
     });
     if (!resources.length) {
@@ -1619,13 +1785,13 @@ function parseIamPolicy(content) {
     }
     return { format: "iam", resources, warnings: [iamPolicyWarning] };
 }
-function iamStatementLine(content, index) {
+function iamStatementLine(content, index, key = "Action") {
     const matches = [...content.matchAll(/"Statement"\s*:/g)];
     const start = matches[0]?.index ?? 0;
     const region = content.slice(start);
-    const actions = [...region.matchAll(/"Action"\s*:/g)];
-    const action = actions[index];
-    if (!action || action.index == null)
+    const keys = [...region.matchAll(new RegExp(`"${key}"\\s*:`, "g"))];
+    const hit = key === "Action" ? keys[index] : keys.find((item) => item.index != null);
+    if (!hit || hit.index == null)
         return lineAt(content, start);
-    return lineAt(content, start + action.index);
+    return lineAt(content, start + hit.index);
 }

package/dist/iac/rules.js

@@ -1,4 +1,4 @@
-import { array, object } from "./parse.js";
+import { array, object, terraformJsonencodeValue } from "./parse.js";
 import { externalHttp, literalCredential } from "../review.js";
 export const rules = {
     SEC001: {
@@ -40,8 +40,15 @@ export const rules = {
         category: "security",
         severity: "high",
         title: "Wildcard permission detected",
-        detail: "An Allow statement grants wildcard actions or principals.",
-        remediation: "List the required actions and trusted principals explicitly, with resource and condition restrictions.",
+        detail: "An Allow statement grants a wildcard action.",
+        remediation: "List the required actions explicitly, with resource and condition restrictions.",
+    },
+    IAM002: {
+        category: "security",
+        severity: "high",
+        title: "Policy allows any principal",
+        detail: "An Allow statement sets Principal to any AWS principal.",
+        remediation: "Name the trusted principals explicitly instead of allowing any principal.",
     },
     DATA001: {
         category: "security",
@@ -369,6 +376,22 @@ export const rules = {
 export function resourceFindings(resources, format) {
     const findings = [];
     const checked = new Set();
+    const sameFile = collectSameFileLiterals(resources);
+    const suppressedSecrets = new WeakMap();
+    const moduleSecrets = new WeakMap();
+    if (format === "terraform") {
+        for (const resource of resources) {
+            if (resource.type === "terraform:variable" ||
+                resource.type === "terraform:local" ||
+                resource.type === "tfvars:assignment")
+                continue;
+            const suppressed = new Set();
+            const referenced = new Set();
+            resolveSameFileRefs(resource.value, sameFile, [], suppressed, referenced);
+            suppressedSecrets.set(resource, suppressed);
+            moduleSecrets.set(resource, referenced);
+        }
+    }
     for (const resource of resources) {
         const check = (id, condition, path = []) => {
             checked.add(id);
@@ -412,6 +435,7 @@ export function resourceFindings(resources, format) {
         }
         if (format === "iam") {
             check("IAM001", resource.value.wildcard === true, ["Action"]);
+            check("NET001", resource.value.openSourceIp === true, ["Condition"]);
             continue;
         }
         if (resource.type === "terraform:local") {
@@ -419,7 +443,7 @@ export function resourceFindings(resources, format) {
             continue;
         }
         if (resource.type === "terraform:module") {
-            checkTerraformLiterals(resource.value, "module", check, []);
+            checkTerraformLiterals(resource.value, "module", check, [], "", moduleSecrets.get(resource));
             continue;
         }
         if (resource.type === "terraform:variable") {
@@ -436,7 +460,8 @@ export function resourceFindings(resources, format) {
             const credentialName = /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)$/i;
             check("SEC001", (credentialName.test(key) ||
                 (key === "value" && credentialName.test(String(parent.name)))) &&
-                literalCredential(value), path);
+                literalCredential(value) &&
