tf-nag 0.1.0__tar.gz

tf_nag-0.1.0/.github/scripts/open_sync_pr.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Push the refreshed vendored data and open (or update) the upstream-sync PR.
+#
+# Expects to run from an actions/checkout working tree with GH_TOKEN set to a
+# token that can push and open pull requests. Requires "Allow GitHub Actions
+# to create and approve pull requests" enabled for the repo. Sets the step
+# outputs prUrl and prId. Only runs when the sync step reported drift; the
+# check below is a safety net for manual invocation.
+set -euo pipefail
+
+BRANCH="${SYNC_BRANCH:?SYNC_BRANCH is required}"
+TARGET="${TARGET_BRANCH:?TARGET_BRANCH is required}"
+SUMMARY_FILE="${SUMMARY_FILE:?SUMMARY_FILE is required}"
+TITLE="chore: sync upstream AWS Solutions pack and AWS runtime data"
+
+if [[ -z "$(git status --porcelain -- tfnag/data)" ]]; then
+  echo "No upstream drift; nothing to push."
+  exit 0
+fi
+
+git config user.email "noreply@github.com"
+git config user.name "github-actions[bot]"
+git checkout -B "$BRANCH"
+git add tfnag/data
+git commit -m "$TITLE" -m "Generated by the weekly upstream-sync workflow."
+# The branch is regenerated from the target branch on every run, so the remote
+# copy of a superseded sync is replaced rather than merged into.
+git push --force origin "HEAD:refs/heads/$BRANCH"
+
+existing="$(gh pr list --head "$BRANCH" --base "$TARGET" --state open \
+  --json number --jq '.[0].number // empty')"
+
+if [[ -n "$existing" ]]; then
+  gh pr edit "$existing" --body-file "$SUMMARY_FILE" >/dev/null
+  pr_id="$existing"
+else
+  gh pr create --head "$BRANCH" --base "$TARGET" \
+    --title "$TITLE" --body-file "$SUMMARY_FILE" >/dev/null
+  pr_id="$(gh pr list --head "$BRANCH" --base "$TARGET" --state open \
+    --json number --jq '.[0].number')"
+fi
+
+pr_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/pull/${pr_id}"
+echo "Sync PR: $pr_url"
+{
+  echo "prId=$pr_id"
+  echo "prUrl=$pr_url"
+} >> "$GITHUB_OUTPUT"

tf_nag-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,104 @@
+# Build and publish tf-nag to PyPI when a version tag is pushed.
+#
+# Releases are cut deliberately by tagging a commit on master with `vX.Y.Z`
+# (matching the version in pyproject.toml), which avoids duplicate-publish
+# failures from firing on every merge. The publish job is pinned to the `pypi`
+# GitHub Environment, which carries a required-reviewer protection rule: the
+# build runs automatically, then the workflow pauses and waits for a manual
+# approval before anything is uploaded to PyPI.
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  PYTHON_VERSION: '3.12'
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  # Build sdist + wheel and run the test suite. No secrets are needed here, so
+  # it stays outside the gated environment and gives reviewers a green artifact
+  # to approve.
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: run_checks
+        run: |
+          set -euo pipefail
+          python -m pip install --quiet pytest ruff
+          python -m pip install --quiet .
+          python -m pytest -q
+          python -m ruff check .
+
+      - name: build_dist
+        run: |
+          set -euo pipefail
+          python -m pip install --quiet build
+          python -m build
+
+      - name: upload_dist
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  # Gated on the `pypi` environment. Execution halts here until a required
+  # reviewer approves the deployment, then the stored API token is used to
+  # upload the artifact built above.
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/tf-nag/
+    steps:
+      - name: download_dist
+        uses: actions/download-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+      - name: publish_to_pypi
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+
+  # Publish a GitHub Release for the tag once the package is on PyPI, attaching
+  # the built sdist/wheel and auto-generated notes. Runs only for tag pushes;
+  # a manual workflow_dispatch has no tag to release against.
+  github_release:
+    name: Create GitHub Release
+    needs: publish
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: download_dist
+        uses: actions/download-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+      - name: create_release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: dist/*

