@suss/terraform-aws 0.31.2 → 0.33.0

package/README.md

@@ -23,19 +23,23 @@ terraformFileToSummaries("infra/terraform/dynamodb", { packs: [awsTerraform()] }
 | --- | --- |
 | `aws_dynamodb_table` | a store, keyed by `hash_key` and `range_key`, with each `global_secondary_index` and `local_secondary_index` as its own way in |
 | `aws_s3_bucket` | a store whose objects have no fields to compare against |
-| `aws_elasticache_cluster` | a Redis store, when `engine` is `redis` or `valkey`; a Memcached cluster is skipped |
+| `aws_elasticache_cluster` | a Redis store, when `engine` is `redis` or `valkey` or unset; any other engine leaves the store with no engine on it |
 | `aws_elasticache_replication_group` | a Redis store |
+| `aws_rds_cluster` | a PostgreSQL or MySQL store, whichever its `engine` picks |
+| `aws_db_instance` | the same, and `mariadb` counts as MySQL |
 | `aws_sqs_queue` | a channel |
 | `aws_sns_topic` | a channel |
 | `aws_cloudwatch_event_bus` | a channel |
+| `aws_kinesis_stream` | a channel |
+| `aws_kinesis_firehose_delivery_stream` | a channel |
+| `aws_cloudwatch_log_metric_filter` | a metric, identified by its namespace and its name together |
+| `aws_cloudwatch_metric_alarm` | one consumer of that metric, identified the same way |
+| `aws_lambda_function` | a deployable, with the variables it sets and the handler it calls |
+| `aws_ecs_task_definition` | a deployable per container, with that container's variables, secrets and image |
 
 Everything else a configuration declares, a security group, a subnet, an IAM policy, is how the deployment is wired rather than something a caller addresses, so nothing reads it.
 
-## Why a Redis cluster pairs with nothing
-
-Code addresses Redis by key namespace: `@suss/framework-redis` reads `session:{id}` and records the container `session`. A cluster declares no namespaces; its `cluster_id` is a deployment name, and code never spells it. The two sides share no name either can state, so the entry says so: the summary declares the store exists, with no container name, and the storage check claims no access for it. A pair between a cluster called `session` and the `session` namespace would be a coincidence between a deployment name and a key prefix, so the entry refuses it rather than reporting it.
-
-What you get from the entry is visibility: `suss contract --from terraform` shows the cluster, and `suss check` reports it as a declared store nothing paired with. Namespace-level pairing stays between the code's own readers and writers of the same keys.
+A database instance and a Redis cluster are the two that pair with nothing: code addresses tables and key namespaces inside them, and no attribute of either lists one, so each declares the store and claims no access. Kinesis pairs with nothing yet either, since no code pack records a send to a stream. [What each entry decided](./DESIGN.md) says why for each of them, and what an alarm and a metric filter share.
 
 ## Why every entry states a version range
 
@@ -53,6 +57,21 @@ terraform {
 
 The reader takes that pin and hands it to the pack. A configuration that pins nothing is read by every entry, since nothing said otherwise.
 
+Every entry here was written against `>=4 <7`, from these pages of the provider's own documentation:
+
+- [`aws_dynamodb_table`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table), [`aws_s3_bucket`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket)
+- [`aws_elasticache_cluster`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_cluster), [`aws_elasticache_replication_group`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/elasticache_replication_group)
+- [`aws_rds_cluster`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster), [`aws_db_instance`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance)
+- [`aws_sqs_queue`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue), [`aws_sns_topic`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic), [`aws_cloudwatch_event_bus`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_bus)
+- [`aws_kinesis_stream`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream), [`aws_kinesis_firehose_delivery_stream`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_firehose_delivery_stream)
+- [`aws_cloudwatch_log_metric_filter`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_metric_filter), [`aws_cloudwatch_metric_alarm`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm)
+
 ## Where it fits in suss
 
-Depends on `@suss/contract-terraform` for the shape of an entry, and on nothing else. A pack for another provider, `google` or `cloudflare`, is the same file with different entries.
+Depends on `@suss/contract-terraform` for the shape of an entry, and on `@suss/ir-core` for the variables each deployment target injects on its own. A pack for another provider, `google` or `cloudflare`, is the same file with different entries.
+
+## More
+
+- [What each entry decided](./DESIGN.md)
+- [Documentation](https://suss.sh/)
+- [Source and issues](https://github.com/nimbuscloud-ai/suss)

