{"resources":{"cloudformation":{"id":"cloudformation","fields":{"context":{"name":"context","type":"\u001bcloudformation.context","title":"CloudFormation template source context","desc":"Source location and raw text of a template element: the file path, the line range it spans, and the template text within that range. Points a reviewer at the exact source of a flagged resource, output, or parameter.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/cloudformation","is_implicit_resource":true},"output":{"name":"output","type":"\u001bcloudformation.output","title":"AWS CloudFormation output","desc":"Single entry from a template's Outputs section, exposing the output name and its properties body (Value, Description, Export, Condition). Useful for spotting outputs that leak resource ARNs, secrets, or sensitive state across stacks, since exported outputs can be imported by unrelated stacks.","provider":"go.mondoo.com/mql/v13/providers/cloudformation","is_implicit_resource":true},"parameter":{"name":"parameter","type":"\u001bcloudformation.parameter","title":"AWS CloudFormation parameter declaration","desc":"Single entry from the template `Parameters` section: its type, default, allowed-values and allowed-pattern constraints, length and value bounds, the `NoEcho` flag, and any constraint description. This is the primary surface for policies that enforce strong input typing, secret masking (`NoEcho: true` for credential-shaped parameters), and bounded inputs.","provider":"go.mondoo.com/mql/v13/providers/cloudformation","is_implicit_resource":true},"resource":{"name":"resource","type":"\u001bcloudformation.resource","title":"AWS CloudFormation resource declaration","desc":"Single resource declared in the template's `Resources` section, the unit that IaC policies match against to enforce resource-shape rules such as encryption, public-access blocking, and tagging. The `name` field is the logical ID as written in the template, for example `cloudformation.resources.where(type == \"AWS::S3::Bucket\")`. The `type` field carries the AWS resource type and `properties` holds the declared configuration body.","provider":"go.mondoo.com/mql/v13/providers/cloudformation","is_implicit_resource":true},"template":{"name":"template","type":"\u001bcloudformation.template","title":"AWS CloudFormation template","desc":"CloudFormation template (or SAM template via Transform) parsed for static analysis of infrastructure-as-code. Exposes the template metadata (AWSTemplateFormatVersion, Transform, Description), the parameter, mapping, condition, rule, global, and metadata sections, the declared resources, the outputs, and the full set of AWS resource types referenced. This is the surface for IaC policy checks against CloudFormation and SAM templates.","provider":"go.mondoo.com/mql/v13/providers/cloudformation","is_implicit_resource":true}},"is_extension":true},"cloudformation.context":{"id":"cloudformation.context","name":"cloudformation.context","fields":{"content":{"name":"content","type":"\u0007","refs":["\"path\"","\"range\""],"title":"Template text within the range, shown as an excerpt","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path of the template file this element is declared in","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"range":{"name":"range","type":"\u001e","is_mandatory":true,"title":"Line range the element spans in the template","provider":"go.mondoo.com/mql/v13/providers/cloudformation"}},"title":"CloudFormation template source context","desc":"Source location and raw text of a template element: the file path, the line range it spans, and the template text within that range. Points a reviewer at the exact source of a flagged resource, output, or parameter.","private":true,"min_provider_version":"13.1.8","defaults":"path range content","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"cloudformation.output":{"id":"cloudformation.output","name":"cloudformation.output","fields":{"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"`Condition` name that gates whether this output is produced","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"context":{"name":"context","type":"\u001bcloudformation.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"`Description` field from the Outputs entry","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"exportName":{"name":"exportName","type":"\u0007","is_mandatory":true,"title":"`Export.Name` value","desc":"Empty when the output is not exported across stacks. Audits commonly forbid exporting sensitive resource ARNs (databases, KMS keys) so they can't be picked up by unrelated stacks.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Output name","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"properties":{"name":"properties","type":"\u001a\u0007\n","is_mandatory":true,"title":"Raw properties body of the Outputs entry","desc":"The entry keyed by its CloudFormation property names: `Value`, `Description`, `Export`, and `Condition`, each mapping to the raw parsed structure. The individual fields value, description, exportName, and condition surface these same values already extracted.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"value":{"name":"value","type":"\n","is_mandatory":true,"title":"The `Value` expression","desc":"Returned as a `dict` because the value may be a literal, a `Ref`, a `Fn::GetAtt`, or any other intrinsic-function call. Audits commonly pattern-match against the shape to detect outputs that leak resource ARNs or sensitive references.