@intentius/chant-lexicon-aws 0.15.2 → 0.16.0

package/src/op/activities/floci.ts

@@ -1,14 +1,11 @@
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
-import { safeHeartbeat, sleep } from "@intentius/chant/op";
-
-const execAsync = promisify(exec);
+import { emulatorLifecycle } from "@intentius/chant/op";
 
 const DEFAULT_NAME = "chant-floci";
 const DEFAULT_PORT = 4566;
 const DEFAULT_IMAGE = "floci/floci:latest";
 const DEFAULT_REGION = "us-east-1";
 const DEFAULT_READY_SERVICE = "cloudformation";
+const DOCKER_SOCK = ["-v", "/var/run/docker.sock:/var/run/docker.sock"] as const;
 
 export interface FlociUpArgs {
   /** Container name. Default: `chant-floci`. */
@@ -34,30 +31,9 @@ export interface FlociDownArgs {
   name?: string;
 }
 
-/** `docker ps -q -f name=<name>` — non-empty stdout means the container is running. */
-export function flociExistsCommand(name: string): string {
-  return `docker ps -q -f name=${name}`;
-}
-
-/** Build the `docker run` command that boots Floci. */
-export function flociRunCommand(args: FlociUpArgs): string {
-  const name = args.name ?? DEFAULT_NAME;
-  const port = args.port ?? DEFAULT_PORT;
-  const image = args.image ?? DEFAULT_IMAGE;
-  const parts = ["docker", "run", "-d", "--rm", "--name", name, "-p", `${port}:4566`];
-  if (args.dockerSocket) parts.push("-v", "/var/run/docker.sock:/var/run/docker.sock");
-  parts.push(image);
-  return parts.join(" ");
-}
-
-/** Build the `docker rm -f` command. */
-export function flociRmCommand(name: string): string {
-  return `docker rm -f ${name}`;
-}
-
-/** The Floci health endpoint URL for a host port. */
-export function flociHealthUrl(port: number): string {
-  return `http://localhost:${port}/_localstack/health`;
+/** True once the health body reports the required service (e.g. `"cloudformation"`). */
+export function isFlociReady(healthBody: string, service: string): boolean {
+  return healthBody.includes(`"${service}"`);
 }
 
 /** The AWS env vars that point the `aws` CLI / SDK at a local Floci endpoint. */
@@ -70,9 +46,32 @@ export function flociEnv(port: number, region: string): Record<string, string> {
   };
 }
 
-/** True once the health body reports the required service (e.g. `"cloudformation"`). */
-export function isFlociReady(healthBody: string, service: string): boolean {
-  return healthBody.includes(`"${service}"`);
+// AWS runs the LocalStack-compatible floci/floci image, so readiness is gated on
+// a service (`cloudformation`) appearing in `/_localstack/health` — unlike the
+// bespoke az/gcp fakes. Shared lifecycle: emulatorLifecycle (#746).
+const flociFor = (readyService: string) =>
+  emulatorLifecycle({
+    name: DEFAULT_NAME,
+    image: DEFAULT_IMAGE,
+    containerPort: DEFAULT_PORT,
+    healthPath: "/_localstack/health",
+    ready: (body) => isFlociReady(body, readyService),
+  });
+
+const builders = flociFor(DEFAULT_READY_SERVICE);
+
+export const flociExistsCommand = builders.existsCommand;
+export const flociRmCommand = builders.rmCommand;
+export const flociHealthUrl = builders.healthUrl;
+
+/** Build the `docker run` command that boots Floci. */
+export function flociRunCommand(args: FlociUpArgs = {}): string {
+  return builders.runCommand({
+    name: args.name,
+    port: args.port,
+    image: args.image,
+    extraArgs: args.dockerSocket ? [...DOCKER_SOCK] : [],
+  });
 }
 
