/**
 * WAW063: IAM Policy Denies An Action It Also Allows
 *
 * IAM evaluates an explicit Deny as an absolute veto: it wins over any
 * Allow granted to the same principal, from any attached policy, no matter
 * how the Allow got there. When a role ends up with both an Allow and a
 * Deny for the same action (over an overlapping resource scope) —
 * typically because a broad guardrail policy and a feature-specific policy
 * were attached to the same role independently — CloudFormation deploys
 * the stack without complaint and the contradiction only surfaces as a
 * runtime 403, the most expensive class of error to trace back to its
 * source. This is IAM-reasoning static analysis over the declared graph:
 * collect every Allow/Deny statement attached to each declared IAM::Role
 * (inline, standalone IAM::Policy, and IAM::ManagedPolicy) and flag a
 * literal action+resource collision between an Allow and a Deny.
 *
 * Deliberately conservative to avoid flagging the common intentional
 * "broad Allow + narrow safety-Deny" guardrail pattern (e.g. `Allow ec2:*`
 * plus `Deny ec2:TerminateInstances`):
 *   - both statements' Action lists are compared string-by-string; a match
 *     requires either the literal same action on both sides, or a
 *     wildcarded Deny action that matches a literal (non-wildcarded) Allow
 *     action. A wildcarded Allow paired with a literal Deny is exactly the
 *     guardrail pattern and is never flagged;
 *   - resources are compared the same way: `Resource: "*"` on the Deny
 *     side always overlaps, or a literal exact match; a wildcarded Allow
 *     resource paired with a narrower literal Deny is not flagged;
 *   - any statement carrying a Condition, NotAction, NotResource,
 *     Principal, or an intrinsic Action/Resource is skipped — the rule
 *     can't prove those statically, so it stays quiet.
 */
import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
export declare function checkDenyAllowContradiction(ctx: PostSynthContext): PostSynthDiagnostic[];
export declare const waw063: PostSynthCheck;
//# sourceMappingURL=waw063.d.ts.map