cdk-insights 0.15.13 → 0.16.0

package/README.md

@@ -95,7 +95,7 @@ In CI mode, CDK Insights will:
 - Skip interactive prompts
 - Exit with code 1 on critical issues (with `--fail-on-critical`)
 
-👉 [Full CI/CD Setup Guide →](https://github.com/TheLeePriest/cdk-insights/blob/main/docs/ci-setup.md)
+👉 [Full CI/CD Setup Guide →](https://github.com/instancelabs/cdk-insights/blob/main/docs/ci-setup.md)
 
 ---
 
@@ -196,8 +196,8 @@ Configure detection in `.cdk-insights.json`:
 
 ## 📚 Links & Resources
 
-- [GitHub Repository & Issues](https://github.com/TheLeePriest/cdk-insights)
-- [Documentation](https://github.com/TheLeePriest/cdk-insights/tree/main/docs)
+- [GitHub Repository & Issues](https://github.com/instancelabs/cdk-insights)
+- [Documentation](https://github.com/instancelabs/cdk-insights/tree/main/docs)
 - [Pricing & Tiers](https://cdkinsights.dev/#pricing)
 - License: MIT
 

package/dist/analysis/templateLevel/__test__/integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/analysis/templateLevel/checks/crossResourceAntiPatterns/duplicateIamStatementsCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkDuplicateIamStatements: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/crossResourceAntiPatterns/dynamodbMissingPitrCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkDynamodbMissingPitr: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/crossResourceAntiPatterns/eventBridgeTargetsNoDlqCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkEventBridgeTargetsNoDlq: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/crossResourceAntiPatterns/lambdaMissingLogGroupCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkLambdaMissingLogGroup: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/crossResourceAntiPatterns/sharedDlqEventBridgeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkSharedDlqEventBridge: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/policyAnalysis/broadPrincipalPoliciesCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkBroadPrincipalPolicies: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/policyAnalysis/iamOverlappingPoliciesCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkIamOverlappingPolicies: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/policyAnalysis/sqsSnsPolicyRedundancyCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkSqsSnsPolicyRedundancy: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/cfnResourceCountCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkCfnResourceCount: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/cfnTemplateSizeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkCfnTemplateSize: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/eventBridgeRulesPerBusCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkEventBridgeRulesPerBus: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/iamInlinePolicySizeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkIamInlinePolicySize: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/iamManagedPolicySizeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkIamManagedPolicySize: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/iamRoleAggregatePolicySizeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkIamRoleAggregatePolicySize: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/lambdaEnvSizeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkLambdaEnvSize: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/lambdaLayersLimitCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkLambdaLayersLimit: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/s3BucketPolicySizeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkS3BucketPolicySize: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/securityGroupRulesLimitCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkSecurityGroupRulesLimit: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/snsTopicPolicySizeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkSnsTopicPolicySize: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/checks/serviceLimits/sqsPolicySizeCheck.d.ts

@@ -0,0 +1,2 @@
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../../../types/analysis.types';
+export declare const checkSqsPolicySize: (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;

package/dist/analysis/templateLevel/helpers/policyHelpers.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared helpers for measuring policy sizes and resolving CloudFormation references.
+ */
+import type { CloudFormationResource } from '../../../types/analysis.types';
+/**
+ * Measure the byte size of a policy document when serialized to JSON.
+ * CloudFormation serializes policies as JSON, so this matches the deployed size.
+ */
+export declare const measurePolicyBytes: (policyDocument: unknown) => number;
+/**
+ * Count the number of statements in a policy document.
+ */
+export declare const countPolicyStatements: (policyDocument: unknown) => number;
+/**
+ * Resolve a CloudFormation value to a logical resource ID.
+ * Handles Ref, Fn::GetAtt, and literal strings.
+ * Returns the logical resource ID or null if unresolvable.
+ */
+export declare const resolveCfnRef: (value: unknown, allResourceIds: Set<string>) => string | null;
+/**
+ * Recursively find all logical resource IDs referenced in a value.
+ */
+export declare const findAllReferencedResources: (value: unknown, allResourceIds: Set<string>) => string[];
+/**
+ * Get policy statements from a policy document as an array.
+ */
+export declare const getPolicyStatements: (policyDocument: unknown) => Array<Record<string, unknown>>;
+/**
+ * Calculate the percentage of a limit that's been used.
+ */
+export declare const percentOfLimit: (current: number, limit: number) => number;
+/**
+ * Format byte size as human-readable string.
+ */
+export declare const formatBytes: (bytes: number) => string;
+/**
+ * Collect all inline policies from an IAM Role resource.
+ */
+export declare const getInlinePolicies: (resource: CloudFormationResource) => Array<{
+    name: string;
+    document: unknown;
+}>;

package/dist/analysis/templateLevel/helpers/resourceCollectors.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared helpers for collecting and grouping resources from CloudFormation templates.
+ */
+import type { CloudFormationResource } from '../../../types/analysis.types';
+/**
+ * Collect all resources of a given type from the template.
+ */
+export declare const collectByType: (resources: Record<string, CloudFormationResource>, type: string) => Array<[string, CloudFormationResource]>;
+/**
+ * Group EventBridge rules by their DLQ target ARN (resolves Ref/GetAtt).
+ * Returns a map of DLQ logical resource ID → array of rule logical resource IDs.
+ */
+export declare const groupEventBridgeRulesByDlqTarget: (resources: Record<string, CloudFormationResource>) => Map<string, string[]>;
+/**
+ * Group EventBridge rules by their event bus name.
+ * Rules without an explicit EventBusName are grouped under "default".
+ */
+export declare const groupEventBridgeRulesByBus: (resources: Record<string, CloudFormationResource>) => Map<string, string[]>;
+/**
+ * Find the SQS queue resource that an SQS::QueuePolicy applies to.
+ * Returns the first resolvable queue logical ID.
+ */
+export declare const findQueueForPolicy: (policyResource: CloudFormationResource, allResourceIds: Set<string>) => string | null;
+/**
+ * Count inbound and outbound rules for a security group, including
+ * both inline rules and separate SecurityGroupIngress/Egress resources.
+ */
+export declare const countSecurityGroupRules: (sgResourceId: string, sgResource: CloudFormationResource, resources: Record<string, CloudFormationResource>) => {
+    inbound: number;
+    outbound: number;
+};

