@synapsestudios/lintofu 0.0.0-stage → 0.9.0

package/dist/rules/aws/no-iam-policy-attachment.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'iamPolicyAttachment';
+}>;
+export default rule;
+//# sourceMappingURL=no-iam-policy-attachment.d.ts.map

package/dist/rules/aws/no-iam-policy-attachment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-iam-policy-attachment.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-iam-policy-attachment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAA;CAAE,CAyBvE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-iam-policy-attachment.js

@@ -0,0 +1,28 @@
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: "Flag `aws_iam_policy_attachment`, which manages a managed policy's attachments exclusively account-wide; prefer the non-exclusive per-principal attachment resources or the `*_policy_attachments_exclusive` resources.",
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            iamPolicyAttachment: "`aws_iam_policy_attachment` manages a policy's attachments exclusively across the whole AWS account and detaches any principal it does not list. Prefer the non-exclusive `aws_iam_role_policy_attachment` / `aws_iam_user_policy_attachment` / `aws_iam_group_policy_attachment`; when exclusive management is intended, use `aws_iam_role_policy_attachments_exclusive` (or the `_user_` / `_group_` counterparts) to scope exclusivity per principal. See https://api.opentofu.org/registry/docs/providers/opentofu/aws/v6.42.0/resources/iam_policy_attachment.md",
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_iam_policy_attachment')
+                    return;
+                context.report({ node, messageId: 'iamPolicyAttachment' });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-iam-policy-attachment.js.map

package/dist/rules/aws/no-iam-policy-attachment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-iam-policy-attachment.js","sourceRoot":"","sources":["../../../src/rules/aws/no-iam-policy-attachment.ts"],"names":[],"mappings":"AAEA,MAAM,IAAI,GAAkE;IAC1E,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,yNAAyN;YAC3N,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,mBAAmB,EACjB,uiBAAuiB;SAC1iB;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,2BAA2B;oBAAE,OAAO;gBAC3D,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC7D,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-iam-role-inline-policies.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'inlinePolicy' | 'managedPolicyArns';
+}>;
+export default rule;
+//# sourceMappingURL=no-iam-role-inline-policies.d.ts.map

package/dist/rules/aws/no-iam-role-inline-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-iam-role-inline-policies.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-iam-role-inline-policies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAQ7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,cAAc,GAAG,mBAAmB,CAAC;CAClD,CAwCA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-iam-role-inline-policies.js

@@ -0,0 +1,43 @@
+import { findAttribute } from '../core/utils.js';
+function isInlinePolicyBlock(block) {
+    if (block.kind === 'inline_policy')
+        return true;
+    return block.kind === 'dynamic' && block.labels[0] === 'inline_policy';
+}
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flag deprecated inline `inline_policy` blocks and the `managed_policy_arns` argument on `aws_iam_role`; prefer standalone `aws_iam_role_policy` / `aws_iam_role_policy_attachment` resources.',
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            inlinePolicy: 'Inline `inline_policy` on `aws_iam_role` makes the role claim exclusive ownership of its inline policies and silently detaches any managed out of band. Use standalone `aws_iam_role_policy`, or `aws_iam_role_policies_exclusive` for intentional exclusive management.',
+            managedPolicyArns: '`managed_policy_arns` on `aws_iam_role` makes the role claim exclusive ownership of its managed-policy attachments (an empty list detaches all of them). Use standalone `aws_iam_role_policy_attachment`, or `aws_iam_role_policy_attachments_exclusive` for intentional exclusive management.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_iam_role')
+                    return;
+                for (const inner of node.body.blocks) {
+                    if (isInlinePolicyBlock(inner)) {
+                        context.report({ node: inner, messageId: 'inlinePolicy' });
+                    }
+                }
+                const managed = findAttribute(node.body.attributes, 'managed_policy_arns');
+                if (managed) {
+                    context.report({ node: managed, messageId: 'managedPolicyArns' });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-iam-role-inline-policies.js.map

