@synapsestudios/lintofu 0.0.0-stage → 0.9.0

package/dist/project-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-index.js","sourceRoot":"","sources":["../src/project-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AA0C9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,MAAM,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,KAAmB;IACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiB,CAAC;IACjD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACtC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;oBACtB,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAiB;QAC1B,YAAY,CAAC,IAAI;YACf,OAAO,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,gBAAgB,CAAC,IAAI;YACnB,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,eAAe,CAAC,IAAI;YAClB,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAAyB;IACzD,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,0BAA0B,CACjC,IAAwB;IAExB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IACpC,IAAI,IAAI,EAAE,IAAI,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,IAAI,EAAE,IAAI,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/rules/aws/acm-certificate-create-before-destroy-required.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'missingCreateBeforeDestroy';
+}>;
+export default rule;
+//# sourceMappingURL=acm-certificate-create-before-destroy-required.d.ts.map

package/dist/rules/aws/acm-certificate-create-before-destroy-required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acm-certificate-create-before-destroy-required.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/acm-certificate-create-before-destroy-required.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,4BAA4B,CAAC;CAC1C,CAwDA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/acm-certificate-create-before-destroy-required.js

@@ -0,0 +1,47 @@
+import { findAttribute } from '../core/utils.js';
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Require `lifecycle { create_before_destroy = true }` on `aws_acm_certificate` so replacing an in-use certificate does not hang until timeout.',
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            missingCreateBeforeDestroy: 'Replacing an in-use `aws_acm_certificate` under the default destroy-before-create ordering hangs until timeout because ACM refuses to delete a certificate still attached to a resource. Set `lifecycle { create_before_destroy = true }`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_acm_certificate')
+                    return;
+                const lifecycle = node.body.blocks.find((b) => b.kind === 'lifecycle');
+                if (!lifecycle) {
+                    context.report({ node, messageId: 'missingCreateBeforeDestroy' });
+                    return;
+                }
+                const preventDestroy = findAttribute(lifecycle.body.attributes, 'prevent_destroy');
+                if (preventDestroy?.expression.type === 'LiteralValueExpr' &&
+                    preventDestroy.expression.value === true) {
+                    return;
+                }
+                const cbd = findAttribute(lifecycle.body.attributes, 'create_before_destroy');
+                if (!cbd) {
+                    context.report({ node, messageId: 'missingCreateBeforeDestroy' });
+                    return;
+                }
+                if (cbd.expression.type === 'LiteralValueExpr' &&
+                    cbd.expression.value === false) {
+                    context.report({ node, messageId: 'missingCreateBeforeDestroy' });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=acm-certificate-create-before-destroy-required.js.map

package/dist/rules/aws/acm-certificate-create-before-destroy-required.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acm-certificate-create-before-destroy-required.js","sourceRoot":"","sources":["../../../src/rules/aws/acm-certificate-create-before-destroy-required.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,IAAI,GAEL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,+IAA+I;YACjJ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,0BAA0B,EACxB,4OAA4O;SAC/O;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,qBAAqB;oBAAE,OAAO;gBAErD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;gBACvE,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBAED,MAAM,cAAc,GAAG,aAAa,CAClC,SAAS,CAAC,IAAI,CAAC,UAAU,EACzB,iBAAiB,CAClB,CAAC;gBACF,IACE,cAAc,EAAE,UAAU,CAAC,IAAI,KAAK,kBAAkB;oBACtD,cAAc,CAAC,UAAU,CAAC,KAAK,KAAK,IAAI,EACxC,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,MAAM,GAAG,GAAG,aAAa,CACvB,SAAS,CAAC,IAAI,CAAC,UAAU,EACzB,uBAAuB,CACxB,CAAC;gBACF,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;oBAClE,OAAO;gBACT,CAAC;gBACD,IACE,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,kBAAkB;oBAC1C,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,KAAK,EAC9B,CAAC;oBACD,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-api-gateway-deployment-stage-args.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'deploymentStageArg';
+}>;
+export default rule;
+//# sourceMappingURL=no-api-gateway-deployment-stage-args.d.ts.map

package/dist/rules/aws/no-api-gateway-deployment-stage-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-api-gateway-deployment-stage-args.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-api-gateway-deployment-stage-args.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAA;CAAE,CAyDtE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-api-gateway-deployment-stage-args.js