package/dist/index.cjs

@@ -25,6 +25,41 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 var CURRENT = ">=4 <7";
+var METRIC_SYSTEM = "cloudwatch";
+var STATISTICS = {
+  SampleCount: "number",
+  Average: "number",
+  Sum: "number",
+  Minimum: "number",
+  Maximum: "number"
+};
+var SQL_ENGINES = {
+  attribute: "engine",
+  means: {
+    postgres: "postgresql",
+    "aurora-postgresql": "postgresql",
+    mysql: "mysql",
+    "aurora-mysql": "mysql",
+    mariadb: "mysql"
+  }
+};
+var CACHE_ENGINES = {
+  attribute: "engine",
+  means: { redis: "redis", valkey: "redis" },
+  whenUnset: "redis"
+};
+function sqlStore(resource) {
+  return {
+    resource,
+    providerVersions: CURRENT,
+    boundary: {
+      kind: "storage",
+      storageSystem: SQL_ENGINES,
+      declares: "store",
+      fieldSet: "none"
+    }
+  };
+}
 function awsTerraform() {
   return {
     name: "terraform-aws",
@@ -74,17 +109,9 @@ function awsTerraform() {
       {
         resource: "aws_elasticache_cluster",
         providerVersions: CURRENT,
-        // A cluster with no engine of its own joins a replication
-        // group, which always runs one of the two Redis-protocol
-        // engines, so an unset engine is read.
-        appliesWhen: {
-          attribute: "engine",
-          equals: ["redis", "valkey"],
-          whenUnset: "read"
-        },
         boundary: {
           kind: "storage",
-          storageSystem: "redis",
+          storageSystem: CACHE_ENGINES,
           // Code addresses key namespaces, which no attribute of a
           // cluster lists, so the cluster declares the store and
           // claims no access. The README says how the sides meet.
@@ -102,6 +129,8 @@ function awsTerraform() {
           fieldSet: "none"
         }
       },
+      sqlStore("aws_rds_cluster"),
+      sqlStore("aws_db_instance"),
       {
         resource: "aws_sqs_queue",
         providerVersions: CURRENT,
@@ -128,6 +157,98 @@ function awsTerraform() {
           messageBus: "eventbridge",
           nameAttribute: "name"
         }
+      },
+      {
+        resource: "aws_kinesis_stream",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "message-bus",
+          messageBus: "aws_kinesis",
+          nameAttribute: "name"
+        }
+      },
+      {
+        resource: "aws_kinesis_firehose_delivery_stream",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "message-bus",
+          messageBus: "aws_firehose",
+          nameAttribute: "name"
+        }
+      },
+      {
+        resource: "aws_cloudwatch_log_metric_filter",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "metric",
+          metricSystem: METRIC_SYSTEM,
+          // CloudWatch identifies a metric by its namespace and its
+          // name together, and an alarm spells both, so both are the
+          // identity the two sides share.
+          metricTypeTemplate: "{metric_transformation.namespace}/{metric_transformation.name}"
+        }
+      },
+      {
+        resource: "aws_cloudwatch_metric_alarm",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "metric-reading",
+          metricSystem: METRIC_SYSTEM,
+          // An alarm on a single metric is one reading, written in the
+          // resource itself rather than in a block.
+          readingBlocks: [],
+          identifies: {
+            from: "attributes",
+            template: "{namespace}/{metric_name}"
+          },
+          comparesTo: { attribute: "threshold", whenSet: "number" },
+          reducesTo: { attribute: "statistic", means: STATISTICS }
+        }
+      },
+      {
+        resource: "aws_lambda_function",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "deployable",
+          deploymentTarget: "lambda",
+          runtimeAttribute: "runtime",
+          env: [{ style: "map", attribute: "environment.variables" }],
+          // Lambda writes the module and the exported name into one
+          // string, split at the last dot.
+          code: {
+            handler: { attribute: "handler", spelling: "module.export" }
+          }
+        }
+      },
+      {
+        resource: "aws_ecs_task_definition",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "deployable",
+          deploymentTarget: "ecs-task",
+          // One task definition runs several containers, each starting
+          // with an environment of its own, and the JSON they are
+          // written in is read the same way a block would be.
+          containers: {
+            blocks: ["container_definitions"],
+            nameAttribute: "name"
+          },
+          env: [
+            {
+              style: "entries",
+              block: "environment",
+              nameAttribute: "name",
+              valueAttribute: "value"
+            },
+            {
+              style: "entries",
+              block: "secrets",
+              nameAttribute: "name",
+              secretAttribute: "valueFrom"
+            }
+          ],
+          code: { imageAttribute: "image" }
+        }
       }
     ]
   };