package/dist/rules/aws/no-iam-role-inline-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-iam-role-inline-policies.js","sourceRoot":"","sources":["../../../src/rules/aws/no-iam-role-inline-policies.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,SAAS,mBAAmB,CAAC,KAAY;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC;AACzE,CAAC;AAED,MAAM,IAAI,GAEL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,+LAA+L;YACjM,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,YAAY,EACV,0QAA0Q;YAC5Q,iBAAiB,EACf,gSAAgS;SACnS;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,cAAc;oBAAE,OAAO;gBAE9C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC/B,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC7D,CAAC;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,aAAa,CAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,qBAAqB,CACtB,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-instance-cpu-count-attributes.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'cpuCountAttribute';
+}>;
+export default rule;
+//# sourceMappingURL=no-instance-cpu-count-attributes.d.ts.map

package/dist/rules/aws/no-instance-cpu-count-attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-instance-cpu-count-attributes.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-instance-cpu-count-attributes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA+C7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,mBAAmB,CAAA;CAAE,CAoFrE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-instance-cpu-count-attributes.js

@@ -0,0 +1,94 @@
+import { findAttribute } from '../core/utils.js';
+const ATTR_MAP = {
+    cpu_core_count: 'core_count',
+    cpu_threads_per_core: 'threads_per_core',
+};
+const OFFENDING_NAMES = Object.keys(ATTR_MAP);
+function lineStart(text, offset) {
+    let start = offset;
+    while (start > 0 && text[start - 1] !== '\n')
+        start--;
+    return start;
+}
+function lineIndent(text, offset) {
+    return text.slice(lineStart(text, offset), offset);
+}
+function fullLineRange(text, attr) {
+    let end = attr.expression.range.end.offset;
+    while (end < text.length && text[end] !== '\n')
+        end++;
+    if (end < text.length)
+        end++;
+    return [lineStart(text, attr.range.start.offset), end];
+}
+function buildCpuOptionsBlock(indent, offending, sourceCode) {
+    const inner = offending
+        .map((o) => `${indent}  ${ATTR_MAP[o.name]} = ${sourceCode.getText(o.attr.expression)}`)
+        .join('\n');
+    return `cpu_options {\n${inner}\n${indent}}`;
+}
+const rule = {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description: 'Flag `cpu_core_count` and `cpu_threads_per_core` on `aws_instance`, removed in AWS provider v6; move the values into a `cpu_options` block.',
+            recommended: true,
+            severity: 'error',
+            category: 'aws',
+            appliesTo: { aws: '>=6.0.0' },
+        },
+        messages: {
+            cpuCountAttribute: 'Remove `{{attribute}}` from `aws_instance`; it was removed in AWS provider v6. Set `{{replacement}}` inside a `cpu_options` block instead.',
+        },
+        schema: [],
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_instance')
+                    return;
+                const offending = OFFENDING_NAMES.map((name) => ({
+                    name,
+                    attr: findAttribute(node.body.attributes, name),
+                })).filter((o) => o.attr !== undefined);
+                if (offending.length === 0)
+                    return;
+                const anchor = offending.reduce((a, b) => b.attr.range.start.offset < a.attr.range.start.offset ? b : a);
+                const hasCpuOptions = node.body.blocks.some((b) => b.kind === 'cpu_options');
+                const allLiteral = offending.every((o) => o.attr.expression.type === 'LiteralValueExpr');
+                const fixable = allLiteral && !hasCpuOptions;
+                for (const o of offending) {
+                    context.report({
+                        node: o.attr,
+                        messageId: 'cpuCountAttribute',
+                        data: { attribute: o.name, replacement: ATTR_MAP[o.name] },
+                        // ESLint drops overlapping fixes, so the whole migration is emitted
+                        // once on the anchor and the other diagnostics carry none.
+                        fix: fixable && o === anchor
+                            ? (fixer) => {
+                                const text = sourceCode.getText();
+                                const indent = lineIndent(text, anchor.attr.range.start.offset);
+                                const block = buildCpuOptionsBlock(indent, offending, sourceCode);
+                                return [
+                                    fixer.replaceTextRange([
+                                        anchor.attr.range.start.offset,
+                                        anchor.attr.expression.range.end.offset,
+                                    ], block),
+                                    ...offending
+                                        .filter((other) => other !== anchor)
+                                        .map((other) => fixer.removeRange(fullLineRange(text, other.attr))),
+                                ];
+                            }
+                            : undefined,
+                    });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-instance-cpu-count-attributes.js.map

