@intentius/chant-lexicon-aws 0.18.23 → 0.18.24

package/src/generated/lexicon-aws.json

@@ -5057,11 +5057,6 @@
     "kind": "property",
     "lexicon": "aws"
   },
-  "AppConfiguration": {
-    "resourceType": "AWS::EMR::InstanceGroupConfig.AppConfiguration",
-    "kind": "property",
-    "lexicon": "aws"
-  },
   "AppCookieStickinessPolicy": {
     "resourceType": "AWS::ElasticLoadBalancing::LoadBalancer.AppCookieStickinessPolicy",
     "kind": "property",
@@ -23164,15 +23159,24 @@
     "kind": "resource",
     "lexicon": "aws",
     "attrs": {
-      "Id": "Id"
+      "CertificateArn": "CertificateArn"
+    },
+    "propertyConstraints": {
+      "CertificateArn": {
+        "pattern": "arn:(aws|aws-cn|aws-us-gov):dms:[\\w-]+:[0-9]+:cert:[A-Z0-9]+"
+      }
     },
     "createOnly": [
       "CertificateIdentifier",
       "CertificatePem",
       "CertificateWallet"
     ],
+    "writeOnly": [
+      "CertificatePem",
+      "CertificateWallet"
+    ],
     "primaryIdentifier": [
-      "Id"
+      "CertificateArn"
     ]
   },
   "DMSEndpoint": {
@@ -49051,7 +49055,7 @@
     "kind": "resource",
     "lexicon": "aws",
     "attrs": {
-      "InstanceGroupId": "InstanceGroupId"
+      "Id": "Id"
     },
     "createOnly": [
       "InstanceRole",
@@ -49064,21 +49068,17 @@
       "Market",
       "BidPrice"
     ],
-    "writeOnly": [
-      "EbsConfiguration/EbsBlockDeviceConfigs/*/VolumesPerInstance"
-    ],
     "primaryIdentifier": [
-      "InstanceGroupId",
-      "JobFlowId"
+      "Id"
     ]
   },
-  "InstanceGroupConfig_AppConfiguration": {
-    "resourceType": "AWS::EMR::InstanceGroupConfig.AppConfiguration",
+  "InstanceGroupConfig_AutoScalingPolicy": {
+    "resourceType": "AWS::EMR::InstanceGroupConfig.AutoScalingPolicy",
     "kind": "property",
     "lexicon": "aws"
   },
-  "InstanceGroupConfig_AutoScalingPolicy": {
-    "resourceType": "AWS::EMR::InstanceGroupConfig.AutoScalingPolicy",
+  "InstanceGroupConfig_Configuration": {
+    "resourceType": "AWS::EMR::InstanceGroupConfig.Configuration",
     "kind": "property",
     "lexicon": "aws"
   },
@@ -53011,6 +53011,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "KmsConfiguration": {
+    "resourceType": "AWS::BedrockAgentCore::TokenVault.KmsConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "KmsEncryptionConfig": {
     "resourceType": "AWS::HealthLake::FHIRDatastore.KmsEncryptionConfig",
     "kind": "property",
@@ -53110,6 +53115,31 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "KnowledgeBasePolicy": {
+    "resourceType": "AWS::Bedrock::KnowledgeBasePolicy",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "RevisionId": "RevisionId"
+    },
+    "propertyConstraints": {
+      "KnowledgeBaseId": {
+        "pattern": "^[0-9a-zA-Z]+$",
+        "minLength": 1,
+        "maxLength": 10
+      },
+      "RevisionId": {
+        "minLength": 1,
+        "maxLength": 255
+      }
+    },
+    "createOnly": [
+      "KnowledgeBaseId"
+    ],
+    "primaryIdentifier": [
+      "KnowledgeBaseId"
+    ]
+  },
   "KubernetesNetworkConfig": {
     "resourceType": "AWS::EKS::Cluster.KubernetesNetworkConfig",
     "kind": "property",
@@ -96832,6 +96862,38 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "TokenVault": {
+    "resourceType": "AWS::BedrockAgentCore::TokenVault",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "TokenVaultId": "TokenVaultId",
+      "KmsConfiguration": "KmsConfiguration",
+      "LastModifiedDate": "LastModifiedDate"
+    },
+    "propertyConstraints": {
+      "TokenVaultId": {
+        "pattern": "^[a-zA-Z0-9\\-_]+$",
+        "minLength": 1,
+        "maxLength": 64
+      },
