@intentius/chant-lexicon-aws 0.18.12 → 0.18.13

package/dist/rules/waw046.ts

@@ -0,0 +1,59 @@
+/**
+ * WAW046: ECS Secret-Looking Value In Plaintext Environment
+ *
+ * Flags ECS TaskDefinition container `Environment` entries whose name looks
+ * like a credential (password/secret/token/key/credential) — those values are
+ * visible in the task definition and console. They should be passed via
+ * `Secrets` (Secrets Manager / SSM Parameter Store) instead.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, getContainerDefinitions, isIntrinsic } from "./cf-refs";
+
+const SECRET_NAME_PATTERN = /password|secret|token|api[_-]?key|credential/i;
+
+export function checkEcsPlaintextSecrets(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ECS::TaskDefinition") continue;
+
+      for (const container of getContainerDefinitions(resource)) {
+        const env = container.Environment;
+        if (!Array.isArray(env)) continue;
+
+        for (const entry of env) {
+          if (typeof entry !== "object" || entry === null) continue;
+          const name = (entry as Record<string, unknown>).Name;
+          if (isIntrinsic(name) || typeof name !== "string") continue;
+
+          if (SECRET_NAME_PATTERN.test(name)) {
+            const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+            diagnostics.push({
+              checkId: "WAW046",
+              severity: "error",
+              message: `TaskDefinition "${logicalId}" container "${containerName}" passes "${name}" via plaintext Environment — use Secrets (Secrets Manager/SSM) instead`,
+              entity: logicalId,
+              lexicon: "aws",
+            });
+          }
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw046: PostSynthCheck = {
+  id: "WAW046",
+  description: "ECS container passes a secret-looking value via plaintext Environment instead of Secrets",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcsPlaintextSecrets(ctx);
+  },
+};

package/dist/rules/waw047.ts

@@ -0,0 +1,50 @@
+/**
+ * WAW047: ECS Privileged Container
+ *
+ * Flags ECS TaskDefinition containers running with Privileged: true — the
+ * container gets elevated access to the host, equivalent to root on the EC2
+ * instance (and rejected outright on Fargate).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, getContainerDefinitions, isIntrinsic } from "./cf-refs";
+
+export function checkEcsPrivilegedContainer(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ECS::TaskDefinition") continue;
+
+      for (const container of getContainerDefinitions(resource)) {
+        const privileged = container.Privileged;
+        if (isIntrinsic(privileged)) continue;
+
+        if (privileged === true) {
+          const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+          diagnostics.push({
+            checkId: "WAW047",
+            severity: "error",
+            message: `TaskDefinition "${logicalId}" container "${containerName}" runs with Privileged: true — drop elevated host access`,
+            entity: logicalId,
+            lexicon: "aws",
+          });
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw047: PostSynthCheck = {
+  id: "WAW047",
+  description: "ECS container runs privileged — drop elevated host access",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcsPrivilegedContainer(ctx);
+  },
+};

package/dist/rules/waw048.ts

@@ -0,0 +1,47 @@
+/**
+ * WAW048: ECS Missing Log Configuration
+ *
+ * Flags ECS TaskDefinition containers with no LogConfiguration — container
+ * stdout/stderr is discarded, leaving no audit trail. Mirrors WAW024 (ALB
+ * access logging): advisory, not a hard block.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, getContainerDefinitions } from "./cf-refs";
+
+export function checkEcsLogConfiguration(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ECS::TaskDefinition") continue;
+
+      for (const container of getContainerDefinitions(resource)) {
+        if (container.LogConfiguration === undefined) {
+          const containerName = typeof container.Name === "string" ? container.Name : "<unnamed>";
+          diagnostics.push({
+            checkId: "WAW048",
+            severity: "warning",
+            message: `TaskDefinition "${logicalId}" container "${containerName}" has no LogConfiguration — container output is discarded`,
+            entity: logicalId,
+            lexicon: "aws",
+          });
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw048: PostSynthCheck = {
+  id: "WAW048",
+  description: "ECS container does not have a LogConfiguration — enable logging for audit trails",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcsLogConfiguration(ctx);
+  },
+};