 /**
@@ -81,69 +80,28 @@ export function isFlociReady(healthBody: string, service: string): boolean {
  * Idempotent: reuses a running container of the same name. Waits for the health
  * endpoint to report `readyService`, then sets `AWS_ENDPOINT_URL` + test creds in
  * the process environment so a following `nativeApply`/`cfn-deploy` targets the
- * emulator. Env injection assumes the in-process **local executor**; under a
+ * emulator. Env injection assumes the in-process local executor; under a
  * distributed Temporal worker, pass the endpoint explicitly instead.
- *
- * Uses longInfra profile — 20m timeout, heartbeat every poll (the image may pull).
  */
-export async function flociUp(args: FlociUpArgs, signal?: AbortSignal): Promise<{ endpoint: string }> {
-  const name = args.name ?? DEFAULT_NAME;
-  const port = args.port ?? DEFAULT_PORT;
+export async function flociUp(args: FlociUpArgs = {}, signal?: AbortSignal): Promise<{ endpoint: string }> {
   const region = args.region ?? DEFAULT_REGION;
   const service = args.readyService ?? DEFAULT_READY_SERVICE;
-  const timeoutMs = args.timeoutMs ?? 60_000;
-  const intervalMs = args.intervalMs ?? 2_000;
-
-  let running = false;
-  try {
-    const { stdout } = await execAsync(flociExistsCommand(name), { signal });
-    running = Boolean(stdout.trim());
-  } catch {
-    // `docker ps` failed — assume not running and try to start it.
-  }
-
-  if (running) {
-    console.log(`Floci container "${name}" already running — reusing`);
-  } else {
-    await execAsync(flociRunCommand({ ...args, name, port }), { signal });
-  }
-
-  const url = flociHealthUrl(port);
-  const deadline = Date.now() + timeoutMs;
-  let ready = false;
-  while (Date.now() < deadline) {
-    if (signal?.aborted) throw new Error("flociUp aborted");
-    safeHeartbeat({ step: "flociUp", container: name });
-    try {
-      const { stdout } = await execAsync(`curl -fs ${url}`, { signal });
-      if (isFlociReady(stdout, service)) {
-        ready = true;
-        break;
-      }
-    } catch {
-      // Not up yet (connection refused / non-2xx) — retry.
-    }
-    await sleep(intervalMs, signal);
-  }
-  if (!ready) {
-    throw new Error(`Floci "${name}" did not become ready within ${timeoutMs}ms`);
-  }
-
-  const env = flociEnv(port, region);
-  Object.assign(process.env, env);
-  console.log(`Floci ready on ${env.AWS_ENDPOINT_URL} (service: ${service})`);
-  return { endpoint: env.AWS_ENDPOINT_URL };
+  const { endpoint } = await flociFor(service).up(
+    {
+      name: args.name,
+      port: args.port,
+      image: args.image,
+      timeoutMs: args.timeoutMs,
+      intervalMs: args.intervalMs,
+      extraArgs: args.dockerSocket ? [...DOCKER_SOCK] : [],
+    },
+    signal,
+  );
+  Object.assign(process.env, flociEnv(args.port ?? DEFAULT_PORT, region));
+  return { endpoint };
 }
 
-/**
- * Stop and remove the local Floci emulator container. A no-op success when the
- * container is already gone. Uses fastIdempotent profile — 5m timeout.
- */
-export async function flociDown(args: FlociDownArgs, signal?: AbortSignal): Promise<void> {
-  const name = args.name ?? DEFAULT_NAME;
-  try {
-    await execAsync(flociRmCommand(name), { signal });
-  } catch {
-    // Already removed (`--rm` on exit, or never started) — treat as success.
-  }
+/** Stop and remove the local Floci emulator container (no-op if already gone). */
+export async function flociDown(args: FlociDownArgs = {}, signal?: AbortSignal): Promise<void> {
+  return builders.down(args, signal);
 }

