@suss/terraform-aws 0.9.0 → 0.10.0

package/README.md

@@ -21,12 +21,20 @@ terraformFileToSummaries("infra/terraform/dynamodb", { packs: [awsTerraform()] }
 | --- | --- |
 | `aws_dynamodb_table` | a store, keyed by `hash_key` and `range_key`, with each `global_secondary_index` and `local_secondary_index` as its own way in |
 | `aws_s3_bucket` | a store whose objects have no fields to compare against |
+| `aws_elasticache_cluster` | a Redis store, when `engine` is `redis` or `valkey`; a Memcached cluster is skipped |
+| `aws_elasticache_replication_group` | a Redis store |
 | `aws_sqs_queue` | a channel |
 | `aws_sns_topic` | a channel |
 | `aws_cloudwatch_event_bus` | a channel |
 
 Everything else a configuration declares, a security group, a subnet, an IAM policy, is how the deployment is wired rather than something a caller addresses, so nothing reads it.
 
+## Why a Redis cluster pairs with nothing
+
+Code addresses Redis by key namespace: `@suss/framework-redis` reads `session:{id}` and records the container `session`. A cluster declares no namespaces; its `cluster_id` is a deployment name, and code never spells it. The two sides share no name either can state, so the entry says so: the summary declares the store exists, with no container name, and the storage check claims no access for it. A pair between a cluster called `session` and the `session` namespace would be a coincidence between a deployment name and a key prefix, so the entry refuses it rather than reporting it.
+
+What you get from the entry is visibility: `suss contract --from terraform` shows the cluster, and `suss check` reports it as a declared store nothing paired with. Namespace-level pairing stays between the code's own readers and writers of the same keys.
+
 ## Why every entry states a version range
 
 The provider moves things between releases. Version 4 split a bucket's settings into resources of their own, so `aws_s3_bucket_server_side_encryption_configuration` is a separate resource in a v4 configuration and an inline block in a v3 one. An entry that describes the v4 shape says so, and a configuration pinned to v3 is read by the entries written for v3 and by none of the others.

package/dist/index.cjs

@@ -71,6 +71,37 @@ function awsTerraform() {
           fieldSet: "none"
         }
       },
+      {
+        resource: "aws_elasticache_cluster",
+        providerVersions: CURRENT,
+        // A cluster with no engine of its own joins a replication
+        // group, which always runs one of the two Redis-protocol
+        // engines, so an unset engine is read.
+        appliesWhen: {
+          attribute: "engine",
+          equals: ["redis", "valkey"],
+          whenUnset: "read"
+        },
+        boundary: {
+          kind: "storage",
+          storageSystem: "redis",
+          // Code addresses key namespaces, which no attribute of a
+          // cluster lists, so the cluster declares the store and
+          // claims no access. The README says how the sides meet.
+          declares: "store",
+          fieldSet: "none"
+        }
+      },
+      {
+        resource: "aws_elasticache_replication_group",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "storage",
+          storageSystem: "redis",
+          declares: "store",
+          fieldSet: "none"
+        }
+      },
       {
         resource: "aws_sqs_queue",
         providerVersions: CURRENT,

package/dist/index.js

@@ -46,6 +46,37 @@ function awsTerraform() {
           fieldSet: "none"
         }
       },
+      {
+        resource: "aws_elasticache_cluster",
+        providerVersions: CURRENT,
+        // A cluster with no engine of its own joins a replication
+        // group, which always runs one of the two Redis-protocol
+        // engines, so an unset engine is read.
+        appliesWhen: {
+          attribute: "engine",
+          equals: ["redis", "valkey"],
+          whenUnset: "read"
+        },
+        boundary: {
+          kind: "storage",
+          storageSystem: "redis",
+          // Code addresses key namespaces, which no attribute of a
+          // cluster lists, so the cluster declares the store and
+          // claims no access. The README says how the sides meet.
+          declares: "store",
+          fieldSet: "none"
+        }
+      },
+      {
+        resource: "aws_elasticache_replication_group",
+        providerVersions: CURRENT,
+        boundary: {
+          kind: "storage",
+          storageSystem: "redis",
+          declares: "store",
+          fieldSet: "none"
+        }
+      },
       {
         resource: "aws_sqs_queue",
         providerVersions: CURRENT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/terraform-aws",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "description": "What AWS's Terraform provider declares, for the Terraform contract reader.",
   "keywords": [
@@ -44,7 +44,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@suss/contract-terraform": "0.9.0"
+    "@suss/contract-terraform": "0.10.0"
   },
   "devDependencies": {
     "@suss/behavioral-ir": "*",