+      "Arn": {
+        "pattern": "^arn:[a-z0-9-\\.]{1,63}:[a-z0-9-\\.]{0,63}:[a-z0-9-\\.]{0,63}:[a-z0-9-\\.]{0,63}:[^/].{0,1023}$"
+      },
+      "LastModifiedDate": {
+        "format": "date-time"
+      }
+    },
+    "primaryIdentifier": [
+      "Arn"
+    ]
+  },
+  "TokenVault_KmsConfiguration": {
+    "resourceType": "AWS::BedrockAgentCore::TokenVault.KmsConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ToolbarConfiguration": {
     "resourceType": "AWS::WorkSpacesWeb::UserSettings.ToolbarConfiguration",
     "kind": "property",
@@ -98398,6 +98460,22 @@
       "tagUpdatable": true
     }
   },
+  "TransitGatewayPolicyTableAssociation": {
+    "resourceType": "AWS::EC2::TransitGatewayPolicyTableAssociation",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "State": "State"
+    },
+    "createOnly": [
+      "TransitGatewayAttachmentId",
+      "TransitGatewayPolicyTableId"
+    ],
+    "primaryIdentifier": [
+      "TransitGatewayPolicyTableId",
+      "TransitGatewayAttachmentId"
+    ]
+  },
   "TransitGatewayPolicyTable_Tag": {
     "resourceType": "AWS::EC2::TransitGatewayPolicyTable.Tag",
     "kind": "property",
@@ -102333,15 +102411,44 @@
       "DefaultNetworkAcl": "DefaultNetworkAcl",
       "DefaultSecurityGroup": "DefaultSecurityGroup",
       "Ipv6CidrBlocks": "Ipv6CidrBlocks",
-      "VpcId": "VpcId"
+      "VpcId": "VpcId",
+      "VpcEncryptionControl_VpcId": "VpcEncryptionControl.VpcId",
+      "VpcEncryptionControl_VpcEncryptionControlId": "VpcEncryptionControl.VpcEncryptionControlId",
+      "VpcEncryptionControl_State": "VpcEncryptionControl.State",
+      "VpcEncryptionControl_StateMessage": "VpcEncryptionControl.StateMessage",
+      "VpcEncryptionControl_ResourceExclusions": "VpcEncryptionControl.ResourceExclusions",
+      "VpcEncryptionControl_ResourceExclusions_InternetGateway": "VpcEncryptionControl.ResourceExclusions.InternetGateway",
+      "VpcEncryptionControl_ResourceExclusions_InternetGateway_State": "VpcEncryptionControl.ResourceExclusions.InternetGateway.State",
+      "VpcEncryptionControl_ResourceExclusions_InternetGateway_StateMessage": "VpcEncryptionControl.ResourceExclusions.InternetGateway.StateMessage",
+      "VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway": "VpcEncryptionControl.ResourceExclusions.EgressOnlyInternetGateway",
+      "VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway_State": "VpcEncryptionControl.ResourceExclusions.EgressOnlyInternetGateway.State",
+      "VpcEncryptionControl_ResourceExclusions_EgressOnlyInternetGateway_StateMessage": "VpcEncryptionControl.ResourceExclusions.EgressOnlyInternetGateway.StateMessage",
+      "VpcEncryptionControl_ResourceExclusions_NatGateway": "VpcEncryptionControl.ResourceExclusions.NatGateway",
+      "VpcEncryptionControl_ResourceExclusions_NatGateway_State": "VpcEncryptionControl.ResourceExclusions.NatGateway.State",
+      "VpcEncryptionControl_ResourceExclusions_NatGateway_StateMessage": "VpcEncryptionControl.ResourceExclusions.NatGateway.StateMessage",
+      "VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway": "VpcEncryptionControl.ResourceExclusions.VirtualPrivateGateway",
+      "VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway_State": "VpcEncryptionControl.ResourceExclusions.VirtualPrivateGateway.State",
+      "VpcEncryptionControl_ResourceExclusions_VirtualPrivateGateway_StateMessage": "VpcEncryptionControl.ResourceExclusions.VirtualPrivateGateway.StateMessage",
+      "VpcEncryptionControl_ResourceExclusions_VpcPeering": "VpcEncryptionControl.ResourceExclusions.VpcPeering",