tf_nag-0.1.0/.github/workflows/upstream-sync.yml

@@ -0,0 +1,94 @@
+# Weekly refresh of everything tf-nag vendors from upstream: the cdk-nag AWS
+# Solutions pack, the latest AWS Lambda runtimes, and the AWS provider schema.
+# Drift is pushed to a single sync branch and raised as a PR for review.
+name: upstream-sync
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+env:
+  PYTHON_VERSION: '3.12'
+  TERRAFORM_VERSION: '1.9.8'
+  SYNC_BRANCH: chore/upstream-sync
+  TARGET_BRANCH: master
+
+concurrency:
+  group: upstream-sync
+  cancel-in-progress: false
+
+jobs:
+  upstream_sync:
+    name: Refresh vendored upstream data
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: install_terraform
+        run: |
+          set -euo pipefail
+          curl -fsSL -o terraform.zip \
+            "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
+          unzip -o -q terraform.zip -d "$RUNNER_TEMP/terraform"
+          echo "$RUNNER_TEMP/terraform" >> "$GITHUB_PATH"
+
+      # Everything downstream is gated on drift: a week where upstream did not
+      # move ends here.
+      - name: sync_upstream_sources
+        id: sync
+        run: |
+          set -euo pipefail
+          echo "SUMMARY_FILE=$RUNNER_TEMP/sync-summary.md" >> "$GITHUB_ENV"
+          python scripts/sync_upstream.py --summary-out "$RUNNER_TEMP/sync-summary.md"
+          if [[ -z "$(git status --porcelain -- tfnag/data)" ]]; then
+            echo "No upstream drift."
+            echo "drift=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "drift=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # The refreshed provider schema is what the rule metadata is validated
+      # against, so a failure here means a rule needs remapping by hand. The PR
+      # is still raised, with the failure recorded in its description.
+      - name: run_checks
+        id: validate
+        if: steps.sync.outputs.drift == 'true'
+        run: |
+          set -uo pipefail
+          python -m pip install --quiet pytest ruff
+          python -m pip install --quiet .
+          if python -m pytest -q && python -m ruff check . && python -m ruff format --check .; then
+            echo "validated=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "validated=false" >> "$GITHUB_OUTPUT"
+            {
+              echo
+              echo "### Checks failed"
+              echo
+              echo "- \`pytest\`/\`ruff\` did not pass on the refreshed data."
+              echo "- See the [workflow logs](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID})."
+            } >> "$SUMMARY_FILE"
+          fi
+
+      - name: open_sync_pr
+        id: pr
+        if: steps.sync.outputs.drift == 'true'
+        run: bash .github/scripts/open_sync_pr.sh
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: publish_summary
+        if: steps.sync.outputs.drift == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: sync-summary
+          path: ${{ env.SUMMARY_FILE }}

tf_nag-0.1.0/.gitignore

@@ -0,0 +1,2 @@
+__pycache__
+.DS_Store

tf_nag-0.1.0/PKG-INFO

@@ -0,0 +1,6 @@
+Metadata-Version: 2.5
+Name: tf-nag
+Version: 0.1.0
+Summary: Offline Terraform plan scanner for the tf-nag AWS Solutions rules
+Project-URL: Repository, https://github.com/vumdao/terraform-nag.git
+Requires-Python: >=3.11