@@ -0,0 +1,56 @@
+import { findAttribute } from '../core/utils.js';
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flag `stage_name`, `stage_description`, and `canary_settings` on `aws_api_gateway_deployment`, removed in AWS provider v6; manage the stage with a separate `aws_api_gateway_stage` resource.',
+            recommended: true,
+            severity: 'error',
+            category: 'aws',
+            appliesTo: { aws: '>=6.0.0' },
+        },
+        messages: {
+            deploymentStageArg: 'The `{{name}}` argument on `aws_api_gateway_deployment` was removed in AWS provider v6. Manage the stage with a separate `aws_api_gateway_stage` resource.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_api_gateway_deployment')
+                    return;
+                for (const name of ['stage_name', 'stage_description']) {
+                    const attr = findAttribute(node.body.attributes, name);
+                    if (attr) {
+                        context.report({
+                            node: attr,
+                            messageId: 'deploymentStageArg',
+                            data: { name },
+                        });
+                    }
+                }
+                const canaryAttr = findAttribute(node.body.attributes, 'canary_settings');
+                if (canaryAttr) {
+                    context.report({
+                        node: canaryAttr,
+                        messageId: 'deploymentStageArg',
+                        data: { name: 'canary_settings' },
+                    });
+                }
+                for (const inner of node.body.blocks) {
+                    if (inner.kind === 'canary_settings') {
+                        context.report({
+                            node: inner,
+                            messageId: 'deploymentStageArg',
+                            data: { name: 'canary_settings' },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-api-gateway-deployment-stage-args.js.map

package/dist/rules/aws/no-api-gateway-deployment-stage-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-api-gateway-deployment-stage-args.js","sourceRoot":"","sources":["../../../src/rules/aws/no-api-gateway-deployment-stage-args.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,IAAI,GAAiE;IACzE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,+LAA+L;YACjM,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAC9B;QACD,QAAQ,EAAE;YACR,kBAAkB,EAChB,4JAA4J;SAC/J;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,4BAA4B;oBAAE,OAAO;gBAE5D,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,EAAE,CAAC;oBACvD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;oBACvD,IAAI,IAAI,EAAE,CAAC;wBACT,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,IAAI;4BACV,SAAS,EAAE,oBAAoB;4BAC/B,IAAI,EAAE,EAAE,IAAI,EAAE;yBACf,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,MAAM,UAAU,GAAG,aAAa,CAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,iBAAiB,CAClB,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,UAAU;wBAChB,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;qBAClC,CAAC,CAAC;gBACL,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBACrC,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,KAAK;4BACX,SAAS,EAAE,oBAAoB;4BAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;yBAClC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-aurora-pinned-minor-with-auto-upgrade.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'pinnedMinorWithAutoUpgrade';
+}>;
+export default rule;
+//# sourceMappingURL=no-aurora-pinned-minor-with-auto-upgrade.d.ts.map

package/dist/rules/aws/no-aurora-pinned-minor-with-auto-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-aurora-pinned-minor-with-auto-upgrade.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-aurora-pinned-minor-with-auto-upgrade.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAY7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,4BAA4B,CAAC;CAC1C,CAgDA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-aurora-pinned-minor-with-auto-upgrade.js