+                !suppressedSecrets.get(resource)?.has(path.join(".")), path);
             check("SEC002", /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/.test(value), path);
             check("SEC003", /-----BEGIN (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----/.test(value), path);
             check("NET002", [...value.matchAll(/\bhttp:\/\/[^\s"'<>]+/gi)].some((m) => externalHttp(m[0])), path);
@@ -447,8 +472,15 @@ export function resourceFindings(resources, format) {
             checkCompose(resource, check);
         else
             checkCloud(resource, resources, format, check);
+        const referencedSecrets = Object.getOwnPropertyDescriptor(resource.value, "__referencedSecrets")?.value;
+        if (Array.isArray(referencedSecrets)) {
+            for (const secretPath of referencedSecrets) {
+                if (Array.isArray(secretPath))
+                    check("SEC001", true, secretPath);
+            }
+        }
     }
-    return { findings, checked };
+    return { findings: dedupeSecretFindings(findings), checked };
 }
 function checkDockerfile(resource, check) {
     if (resource.type === "dockerfile:user")
@@ -500,8 +532,10 @@ function checkPipeline(resource, check) {
         check("PIPE003", resource.value.present === true, ["privileged"]);
 }
 function checkServerless(resource, check) {
-    if (resource.type === "serverless:iam")
+    if (resource.type === "serverless:iam") {
         check("IAM001", resource.value.wildcard === true, ["Action"]);
+        check("NET001", resource.value.openSourceIp === true, ["Condition"]);
+    }
     else if (resource.type === "serverless:env")
         check("SLS001", resource.value.literal === true, ["environment"]);
 }
@@ -520,7 +554,7 @@ function moduleCidrExempt(name) {
         normalized === "destination" ||
         normalized === "ipv6_egress");
 }
-function checkTerraformLiterals(value, mode, check, path, name = "") {
+function checkTerraformLiterals(value, mode, check, path, name = "", referencedSecrets) {
     if (typeof value === "string" || typeof value === "boolean") {
         const open = value === "0.0.0.0/0" || value === "::/0";
         const exempt = mode === "assignment" ? name.toLowerCase() === "egress" : moduleCidrExempt(name);
@@ -532,16 +566,247 @@ function checkTerraformLiterals(value, mode, check, path, name = "") {
             check("TF001", value.trim() !== "" && !terraformReference(value), path);
         if (mode === "local" && typeof value === "string" && secretAssignmentName(name))
             check("TF002", value.trim() !== "" && !terraformReference(value), path);
+        if (mode === "module" && referencedSecrets?.has(path.join(".")))
+            check("SEC001", true, path);
         return;
     }
     if (Array.isArray(value)) {
-        value.forEach((item, index) => checkTerraformLiterals(item, mode, check, [...path, index], name));
+        value.forEach((item, index) => checkTerraformLiterals(item, mode, check, [...path, index], name, referencedSecrets));
         return;
     }
     if (value && typeof value === "object") {
         for (const [key, child] of Object.entries(value))
-            checkTerraformLiterals(child, mode, check, [...path, key], key);
+            checkTerraformLiterals(child, mode, check, [...path, key], key, referencedSecrets);
+    }
+}
+const exactSameFileRef = /^\$\{(var|local)\.([A-Za-z_][A-Za-z0-9_]*)\}$/;
+const interpolationPiece = /\$\{(var|local)\.([A-Za-z_][A-Za-z0-9_]*)\}/g;
+const interpolationOnly = /^(\$\{(?:var|local)\.[A-Za-z_][A-Za-z0-9_]*\})+$/;
+function sameFileText(kind, name, sameFile) {
+    const literal = (kind === "var" ? sameFile.vars : sameFile.locals).get(name);
+    if (typeof literal === "string" || typeof literal === "number" || typeof literal === "boolean")
+        return String(literal);
+    return undefined;
+}
+function resolveInterpolationString(value, sameFile) {
+    const trimmed = value.trim();
+    if (!interpolationOnly.test(trimmed))
+        return undefined;
+    let count = 0;
+    let failed = false;
+    const text = trimmed.replace(interpolationPiece, (_full, kind, name) => {
+        count += 1;
+        const part = sameFileText(kind, name, sameFile);
+        if (part === undefined) {
+            failed = true;