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"}},"title":"AWS CloudFormation output","desc":"Single entry from a template's Outputs section, exposing the output name and its properties body (Value, Description, Export, Condition). Useful for spotting outputs that leak resource ARNs, secrets, or sensitive state across stacks, since exported outputs can be imported by unrelated stacks.","min_provider_version":"11.0.0","defaults":"name","context":"cloudformation.context","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"cloudformation.parameter":{"id":"cloudformation.parameter","name":"cloudformation.parameter","fields":{"allowedPattern":{"name":"allowedPattern","type":"\u0007","is_mandatory":true,"title":"`AllowedPattern` regular expression (String parameters only)","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"allowedValues":{"name":"allowedValues","type":"\u0019\n","is_mandatory":true,"title":"`AllowedValues` constraint","desc":"Heterogeneous list (strings, numbers) preserved as `dict`. Empty when the constraint is not set.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"constraintDescription":{"name":"constraintDescription","type":"\u0007","is_mandatory":true,"title":"`ConstraintDescription` shown when validation fails","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"context":{"name":"context","type":"\u001bcloudformation.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"default":{"name":"default","type":"\n","is_mandatory":true,"title":"`Default` value","desc":"Returned as a `dict` because the value may be a string, number, or list depending on `type`. Empty when the parameter is required.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"`Description` text","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"maxLength":{"name":"maxLength","type":"\u0005","is_mandatory":true,"title":"`MaxLength` constraint (String parameters)","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"maxValue":{"name":"maxValue","type":"\u0005","is_mandatory":true,"title":"`MaxValue` constraint (Number parameters)","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"minLength":{"name":"minLength","type":"\u0005","is_mandatory":true,"title":"`MinLength` constraint (String parameters)","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"minValue":{"name":"minValue","type":"\u0005","is_mandatory":true,"title":"`MinValue` constraint (Number parameters)","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Parameter name","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"noEcho":{"name":"noEcho","type":"\u0004","is_mandatory":true,"title":"`NoEcho` flag","desc":"When true, the parameter value is masked in stack events, the console, and the CLI. Required by most audit policies on parameters that hold passwords, API keys, or other credentials.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Parameter type","desc":"`String`, `Number`, `List\u003cNumber\u003e`, `CommaDelimitedList`, or any of the AWS-specific parameter types (`AWS::EC2::KeyPair::KeyName`, `AWS::SSM::Parameter::Value\u003cString\u003e`, etc.).","provider":"go.mondoo.com/mql/v13/providers/cloudformation"}},"title":"AWS CloudFormation parameter declaration","desc":"Single entry from the template `Parameters` section: its type, default, allowed-values and allowed-pattern constraints, length and value bounds, the `NoEcho` flag, and any constraint description. This is the primary surface for policies that enforce strong input typing, secret masking (`NoEcho: true` for credential-shaped parameters), and bounded inputs.","min_provider_version":"13.0.13","defaults":"name type","context":"cloudformation.context","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"cloudformation.resource":{"id":"cloudformation.resource","name":"cloudformation.resource","fields":{"attributes":{"name":"attributes","type":"\u001a\u0007\n","is_mandatory":true,"title":"Resource `Attributes` section","desc":"Map keyed by attribute name as declared in the template's `Attributes` block, with each value the raw attribute body. Used by modules and custom resources, and empty for most resource types.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"Resource condition","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"context":{"name":"context","type":"\u001bcloudformation.context","title":"Contextual info, where this resource is located and defined","min_provider_version":"13.1.8","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"creationPolicy":{"name":"creationPolicy","type":"\n","is_mandatory":true,"title":"`CreationPolicy` attribute","desc":"Nested object with `AutoScalingCreationPolicy` and `ResourceSignal` sub-sections used to wait for resource readiness before reporting CREATE_COMPLETE. Empty when not declared.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"deletionPolicy":{"name":"deletionPolicy","type":"\u0007","is_mandatory":true,"title":"`DeletionPolicy` attribute","desc":"One of `Delete`, `Retain`, `RetainExceptOnCreate`, or `Snapshot`. Empty when the attribute is not declared (CloudFormation then applies the `Delete` default). Stateful resources such as `AWS::RDS::DBInstance` or `AWS::S3::Bucket` typically require `Retain` to avoid accidental data loss on stack deletion.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"dependsOn":{"name":"dependsOn","type":"\u0019\u0007","is_mandatory":true,"title":"Resource dependencies (DependsOn)","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"documentation":{"name":"documentation","type":"\u0007","is_mandatory":true,"title":"Resource documentation URL","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"properties":{"name":"properties","type":"\u001a\u0007\n","is_mandatory":true,"title":"Resource `Properties` section","desc":"Map keyed by property name as declared in the template (for example `BucketName` or `VersioningConfiguration` on an `AWS::S3::Bucket`), with each value the raw property body. A value may be a literal or an intrinsic-function call such as `Ref` or `Fn::GetAtt`, so audits pattern-match against the value shape.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"resourceMetadata":{"name":"resourceMetadata","type":"\n","is_mandatory":true,"title":"`Metadata` attribute","desc":"Stores resource-specific metadata such as `AWS::CloudFormation::Init` or interface designer hints. Empty when not declared.