@@ -0,0 +1,88 @@
+import { findAttribute, literalStringValue, traversalHead, trimNumericVersion, } from '../core/utils.js';
+import { autoMinorUpgradeEnabled, engineName } from './utils.js';
+const CLUSTER_KIND = 'aws_rds_cluster';
+const INSTANCE_KIND = 'aws_rds_cluster_instance';
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag an Aurora PostgreSQL cluster that pins `engine_version` deeper than the auto minor upgrade enabled across its instances will hold stable, which drifts on every plan.',
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            pinnedMinorWithAutoUpgrade: '`engine_version` pins a minor version that `auto_minor_version_upgrade` on this cluster’s instances will move, so every plan drifts. Use `{{safeForm}}`, or set `auto_minor_version_upgrade = false` on an instance.',
+        },
+        schema: [],
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== CLUSTER_KIND)
+                    return;
+                if (engineName(node) !== 'aurora-postgresql')
+                    return;
+                const versionAttr = findAttribute(node.body.attributes, 'engine_version');
+                if (!versionAttr)
+                    return;
+                const version = literalStringValue(versionAttr.expression);
+                if (version === undefined)
+                    return;
+                const safeForm = trimNumericVersion(version, 1);
+                if (safeForm === undefined)
+                    return;
+                const instances = clusterInstancesFor(node, sourceCode);
+                if (instances.length === 0)
+                    return;
+                // Aurora only auto-upgrades when every instance opts in, so the pin is
+                // safe the moment any instance turns it off.
+                if (!instances.every(autoMinorUpgradeEnabled))
+                    return;
+                context.report({
+                    node: versionAttr,
+                    messageId: 'pinnedMinorWithAutoUpgrade',
+                    data: { safeForm },
+                });
+            },
+        };
+    },
+};
+export default rule;
+function clusterInstancesFor(cluster, sourceCode) {
+    const out = [];
+    const seen = new Set();
+    const collect = (blocks) => {
+        for (const block of blocks) {
+            if (!isInstanceOf(block, cluster))
+                continue;
+            const key = block.labels.join('.');
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push(block);
+        }
+    };
+    // In-source blocks win over the on-disk index copy of the same resource: the
+    // file being linted is authoritative when it differs from what's on disk.
+    collect(sourceCode.ast.blocks);
+    collect(sourceCode.parserServices.projectIndex.resourcesByType(INSTANCE_KIND));
+    return out;
+}
+function isInstanceOf(block, cluster) {
+    if (block.kind !== 'resource')
+        return false;
+    if (block.labels[0] !== INSTANCE_KIND)
+        return false;
+    const attr = findAttribute(block.body.attributes, 'cluster_identifier');
+    if (attr?.expression.type !== 'ScopeTraversalExpr')
+        return false;
+    const head = traversalHead(attr.expression);
+    if (!head)
+        return false;
+    return head[0] === cluster.labels[0] && head[1] === cluster.labels[1];
+}
+//# sourceMappingURL=no-aurora-pinned-minor-with-auto-upgrade.js.map

package/dist/rules/aws/no-aurora-pinned-minor-with-auto-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-aurora-pinned-minor-with-auto-upgrade.js","sourceRoot":"","sources":["../../../src/rules/aws/no-aurora-pinned-minor-with-auto-upgrade.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,YAAY,GAAG,iBAAiB,CAAC;AACvC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,MAAM,IAAI,GAEL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,4KAA4K;YAC9K,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,0BAA0B,EACxB,sNAAsN;SACzN;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY;oBAAE,OAAO;gBAC5C,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,mBAAmB;oBAAE,OAAO;gBAErD,MAAM,WAAW,GAAG,aAAa,CAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,gBAAgB,CACjB,CAAC;gBACF,IAAI,CAAC,WAAW;oBAAE,OAAO;gBACzB,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;gBAC3D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO;gBAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAChD,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO;gBAEnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBACnC,uEAAuE;gBACvE,6CAA6C;gBAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uBAAuB,CAAC;oBAAE,OAAO;gBAEtD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,4BAA4B;oBACvC,IAAI,EAAE,EAAE,QAAQ,EAAE;iBACnB,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC;AAEpB,SAAS,mBAAmB,CAC1B,OAAc,EACd,UAA8B;IAE9B,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,MAAwB,EAAE,EAAE;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC;gBAAE,SAAS;YAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,CACL,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,eAAe,CAAC,aAAa,CAAC,CACtE,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAY,EAAE,OAAc;IAChD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IACxE,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/rules/aws/no-db-instance-name-attribute.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'dbInstanceName';
+}>;
+export default rule;
+//# sourceMappingURL=no-db-instance-name-attribute.d.ts.map

package/dist/rules/aws/no-db-instance-name-attribute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-db-instance-name-attribute.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-db-instance-name-attribute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,gBAAgB,CAAA;CAAE,CA0ClE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-db-instance-name-attribute.js

