/**
 * WAW059: Wildcard Resource where the declared graph enumerates the touched set
 *
 * An identity policy that allows resource-scopable actions on `Resource: "*"`
 * (or a service-wide ARN pattern) when every consumer of the attached role
 * only touches resources declared in the same template. In that case the
 * declared graph already enumerates the touched set, so the statement can be
 * tightened to the `Fn::GetAtt` Arn list of those declared entities.
 *
 * Deliberately narrow (#1225). Fires only when ALL of these hold:
 * - the statement is an `Effect: Allow` identity-policy statement (role inline
 *   policy, IAM::Policy, IAM::ManagedPolicy) — trust policies carry a
 *   Principal and are skipped, resource policies live on other types;
 * - no Condition/NotAction/NotResource and no intrinsics in Action/Resource;
 * - `Resource` is `"*"` or a service-wide ARN pattern;
 * - every Action is in the curated resource-scopable table (s3, dynamodb,
 *   sqs) — actions that genuinely need `"*"` (s3:ListAllMyBuckets,
 *   dynamodb:ListTables, sqs:ListQueues) are not in the table;
 * - the attached principal resolves to declared roles only, those roles have
 *   consumers in the template, and no consumer carries a foreign edge (a
 *   literal ARN of the service) or an intrinsic edge (Fn::ImportValue) that
 *   would put resources outside the declared graph in reach.
 *
 * Anything the static graph cannot prove stays quiet.
 */
import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
/**
 * Curated table of actions that support resource-level permissions, per
 * service. Lower-cased (IAM action matching is case-insensitive). An action
 * outside this table gates the whole statement off — it may legitimately
 * require `Resource: "*"`.
 */
export declare const RESOURCE_SCOPABLE_ACTIONS: Record<string, ReadonlySet<string>>;
export declare function checkWildcardResourceEnumerable(ctx: PostSynthContext): PostSynthDiagnostic[];
export declare const waw059: PostSynthCheck;
//# sourceMappingURL=waw059.d.ts.map