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Resource type","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"updatePolicy":{"name":"updatePolicy","type":"\n","is_mandatory":true,"title":"`UpdatePolicy` attribute","desc":"Used by `AWS::AutoScaling::AutoScalingGroup`, `AWS::ElastiCache::ReplicationGroup`, `AWS::Lambda::Alias`, and a few others to control update behavior. Empty when not declared.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"updateReplacePolicy":{"name":"updateReplacePolicy","type":"\u0007","is_mandatory":true,"title":"`UpdateReplacePolicy` attribute","desc":"One of `Delete`, `Retain`, `RetainExceptOnCreate`, or `Snapshot`. Empty when not declared. Controls what happens to the existing physical resource when an update forces replacement.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"}},"title":"AWS CloudFormation resource declaration","desc":"Single resource declared in the template's `Resources` section, the unit that IaC policies match against to enforce resource-shape rules such as encryption, public-access blocking, and tagging. The `name` field is the logical ID as written in the template, for example `cloudformation.resources.where(type == \"AWS::S3::Bucket\")`. The `type` field carries the AWS resource type and `properties` holds the declared configuration body.","min_provider_version":"11.0.0","defaults":"name","context":"cloudformation.context","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"cloudformation.template":{"id":"cloudformation.template","name":"cloudformation.template","fields":{"conditions":{"name":"conditions","type":"\u001a\u0007\n","title":"Conditions section","desc":"The `Conditions` section keyed by condition name, each value the raw boolean expression (`Fn::Equals`, `Fn::And`, `Fn::Or`, `Fn::Not`) that gates whether a resource or output is created.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Template description","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"globals":{"name":"globals","type":"\u001a\u0007\n","title":"Globals section (SAM)","desc":"The SAM `Globals` section keyed by resource-type name (`Function`, `Api`, `HttpApi`, `SimpleTable`, `StateMachine`). Each value is the raw body of default properties applied to every resource of that type in the template. Empty for a plain CloudFormation template.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"mappings":{"name":"mappings","type":"\u001a\u0007\n","title":"Mappings section","desc":"The `Mappings` section keyed by each mapping's logical name. Every value is the raw mapping body: an inner set of keys (typically a region or environment name) each holding named attribute values that templates resolve with `Fn::FindInMap`.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"metadata":{"name":"metadata","type":"\u001a\u0007\n","title":"Metadata section","desc":"The `Metadata` section keyed by metadata key (for example `AWS::CloudFormation::Interface` for console parameter grouping, or `AWS::CloudFormation::Designer`). Each value is the raw metadata body.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"outputs":{"name":"outputs","type":"\u0019\u001bcloudformation.output","title":"Template outputs","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"parameterList":{"name":"parameterList","type":"\u0019\u001bcloudformation.parameter","title":"Parameter declarations as typed objects","desc":"Iterate the `Parameters` section as `cloudformation.parameter` records exposing type, default, allowed values / patterns, length and value bounds, and the `NoEcho` flag — useful for policy that needs to reason about how a stack accepts input. Use `parameters` (the dict form) when you need a key-keyed view of the same data.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"parameters":{"name":"parameters","type":"\u001a\u0007\n","title":"Parameters section as raw dicts","desc":"The `Parameters` section keyed by parameter logical name, each value the raw parameter body (`Type`, `Default`, `AllowedValues`, `NoEcho`, and other constraints). Use `parameterList` for the same data as structured records with individual fields.","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"resources":{"name":"resources","type":"\u0019\u001bcloudformation.resource","title":"Template resources","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"rules":{"name":"rules","type":"\u001a\u0007\n","title":"Rules section for parameter validation","desc":"The `Rules` section keyed by rule name, each value the raw rule body: an optional `RuleCondition` and the `Assertions` that validate parameter values at stack create or update time.","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"transform":{"name":"transform","type":"\u0019\u0007","is_mandatory":true,"title":"Template macros","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"types":{"name":"types","type":"\u0019\u0007","title":"AWS resource types referenced in the template","provider":"go.mondoo.com/mql/v13/providers/cloudformation"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Template format version","provider":"go.mondoo.com/mql/v13/providers/cloudformation"}},"title":"AWS CloudFormation template","desc":"CloudFormation template (or SAM template via Transform) parsed for static analysis of infrastructure-as-code. Exposes the template metadata (AWSTemplateFormatVersion, Transform, Description), the parameter, mapping, condition, rule, global, and metadata sections, the declared resources, the outputs, and the full set of AWS resource types referenced. This is the surface for IaC policy checks against CloudFormation and SAM templates.","min_provider_version":"11.0.0","defaults":"description","provider":"go.mondoo.com/mql/v13/providers/cloudformation"}}}