@@ -0,0 +1,45 @@
+import { findAttribute } from '../core/utils.js';
+const rule = {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description: 'Flag the top-level `name` argument on `aws_db_instance`, removed in AWS provider v5. Use `db_name` with the same value.',
+            recommended: true,
+            severity: 'error',
+            category: 'aws',
+            appliesTo: { aws: '>=5.0.0' },
+        },
+        messages: {
+            dbInstanceName: 'The top-level `name` argument on `aws_db_instance` was removed in AWS provider v5. Use `db_name` with the same value.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_db_instance')
+                    return;
+                const nameAttr = findAttribute(node.body.attributes, 'name');
+                if (!nameAttr)
+                    return;
+                context.report({
+                    node: nameAttr,
+                    messageId: 'dbInstanceName',
+                    fix: (fixer) => {
+                        // Renaming to db_name is safe for any value type, but only when the
+                        // block does not already declare db_name; otherwise the rename would
+                        // emit a duplicate argument, which is invalid HCL.
+                        if (findAttribute(node.body.attributes, 'db_name'))
+                            return null;
+                        return fixer.replaceText(nameAttr, `db_name = ${context.sourceCode.getText(nameAttr.expression)}`);
+                    },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-db-instance-name-attribute.js.map

package/dist/rules/aws/no-db-instance-name-attribute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-db-instance-name-attribute.js","sourceRoot":"","sources":["../../../src/rules/aws/no-db-instance-name-attribute.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,IAAI,GAA6D;IACrE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,WAAW,EACT,yHAAyH;YAC3H,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAC9B;QACD,QAAQ,EAAE;YACR,cAAc,EACZ,uHAAuH;SAC1H;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,iBAAiB;oBAAE,OAAO;gBACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,gBAAgB;oBAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;wBACb,oEAAoE;wBACpE,qEAAqE;wBACrE,mDAAmD;wBACnD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC;4BAAE,OAAO,IAAI,CAAC;wBAChE,OAAO,KAAK,CAAC,WAAW,CACtB,QAAQ,EACR,aAAa,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAC/D,CAAC;oBACJ,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-deprecated-lambda-runtime.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'deprecatedRuntime';
+}>;
+export default rule;
+//# sourceMappingURL=no-deprecated-lambda-runtime.d.ts.map

package/dist/rules/aws/no-deprecated-lambda-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-deprecated-lambda-runtime.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-deprecated-lambda-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAkC7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,mBAAmB,CAAA;CAAE,CAyDrE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-deprecated-lambda-runtime.js