+      "VpcEncryptionControl_ResourceExclusions_VpcPeering_State": "VpcEncryptionControl.ResourceExclusions.VpcPeering.State",
+      "VpcEncryptionControl_ResourceExclusions_VpcPeering_StateMessage": "VpcEncryptionControl.ResourceExclusions.VpcPeering.StateMessage",
+      "VpcEncryptionControl_ResourceExclusions_Lambda": "VpcEncryptionControl.ResourceExclusions.Lambda",
+      "VpcEncryptionControl_ResourceExclusions_Lambda_State": "VpcEncryptionControl.ResourceExclusions.Lambda.State",
+      "VpcEncryptionControl_ResourceExclusions_Lambda_StateMessage": "VpcEncryptionControl.ResourceExclusions.Lambda.StateMessage",
+      "VpcEncryptionControl_ResourceExclusions_VpcLattice": "VpcEncryptionControl.ResourceExclusions.VpcLattice",
+      "VpcEncryptionControl_ResourceExclusions_VpcLattice_State": "VpcEncryptionControl.ResourceExclusions.VpcLattice.State",
+      "VpcEncryptionControl_ResourceExclusions_VpcLattice_StateMessage": "VpcEncryptionControl.ResourceExclusions.VpcLattice.StateMessage",
+      "VpcEncryptionControl_ResourceExclusions_ElasticFileSystem": "VpcEncryptionControl.ResourceExclusions.ElasticFileSystem",
+      "VpcEncryptionControl_ResourceExclusions_ElasticFileSystem_State": "VpcEncryptionControl.ResourceExclusions.ElasticFileSystem.State",
+      "VpcEncryptionControl_ResourceExclusions_ElasticFileSystem_StateMessage": "VpcEncryptionControl.ResourceExclusions.ElasticFileSystem.StateMessage"
     },
     "propertyConstraints": {
-      "VpcId": {
-        "format": "AWS::EC2::VPC.Id"
-      },
       "CidrBlock": {
         "format": "ipv4-network"
       },
+      "VpcId": {
+        "format": "AWS::EC2::VPC.Id"
+      },
       "DefaultSecurityGroup": {
         "format": "AWS::EC2::SecurityGroup.Id"
       }
@@ -102349,11 +102456,20 @@
     "createOnly": [
       "CidrBlock",
       "Ipv4IpamPoolId",
-      "Ipv4NetmaskLength"
+      "Ipv4NetmaskLength",
+      "VpcEncryptionControl"
     ],
     "writeOnly": [
       "Ipv4IpamPoolId",
-      "Ipv4NetmaskLength"
+      "Ipv4NetmaskLength",
+      "VpcEncryptionControl/InternetGatewayExclusion",
+      "VpcEncryptionControl/EgressOnlyInternetGatewayExclusion",
+      "VpcEncryptionControl/NatGatewayExclusion",
+      "VpcEncryptionControl/VirtualPrivateGatewayExclusion",
+      "VpcEncryptionControl/VpcPeeringExclusion",
+      "VpcEncryptionControl/LambdaExclusion",
+      "VpcEncryptionControl/VpcLatticeExclusion",
+      "VpcEncryptionControl/ElasticFileSystemExclusion"
     ],
     "primaryIdentifier": [
       "VpcId"
@@ -102520,8 +102636,13 @@
     "kind": "property",
     "lexicon": "aws"
   },
-  "VpcEncryptionControlExclusion": {
-    "resourceType": "AWS::EC2::VPCEncryptionControl.VpcEncryptionControlExclusion",
+  "VpcEncryptionControl": {
+    "resourceType": "AWS::EC2::VPC.VpcEncryptionControl",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "VpcEncryptionControlExclusions": {
+    "resourceType": "AWS::EC2::VPC.VpcEncryptionControlExclusions",
     "kind": "property",
     "lexicon": "aws"
   },
@@ -103126,6 +103247,21 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "Vpc_VpcEncryptionControl": {
+    "resourceType": "AWS::EC2::VPC.VpcEncryptionControl",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "Vpc_VpcEncryptionControlExclusion": {
+    "resourceType": "AWS::EC2::VPC.VpcEncryptionControlExclusion",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "Vpc_VpcEncryptionControlExclusions": {
+    "resourceType": "AWS::EC2::VPC.VpcEncryptionControlExclusions",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "VpnTunnelLogOptionsSpecification": {
     "resourceType": "AWS::EC2::VPNConnection.VpnTunnelLogOptionsSpecification",
     "kind": "property",