tf_nag-0.1.0/README.md

@@ -0,0 +1,196 @@
+# tf-nag
+
+`tf-nag` is an offline Python CLI that checks Terraform plan or state JSON
+against the tf-nag AWS Solutions rules. It does not contact AWS.
+
+Rule IDs and severity levels are derived from the upstream AWS Solutions pack:
+https://github.com/cdklabs/cdk-nag.
+
+## Installation
+
+Clone this repository and install its development environment with `uv`:
+
+```bash
+git clone git@github.com:vumdao/terraform-nag.git
+cd terraform-nag
+uv sync --group dev
+```
+
+For a one-off invocation without installing globally:
+
+```bash
+uvx --from . tf-nag --version
+```
+
+For a regular virtual environment or pipeline installation:
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+pip install .
+tf-nag --version
+```
+
+## Manual run (plan JSON)
+
+```bash
+terraform plan -out=tf.plan -refresh=false -lock=false
+terraform show -json tf.plan > plan.json
+tf-nag scan --plan-json plan.json
+```
+
+To scan a subdirectory or workspace, run the first two commands from that
+directory (or select the workspace with `terraform workspace select NAME`) and
+pass its resulting JSON path to `--plan-json`, for example:
+`tf-nag scan --plan-json ./environments/prod/plan.json`.
+The same workflow can be piped without an intermediate file:
+
+```bash
+terraform show -json tf.plan | tf-nag scan --plan-json -
+```
+
+### Example run
+
+```
+$ terraform plan -out=tf.plan -refresh=false -lock=false
+
+module.demo_custom_domain.data.aws_route53_zone.hosted_zone[0]: Reading...
+module.demo_svc.module.demo_lambda.data.aws_iam_policy_document.lambda_assume_role: Reading...
+module.demo_svc.module.demo_lambda.data.aws_iam_policy_document.lambda_assume_role: Read complete after 0s [id=1792567899]
+module.demo_svc.module.demo_lambda.data.aws_iam_policy_document.lambda_policy: Reading...
+module.demo_svc.module.demo_lambda.data.aws_iam_policy_document.lambda_policy: Read complete after 0s [id=1012345678]
+module.demo_custom_domain.data.aws_route53_zone.hosted_zone[0]: Read complete after 2s [id=Z45F22PP7P3PP]
+
+No changes. Your infrastructure matches the configuration.
+
+Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.
+
+⚡ $ terraform show -json tf.plan > plan.json
+
+⚡ $ uvx --from /tmp/terraform-nag tf-nag scan --plan-json plan.json
+LEVEL       RULE              ADDRESS                         MESSAGE
+ERROR       AwsSolutions-APIG1  module.demo_svc.module.demo_gw.aws_api_gateway_stage.demo-gw-stage  The API does not have access logging enabled.
+ERROR       AwsSolutions-APIG2  module.demo_svc.aws_api_gateway_rest_api.demo-gw-api  The REST API does not have request validation enabled.
+WARN        AwsSolutions-APIG3  module.demo_svc.module.demo_gw.aws_api_gateway_stage.demo-gw-stage  The REST API stage is not associated with AWS WAFv2 web ACL.
+ERROR       AwsSolutions-APIG4  module.demo_svc.module.demo_gw.aws_api_gateway_method.demo-gw-method  The API does not implement authorization.
+ERROR       AwsSolutions-APIG4  module.demo_svc.module.demo_gw.aws_api_gateway_method.demo-gw-options  The API does not implement authorization.
+ERROR       AwsSolutions-COG4  module.demo_svc.module.demo_gw.aws_api_gateway_method.demo-gw-method  The API GW method does not use a Cognito user pool authorizer.
+WARN        AwsSolutions-DDB3  module.demo_svc.module.demo_cached_table.aws_dynamodb_table.demo-ld-cached-table  The DynamoDB table does not have Point-in-time Recovery enabled.
+ERROR       AwsSolutions-IAM5  module.demo_svc.module.demo_lambda.aws_iam_policy.demo-lambda-policy  The IAM entity contains wildcard permissions and does not have a tf-nag rule suppression with evidence for those permission.
+```
+
+Exit codes are **0** for clean (or when `--fail-on never` is used), **1** when
+an ERROR finding is present, and **2** for WARN-only findings when
+`--fail-on warn` is selected. **3** indicates a malformed suppression
+configuration. The default `--fail-on error` reports WARN-only findings but
+exits 0.
+
+```bash
+tf-nag scan --plan-json plan.json --format sarif
+tf-nag list-rules
+```
+
+The plan-JSON loader also accepts state JSON. HCL parsing is intentionally