@@ -0,0 +1,91 @@
+import { findAttribute, literalStringValue } from '../core/utils.js';
+const DEPRECATED = {
+    'nodejs4.3': 'nodejs22.x',
+    'nodejs4.3-edge': 'nodejs22.x',
+    'nodejs6.10': 'nodejs22.x',
+    'nodejs8.10': 'nodejs22.x',
+    'nodejs10.x': 'nodejs22.x',
+    'nodejs12.x': 'nodejs22.x',
+    'nodejs14.x': 'nodejs22.x',
+    'nodejs16.x': 'nodejs22.x',
+    'nodejs18.x': 'nodejs22.x',
+    'nodejs20.x': 'nodejs22.x',
+    'python2.7': 'python3.13',
+    'python3.6': 'python3.13',
+    'python3.7': 'python3.13',
+    'python3.8': 'python3.13',
+    'python3.9': 'python3.13',
+    'ruby2.5': 'ruby3.3',
+    'ruby2.7': 'ruby3.3',
+    'ruby3.2': 'ruby3.3',
+    java8: 'java21',
+    'go1.x': 'provided.al2023',
+    'dotnetcore1.0': 'dotnet8',
+    'dotnetcore2.0': 'dotnet8',
+    'dotnetcore2.1': 'dotnet8',
+    'dotnetcore3.1': 'dotnet8',
+    'dotnet5.0': 'dotnet8',
+    dotnet6: 'dotnet8',
+    dotnet7: 'dotnet8',
+    provided: 'provided.al2023',
+};
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag AWS-deprecated Lambda runtime identifiers on `aws_lambda_function` and `aws_lambda_layer_version` and name the nearest supported successor.',
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            deprecatedRuntime: 'The Lambda runtime `{{runtime}}` is deprecated by AWS. Use `{{successor}}` or a later supported runtime.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] === 'aws_lambda_function') {
+                    const attr = findAttribute(node.body.attributes, 'runtime');
+                    if (!attr)
+                        return;
+                    const value = literalStringValue(attr.expression);
+                    if (value === undefined)
+                        return;
+                    const successor = DEPRECATED[value];
+                    if (successor === undefined)
+                        return;
+                    context.report({
+                        node: attr,
+                        messageId: 'deprecatedRuntime',
+                        data: { runtime: value, successor },
+                    });
+                    return;
+                }
+                if (node.labels[0] === 'aws_lambda_layer_version') {
+                    const attr = findAttribute(node.body.attributes, 'compatible_runtimes');
+                    if (attr?.expression.type !== 'TupleConsExpr')
+                        return;
+                    for (const element of attr.expression.exprs) {
+                        const value = literalStringValue(element);
+                        if (value === undefined)
+                            continue;
+                        const successor = DEPRECATED[value];
+                        if (successor === undefined)
+                            continue;
+                        context.report({
+                            node: element,
+                            messageId: 'deprecatedRuntime',
+                            data: { runtime: value, successor },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-deprecated-lambda-runtime.js.map

package/dist/rules/aws/no-deprecated-lambda-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-deprecated-lambda-runtime.js","sourceRoot":"","sources":["../../../src/rules/aws/no-deprecated-lambda-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,UAAU,GAA2B;IACzC,WAAW,EAAE,YAAY;IACzB,gBAAgB,EAAE,YAAY;IAC9B,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,YAAY;IACzB,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,iBAAiB;IAC1B,eAAe,EAAE,SAAS;IAC1B,eAAe,EAAE,SAAS;IAC1B,eAAe,EAAE,SAAS;IAC1B,eAAe,EAAE,SAAS;IAC1B,WAAW,EAAE,SAAS;IACtB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,iBAAiB;CAC5B,CAAC;AAEF,MAAM,IAAI,GAAgE;IACxE,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,kJAAkJ;YACpJ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,iBAAiB,EACf,0GAA0G;SAC7G;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBAErC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,qBAAqB,EAAE,CAAC;oBAC7C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;oBAC5D,IAAI,CAAC,IAAI;wBAAE,OAAO;oBAClB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAClD,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO;oBAChC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;oBACpC,IAAI,SAAS,KAAK,SAAS;wBAAE,OAAO;oBACpC,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,IAAI;wBACV,SAAS,EAAE,mBAAmB;wBAC9B,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE;qBACpC,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBAED,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,0BAA0B,EAAE,CAAC;oBAClD,MAAM,IAAI,GAAG,aAAa,CACxB,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,qBAAqB,CACtB,CAAC;oBACF,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,KAAK,eAAe;wBAAE,OAAO;oBACtD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;wBAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;wBAC1C,IAAI,KAAK,KAAK,SAAS;4BAAE,SAAS;wBAClC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;wBACpC,IAAI,SAAS,KAAK,SAAS;4BAAE,SAAS;wBACtC,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,OAAO;4BACb,SAAS,EAAE,mBAAmB;4BAC9B,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE;yBACpC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-eip-vpc-attribute.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'eipVpcAttribute';
+}>;
+export default rule;
+//# sourceMappingURL=no-eip-vpc-attribute.d.ts.map

package/dist/rules/aws/no-eip-vpc-attribute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-eip-vpc-attribute.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-eip-vpc-attribute.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAmB7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,iBAAiB,CAAA;CAAE,CA8CnE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-eip-vpc-attribute.js