package/src/index.ts

@@ -4,6 +4,8 @@ export { Parameter } from "./parameter";
 // Default Tags
 export { defaultTags, isDefaultTags, DEFAULT_TAGS_MARKER } from "./default-tags";
 export type { DefaultTags, TagEntry } from "./default-tags";
+export { templateTransform, isTemplateTransform, TEMPLATE_TRANSFORM_MARKER } from "./template-transform";
+export type { TemplateTransform } from "./template-transform";
 
 // Serializer
 export { awsSerializer } from "./serializer";

package/src/serializer.test.ts

@@ -12,6 +12,7 @@ import type { SerializerResult } from "@intentius/chant/serializer";
 import type { BuildResult } from "@intentius/chant/build";
 import { Parameter } from "./parameter";
 import { defaultTags } from "./default-tags";
+import { templateTransform } from "./template-transform";
 
 // Mock S3 Bucket for testing
 class MockBucket implements Declarable {
@@ -68,6 +69,38 @@ describe("awsSerializer.serialize", () => {
     expect(template.Resources.MyBucket.Properties.BucketName).toBe("my-bucket");
   });
 
+  test("lifts a templateTransform to the top-level Transform, not a resource", () => {
+    const entities = new Map<string, Declarable>();
+    entities.set("MyBucket", new MockBucket({ BucketName: "my-bucket" }));
+    entities.set("rotationTransform", templateTransform("AWS::SecretsManager-2020-07-23"));
+
+    const template = JSON.parse(awsSerializer.serialize(entities));
+
+    expect(template.Transform).toBe("AWS::SecretsManager-2020-07-23");
+    expect(template.Resources.rotationTransform).toBeUndefined();
+    expect(template.Resources.MyBucket).toBeDefined();
+  });
+
+  test("merges + de-duplicates multiple transforms into a list", () => {
+    const entities = new Map<string, Declarable>();
+    entities.set("t1", templateTransform("AWS::SecretsManager-2020-07-23"));
+    entities.set("t2", templateTransform("AWS::LanguageExtensions"));
+    entities.set("t3", templateTransform("AWS::SecretsManager-2020-07-23")); // dup
+
+    const template = JSON.parse(awsSerializer.serialize(entities));
+
+    expect(template.Transform).toEqual(["AWS::SecretsManager-2020-07-23", "AWS::LanguageExtensions"]);
+  });
+
+  test("no Transform when none is declared", () => {
+    const entities = new Map<string, Declarable>();
+    entities.set("MyBucket", new MockBucket({ BucketName: "my-bucket" }));
+
+    const template = JSON.parse(awsSerializer.serialize(entities));
+
+    expect(template.Transform).toBeUndefined();
+  });
+
   test("serializes parameters", () => {
     const entities = new Map<string, Declarable>();
     entities.set("Environment", new Parameter("String", {

package/src/serializer.ts

@@ -10,6 +10,7 @@ import { isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
 import { isAttrRefLike } from "@intentius/chant/utils";
 import { resolveDependsOn } from "@intentius/chant/resource-attributes";
 import { isDefaultTags, type TagEntry } from "./default-tags";
+import { isTemplateTransform } from "./template-transform";
 import { loadTaggableResources } from "./taggable";
 
 /**
@@ -25,6 +26,7 @@ function isCoreParameter(entity: Declarable): entity is CoreParameter {
 interface CFTemplate {
   AWSTemplateFormatVersion: "2010-09-09";
   Description?: string;
+  Transform?: string | string[];
   Parameters?: Record<string, CFParameter>;
   Resources: Record<string, CFResource>;
   Outputs?: Record<string, CFOutput>;
@@ -192,6 +194,21 @@ function serializeToTemplate(
     }
   }
 