package/src/op/activities/index.ts

@@ -1,7 +1,9 @@
 /**
  * AWS Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `aws` lexicon. Contributes the local Floci AWS
- * emulator lifecycle (`flociUp`/`flociDown`).
+ * emulator lifecycle (`flociUp`/`flociDown`) and the native CloudFormation
+ * applier (`awsApply`), which calls the CloudFormation API directly rather than
+ * shelling `aws` — the direct twin of `azApply`/`gcpApply`.
  */
 export {
   flociUp,
@@ -14,3 +16,22 @@ export {
   isFlociReady,
 } from "./floci";
 export type { FlociUpArgs, FlociDownArgs } from "./floci";
+
+export {
+  awsApply,
+  awsDelete,
+  waitForStackSettled,
+  cfnUrl,
+  cfnForm,
+  capabilityParams,
+  xmlField,
+  stackStatus,
+  stackId,
+  cfnErrorMessage,
+  isStackMissing,
+  isNoUpdates,
+  isSuccessStatus,
+  isFailureStatus,
+  isTerminalStatus,
+} from "./aws-apply";
+export type { AwsApplyArgs, AwsHttp } from "./aws-apply";

package/src/plugin.ts

@@ -14,6 +14,8 @@ import { readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { awsSerializer } from "./serializer";
+import { awsReferenceCatalog } from "./reference-catalog";
+import { resolveTemplateAttrs } from "./live-attrs";
 import { CFParser } from "./import/parser";
 import { CFGenerator } from "./import/generator";
 import { parseStackTemplate } from "./import/live-export";
@@ -31,6 +33,8 @@ export const awsPlugin: LexiconPlugin = {
   serializer: awsSerializer,
   // Audit rule metadata for this lexicon's WAW* checks (#687).
   auditCatalog: () => awsAuditCatalog,
+  // Live edge reconstruction for `chant graph --live` (#778).
+  referenceCatalog: awsReferenceCatalog,
 
   lintRules(): LintRule[] {
     const rulesDir = join(dirname(fileURLToPath(import.meta.url)), "lint", "rules");
@@ -580,6 +584,15 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
     return parseStackTemplate(parsed.TemplateBody, options.selector, options.owned);
   },
 
+  // Live attribute enrichment for `chant graph --live` edge reconstruction (#784).
+  // describe-stack-resources is too thin; the deployed template (exportResources)
+  // carries the references. Resolve its `{Ref}`/`{Fn::GetAtt}` intrinsics to bare
+  // logical ids so the reference resolver matches them.
+  async enrichLiveAttrs(options: { environment: string; owned?: boolean }): Promise<Record<string, Record<string, unknown>>> {
+    const template = await this.exportResources!({ environment: options.environment, owned: options.owned });
+    return resolveTemplateAttrs(template);
+  },
+
   mcpTools() {
     return [
       {