package/dist/analysis/templateLevel/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Template-Level Analysis
+ *
+ * Analyzes the full CloudFormation template for cross-resource patterns,
+ * AWS service limit violations, and policy issues that cannot be detected
+ * by analyzing resources individually.
+ *
+ * Runs client-side only — templates never leave the user's machine.
+ * Free for all users — no backend cost or tier gating.
+ */
+export { runAllTemplateLevelChecks, getRegisteredChecks } from './registry';
+export type { TemplateLevelCheckFunction, TemplateLevelCheckDefinition, TemplateLevelCategory, } from './types';
+export { AWS_SERVICE_LIMITS, WARNING_THRESHOLD } from './types';

package/dist/analysis/templateLevel/registry.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Template-Level Check Registry
+ *
+ * Registers all template-level checks and provides the runner that
+ * executes them against a CloudFormation template.
+ */
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults } from '../../types/analysis.types';
+import type { TemplateLevelCheckDefinition } from './types';
+/**
+ * Run all template-level checks against a CloudFormation stack.
+ * Merges results from all checks, tagging each issue with its ruleId.
+ */
+export declare const runAllTemplateLevelChecks: (template: CloudFormationStack, createFinding: CreateFindingFunction, ruleFilter?: string[]) => AnalysisResults;
+/**
+ * Get all registered template-level check definitions (for documentation/listing).
+ */
+export declare const getRegisteredChecks: () => readonly TemplateLevelCheckDefinition[];

package/dist/analysis/templateLevel/types.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Template-Level Analysis Types and Constants
+ *
+ * Template-level checks analyze the full CloudFormation template to detect
+ * cross-resource patterns, AWS service limit violations, and policy issues
+ * that cannot be found by analyzing resources individually.
+ */
+import type { CloudFormationStack, CreateFindingFunction, AnalysisResults, Severity, WAFPillars } from '../../types/analysis.types';
+/**
+ * Category for template-level check rule IDs.
+ * TL-LIMIT-xxx = Service limit checks
+ * TL-XRES-xxx  = Cross-resource anti-pattern checks
+ * TL-POL-xxx   = Policy analysis checks
+ */
+export type TemplateLevelCategory = 'serviceLimits' | 'crossResourceAntiPatterns' | 'policyAnalysis';
+/**
+ * A template-level check function.
+ * Receives the FULL CloudFormation stack (all resources).
+ * Returns AnalysisResults keyed by affected resource logical ID.
+ *
+ * Intentionally matches the AWSServiceCheckFunction signature so it
+ * integrates seamlessly with the existing pipeline.
+ */
+export type TemplateLevelCheckFunction = (template: CloudFormationStack, createFinding: CreateFindingFunction) => AnalysisResults;
+/**
+ * Metadata about a registered template-level check.
+ */
+export interface TemplateLevelCheckDefinition {
+    /** Unique rule ID: TL-LIMIT-001, TL-XRES-001, TL-POL-001, etc. */
+    ruleId: string;
+    /** Human-readable title */
+    title: string;
+    /** Category for grouping */
+    category: TemplateLevelCategory;
+    /** Default severity */
+    defaultSeverity: Severity;
+    /** WAF pillar */
+    wafPillar: WAFPillars;
+    /** The check function */
+    check: TemplateLevelCheckFunction;
+    /** Description for documentation */
+    description: string;
+}
+/**
+ * AWS service limits used by checks.
+ * All values are in bytes unless noted otherwise.
+ */
+export declare const AWS_SERVICE_LIMITS: {
+    readonly SQS_POLICY_MAX_BYTES: 8192;
+    readonly SQS_POLICY_MAX_STATEMENTS: 20;
+    readonly IAM_INLINE_POLICY_MAX_BYTES: 2048;
+    readonly IAM_MANAGED_POLICY_MAX_BYTES: 6144;
+    readonly IAM_ROLE_AGGREGATE_INLINE_MAX_BYTES: 10240;
+    readonly LAMBDA_ENV_MAX_BYTES: 4096;
+    readonly LAMBDA_MAX_LAYERS: 5;
+    readonly S3_BUCKET_POLICY_MAX_BYTES: 20480;
+    readonly SNS_TOPIC_POLICY_MAX_BYTES: 30720;
+    readonly EVENTBRIDGE_RULES_PER_BUS_DEFAULT: 300;
+    readonly CFN_MAX_RESOURCES: 500;
+    readonly CFN_TEMPLATE_MAX_BYTES_DIRECT: 51200;
+    readonly CFN_TEMPLATE_MAX_BYTES_S3: 460800;
+    readonly SECURITY_GROUP_MAX_INBOUND_RULES: 60;
+    readonly SECURITY_GROUP_MAX_OUTBOUND_RULES: 60;
+};
+/**
+ * Warning threshold ratio: flag when usage exceeds this fraction of the limit.
+ * e.g., 0.8 means warn at 80% of the limit.
+ */
+export declare const WARNING_THRESHOLD = 0.8;