package/dist/rules/aws/no-instance-cpu-count-attributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-instance-cpu-count-attributes.js","sourceRoot":"","sources":["../../../src/rules/aws/no-instance-cpu-count-attributes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,QAAQ,GAAG;IACf,cAAc,EAAE,YAAY;IAC5B,oBAAoB,EAAE,kBAAkB;CAChC,CAAC;AAQX,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAoB,CAAC;AAEjE,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,OAAO,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,EAAE,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAe;IAClD,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IAC3C,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,GAAG,EAAE,CAAC;IACtD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM;QAAE,GAAG,EAAE,CAAC;IAC7B,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAc,EACd,SAA8B,EAC9B,UAA8B;IAE9B,MAAM,KAAK,GAAG,SAAS;SACpB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAC9E;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,kBAAkB,KAAK,KAAK,MAAM,GAAG,CAAC;AAC/C,CAAC;AAED,MAAM,IAAI,GAAgE;IACxE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,WAAW,EACT,6IAA6I;YAC/I,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAC9B;QACD,QAAQ,EAAE;YACR,iBAAiB,EACf,4IAA4I;SAC/I;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,cAAc;oBAAE,OAAO;gBAE9C,MAAM,SAAS,GAAe,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC3D,IAAI;oBACJ,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC;iBAChD,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;gBACvD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAEnC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;gBAEF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAChC,CAAC;gBACF,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,kBAAkB,CACrD,CAAC;gBACF,MAAM,OAAO,GAAG,UAAU,IAAI,CAAC,aAAa,CAAC;gBAE7C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,SAAS,EAAE,mBAAmB;wBAC9B,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;wBAC1D,oEAAoE;wBACpE,2DAA2D;wBAC3D,GAAG,EACD,OAAO,IAAI,CAAC,KAAK,MAAM;4BACrB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE;gCACR,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;gCAClC,MAAM,MAAM,GAAG,UAAU,CACvB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAC/B,CAAC;gCACF,MAAM,KAAK,GAAG,oBAAoB,CAChC,MAAM,EACN,SAAS,EACT,UAAU,CACX,CAAC;gCACF,OAAO;oCACL,KAAK,CAAC,gBAAgB,CACpB;wCACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;wCAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM;qCACxC,EACD,KAAK,CACN;oCACD,GAAG,SAAS;yCACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;yCACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CACnD;iCACJ,CAAC;4BACJ,CAAC;4BACH,CAAC,CAAC,SAAS;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-legacy-security-group-rules.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'legacySecurityGroupRule';
+}>;
+export default rule;
+//# sourceMappingURL=no-legacy-security-group-rules.d.ts.map

package/dist/rules/aws/no-legacy-security-group-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-legacy-security-group-rules.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-legacy-security-group-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,yBAAyB,CAAC;CACvC,CAqCA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-legacy-security-group-rules.js

@@ -0,0 +1,39 @@
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flag legacy `aws_security_group_rule` resources and inline `ingress`/`egress` blocks; prefer `aws_vpc_security_group_{ingress,egress}_rule`.',
+            recommended: true,
+            severity: 'error',
+            category: 'aws',
+        },
+        messages: {
+            legacySecurityGroupRule: 'Use `aws_vpc_security_group_ingress_rule` / `aws_vpc_security_group_egress_rule` instead. The legacy form is deprecated by the provider; see https://api.opentofu.org/registry/docs/providers/opentofu/aws/v6.42.0/resources/security_group_rule.md',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] === 'aws_security_group_rule') {
+                    context.report({ node, messageId: 'legacySecurityGroupRule' });
+                    return;
+                }
+                if (node.labels[0] === 'aws_security_group') {
+                    for (const inner of node.body.blocks) {
+                        if (inner.kind === 'ingress' || inner.kind === 'egress') {
+                            context.report({
+                                node: inner,
+                                messageId: 'legacySecurityGroupRule',
+                            });
+                        }
+                    }
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-legacy-security-group-rules.js.map