package/dist/rules/waw049.ts

@@ -0,0 +1,100 @@
+/**
+ * WAW049: Security Group Broad Ingress (any port, except ALB:80/443)
+ *
+ * Generalizes WAW019 beyond the four named sensitive ports (SSH/RDP/MySQL/
+ * Postgres): flags 0.0.0.0/0 or ::/0 ingress on *any* port, with a carve-out
+ * for the conventional public ALB listener ports (exactly 80 or 443).
+ *
+ * Port 80 is exempt unconditionally, not just on a relaxed tier (#917): a
+ * public ALB's HTTP listener is meant to be internet-facing on every tier —
+ * on the full/production tier it still needs an SG rule open to 0.0.0.0/0 so
+ * clients can reach the listener that redirects them to HTTPS (WAW044 is the
+ * rule that enforces the redirect actually happens; this rule only judges the
+ * SG's shape). The "light" tier serves plaintext HTTP straight off that same
+ * port instead of redirecting, which doesn't change the SG's exposure at all.
+ * A genuinely over-broad rule (all ports, SSH, etc.) still errors regardless
+ * of tier.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, getSecurityGroupIngress, isIntrinsic } from "./cf-refs";
+
+const OPEN_CIDRS = new Set(["0.0.0.0/0", "::/0"]);
+const ALB_LISTENER_PORTS = new Set([80, 443]);
+
+function isAlbListenerException(rule: Record<string, unknown>): boolean {
+  return (
+    typeof rule.FromPort === "number" &&
+    rule.FromPort === rule.ToPort &&
+    ALB_LISTENER_PORTS.has(rule.FromPort)
+  );
+}
+
+function checkIngressRule(
+  rule: Record<string, unknown>,
+  logicalId: string,
+  diagnostics: PostSynthDiagnostic[],
+): void {
+  const cidrIp = rule.CidrIp;
+  const cidrIpv6 = rule.CidrIpv6;
+
+  const hasOpenCidr =
+    (typeof cidrIp === "string" && OPEN_CIDRS.has(cidrIp)) ||
+    (typeof cidrIpv6 === "string" && OPEN_CIDRS.has(cidrIpv6));
+
+  if (!hasOpenCidr) return;
+
+  // Can't statically verify a port pinned by an intrinsic — don't guess.
+  if (isIntrinsic(rule.FromPort) || isIntrinsic(rule.ToPort)) return;
+
+  if (isAlbListenerException(rule)) return;
+
+  const cidr = typeof cidrIp === "string" && OPEN_CIDRS.has(cidrIp) ? cidrIp : cidrIpv6;
+  const fromPort = rule.FromPort;
+  const toPort = rule.ToPort;
+  const portDesc =
+    fromPort !== undefined && toPort !== undefined ? ` on ports ${fromPort}-${toPort}` : " on all ports";
+
+  diagnostics.push({
+    checkId: "WAW049",
+    severity: "error",
+    message: `Security group "${logicalId}" allows unrestricted ingress from ${cidr}${portDesc} — restrict to specific CIDR ranges (only ALB:80/443 is exempt)`,
+    entity: logicalId,
+    lexicon: "aws",
+  });
+}
+
+export function checkBroadIngress(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type === "AWS::EC2::SecurityGroup") {
+        for (const rule of getSecurityGroupIngress(resource)) {
+          checkIngressRule(rule, logicalId, diagnostics);
+        }
+      }
+
+      if (resource.Type === "AWS::EC2::SecurityGroupIngress") {
+        const props = resource.Properties ?? {};
+        if (!isIntrinsic(props)) {
+          checkIngressRule(props as Record<string, unknown>, logicalId, diagnostics);
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw049: PostSynthCheck = {
+  id: "WAW049",
+  description: "Security group allows unrestricted ingress on a port other than ALB:80/443",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkBroadIngress(ctx);
+  },
+};