+deferred; this phase is fully offline and has no runtime dependencies.
+
+## Suppressions
+
+The canonical file is `.tfnag.json` in the current directory. Pass
+`--suppressions PATH` to select another file. If neither is passed explicitly,
+`.tfnag.json` takes precedence over the legacy `.tfnag.yml`.
+
+The JSON file may be either an object containing a `suppressions` array or a
+bare top-level array:
+
+```json
+{
+  "suppressions": [
+    {
+      "id": "AwsSolutions-APIG1",
+      "resources": ["demo_gw.aws_api_gateway_stage.demo-gw-stage"],
+      "reason": "Access logging handled centrally"
+    }
+  ]
+}
+```
+
+`id` must be a registered rule ID. `resources` matches a full Terraform
+address or a trailing suffix on whole `.`-segment boundaries, so the example
+matches
+`module.demo_svc.module.demo_gw.aws_api_gateway_stage.demo-gw-stage`, but not
+`gw-stage` or `stage.demo-gw-stage`. `*` globs are supported within a segment.
+An address without a `count`/`for_each` instance key matches every expanded
+instance; an address with a key matches only that instance. Use
+`"resources": ["*"]` to suppress every resource for that rule.
+
+`reason` is mandatory and non-empty. `expires` is optional and must be
+`YYYY-MM-DD`; expired entries do not suppress findings and are reported as
+WARN with an expiration message. Suppressed findings remain visible in table,
+Markdown, and JSON reports, including their reason. Table and Markdown
+reports include a suppression summary and warn about entries that matched no
+findings. `--strict` ignores all suppressions.
+
+For back-compat, `.tfnag.yml` continues to support the restricted format below.
+Create `.tfnag.yml` with one or more list items. The supported subset is
+exactly a top-level sequence of mappings containing:
+
+- `rule` (or `id`): an exact `AwsSolutions-*` ID, or `*`
+- `address`: an optional shell-style glob, defaulting to `*`
+- `reason`: a required non-empty string
+- `expires`: an optional ISO date (`YYYY-MM-DD`)
+
+For example:
+
+```yaml
+- rule: AwsSolutions-S1
+  address: aws_s3_bucket.site
+  reason: Access logs are delivered by the centralized platform account.
+  expires: 2027-01-01
+```
+
+Address values are shell-style globs. Expired suppressions are not applied.
+Unsupported YAML is silently ignored by the restricted parser: nested mappings,
+flow-style lists, quoted multiline values, and unrelated top-level mappings are
+not supported. `--strict` ignores all suppressions. Inline HCL comments are
+deferred until the HCL loader exists (TODO).
+
+## Rule coverage
+
+`tf-nag list-rules` reads the vendored authoritative inventory and reports all
+131 AWS Solutions rules:
+
+| Status                      | Count |
+| --------------------------- | ----: |
+| implemented                 |   126 |
+| not-applicable-to-terraform |     5 |
+| not-implemented             |     0 |
+
+The not-applicable rules have no Terraform provider resource equivalent.
+Run `tf-nag list-rules` for the complete per-rule table.
+
+## Development
+
+```bash
+uv sync --group dev
+uv run ruff check .
+uv run ruff format --check .
+uv run pytest
+```
+
+Fixtures in `tests/fixtures` are hand-crafted documents matching the
+`terraform show -json` schema. `tests/real-terraform/real-plan.json` is
+generated by Terraform 1.9.8 with the AWS provider and is committed as a
+real-plan integration fixture; it needs no AWS credentials to scan. Terraform
+is not required to run the suite.
+`python scripts/generate_rule_mapping.py` regenerates the mapping document from
+the rule module docstrings.
+
+## Limitations
+
+This phase does not parse HCL, resolve resources created outside Terraform,
+inspect `null_resource`/local-exec or embedded CloudFormation, or provide
+baseline support. Dynamic policy documents that cannot be statically resolved
+are reported as UNKNOWN and follow `--unknown-as`. Terraform plan JSON does
+not contain source file or line locations; SARIF locations therefore contain
+Terraform resource addresses. The implementation follows the tf-nag AWS
+Solutions IDs and levels, not Checkov/tfsec IDs.