+  // Collect top-level Transform macros (e.g. AWS::SecretsManager-2020-07-23),
+  // de-duplicated in declaration order. One → a string, several → a list,
+  // matching CloudFormation's own `Transform` shape.
+  const transforms: string[] = [];
+  for (const [, entity] of entities) {
+    if (isTemplateTransform(entity) && !transforms.includes(entity.transform)) {
+      transforms.push(entity.transform);
+    }
+  }
+  if (transforms.length === 1) {
+    template.Transform = transforms[0];
+  } else if (transforms.length > 1) {
+    template.Transform = transforms;
+  }
+
   // Process entities
   for (const [name, entity] of entities) {
     // Skip StackOutput entities — they go in the Outputs section
@@ -204,6 +221,11 @@ function serializeToTemplate(
       continue;
     }
 
+    // Skip TemplateTransform entities — lifted to the top-level Transform above
+    if (isTemplateTransform(entity)) {
+      continue;
+    }
+
     if (isCoreParameter(entity)) {
       if (!template.Parameters) {
         template.Parameters = {};

package/src/template-transform.ts

@@ -0,0 +1,68 @@
+/**
+ * Template Transform — declares a top-level CloudFormation `Transform` macro
+ * for the synthesized template (e.g. `AWS::SecretsManager-2020-07-23` for a
+ * Secrets Manager `HostedRotationLambda`, or `AWS::LanguageExtensions`).
+ *
+ * CloudFormation's `Transform` is a template-level directive, not a resource
+ * property, so it can't be expressed as a normal Declarable's attributes. A
+ * project (or composite) exports a `templateTransform(...)` declaration and the
+ * serializer lifts it to the template's top-level `Transform` at synthesis time.
+ * Multiple declarations are merged and de-duplicated into a `Transform` list.
+ *
+ * Modeled exactly like `./default-tags.ts` — a marker-tagged Declarable the
+ * serializer detects and consumes rather than emitting as a resource.
+ */
+
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+
+/** Marker symbol for template-transform identification. */
+export const TEMPLATE_TRANSFORM_MARKER = Symbol.for("chant.aws.templateTransform");
+
+/**
+ * A template-transform declaration — wraps a macro name into a Declarable the
+ * serializer lifts to the template's top-level `Transform`.
+ */
+export interface TemplateTransform extends Declarable {
+  readonly [TEMPLATE_TRANSFORM_MARKER]: true;
+  readonly [DECLARABLE_MARKER]: true;
+  readonly lexicon: "aws";
+  readonly entityType: "chant:aws:templateTransform";
+  readonly transform: string;
+}
+
+/** Type guard for TemplateTransform. */
+export function isTemplateTransform(value: unknown): value is TemplateTransform {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    TEMPLATE_TRANSFORM_MARKER in value &&
+    (value as Record<symbol, unknown>)[TEMPLATE_TRANSFORM_MARKER] === true
+  );
+}
+
+/**
+ * Declare a top-level CloudFormation `Transform` macro for the synthesized
+ * template. The serializer collects every `templateTransform(...)` in the
+ * project and emits their de-duplicated union as the template's `Transform`
+ * (a single string when there is one, a list when there are several).
+ *
+ * @param transform - The macro name, e.g. `"AWS::SecretsManager-2020-07-23"`.
+ * @returns A TemplateTransform Declarable.
+ *
+ * @example
+ * ```ts
+ * import { templateTransform } from "@intentius/chant-lexicon-aws";
+ *
+ * // Required whenever a resource uses SecretsManager HostedRotationLambda.
+ * export const rotationTransform = templateTransform("AWS::SecretsManager-2020-07-23");
+ * ```
+ */
+export function templateTransform(transform: string): TemplateTransform {
+  return {
+    [TEMPLATE_TRANSFORM_MARKER]: true,
+    [DECLARABLE_MARKER]: true,
+    lexicon: "aws",
+    entityType: "chant:aws:templateTransform",
+    transform,
+  };
+}