package/src/reference-catalog.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect } from "vitest";
+import { reconstructEdges, containmentGroups } from "@intentius/chant/graph-refs";
+import type { IRNode } from "@intentius/chant/graph-ir";
+import { awsReferenceCatalog } from "./reference-catalog";
+
+const n = (id: string, kind: string, attrs: Record<string, unknown>): IRNode => ({ id, kind, lexicon: "aws", attrs });
+
+// A canonical 3-tier VPC (managed subgraph): internet → ALB (public subnets) →
+// ECS service (private subnets) → RDS, with SG attachments. Attributes are the
+// per-resource describe/export shape the catalog targets.
+const nodes: IRNode[] = [
+  n("vpc", "AWS::EC2::VPC", { VpcId: "vpc-1" }),
+  n("pubA", "AWS::EC2::Subnet", { SubnetId: "subnet-pa", VpcId: "vpc-1" }),
+  n("pubB", "AWS::EC2::Subnet", { SubnetId: "subnet-pb", VpcId: "vpc-1" }),
+  n("privA", "AWS::EC2::Subnet", { SubnetId: "subnet-qa", VpcId: "vpc-1" }),
+  n("privB", "AWS::EC2::Subnet", { SubnetId: "subnet-qb", VpcId: "vpc-1" }),
+  n("albSg", "AWS::EC2::SecurityGroup", { GroupId: "sg-alb", VpcId: "vpc-1" }),
+  n("appSg", "AWS::EC2::SecurityGroup", { GroupId: "sg-app", VpcId: "vpc-1", IpPermissions: [{ UserIdGroupPairs: [{ GroupId: "sg-alb" }] }] }),
+  n("alb", "AWS::ElasticLoadBalancingV2::LoadBalancer", { LoadBalancerArn: "arn-alb", AvailabilityZones: [{ SubnetId: "subnet-pa" }, { SubnetId: "subnet-pb" }], SecurityGroups: ["sg-alb"] }),
+  n("tg", "AWS::ElasticLoadBalancingV2::TargetGroup", { TargetGroupArn: "arn-tg", VpcId: "vpc-1" }),
+  n("listener", "AWS::ElasticLoadBalancingV2::Listener", { LoadBalancerArn: "arn-alb", DefaultActions: [{ TargetGroupArn: "arn-tg" }] }),
+  n("cluster", "AWS::ECS::Cluster", { ClusterArn: "arn-cl" }),
+  n("taskdef", "AWS::ECS::TaskDefinition", { TaskDefinitionArn: "arn-td" }),
+  n("svc", "AWS::ECS::Service", { ServiceArn: "arn-svc", ClusterArn: "arn-cl", TaskDefinition: "arn-td", LoadBalancers: [{ TargetGroupArn: "arn-tg" }], NetworkConfiguration: { AwsvpcConfiguration: { Subnets: ["subnet-qa", "subnet-qb"], SecurityGroups: ["sg-app"] } } }),
+  n("rds", "AWS::RDS::DBInstance", { DBInstanceArn: "arn-rds", DBSubnetGroup: { Subnets: [{ SubnetIdentifier: "subnet-qa" }, { SubnetIdentifier: "subnet-qb" }] }, VpcSecurityGroups: [{ VpcSecurityGroupId: "sg-app" }] }),
+];
+
+describe("awsReferenceCatalog — golden 3-tier VPC", () => {
+  const { edges, containment, dangling } = reconstructEdges(nodes, awsReferenceCatalog);
+  const hasEdge = (from: string, to: string, via?: string) =>
+    edges.some((e) => e.from === from && e.to === to && (via === undefined || e.viaAttr === via));
+  const hasCont = (child: string, parent: string) =>
+    containment.some((c) => c.child === child && c.parent === parent);
+
+  it("reconstructs the topology edges", () => {
+    expect(hasEdge("svc", "cluster", "in cluster")).toBe(true);
+    expect(hasEdge("svc", "taskdef", "runs")).toBe(true);
+    expect(hasEdge("svc", "tg", "registered in")).toBe(true);
+    expect(hasEdge("svc", "appSg", "sg")).toBe(true);
+    expect(hasEdge("listener", "alb", "on")).toBe(true);
+    expect(hasEdge("listener", "tg", "forwards to")).toBe(true);
+    expect(hasEdge("alb", "albSg", "sg")).toBe(true);
+    expect(hasEdge("appSg", "albSg", "allows")).toBe(true);
+    expect(hasEdge("rds", "appSg", "sg")).toBe(true);
+  });
+
+  it("reconstructs network containment (→ #779 boundaries), not as edges", () => {
+    for (const s of ["pubA", "pubB", "privA", "privB", "albSg", "appSg", "tg"]) expect(hasCont(s, "vpc")).toBe(true);
+    expect(hasCont("alb", "pubA")).toBe(true);
+    expect(hasCont("alb", "pubB")).toBe(true);
+    expect(hasCont("svc", "privA")).toBe(true);
+    expect(hasCont("rds", "privB")).toBe(true);
+    // containment is never an edge
+    expect(edges.some((e) => e.to === "vpc")).toBe(false);
+  });
+
+  it("has no dangling references — every target is in the observed set", () => {
+    expect(dangling).toEqual([]);
+  });
+
+  it("reference edges point holder → referenced", () => {
+    // e.g. the service references the cluster, not the reverse
+    expect(hasEdge("cluster", "svc")).toBe(false);
+  });
+
+  it("containment groups nest VPC → subnets → resources (#779)", () => {
+    const groups = containmentGroups(containment);
+    // the VPC contains its subnets, SGs, and target group
+    expect(groups.vpc).toEqual(expect.arrayContaining(["pubA", "pubB", "privA", "privB", "albSg", "appSg", "tg"]));
+    // public subnets contain the ALB; private subnets contain the service + RDS
+    expect(groups.pubA).toContain("alb");
+    expect(groups.privA).toEqual(expect.arrayContaining(["svc", "rds"]));
+  });
+});