package/dist/rules/aws/no-legacy-security-group-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-legacy-security-group-rules.js","sourceRoot":"","sources":["../../../src/rules/aws/no-legacy-security-group-rules.ts"],"names":[],"mappings":"AAEA,MAAM,IAAI,GAEL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,8IAA8I;YAChJ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,uBAAuB,EACrB,qPAAqP;SACxP;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,yBAAyB,EAAE,CAAC;oBACjD,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,EAAE,CAAC;oBAC5C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACrC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BACxD,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,KAAK;gCACX,SAAS,EAAE,yBAAyB;6BACrC,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-mixed-security-group-rule-forms.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'mixedForms';
+}>;
+export default rule;
+//# sourceMappingURL=no-mixed-security-group-rule-forms.d.ts.map

package/dist/rules/aws/no-mixed-security-group-rule-forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-mixed-security-group-rule-forms.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-mixed-security-group-rule-forms.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAS7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,YAAY,CAAA;CAAE,CAuC9D,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-mixed-security-group-rule-forms.js

@@ -0,0 +1,63 @@
+import { findAttribute, traversalHead } from '../core/utils.js';
+const STANDALONE_RULE_KINDS = new Set([
+    'aws_vpc_security_group_ingress_rule',
+    'aws_vpc_security_group_egress_rule',
+    'aws_security_group_rule',
+]);
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Warn when a standalone security group rule targets an `aws_security_group` that also defines inline `ingress`/`egress` blocks, which causes drift.',
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            mixedForms: 'This rule is currently attached to a resource that defines either or both `ingress {}` or `egress {}` rule blocks, this will cause inconsistent state changes and appear as drift.',
+        },
+        schema: [],
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                const kindLabel = node.labels[0];
+                if (!kindLabel || !STANDALONE_RULE_KINDS.has(kindLabel))
+                    return;
+                const sgIdAttr = findAttribute(node.body.attributes, 'security_group_id');
+                if (!sgIdAttr)
+                    return;
+                if (sgIdAttr.expression.type !== 'ScopeTraversalExpr')
+                    return;
+                const target = resolveSecurityGroup(sourceCode, sgIdAttr.expression);
+                if (!target)
+                    return;
+                if (!hasInlineRuleBlocks(target))
+                    return;
+                context.report({ node, messageId: 'mixedForms' });
+            },
+        };
+    },
+};
+export default rule;
+function resolveSecurityGroup(sourceCode, expr) {
+    // In-source definitions take precedence over the on-disk project index:
+    // during linting the in-memory AST is authoritative for the current file.
+    const addr = traversalHead(expr);
+    if (addr) {
+        const inSource = findBlock(sourceCode.ast, 'resource', addr);
+        if (inSource)
+            return inSource;
+    }
+    return sourceCode.parserServices.projectIndex.resolveTraversal(expr);
+}
+function findBlock(body, kind, labels) {
+    return body.blocks.find((b) => b.kind === kind && b.labels[0] === labels[0] && b.labels[1] === labels[1]);
+}
+function hasInlineRuleBlocks(sg) {
+    return sg.body.blocks.some((b) => b.kind === 'ingress' || b.kind === 'egress');
+}
+//# sourceMappingURL=no-mixed-security-group-rule-forms.js.map

package/dist/rules/aws/no-mixed-security-group-rule-forms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-mixed-security-group-rule-forms.js","sourceRoot":"","sources":["../../../src/rules/aws/no-mixed-security-group-rule-forms.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEhE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,qCAAqC;IACrC,oCAAoC;IACpC,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,IAAI,GAAyD;IACjE,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,oJAAoJ;YACtJ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,UAAU,EACR,oLAAoL;SACvL;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,SAAS,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,OAAO;gBAEhE,MAAM,QAAQ,GAAG,aAAa,CAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,mBAAmB,CACpB,CAAC;gBACF,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,oBAAoB;oBAAE,OAAO;gBAE9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAEzC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;YACpD,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC;AAEpB,SAAS,oBAAoB,CAC3B,UAA8B,EAC9B,IAAwB;IAExB,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAChB,IAAU,EACV,IAAY,EACZ,MAAiC;IAEjC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,EAAS;IACpC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CACnD,CAAC;AACJ,CAAC"}

package/dist/rules/aws/no-pinned-minor-with-auto-upgrade.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'pinnedMinorWithAutoUpgrade';
+}>;
+export default rule;
+//# sourceMappingURL=no-pinned-minor-with-auto-upgrade.d.ts.map

package/dist/rules/aws/no-pinned-minor-with-auto-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-pinned-minor-with-auto-upgrade.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-pinned-minor-with-auto-upgrade.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAkC7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,4BAA4B,CAAC;CAC1C,CAoCA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-pinned-minor-with-auto-upgrade.js