package/dist/index.js

@@ -1,5 +1,40 @@
 // src/index.ts
 var CURRENT = ">=4 <7";
+var METRIC_SYSTEM = "cloudwatch";
+var STATISTICS = {
+  SampleCount: "number",
+  Average: "number",
+  Sum: "number",
+  Minimum: "number",
+  Maximum: "number"
+};
+var SQL_ENGINES = {
+  attribute: "engine",
+  means: {
+    postgres: "postgresql",
+    "aurora-postgresql": "postgresql",
+    mysql: "mysql",
+    "aurora-mysql": "mysql",
+    mariadb: "mysql"
+  }
+};
+var CACHE_ENGINES = {
+  attribute: "engine",
+  means: { redis: "redis", valkey: "redis" },
+  whenUnset: "redis"
+};
+function sqlStore(resource) {
+  return {
+    resource,
+    providerVersions: CURRENT,
+    boundary: {
+      kind: "storage",
+      storageSystem: SQL_ENGINES,
+      declares: "store",
+      fieldSet: "none"
+    }
+  };
+}
 function awsTerraform() {
   return {
     name: "terraform-aws",
@@ -49,17 +84,9 @@ function awsTerraform() {
       {
         resource: "aws_elasticache_cluster",
         providerVersions: CURRENT,
-        // A cluster with no engine of its own joins a replication
-        // group, which always runs one of the two Redis-protocol
-        // engines, so an unset engine is read.
-        appliesWhen: {
-          attribute: "engine",
-          equals: ["redis", "valkey"],
-          whenUnset: "read"
-        },
         boundary: {
           kind: "storage",
-          storageSystem: "redis",
+          storageSystem: CACHE_ENGINES,
           // Code addresses key namespaces, which no attribute of a
           // cluster lists, so the cluster declares the store and
           // claims no access. The README says how the sides meet.
@@ -77,6 +104,8 @@ function awsTerraform() {
           fieldSet: "none"
         }
       },
+      sqlStore("aws_rds_cluster"),
+      sqlStore("aws_db_instance"),
       {
         resource: "aws_sqs_queue",
         providerVersions: CURRENT,
@@ -103,6 +132,98 @@ function awsTerraform() {
           messageBus: "eventbridge",
           nameAttribute: "name"
         }
+      },
+      {
+        resource: "aws_kinesis_stream",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "message-bus",
+          messageBus: "aws_kinesis",
+          nameAttribute: "name"
+        }
+      },
+      {
+        resource: "aws_kinesis_firehose_delivery_stream",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "message-bus",
+          messageBus: "aws_firehose",
+          nameAttribute: "name"
+        }
+      },
+      {
+        resource: "aws_cloudwatch_log_metric_filter",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "metric",
+          metricSystem: METRIC_SYSTEM,
+          // CloudWatch identifies a metric by its namespace and its
+          // name together, and an alarm spells both, so both are the
+          // identity the two sides share.
+          metricTypeTemplate: "{metric_transformation.namespace}/{metric_transformation.name}"
+        }
+      },
+      {
+        resource: "aws_cloudwatch_metric_alarm",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "metric-reading",
+          metricSystem: METRIC_SYSTEM,
+          // An alarm on a single metric is one reading, written in the
+          // resource itself rather than in a block.
+          readingBlocks: [],
+          identifies: {
+            from: "attributes",
+            template: "{namespace}/{metric_name}"
+          },
+          comparesTo: { attribute: "threshold", whenSet: "number" },
+          reducesTo: { attribute: "statistic", means: STATISTICS }
+        }
+      },
+      {
+        resource: "aws_lambda_function",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "deployable",
+          deploymentTarget: "lambda",
+          runtimeAttribute: "runtime",
+          env: [{ style: "map", attribute: "environment.variables" }],
+          // Lambda writes the module and the exported name into one
+          // string, split at the last dot.
+          code: {
+            handler: { attribute: "handler", spelling: "module.export" }
+          }
+        }
+      },
+      {
+        resource: "aws_ecs_task_definition",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "deployable",
+          deploymentTarget: "ecs-task",
+          // One task definition runs several containers, each starting
+          // with an environment of its own, and the JSON they are
+          // written in is read the same way a block would be.
+          containers: {
+            blocks: ["container_definitions"],
+            nameAttribute: "name"
+          },
+          env: [
+            {
+              style: "entries",
+              block: "environment",
+              nameAttribute: "name",
+              valueAttribute: "value"
+            },
+            {
+              style: "entries",
+              block: "secrets",
+              nameAttribute: "name",
+              secretAttribute: "valueFrom"
+            }
+          ],
+          code: { imageAttribute: "image" }
+        }
       }
     ]
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/terraform-aws",
-  "version": "0.31.2",
+  "version": "0.33.0",
   "type": "module",
   "description": "What the AWS Terraform provider declares, so suss can check your code against the infrastructure you deploy.",
   "keywords": [
@@ -46,7 +46,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@suss/contract-terraform": "0.31.2"
+    "@suss/contract-terraform": "0.33.0"
   },
   "devDependencies": {
     "@suss/behavioral-ir": "*",