@@ -0,0 +1,66 @@
+import { findAttribute } from '../core/utils.js';
+function removalRange(source, attr) {
+    let start = attr.range.start.offset;
+    let end = attr.range.end.offset;
+    while (start > 0 && (source[start - 1] === ' ' || source[start - 1] === '\t'))
+        start--;
+    while (source[end] === ' ' || source[end] === '\t')
+        end++;
+    const next = source[end];
+    if (next === '\r' && source[end + 1] === '\n')
+        return [start, end + 2];
+    if (next === '\n')
+        return [start, end + 1];
+    if (next === undefined || next === '}')
+        return [start, end];
+    return undefined;
+}
+const rule = {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description: 'Flag the `vpc` argument on `aws_eip`, removed in AWS provider v6. Use `domain = "vpc"` (or omit `domain`).',
+            recommended: true,
+            severity: 'error',
+            category: 'aws',
+            appliesTo: { aws: '>=6.0.0' },
+        },
+        messages: {
+            eipVpcAttribute: 'The `vpc` argument was removed from `aws_eip` in AWS provider v6 and fails validate and plan. Set `domain = "vpc"` (or omit `domain`) instead.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_eip')
+                    return;
+                const vpcAttr = findAttribute(node.body.attributes, 'vpc');
+                if (!vpcAttr)
+                    return;
+                context.report({
+                    node: vpcAttr,
+                    messageId: 'eipVpcAttribute',
+                    fix: (fixer) => {
+                        const expr = vpcAttr.expression;
+                        if (expr.type !== 'LiteralValueExpr' ||
+                            typeof expr.value !== 'boolean')
+                            return null;
+                        if (expr.value) {
+                            if (findAttribute(node.body.attributes, 'domain'))
+                                return null;
+                            return fixer.replaceText(vpcAttr, 'domain = "vpc"');
+                        }
+                        const range = removalRange(context.sourceCode.getText(), vpcAttr);
+                        return range ? fixer.replaceTextRange(range, '') : null;
+                    },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-eip-vpc-attribute.js.map

package/dist/rules/aws/no-eip-vpc-attribute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-eip-vpc-attribute.js","sourceRoot":"","sources":["../../../src/rules/aws/no-eip-vpc-attribute.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,SAAS,YAAY,CACnB,MAAc,EACd,IAAe;IAEf,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;IACpC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IAChC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;QAC3E,KAAK,EAAE,CAAC;IACV,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,GAAG,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,IAAI,GAA8D;IACtE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,WAAW,EACT,4GAA4G;YAC9G,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAC9B;QACD,QAAQ,EAAE;YACR,eAAe,EACb,gJAAgJ;SACnJ;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;oBAAE,OAAO;gBACzC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAC3D,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,OAAO;oBACb,SAAS,EAAE,iBAAiB;oBAC5B,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;wBACb,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC;wBAChC,IACE,IAAI,CAAC,IAAI,KAAK,kBAAkB;4BAChC,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS;4BAE/B,OAAO,IAAI,CAAC;wBACd,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BACf,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;gCAAE,OAAO,IAAI,CAAC;4BAC/D,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;wBACtD,CAAC;wBACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;wBAClE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC1D,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-eks-addon-resolve-conflicts.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'resolveConflicts';
+}>;
+export default rule;
+//# sourceMappingURL=no-eks-addon-resolve-conflicts.d.ts.map

package/dist/rules/aws/no-eks-addon-resolve-conflicts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-eks-addon-resolve-conflicts.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-eks-addon-resolve-conflicts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,kBAAkB,CAAA;CAAE,CA+BpE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-eks-addon-resolve-conflicts.js