@@ -0,0 +1,100 @@
+import { findAttribute, literalStringValue, trimNumericVersion, } from '../core/utils.js';
+import { autoMinorUpgradeEnabled, engineName } from './utils.js';
+const DB_INSTANCE_SAFE_DEPTH = {
+    postgres: 1,
+    mysql: 2,
+    mariadb: 2,
+    'db2-ae': 2,
+    'db2-se': 2,
+};
+const POSTGRES_INTEGER_MAJOR_FLOOR = 10;
+const ELASTICACHE_AUTO_UPGRADE_MAJOR = 6;
+const RESOURCE_HANDLERS = {
+    aws_db_instance: checkDbInstance,
+    aws_elasticache_cluster: checkElastiCache,
+    aws_elasticache_replication_group: checkElastiCache,
+};
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag AWS engine resources that pin `engine_version` deeper than an enabled `auto_minor_version_upgrade` will hold stable, which drifts on every plan.',
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            pinnedMinorWithAutoUpgrade: '`engine_version` pins a minor version that `auto_minor_version_upgrade` will move, so every plan drifts. Use `{{safeForm}}`, or set `auto_minor_version_upgrade = false`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                const kind = node.labels[0];
+                if (!kind)
+                    return;
+                const handler = RESOURCE_HANDLERS[kind];
+                if (!handler)
+                    return;
+                if (!autoMinorUpgradeEnabled(node))
+                    return;
+                const violation = handler(node);
+                if (!violation)
+                    return;
+                context.report({
+                    node: violation.node,
+                    messageId: 'pinnedMinorWithAutoUpgrade',
+                    data: { safeForm: violation.safeForm },
+                });
+            },
+        };
+    },
+};
+export default rule;
+function checkDbInstance(block) {
+    const engine = engineName(block);
+    if (engine === undefined)
+        return undefined;
+    const baseDepth = DB_INSTANCE_SAFE_DEPTH[engine];
+    if (baseDepth === undefined)
+        return undefined;
+    const versionAttr = findAttribute(block.body.attributes, 'engine_version');
+    if (!versionAttr)
+        return undefined;
+    const version = literalStringValue(versionAttr.expression);
+    if (version === undefined)
+        return undefined;
+    const major = version.split('.')[0] ?? '';
+    const depth = engine === 'postgres' &&
+        /^\d+$/.test(major) &&
+        Number(major) < POSTGRES_INTEGER_MAJOR_FLOOR
+        ? 2
+        : baseDepth;
+    const safeForm = trimNumericVersion(version, depth);
+    if (safeForm === undefined)
+        return undefined;
+    return { node: versionAttr, safeForm };
+}
+function checkElastiCache(block) {
+    const engine = engineName(block) ?? 'redis';
+    if (engine !== 'redis' && engine !== 'valkey')
+        return undefined;
+    const versionAttr = findAttribute(block.body.attributes, 'engine_version');
+    if (!versionAttr)
+        return undefined;
+    const version = literalStringValue(versionAttr.expression);
+    if (version === undefined)
+        return undefined;
+    const parts = version.split('.');
+    if (!/^\d+$/.test(parts[0] ?? ''))
+        return undefined;
+    if (Number(parts[0]) !== ELASTICACHE_AUTO_UPGRADE_MAJOR)
+        return undefined;
+    if (!/^\d+$/.test(parts[1] ?? ''))
+        return undefined;
+    return { node: versionAttr, safeForm: '6.x' };
+}
+//# sourceMappingURL=no-pinned-minor-with-auto-upgrade.js.map