package/dist/rules/waw050.ts

@@ -0,0 +1,54 @@
+/**
+ * WAW050: Cognito Advanced Security Disabled
+ *
+ * Flags Cognito UserPools without UserPoolAddOns.AdvancedSecurityMode set to
+ * AUDIT or ENFORCED — without it, Cognito does not evaluate risk (compromised
+ * credentials, adaptive auth) on sign-in/sign-up.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkCognitoAdvancedSecurity(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::Cognito::UserPool") continue;
+
+      const props = resource.Properties ?? {};
+      const addOns = props.UserPoolAddOns;
+
+      if (isIntrinsic(addOns)) continue;
+
+      const mode =
+        typeof addOns === "object" && addOns !== null ? (addOns as Record<string, unknown>).AdvancedSecurityMode : undefined;
+
+      if (isIntrinsic(mode)) continue;
+
+      if (mode !== "AUDIT" && mode !== "ENFORCED") {
+        diagnostics.push({
+          checkId: "WAW050",
+          severity: "error",
+          message: `Cognito UserPool "${logicalId}" does not have advanced security enabled — set UserPoolAddOns.AdvancedSecurityMode to AUDIT or ENFORCED`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw050: PostSynthCheck = {
+  id: "WAW050",
+  description: "Cognito UserPool does not have advanced security (risk-based auth) enabled",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkCognitoAdvancedSecurity(ctx);
+  },
+};

package/dist/rules/waw051.ts

@@ -0,0 +1,49 @@
+/**
+ * WAW051: Cognito Implicit OAuth Grant Allowed
+ *
+ * Flags UserPoolClients whose AllowedOAuthFlows include the deprecated
+ * "implicit" grant — it returns tokens directly in the redirect URL (exposed
+ * in browser history/referrer headers) instead of via a code exchange.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkCognitoImplicitGrant(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::Cognito::UserPoolClient") continue;
+
+      const props = resource.Properties ?? {};
+      const flows = props.AllowedOAuthFlows;
+
+      if (isIntrinsic(flows) || !Array.isArray(flows)) continue;
+
+      if (flows.some((f) => f === "implicit")) {
+        diagnostics.push({
+          checkId: "WAW051",
+          severity: "error",
+          message: `Cognito UserPoolClient "${logicalId}" allows the implicit OAuth grant — use the authorization code grant instead`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw051: PostSynthCheck = {
+  id: "WAW051",
+  description: "Cognito UserPoolClient allows the deprecated implicit OAuth grant",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkCognitoImplicitGrant(ctx);
+  },
+};

package/dist/rules/waw052.ts

@@ -0,0 +1,51 @@
+/**
+ * WAW052: Cognito MFA Not Required (full tier)
+ *
+ * Flags UserPools without MfaConfiguration: ON. Tier-aware (#894), same
+ * seam as WAW040: a relaxed "light" stack (local/Floci, or no --env/
+ * ownership.env set) only warns; the strict "full"/production tier
+ * (ctx.env === "prod"/"production"/"full") fails the build.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic, isFullTierEnv } from "./cf-refs";
+
+export function checkCognitoMfaRequired(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+  const severity = isFullTierEnv(ctx.env) ? "error" : "warning";
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::Cognito::UserPool") continue;
+
+      const props = resource.Properties ?? {};
+      const mfaConfiguration = props.MfaConfiguration;
+
+      if (isIntrinsic(mfaConfiguration)) continue;
+
+      if (mfaConfiguration !== "ON") {
+        diagnostics.push({
+          checkId: "WAW052",
+          severity,
+          message: `Cognito UserPool "${logicalId}" does not require MFA (MfaConfiguration: ON) — require it on the full/production tier`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw052: PostSynthCheck = {
+  id: "WAW052",
+  description: "Cognito UserPool does not require MFA (full tier)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkCognitoMfaRequired(ctx);
+  },
+};

package/dist/rules/waw053.ts

@@ -0,0 +1,53 @@
+/**
+ * WAW053: ECR Image Scanning Disabled
+ *
+ * Flags ECR repositories without ImageScanningConfiguration.ScanOnPush: true
+ * — pushed images aren't scanned for known CVEs.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkEcrScanOnPush(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ECR::Repository") continue;
+
+      const props = resource.Properties ?? {};
+      const scanConfig = props.ImageScanningConfiguration;
+
+      if (isIntrinsic(scanConfig)) continue;
+
+      const scanOnPush =
+        typeof scanConfig === "object" && scanConfig !== null ? (scanConfig as Record<string, unknown>).ScanOnPush : undefined;
+
+      if (isIntrinsic(scanOnPush)) continue;
+
+      if (scanOnPush !== true) {
+        diagnostics.push({
+          checkId: "WAW053",
+          severity: "error",
+          message: `ECR repository "${logicalId}" does not have ImageScanningConfiguration.ScanOnPush: true — pushed images aren't scanned for vulnerabilities`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw053: PostSynthCheck = {
+  id: "WAW053",
+  description: "ECR repository does not scan images on push",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcrScanOnPush(ctx);
+  },
+};