tf_nag-0.1.0/docs/rule-mapping.md

@@ -0,0 +1,137 @@
+# Rule mapping
+
+Generated from the vendored AWS Solutions inventory.
+
+| Rule | Level | Status | CloudFormation origin | Terraform coverage |
+|---|---|---|---|---|
+| `AwsSolutions-AEC1` | ERROR | implemented | CacheCluster, ReplicationGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-AEC3` | ERROR | implemented | ReplicationGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-AEC4` | ERROR | implemented | ReplicationGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-AEC5` | ERROR | implemented | CacheCluster, ReplicationGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-AEC6` | ERROR | implemented | ReplicationGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-APIG1` | ERROR | implemented | Stage, V2Stage | Implemented by tf-nag rules. |
+| `AwsSolutions-APIG2` | ERROR | implemented | RequestValidator, RestApi | Implemented by tf-nag rules. |
+| `AwsSolutions-APIG3` | WARN | implemented | Stage, WebACLAssociation | Implemented by tf-nag rules. |
+| `AwsSolutions-APIG4` | ERROR | implemented | Method, Route | Implemented by tf-nag rules. |
+| `AwsSolutions-APIG6` | ERROR | implemented | Stage | Implemented by tf-nag rules. |
+| `AwsSolutions-AS1` | ERROR | implemented | AutoScalingGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-AS2` | ERROR | implemented | AutoScalingGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-AS3` | ERROR | implemented | AutoScalingGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-ASC3` | ERROR | implemented | GraphQLApi | Implemented by tf-nag rules. |
+| `AwsSolutions-C91` | ERROR | implemented | EnvironmentEC2 | Implemented by tf-nag rules. |
+| `AwsSolutions-CB4` | ERROR | implemented | Project | Implemented by tf-nag rules. |
+| `AwsSolutions-CB5` | WARN | implemented | Project | Implemented by tf-nag rules. |
+| `AwsSolutions-CFR1` | WARN | implemented | Distribution | Implemented by tf-nag rules. |
+| `AwsSolutions-CFR2` | WARN | implemented | Distribution | Implemented by tf-nag rules. |
+| `AwsSolutions-CFR3` | ERROR | implemented | Distribution, StreamingDistribution | Implemented by tf-nag rules. |
+| `AwsSolutions-CFR4` | ERROR | implemented | Distribution | Implemented by tf-nag rules. |
+| `AwsSolutions-CFR5` | ERROR | implemented | Distribution | Implemented by tf-nag rules. |
+| `AwsSolutions-CFR6` | ERROR | not-applicable-to-terraform | StreamingDistribution | Terraform AWS provider has no CloudFront streaming-distribution resource. |
+| `AwsSolutions-CFR7` | ERROR | implemented | Bucket, Distribution | Implemented by tf-nag rules. |
+| `AwsSolutions-COG1` | ERROR | implemented | UserPool | Implemented by tf-nag rules. |
+| `AwsSolutions-COG2` | WARN | implemented | UserPool | Implemented by tf-nag rules. |
+| `AwsSolutions-COG4` | ERROR | implemented | Method | Implemented by tf-nag rules. |
+| `AwsSolutions-COG7` | ERROR | implemented | IdentityPool | Implemented by tf-nag rules. |
+| `AwsSolutions-COG8` | ERROR | implemented | UserPool | Implemented by tf-nag rules. |
+| `AwsSolutions-DDB3` | WARN | implemented | Table | Implemented by tf-nag rules. |
+| `AwsSolutions-DDB4` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-DOC1` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-DOC2` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-DOC3` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-DOC4` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-DOC5` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-EB1` | ERROR | implemented | Environment | Implemented by tf-nag rules. |
+| `AwsSolutions-EB3` | ERROR | implemented | Environment | Implemented by tf-nag rules. |
+| `AwsSolutions-EB4` | WARN | implemented | Environment | Implemented by tf-nag rules. |
+| `AwsSolutions-EC23` | ERROR | implemented | SecurityGroup, SecurityGroupIngress | Implemented by tf-nag rules. |
+| `AwsSolutions-EC26` | ERROR | implemented | AutoScalingGroup, Instance, LaunchConfiguration, LaunchTemplate, Volume | Implemented by tf-nag rules. |
+| `AwsSolutions-EC27` | ERROR | implemented | SecurityGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-EC28` | ERROR | implemented | Instance, LaunchConfiguration | Implemented by tf-nag rules. |
+| `AwsSolutions-EC29` | ERROR | implemented | Instance | Implemented by tf-nag rules. |
+| `AwsSolutions-ECR1` | ERROR | implemented | RegistryPolicy, Repository | Implemented by tf-nag rules. |
+| `AwsSolutions-ECS2` | ERROR | implemented | TaskDefinition | Implemented by tf-nag rules. |
+| `AwsSolutions-ECS4` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-ECS7` | ERROR | implemented | TaskDefinition | Implemented by tf-nag rules. |
+| `AwsSolutions-EFS1` | ERROR | implemented | FileSystem | Implemented by tf-nag rules. |
+| `AwsSolutions-EKS1` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-EKS2` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-ELB1` | ERROR | implemented | LoadBalancer | Implemented by tf-nag rules. |
+| `AwsSolutions-ELB2` | ERROR | implemented | LoadBalancer, LoadBalancerV2 | Implemented by tf-nag rules. |
+| `AwsSolutions-ELB3` | ERROR | implemented | LoadBalancer | Implemented by tf-nag rules. |
+| `AwsSolutions-ELB4` | ERROR | implemented | LoadBalancer | Implemented by tf-nag rules. |
+| `AwsSolutions-ELB5` | ERROR | implemented | LoadBalancer | Implemented by tf-nag rules. |
+| `AwsSolutions-EMR2` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-EMR4` | ERROR | implemented | Cluster, SecurityConfiguration | Implemented by tf-nag rules. |
+| `AwsSolutions-EMR5` | ERROR | implemented | Cluster, SecurityConfiguration | Implemented by tf-nag rules. |
+| `AwsSolutions-EMR6` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-EVB1` | ERROR | implemented | EventBusPolicy | Implemented by tf-nag rules. |
+| `AwsSolutions-GL1` | WARN | implemented | Crawler, Job, SecurityConfiguration | Implemented by tf-nag rules. |
+| `AwsSolutions-GL3` | WARN | implemented | Job, SecurityConfiguration | Implemented by tf-nag rules. |