package/dist/rules/aws/no-pinned-minor-with-auto-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-pinned-minor-with-auto-upgrade.js","sourceRoot":"","sources":["../../../src/rules/aws/no-pinned-minor-with-auto-upgrade.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAOjE,MAAM,sBAAsB,GAA2B;IACrD,QAAQ,EAAE,CAAC;IACX,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAExC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAEzC,MAAM,iBAAiB,GAGnB;IACF,eAAe,EAAE,eAAe;IAChC,uBAAuB,EAAE,gBAAgB;IACzC,iCAAiC,EAAE,gBAAgB;CACpD,CAAC;AAEF,MAAM,IAAI,GAEL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,uJAAuJ;YACzJ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,0BAA0B,EACxB,2KAA2K;SAC9K;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,SAAS;oBAAE,OAAO;gBACvB,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,SAAS,EAAE,4BAA4B;oBACvC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;iBACvC,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC;AAEpB,SAAS,eAAe,CAAC,KAAY;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAC3E,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GACT,MAAM,KAAK,UAAU;QACrB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,GAAG,4BAA4B;QAC1C,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAY;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;IAC5C,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhE,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAC3E,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,8BAA8B;QAAE,OAAO,SAAS,CAAC;IAC1E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC"}

package/dist/rules/aws/no-s3-bucket-inline-config.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'inlineConfig';
+}>;
+export default rule;
+//# sourceMappingURL=no-s3-bucket-inline-config.d.ts.map

package/dist/rules/aws/no-s3-bucket-inline-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-s3-bucket-inline-config.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-s3-bucket-inline-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAsB7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,cAAc,CAAA;CAAE,CA+ChE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-s3-bucket-inline-config.js

@@ -0,0 +1,67 @@
+const ATTRIBUTE_REPLACEMENTS = {
+    acl: 'aws_s3_bucket_acl',
+    policy: 'aws_s3_bucket_policy',
+    request_payer: 'aws_s3_bucket_request_payment_configuration',
+    acceleration_status: 'aws_s3_bucket_accelerate_configuration',
+};
+const BLOCK_REPLACEMENTS = {
+    grant: 'aws_s3_bucket_acl',
+    cors_rule: 'aws_s3_bucket_cors_configuration',
+    lifecycle_rule: 'aws_s3_bucket_lifecycle_configuration',
+    logging: 'aws_s3_bucket_logging',
+    object_lock_configuration: 'aws_s3_bucket_object_lock_configuration',
+    replication_configuration: 'aws_s3_bucket_replication_configuration',
+    server_side_encryption_configuration: 'aws_s3_bucket_server_side_encryption_configuration',
+    versioning: 'aws_s3_bucket_versioning',
+    website: 'aws_s3_bucket_website_configuration',
+};
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag deprecated inline configuration on `aws_s3_bucket`; use the dedicated standalone `aws_s3_bucket_*` resources instead.',
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            inlineConfig: 'The inline `{{name}}` configuration on `aws_s3_bucket` is deprecated; use the standalone `{{replacement}}` resource instead.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'aws_s3_bucket')
+                    return;
+                for (const attr of node.body.attributes) {
+                    const replacement = ATTRIBUTE_REPLACEMENTS[attr.name];
+                    if (replacement !== undefined) {
+                        context.report({
+                            node: attr,
+                            messageId: 'inlineConfig',
+                            data: { name: attr.name, replacement },
+                        });
+                    }
+                }
+                for (const inner of node.body.blocks) {
+                    const name = inner.kind === 'dynamic' ? inner.labels[0] : inner.kind;
+                    if (name === undefined)
+                        continue;
+                    const replacement = BLOCK_REPLACEMENTS[name];
+                    if (replacement !== undefined) {
+                        context.report({
+                            node: inner,
+                            messageId: 'inlineConfig',
+                            data: { name, replacement },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-s3-bucket-inline-config.js.map