package/dist/rules/waw054.ts

@@ -0,0 +1,49 @@
+/**
+ * WAW054: ECR Tag Mutability Not Immutable
+ *
+ * Flags ECR repositories without ImageTagMutability: IMMUTABLE — mutable tags
+ * let a previously deployed/scanned/signed tag (e.g. "prod") silently point at
+ * different image content later.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkEcrTagImmutability(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::ECR::Repository") continue;
+
+      const props = resource.Properties ?? {};
+      const mutability = props.ImageTagMutability;
+
+      if (isIntrinsic(mutability)) continue;
+
+      if (mutability !== "IMMUTABLE") {
+        diagnostics.push({
+          checkId: "WAW054",
+          severity: "error",
+          message: `ECR repository "${logicalId}" does not have ImageTagMutability: IMMUTABLE — a tag can silently be repointed at different image content`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw054: PostSynthCheck = {
+  id: "WAW054",
+  description: "ECR repository does not have immutable image tags",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkEcrTagImmutability(ctx);
+  },
+};

package/dist/rules/waw055.ts

@@ -0,0 +1,49 @@
+/**
+ * WAW055: CloudWatch Logs Retention Not Set
+ *
+ * Flags Logs::LogGroup resources without RetentionInDays — an unset
+ * retention means "Never expire," which is rarely the intended cost/
+ * compliance posture.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, isIntrinsic } from "./cf-refs";
+
+export function checkLogsRetention(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::Logs::LogGroup") continue;
+
+      const props = resource.Properties ?? {};
+      const retention = props.RetentionInDays;
+
+      if (isIntrinsic(retention)) continue;
+
+      if (retention === undefined) {
+        diagnostics.push({
+          checkId: "WAW055",
+          severity: "warning",
+          message: `Log group "${logicalId}" has no RetentionInDays set — logs are kept forever by default; set an explicit retention period`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw055: PostSynthCheck = {
+  id: "WAW055",
+  description: "CloudWatch Logs log group has no retention period set",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkLogsRetention(ctx);
+  },
+};

package/dist/types/index.d.ts

@@ -50316,7 +50316,7 @@ export declare class CfDistribution_CustomOriginConfig {
     HTTPSPort?: number;
     /** Specifies which IP protocol CloudFront uses when connecting to your origin. If your origin uses both IPv4 and IPv6 protocols, you can choose ``dualstack`` to help optimize reliability. */
     IpAddressType?: "dualstack" | "ipv4" | "ipv6";
-    /** Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 120 seconds, and the default (if you don't specify otherwise) is 5 seconds.
+    /** Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 300 seconds, and the default (if you don't specify otherwise) is 5 seconds.
  For more information, see [Keep-alive timeout (custom origins only)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginKeepaliveTimeout) in the *Amazon CloudFront Developer Guide*. */
     OriginKeepaliveTimeout?: number;
     /** Configures mutual TLS authentication between CloudFront and your origin server. */
@@ -50795,7 +50795,7 @@ export declare class CfDistribution_VpcOriginConfig {
   constructor(props: {
     /** The VPC origin ID. */
     VpcOriginId: string;
-    /** Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 120 seconds, and the default (if you don't specify otherwise) is 5 seconds.
+    /** Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 300 seconds, and the default (if you don't specify otherwise) is 5 seconds.
  For more information, see [Keep-alive timeout (custom origins only)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginKeepaliveTimeout) in the *Amazon CloudFront Developer Guide*. */
     OriginKeepaliveTimeout?: number;
     /** Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout*. The minimum timeout is 1 second, the maximum is 120 seconds, and the default (if you don't specify otherwise) is 30 seconds.
@@ -50808,7 +50808,7 @@ export declare class CfDistribution_VpcOriginConfig {
 
 export declare class CfFunction_FunctionConfig {
   constructor(props: {
-    /** A comment to describe the function. */
+    /** A comment to describe the function. The comment cannot be longer than 128 characters. */
     Comment: string;
     /** The function's runtime environment version. */
     Runtime: string;
@@ -54524,7 +54524,7 @@ export declare class ConnectionDrainingPolicy {
 