package/src/reference-catalog.ts

@@ -0,0 +1,82 @@
+import type { ReferenceCatalog } from "@intentius/chant/lexicon";
+
+/**
+ * AWS reference catalog (#778, epic #776 v1) — how observed AWS resources
+ * reference each other, so `chant graph --live` can reconstruct the topology.
+ *
+ * Keyed to the per-resource describe/export attribute shape (`VpcId`,
+ * `SecurityGroups[].GroupId`, `TargetGroupArn`, …), not the thin
+ * `describe-stack-resources` metadata. Enough to draw the canonical 3-tier VPC
+ * (internet → ALB → ECS service → RDS, with SG attachments). `containment`
+ * relations (subnet ∈ VPC) feed #779's boundary boxes; `reference` relations are
+ * edges.
+ */
+export const awsReferenceCatalog: ReferenceCatalog = {
+  identities: [
+    { kind: "AWS::EC2::VPC", ids: ["VpcId"] },
+    { kind: "AWS::EC2::Subnet", ids: ["SubnetId"] },
+    { kind: "AWS::EC2::SecurityGroup", ids: ["GroupId"] },
+    { kind: "AWS::EC2::Instance", ids: ["InstanceId"] },
+    { kind: "AWS::EC2::InternetGateway", ids: ["InternetGatewayId"] },
+    { kind: "AWS::EC2::NatGateway", ids: ["NatGatewayId"] },
+    { kind: "AWS::EC2::RouteTable", ids: ["RouteTableId"] },
+    { kind: "AWS::ElasticLoadBalancingV2::LoadBalancer", ids: ["LoadBalancerArn", "DNSName"] },
+    { kind: "AWS::ElasticLoadBalancingV2::TargetGroup", ids: ["TargetGroupArn"] },
+    { kind: "AWS::ECS::Cluster", ids: ["ClusterArn", "ClusterName"] },
+    { kind: "AWS::ECS::Service", ids: ["ServiceArn"] },
+    { kind: "AWS::ECS::TaskDefinition", ids: ["TaskDefinitionArn"] },
+    { kind: "AWS::RDS::DBInstance", ids: ["DBInstanceArn", "Endpoint.Address"] },
+  ],
+  refs: [
+    // ── containment (→ boundary boxes, #779) ──
+    { from: "AWS::EC2::Subnet", path: "VpcId", targetKind: "AWS::EC2::VPC", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::SecurityGroup", path: "VpcId", targetKind: "AWS::EC2::VPC", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::RouteTable", path: "VpcId", targetKind: "AWS::EC2::VPC", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::Instance", path: "SubnetId", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+    { from: "AWS::EC2::NatGateway", path: "SubnetId", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+    { from: "AWS::ElasticLoadBalancingV2::LoadBalancer", path: "AvailabilityZones[].SubnetId", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+    { from: "AWS::ElasticLoadBalancingV2::TargetGroup", path: "VpcId", targetKind: "AWS::EC2::VPC", relation: "containment", label: "in VPC" },
+    { from: "AWS::ECS::Service", path: "NetworkConfiguration.AwsvpcConfiguration.Subnets[]", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+    { from: "AWS::RDS::DBInstance", path: "DBSubnetGroup.Subnets[].SubnetIdentifier", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+
+    // ── references (→ edges) ──
+    { from: "AWS::EC2::Instance", path: "SecurityGroups[].GroupId", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "sg" },
+    { from: "AWS::EC2::SecurityGroup", path: "IpPermissions[].UserIdGroupPairs[].GroupId", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "allows" },
+    { from: "AWS::EC2::Route", path: "GatewayId", targetKind: "AWS::EC2::InternetGateway", relation: "reference", label: "via" },
+    { from: "AWS::EC2::Route", path: "NatGatewayId", targetKind: "AWS::EC2::NatGateway", relation: "reference", label: "via" },
+    { from: "AWS::ElasticLoadBalancingV2::LoadBalancer", path: "SecurityGroups[]", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "sg" },