+| `AwsSolutions-IAM4` | ERROR | implemented | Group, Role, User | Implemented by tf-nag rules. |
+| `AwsSolutions-IAM5` | ERROR | implemented | Group, ManagedPolicy, Policy, Role, User | Implemented by tf-nag rules. |
+| `AwsSolutions-KDA3` | WARN | implemented | ApplicationV2 | Implemented by tf-nag rules. |
+| `AwsSolutions-KDF1` | ERROR | implemented | DeliveryStream | Implemented by tf-nag rules. |
+| `AwsSolutions-KDS1` | ERROR | implemented | Stream | Implemented by tf-nag rules. |
+| `AwsSolutions-KDS3` | WARN | implemented | Stream | Implemented by tf-nag rules. |
+| `AwsSolutions-KMS5` | ERROR | implemented | Key | Implemented by tf-nag rules. |
+| `AwsSolutions-L1` | ERROR | implemented | Function | Implemented by tf-nag rules. |
+| `AwsSolutions-LEX4` | ERROR | implemented | Bot, BotAlias, LogGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-MS1` | ERROR | not-applicable-to-terraform | Container | Terraform AWS provider exposes no MediaStore access-logging configuration. |
+| `AwsSolutions-MS10` | WARN | not-applicable-to-terraform | Container | Terraform AWS provider exposes no MediaStore lifecycle-policy resource. |
+| `AwsSolutions-MS3` | ERROR | implemented | Container | Implemented by tf-nag rules. |
+| `AwsSolutions-MS4` | WARN | not-applicable-to-terraform | Container | Terraform AWS provider exposes no MediaStore CloudWatch metric-policy resource. |
+| `AwsSolutions-MS7` | WARN | implemented | Container | Implemented by tf-nag rules. |
+| `AwsSolutions-MS8` | WARN | not-applicable-to-terraform | Container | Terraform AWS provider exposes no MediaStore CORS-policy resource. |
+| `AwsSolutions-MSK2` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-MSK3` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-MSK6` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-N1` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-N2` | ERROR | implemented | DBInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-N3` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-N4` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-N5` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-OS1` | ERROR | implemented | Domain | Implemented by tf-nag rules. |
+| `AwsSolutions-OS2` | ERROR | implemented | Domain | Implemented by tf-nag rules. |
+| `AwsSolutions-OS3` | ERROR | implemented | Domain | Implemented by tf-nag rules. |
+| `AwsSolutions-OS4` | ERROR | implemented | Domain | Implemented by tf-nag rules. |
+| `AwsSolutions-OS5` | ERROR | implemented | Domain | Implemented by tf-nag rules. |
+| `AwsSolutions-OS7` | ERROR | implemented | Domain | Implemented by tf-nag rules. |
+| `AwsSolutions-OS8` | ERROR | implemented | Domain | Implemented by tf-nag rules. |
+| `AwsSolutions-OS9` | ERROR | implemented | Domain | Implemented by tf-nag rules. |
+| `AwsSolutions-QS1` | ERROR | implemented | DataSource | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS10` | ERROR | implemented | DBCluster, DBInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS11` | ERROR | implemented | DBCluster, DBInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS13` | ERROR | implemented | DBInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS14` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS16` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS2` | ERROR | implemented | DBCluster, DBInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS3` | ERROR | implemented | DBInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS6` | ERROR | implemented | DBCluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RDS8` | ERROR | implemented | DBSecurityGroup, DBSecurityGroupIngress | Implemented by tf-nag rules. |
+| `AwsSolutions-RS1` | ERROR | implemented | Cluster, ClusterParameterGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-RS10` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RS11` | ERROR | implemented | Cluster, ClusterParameterGroup | Implemented by tf-nag rules. |
+| `AwsSolutions-RS2` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RS3` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RS4` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RS5` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RS6` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RS8` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-RS9` | ERROR | implemented | Cluster | Implemented by tf-nag rules. |
+| `AwsSolutions-S1` | ERROR | implemented | Bucket | Implemented by tf-nag rules. |
+| `AwsSolutions-S10` | ERROR | implemented | Bucket, BucketPolicy | Implemented by tf-nag rules. |
+| `AwsSolutions-S2` | ERROR | implemented | Bucket | Implemented by tf-nag rules. |
+| `AwsSolutions-S5` | ERROR | implemented | Bucket, BucketPolicy | Implemented by tf-nag rules. |
+| `AwsSolutions-SF1` | ERROR | implemented | StateMachine | Implemented by tf-nag rules. |
+| `AwsSolutions-SF2` | ERROR | implemented | StateMachine | Implemented by tf-nag rules. |
+| `AwsSolutions-SM1` | ERROR | implemented | NotebookInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-SM2` | ERROR | implemented | NotebookInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-SM3` | ERROR | implemented | NotebookInstance | Implemented by tf-nag rules. |
+| `AwsSolutions-SMG4` | ERROR | implemented | RotationSchedule, Secret, SecretTargetAttachment, TargetAttachment | Implemented by tf-nag rules. |
+| `AwsSolutions-SNS3` | ERROR | implemented | Topic, TopicPolicy | Implemented by tf-nag rules. |
+| `AwsSolutions-SQS2` | ERROR | implemented | Queue | Implemented by tf-nag rules. |
+| `AwsSolutions-SQS3` | ERROR | implemented | Function, Queue | Implemented by tf-nag rules. |
+| `AwsSolutions-SQS4` | ERROR | implemented | Queue, QueuePolicy | Implemented by tf-nag rules. |
+| `AwsSolutions-TS3` | WARN | implemented | Database | Implemented by tf-nag rules. |
+| `AwsSolutions-VPC3` | WARN | implemented | NetworkAcl, NetworkAclEntry | Implemented by tf-nag rules. |
+| `AwsSolutions-VPC7` | ERROR | implemented | FlowLog, VPC | Implemented by tf-nag rules. |