package/dist/rules/aws/no-s3-bucket-inline-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-s3-bucket-inline-config.js","sourceRoot":"","sources":["../../../src/rules/aws/no-s3-bucket-inline-config.ts"],"names":[],"mappings":"AAEA,MAAM,sBAAsB,GAA2B;IACrD,GAAG,EAAE,mBAAmB;IACxB,MAAM,EAAE,sBAAsB;IAC9B,aAAa,EAAE,6CAA6C;IAC5D,mBAAmB,EAAE,wCAAwC;CAC9D,CAAC;AAEF,MAAM,kBAAkB,GAA2B;IACjD,KAAK,EAAE,mBAAmB;IAC1B,SAAS,EAAE,kCAAkC;IAC7C,cAAc,EAAE,uCAAuC;IACvD,OAAO,EAAE,uBAAuB;IAChC,yBAAyB,EAAE,yCAAyC;IACpE,yBAAyB,EAAE,yCAAyC;IACpE,oCAAoC,EAClC,oDAAoD;IACtD,UAAU,EAAE,0BAA0B;IACtC,OAAO,EAAE,qCAAqC;CAC/C,CAAC;AAEF,MAAM,IAAI,GAA2D;IACnE,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,4HAA4H;YAC9H,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,YAAY,EACV,8HAA8H;SACjI;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe;oBAAE,OAAO;gBAE/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxC,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACtD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;wBAC9B,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,IAAI;4BACV,SAAS,EAAE,cAAc;4BACzB,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE;yBACvC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;oBACrE,IAAI,IAAI,KAAK,SAAS;wBAAE,SAAS;oBACjC,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;oBAC7C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;wBAC9B,OAAO,CAAC,MAAM,CAAC;4BACb,IAAI,EAAE,KAAK;4BACX,SAAS,EAAE,cAAc;4BACzB,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;yBAC5B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-s3-bucket-object.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'deprecatedS3BucketObject';
+}>;
+export default rule;
+//# sourceMappingURL=no-s3-bucket-object.d.ts.map

package/dist/rules/aws/no-s3-bucket-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-s3-bucket-object.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/no-s3-bucket-object.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,0BAA0B,CAAA;CAAE,CA2C1E,CAAC;AAEJ,eAAe,IAAI,CAAC"}

package/dist/rules/aws/no-s3-bucket-object.js

@@ -0,0 +1,41 @@
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag the deprecated `aws_s3_bucket_object` resource and data source and the `aws_s3_bucket_objects` data source; use `aws_s3_object` and `aws_s3_objects` instead.',
+            recommended: true,
+            severity: 'warn',
+            category: 'aws',
+        },
+        messages: {
+            deprecatedS3BucketObject: 'The `{{type}}` type is a deprecated alias. Use `{{replacement}}` instead; migrating needs a manual import because renaming the type forces a destroy and recreate.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                const type = node.labels[0];
+                if (type === undefined)
+                    return;
+                let replacement;
+                if (type === 'aws_s3_bucket_object' &&
+                    (node.kind === 'resource' || node.kind === 'data')) {
+                    replacement = 'aws_s3_object';
+                }
+                else if (node.kind === 'data' && type === 'aws_s3_bucket_objects') {
+                    replacement = 'aws_s3_objects';
+                }
+                if (replacement === undefined)
+                    return;
+                context.report({
+                    node,
+                    messageId: 'deprecatedS3BucketObject',
+                    data: { type, replacement },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-s3-bucket-object.js.map

package/dist/rules/aws/no-s3-bucket-object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-s3-bucket-object.js","sourceRoot":"","sources":["../../../src/rules/aws/no-s3-bucket-object.ts"],"names":[],"mappings":"AAEA,MAAM,IAAI,GACR;IACE,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,oKAAoK;YACtK,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,QAAQ,EAAE;YACR,wBAAwB,EACtB,oKAAoK;SACvK;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO;gBAE/B,IAAI,WAA+B,CAAC;gBACpC,IACE,IAAI,KAAK,sBAAsB;oBAC/B,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,EAClD,CAAC;oBACD,WAAW,GAAG,eAAe,CAAC;gBAChC,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;oBACpE,WAAW,GAAG,gBAAgB,CAAC;gBACjC,CAAC;gBAED,IAAI,WAAW,KAAK,SAAS;oBAAE,OAAO;gBAEtC,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,0BAA0B;oBACrC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;iBAC5B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEJ,eAAe,IAAI,CAAC"}

package/dist/rules/aws/utils.d.ts

@@ -0,0 +1,4 @@
+import type { Block } from '../../parser/types.js';
+export declare function engineName(block: Block): string | undefined;
+export declare function autoMinorUpgradeEnabled(block: Block): boolean;
+//# sourceMappingURL=utils.d.ts.map

package/dist/rules/aws/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/rules/aws/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,wBAAgB,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAI3D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAS7D"}