+    { from: "AWS::ElasticLoadBalancingV2::Listener", path: "LoadBalancerArn", targetKind: "AWS::ElasticLoadBalancingV2::LoadBalancer", relation: "reference", label: "on" },
+    { from: "AWS::ElasticLoadBalancingV2::Listener", path: "DefaultActions[].TargetGroupArn", targetKind: "AWS::ElasticLoadBalancingV2::TargetGroup", relation: "reference", label: "forwards to" },
+    { from: "AWS::ECS::Service", path: "ClusterArn", targetKind: "AWS::ECS::Cluster", relation: "reference", label: "in cluster" },
+    { from: "AWS::ECS::Service", path: "TaskDefinition", targetKind: "AWS::ECS::TaskDefinition", relation: "reference", label: "runs" },
+    { from: "AWS::ECS::Service", path: "LoadBalancers[].TargetGroupArn", targetKind: "AWS::ElasticLoadBalancingV2::TargetGroup", relation: "reference", label: "registered in" },
+    { from: "AWS::ECS::Service", path: "NetworkConfiguration.AwsvpcConfiguration.SecurityGroups[]", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "sg" },
+    { from: "AWS::RDS::DBInstance", path: "VpcSecurityGroups[].VpcSecurityGroupId", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "sg" },
+
+    // ── CloudFormation *template* property paths (#784) ──
+    // `enrichLiveAttrs` resolves the deployed template's `{Ref}`/`{Fn::GetAtt}`
+    // intrinsics to bare logical ids (= node ids), so these match by node id; the
+    // property names are the CFN template shape (SecurityGroupIds, Cluster, …),
+    // which differs from the describe/SDK shape above. No targetKind needed —
+    // logical ids are unique.
+    { from: "AWS::EC2::Subnet", path: "VpcId", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::SecurityGroup", path: "VpcId", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::RouteTable", path: "VpcId", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::Instance", path: "SubnetId", relation: "containment", label: "in subnet" },
+    { from: "AWS::EC2::Instance", path: "SecurityGroupIds[]", relation: "reference", label: "sg" },
+    { from: "AWS::EC2::NatGateway", path: "SubnetId", relation: "containment", label: "in subnet" },
+    { from: "AWS::EC2::Route", path: "RouteTableId", relation: "reference", label: "in" },
+    { from: "AWS::EC2::Route", path: "GatewayId", relation: "reference", label: "via" },
+    { from: "AWS::EC2::Route", path: "NatGatewayId", relation: "reference", label: "via" },
+    { from: "AWS::ElasticLoadBalancingV2::LoadBalancer", path: "Subnets[]", relation: "containment", label: "in subnet" },
+    { from: "AWS::ElasticLoadBalancingV2::LoadBalancer", path: "SecurityGroups[]", relation: "reference", label: "sg" },
+    { from: "AWS::ElasticLoadBalancingV2::TargetGroup", path: "VpcId", relation: "containment", label: "in VPC" },
+    { from: "AWS::ElasticLoadBalancingV2::Listener", path: "LoadBalancerArn", relation: "reference", label: "on" },
+    { from: "AWS::ElasticLoadBalancingV2::Listener", path: "DefaultActions[].TargetGroupArn", relation: "reference", label: "forwards to" },
+    { from: "AWS::ECS::Service", path: "Cluster", relation: "reference", label: "in cluster" },
+    { from: "AWS::ECS::Service", path: "TaskDefinition", relation: "reference", label: "runs" },
+    { from: "AWS::ECS::Service", path: "LoadBalancers[].TargetGroupArn", relation: "reference", label: "registered in" },
+    { from: "AWS::RDS::DBInstance", path: "DBSubnetGroupName", relation: "reference", label: "subnets" },
+    { from: "AWS::RDS::DBInstance", path: "VPCSecurityGroups[]", relation: "reference", label: "sg" },
+  ],
+};