 export declare class ConnectionFunction_ConnectionFunctionConfig {
   constructor(props: {
-    /** A comment to describe the function. */
+    /** A comment to describe the function. The comment cannot be longer than 128 characters. */
     Comment: string;
     /** The function's runtime environment version. */
     Runtime: "cloudfront-js-2.0";
@@ -54560,7 +54560,7 @@ export declare class ConnectionFunctionAssociation {
 
 export declare class ConnectionFunctionConfig {
   constructor(props: {
-    /** A comment to describe the function. */
+    /** A comment to describe the function. The comment cannot be longer than 128 characters. */
     Comment: string;
     /** The function's runtime environment version. */
     Runtime: "cloudfront-js-2.0";
@@ -57733,7 +57733,7 @@ export declare class CustomOriginConfig {
     HTTPSPort?: number;
     /** Specifies which IP protocol CloudFront uses when connecting to your origin. If your origin uses both IPv4 and IPv6 protocols, you can choose ``dualstack`` to help optimize reliability. */
     IpAddressType?: "dualstack" | "ipv4" | "ipv6";
-    /** Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 120 seconds, and the default (if you don't specify otherwise) is 5 seconds.
+    /** Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 300 seconds, and the default (if you don't specify otherwise) is 5 seconds.
  For more information, see [Keep-alive timeout (custom origins only)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginKeepaliveTimeout) in the *Amazon CloudFront Developer Guide*. */
     OriginKeepaliveTimeout?: number;
     /** Configures mutual TLS authentication between CloudFront and your origin server. */
@@ -72661,7 +72661,7 @@ export declare class FunctionAssociation {
 
 export declare class FunctionConfig {
   constructor(props: {
-    /** A comment to describe the function. */
+    /** A comment to describe the function. The comment cannot be longer than 128 characters. */
     Comment: string;
     /** The function's runtime environment version. */
     Runtime: string;
@@ -121683,6 +121683,7 @@ export declare class VpcOrigin_VpcOriginEndpointConfig {
     HTTPPort?: number;
     /** The HTTPS port of the CloudFront VPC origin endpoint configuration. The default value is ``443``. */
     HTTPSPort?: number;
+    IpAddressType?: "dualstack" | "ipv4";
     /** The origin protocol policy for the CloudFront VPC origin endpoint configuration. */
     OriginProtocolPolicy?: string;
     /** Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS. Valid values include ``SSLv3``, ``TLSv1``, ``TLSv1.1``, and ``TLSv1.2``.
@@ -121695,7 +121696,7 @@ export declare class VpcOriginConfig {
   constructor(props: {
     /** The VPC origin ID. */
     VpcOriginId: string;
-    /** Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 120 seconds, and the default (if you don't specify otherwise) is 5 seconds.
+    /** Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 300 seconds, and the default (if you don't specify otherwise) is 5 seconds.
  For more information, see [Keep-alive timeout (custom origins only)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginKeepaliveTimeout) in the *Amazon CloudFront Developer Guide*. */
     OriginKeepaliveTimeout?: number;
     /** Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout*. The minimum timeout is 1 second, the maximum is 120 seconds, and the default (if you don't specify otherwise) is 30 seconds.
@@ -121716,6 +121717,7 @@ export declare class VpcOriginEndpointConfig {
     HTTPPort?: number;
     /** The HTTPS port of the CloudFront VPC origin endpoint configuration. The default value is ``443``. */
     HTTPSPort?: number;
+    IpAddressType?: "dualstack" | "ipv4";
     /** The origin protocol policy for the CloudFront VPC origin endpoint configuration. */
     OriginProtocolPolicy?: string;
     /** Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS. Valid values include ``SSLv3``, ``TLSv1``, ``TLSv1.1``, and ``TLSv1.2``.
@@ -127344,7 +127346,7 @@ export type EmailContact_EmailContactStatus = "active" | "inactive";
 
 export type EMRServerlessApplication_Architecture = "ARM64" | "X86_64";
 
-export type EnforcedGuardrailConfiguration_ConfigOwner = "ACCOUNT";
+export type EnforcedGuardrailConfiguration_ConfigOwner = "ACCOUNT" | "ORGANIZATION";
 
 export type EnvironmentAccountConnection_Status = "CONNECTED" | "PENDING" | "REJECTED";