+            return "";
+        }
+        return part;
+    });
+    if (failed || count < 2)
+        return undefined;
+    return text;
+}
+function splitCallArguments(source) {
+    const args = [];
+    let current = "";
+    let quote = null;
+    let depth = 0;
+    for (let index = 0; index < source.length; index += 1) {
+        const char = source[index];
+        if (quote) {
+            current += char;
+            if (char === "\\" && index + 1 < source.length) {
+                current += source[index + 1];
+                index += 1;
+                continue;
+            }
+            if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            current += char;
+            continue;
+        }
+        if (char === "(" || char === "[" || char === "{") {
+            depth += 1;
+            current += char;
+            continue;
+        }
+        if (char === ")" || char === "]" || char === "}") {
+            if (depth === 0)
+                return undefined;
+            depth -= 1;
+            current += char;
+            continue;
+        }
+        if (char === "," && depth === 0) {
+            args.push(current.trim());
+            current = "";
+            continue;
+        }
+        current += char;
+    }
+    if (quote || depth !== 0)
+        return undefined;
+    if (current.trim() !== "")
+        args.push(current.trim());
+    return args;
+}
+function unquoteHcl(token) {
+    if (token.length < 2)
+        return undefined;
+    const quote = token[0];
+    if ((quote !== '"' && quote !== "'") || token[token.length - 1] !== quote)
+        return undefined;
+    const body = token.slice(1, -1);
+    return quote === '"'
+        ? body.replace(/\\n/g, "\n").replace(/\\"/g, '"').replace(/\\\\/g, "\\")
+        : body.replace(/\\'/g, "'").replace(/\\\\/g, "\\");
+}
+function resolveFormatArgument(token, sameFile) {
+    const literal = unquoteHcl(token);
+    if (literal !== undefined)
+        return literal;
+    if (/^-?\d+(?:\.\d+)?$/.test(token) || token === "true" || token === "false")
+        return token;
+    const ref = /^(var|local)\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(token);
+    if (!ref)
+        return undefined;
+    return sameFileText(ref[1], ref[2], sameFile);
+}
+function applyPercentS(format, args) {
+    let index = 0;
+    let text = "";
+    for (let cursor = 0; cursor < format.length; cursor += 1) {
+        if (format[cursor] !== "%") {
+            text += format[cursor];
+            continue;
+        }
+        const verb = format[cursor + 1];
+        if (verb === "%") {
+            text += "%";
+            cursor += 1;
+            continue;
+        }
+        if (verb !== "s" || index >= args.length)
+            return undefined;
+        text += args[index];
+        index += 1;
+        cursor += 1;
+    }
+    return text;
+}
+function resolveFormatCall(value, sameFile) {
+    const wrapped = /^\$\{format\(([\s\S]*)\)\}$/.exec(value.trim());
+    if (!wrapped)
+        return undefined;
+    const args = splitCallArguments(wrapped[1]);
+    if (!args || args.length === 0)
+        return undefined;
+    const resolved = [];
+    for (const arg of args) {
+        const part = resolveFormatArgument(arg, sameFile);
+        if (part === undefined)
+            return undefined;
+        resolved.push(part);
+    }
+    return applyPercentS(resolved[0], resolved.slice(1));
+}
+function noteResolvedLiteral(literal, path, sameFile, suppressed, referencedSecrets) {
+    if (literal.trim() === "")
+        return;
+    const key = [...path].reverse().find((part) => typeof part === "string");
+    if (sameFile.declaredSecrets.has(literal))
+        suppressed.add(path.join("."));
+    else if (typeof key === "string" && secretAssignmentName(key))
+        referencedSecrets.add(path.join("."));
+}
+function sameFileLiteral(value) {
+    if (typeof value === "boolean" || typeof value === "number")
+        return value;
+    if (typeof value === "string" && !value.includes("${"))
+        return value;
+    return undefined;
+}
+function collectSameFileLiterals(resources) {
+    const vars = new Map();
+    const locals = new Map();
+    const declaredSecrets = new Set();
+    for (const resource of resources) {