tf_nag-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "tf-nag"
+version = "0.1.0"
+description = "Offline Terraform plan scanner for the tf-nag AWS Solutions rules"
+requires-python = ">=3.11"
+dependencies = []
+
+[project.urls]
+Repository = "https://github.com/vumdao/terraform-nag.git"
+
+[project.scripts]
+tf-nag = "tfnag.cli:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["tfnag"]
+
+[dependency-groups]
+dev = [
+    "pytest>=8",
+    "ruff>=0.6",
+]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "I"]
+ignore = ["E501"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

tf_nag-0.1.0/scripts/generate_rule_mapping.py

@@ -0,0 +1,29 @@
+"""Regenerate docs/rule-mapping.md from the vendored rule inventory."""
+
+from pathlib import Path
+
+from tfnag.registry import INVENTORY, discover, status
+
+
+def main() -> None:
+    discover()
+    lines = [
+        "# Rule mapping",
+        "",
+        "Generated from the vendored AWS Solutions inventory.",
+        "",
+        "| Rule | Level | Status | CloudFormation origin | Terraform coverage |",
+        "|---|---|---|---|---|",
+    ]
+    for rule_id, item in sorted(INVENTORY.items()):
+        origin = ", ".join(item.get("cfn", []))
+        coverage = item.get("not_applicable_reason", "Implemented by tf-nag rules.")
+        coverage = coverage.replace("|", "\\|")
+        lines.append(
+            f"| `{rule_id}` | {item['level']} | {status(rule_id)} | {origin} | {coverage} |"
+        )
+    Path("docs/rule-mapping.md").write_text("\n".join(lines) + "\n", encoding="utf-8")
+
+
+if __name__ == "__main__":
+    main()