@@ -0,0 +1,36 @@
+import { findAttribute } from '../core/utils.js';
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flag the `resolve_conflicts` argument on `aws_eks_addon`, removed in AWS provider v6. Use `resolve_conflicts_on_create` and `resolve_conflicts_on_update`.',
+            recommended: true,
+            severity: 'error',
+            category: 'aws',
+            appliesTo: { aws: '>=6.0.0' },
+        },
+        messages: {
+            resolveConflicts: 'The `resolve_conflicts` argument on `aws_eks_addon` was removed in AWS provider v6. Replace it with `resolve_conflicts_on_create` and `resolve_conflicts_on_update`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_eks_addon')
+                    return;
+                const attr = findAttribute(node.body.attributes, 'resolve_conflicts');
+                if (!attr)
+                    return;
+                context.report({
+                    node: attr,
+                    messageId: 'resolveConflicts',
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-eks-addon-resolve-conflicts.js.map

package/dist/rules/aws/no-eks-addon-resolve-conflicts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-eks-addon-resolve-conflicts.js","sourceRoot":"","sources":["../../../src/rules/aws/no-eks-addon-resolve-conflicts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,IAAI,GAA+D;IACvE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,4JAA4J;YAC9J,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAC9B;QACD,QAAQ,EAAE;YACR,gBAAgB,EACd,sKAAsK;SACzK;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;oBAAE,OAAO;gBAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;gBACtE,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,kBAAkB;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-hardcoded-provider-credentials.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'hardcodedCredential';
+}>;
+export default rule;
+//# sourceMappingURL=no-hardcoded-provider-credentials.d.ts.map

package/dist/rules/aws/no-hardcoded-provider-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hardcoded-provider-credentials.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-hardcoded-provider-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAK7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAA;CAAE,CAsCvE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-hardcoded-provider-credentials.js

@@ -0,0 +1,42 @@
+import { findAttribute, literalStringValue } from '../core/utils.js';
+const CREDENTIAL_ATTRIBUTES = ['access_key', 'secret_key', 'token'];
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flag literal `access_key`, `secret_key`, or `token` values in `provider "aws"` and s3 `backend` blocks, which leak credentials into source control.',
+            recommended: true,
+            severity: 'error',
+            category: 'aws',
+        },
+        messages: {
+            hardcodedCredential: 'Hard-coded `{{attr}}` in this block leaks the credential into source control and its git history. Supply it from the environment, a shared profile, `assume_role`, or CI OIDC federation instead.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                const isAwsProvider = node.kind === 'provider' && node.labels[0] === 'aws';
+                const isS3Backend = node.kind === 'backend' && node.labels[0] === 's3';
+                if (!isAwsProvider && !isS3Backend)
+                    return;
+                for (const name of CREDENTIAL_ATTRIBUTES) {
+                    const attr = findAttribute(node.body.attributes, name);
+                    if (!attr)
+                        continue;
+                    const value = literalStringValue(attr.expression);
+                    if (value === undefined || value.length === 0)
+                        continue;
+                    context.report({
+                        node: attr,
+                        messageId: 'hardcodedCredential',
+                        data: { attr: name },
+                    });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-hardcoded-provider-credentials.js.map

package/dist/rules/aws/no-hardcoded-provider-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hardcoded-provider-credentials.js","sourceRoot":"","sources":["../../../src/rules/aws/no-hardcoded-provider-credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAEpE,MAAM,IAAI,GAAkE;IAC1E,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,qJAAqJ;YACvJ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,mBAAmB,EACjB,mMAAmM;SACtM;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,MAAM,aAAa,GACjB,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;gBACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;gBACvE,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW;oBAAE,OAAO;gBAE3C,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;oBACzC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;oBACvD,IAAI,CAAC,IAAI;wBAAE,SAAS;oBACpB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBACxD,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,IAAI;wBACV,SAAS,EAAE,qBAAqB;wBAChC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}