+        if (resource.type === "terraform:variable") {
+            const name = String(resource.value.name ?? "");
+            const literal = sameFileLiteral(resource.value.default);
+            if (!name || literal === undefined)
+                continue;
+            vars.set(name, literal);
+            if (typeof literal === "string" && literal.trim() !== "" && secretAssignmentName(name))
+                declaredSecrets.add(literal);
+        }
+        if (resource.type === "terraform:local") {
+            for (const [name, raw] of Object.entries(resource.value)) {
+                const literal = sameFileLiteral(raw);
+                if (literal === undefined)
+                    continue;
+                locals.set(name, literal);
+                if (typeof literal === "string" && literal.trim() !== "" && secretAssignmentName(name))
+                    declaredSecrets.add(literal);
+            }
+        }
     }
+    return { vars, locals, declaredSecrets };
+}
+function resolveSameFileRefs(value, sameFile, path, suppressed, referencedSecrets) {
+    if (typeof value === "string") {
+        const match = exactSameFileRef.exec(value.trim());
+        if (match) {
+            const literal = (match[1] === "var" ? sameFile.vars : sameFile.locals).get(match[2]);
+            if (literal === undefined)
+                return value;
+            if (typeof literal === "string")
+                noteResolvedLiteral(literal, path, sameFile, suppressed, referencedSecrets);
+            return literal;
+        }
+        const concatenated = resolveInterpolationString(value, sameFile);
+        if (concatenated !== undefined) {
+            noteResolvedLiteral(concatenated, path, sameFile, suppressed, referencedSecrets);
+            return concatenated;
+        }
+        const formatted = resolveFormatCall(value, sameFile);
+        if (formatted !== undefined) {
+            noteResolvedLiteral(formatted, path, sameFile, suppressed, referencedSecrets);
+            return formatted;
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => {
+            value[index] = resolveSameFileRefs(item, sameFile, [...path, index], suppressed, referencedSecrets);
+        });
+        return value;
+    }
+    if (value && typeof value === "object") {
+        for (const [key, child] of Object.entries(value)) {
+            if (key === "__referencedSecrets")
+                continue;
+            value[key] = resolveSameFileRefs(child, sameFile, [...path, key], suppressed, referencedSecrets);
+        }
+    }
+    return value;
+}
+function dedupeSecretFindings(findings) {
+    const seen = new Set();
+    return findings.filter((finding) => {
+        if (finding.ruleId !== "SEC001")
+            return true;
+        const key = `${finding.ruleId}|${finding.resource}|${finding.location?.path ?? ""}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
 }
 function checkAzure(resource, check) {
     if (resource.type === "azure:exposure")
@@ -597,6 +862,39 @@ function checkCompose(resource, check) {
         service.mem_reservation == null, ["mem_limit"]);
     check("NET001", array(service.ports).some(composePortIsPublic), ["ports"]);
 }
+function statementEffectAllows(body) {
+    const effect = body.Effect ?? body.effect;
+    if (effect == null || String(effect).trim() === "")
+        return true;
+    return String(effect).trim().toLowerCase() === "allow";
+}
+function principalAllowsAnyone(value) {
+    if (typeof value === "string")
+        return value.trim() === "*";
+    if (Array.isArray(value))
+        return value.some((item) => principalAllowsAnyone(item));
+    if (value && typeof value === "object")
+        return Object.values(value).some((item) => principalAllowsAnyone(item));
+    return false;
+}
+function actionIncludesWildcard(value) {
+    return array(value).some((item) => typeof item === "string" && item.includes("*"));
+}
+function checkInlinePolicy(document, check, path) {
+    const root = object(document);
+    const statements = root.Statement ?? root.statement;
+    if (!Array.isArray(statements) && (statements == null || typeof statements !== "object"))
+        return;
+    for (const statement of array(statements)) {
+        const body = object(statement);
+        if (!statementEffectAllows(body))
+            continue;
+        check("IAM001", actionIncludesWildcard(body.Action ?? body.action ?? body.Actions ?? body.actions), path);
+        const principal = body.Principal ?? body.principal ?? body.Principals ?? body.principals;
+        if (principal !== undefined)
+            check("IAM002", principalAllowsAnyone(principal), path);
+    }
+}
 function checkCloud(resource, resources, format, check) {
     const tf = format === "terraform";
     const pulumi = format === "pulumi";
@@ -619,31 +917,30 @@ function checkCloud(resource, resources, format, check) {
             isIngress) {
             check("NET001", array(child).some((cidr) => cidr === "0.0.0.0/0" || cidr === "::/0"), [...prefix, ...at]);
         }
-        if (/^(?:Action|Principal|actions|principals)$/.test(key) &&
-            (parent.Effect === "Allow" || parent.effect === "Allow")) {
-            const values = typeof child === "object" && !Array.isArray(child)
-                ? Object.values(object(child)).flatMap(array)
-                : array(child);
-            check("IAM001", values.some((item) => typeof item === "string" && item.includes("*")), [...prefix, ...at]);
-        }
-        if (/^(?:policy|assume_role_policy|PolicyDocument)$/.test(key) &&
-            typeof child === "string" &&
-            child.trimStart().startsWith("{")) {
-            try {
-                const document = JSON.parse(child);
-                for (const statement of array(object(document).Statement)) {
-                    const s = object(statement);
-                    check("IAM001", s.Effect === "Allow" &&
-                        [
-                            ...array(s.Action),
-                            ...array(s.Principal),
-                            ...Object.values(object(s.Principal)).flatMap(array),
-                        ].some((v) => typeof v === "string" && v.includes("*")), [...prefix, ...at]);
+        if (/^(?:Action|actions)$/.test(key) && statementEffectAllows(parent)) {
+            check("IAM001", actionIncludesWildcard(child), [...prefix, ...at]);
+        }
+        if (/^(?:Principal|principals)$/.test(key) && statementEffectAllows(parent)) {
+            check("IAM002", principalAllowsAnyone(child), [...prefix, ...at]);
+        }
+        if (typeof child === "string") {
+            const encoded = child.trim().startsWith("${jsonencode(")
+                ? terraformJsonencodeValue(child)
+                : undefined;
+            let parsed;
+            if (encoded === undefined &&
+                /^(?:policy|assume_role_policy|PolicyDocument)$/.test(key) &&
+                child.trimStart().startsWith("{")) {
+                try {
+                    parsed = JSON.parse(child);
+                }
+                catch {
+                    parsed = undefined;
                 }
             }
-            catch {
-                /* Nonliteral policies are covered by the expression warning. */
-            }
+            const document = encoded ?? parsed;
+            if (document !== undefined)
+                checkInlinePolicy(document, check, [...prefix, ...at]);
         }
         if (/^(?:instance_type|machine_type|vm_size|InstanceType|DBInstanceClass|instance_class)$/.test(key))
             check("COST001", typeof child === "string", [...prefix, ...at]);

package/dist/iac/scan.js

@@ -55,6 +55,11 @@ export function scanIac(content, options = {}) {
                     "HCL locations point to resource declarations; property paths identify the affected setting.",
                 ]
                 : []),
+            ...(parsed.format === "terraform" || parsed.format === "cloudformation"
+                ? [
+                    "Same-file var, local, and CloudFormation parameter defaults are resolved. Functions, Fn::Sub, and module sources are not.",
+                ]
+                : []),
         ],
     };
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.13";
+export declare const VERSION = "0.6.15";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.13";
+export const VERSION = "0.6.15";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.13",
+  "version": "0.6.15",
   "private": false,
   "publishConfig": {
     "access": "public"