@intentius/chant-lexicon-aws 0.33.1 → 0.34.1

package/src/dependencies.ts

@@ -0,0 +1,323 @@
+/**
+ * What an AWS estate depends on but does not declare (#1273).
+ *
+ * `describeResources` is scoped to the stack. An instance placed in the
+ * account's default VPC routes through a route table nobody declared, so that
+ * table is never observed, never a node, and no fold can traverse to it. The
+ * answer used to be computed inside the lexicon and injected as an attribute —
+ * which is a conclusion no snapshot can record enough to recompute.
+ *
+ * This reports the resources instead, so the one graph fold derives the answer.
+ *
+ * The closure is bounded: start from the observed instances, follow the
+ * reference chain the catalog declares as meaningful — subnet, then route
+ * table, then gateway — and stop. Anything not reached from a declared resource
+ * along a declared reference is not a dependency, it is just the account.
+ */
+
+import { applyAwsEndpointArgv } from "./components/cloud-executor";
+import type { DependencyObservation, ResourceMetadata, IREdge } from "@intentius/chant/lexicon";
+
+/** Cloud-shaped ids are stable across a redeploy and unique per account. */
+const nodeId = (physicalId: string): string => physicalId;
+
+/** One ingress permission as `describe-security-groups` returns it. */
+interface RawIpPermission {
+  IpProtocol?: string;
+  FromPort?: number;
+  ToPort?: number;
+  IpRanges?: Array<{ CidrIp?: string }>;
+  Ipv6Ranges?: Array<{ CidrIpv6?: string }>;
+  UserIdGroupPairs?: Array<{ GroupId?: string }>;
+}
+
+/**
+ * Flatten `IpPermissions` into the CloudFormation-shaped rules the fold reads.
+ *
+ * The two AWS surfaces disagree about the same concept: a template's
+ * `SecurityGroupIngress` carries `CidrIp` flat on the rule, while
+ * `describe-security-groups` nests sources under `IpRanges[]`, `Ipv6Ranges[]`
+ * and `UserIdGroupPairs[]`, and one permission can hold several. Handing the
+ * describe shape to the fold unchanged yields a rule with no recognisable
+ * source, which `normalizeIngress` renders as `?` — an ingress rule that
+ * matches no CIDR query and quietly narrows the answer.
+ *
+ * One rule per source, because that is what the flat shape means.
+ */
+export function toIngressRules(permissions: RawIpPermission[]): Array<Record<string, unknown>> {
+  const rules: Array<Record<string, unknown>> = [];
+  for (const permission of permissions) {
+    const base = {
+      IpProtocol: permission.IpProtocol ?? "-1",
+      ...(permission.FromPort != null ? { FromPort: permission.FromPort } : {}),
+      ...(permission.ToPort != null ? { ToPort: permission.ToPort } : {}),
+    };
+    for (const range of permission.IpRanges ?? []) {
+      if (range.CidrIp) rules.push({ ...base, CidrIp: range.CidrIp });
+    }
+    for (const range of permission.Ipv6Ranges ?? []) {
+      if (range.CidrIpv6) rules.push({ ...base, CidrIpv6: range.CidrIpv6 });
+    }
+    for (const pair of permission.UserIdGroupPairs ?? []) {
+      if (pair.GroupId) rules.push({ ...base, SourceSecurityGroupId: pair.GroupId });
+    }
+  }
+  return rules;
+}
+
+interface RawRouteTable {
+  RouteTableId?: string;
+  VpcId?: string;
+  Routes?: Array<{ GatewayId?: string; DestinationCidrBlock?: string }>;
+  Associations?: Array<{ SubnetId?: string; Main?: boolean }>;
+}
+
+/**
+ * Read the routing an observed estate depends on.
+ *
+ * Only the tables that actually serve an observed instance are reported: one
+ * reached by an explicit subnet association, or the VPC's main table standing in
+ * for a subnet with none. A route table serving nothing chant deployed is not a
+ * dependency of this estate.
+ */
+export async function observeAwsDependencies(options: {
+  observed: Record<string, ResourceMetadata>;
+  region?: string;
+}): Promise<DependencyObservation> {
+  const { getRuntime } = await import("@intentius/chant/runtime-adapter");
+  const rt = getRuntime();
+  const regionArgs = options.region ? ["--region", options.region] : [];
+  const run = (args: string[]) =>
+    rt.spawn(applyAwsEndpointArgv(["aws", ...args, ...regionArgs, "--output", "json"], process.env.AWS_ENDPOINT_URL));
+
+  const resources: Record<string, ResourceMetadata> = {};
+  const edges: IREdge[] = [];
+
+  // Roots: the instances this estate manages, and where each one sits. Placement
+  // comes from the live API rather than the template, because the declared side
+  // may only carry a parameter reference to a subnet it never modelled.
+  const instances = Object.entries(options.observed).filter(
+    ([, meta]) => meta.type === "AWS::EC2::Instance" && meta.physicalId,
+  );
+  if (instances.length === 0) return { resources: {}, edges: [] };
+
+  try {
+    const described = await run([
+      "ec2",
+      "describe-instances",
+      "--instance-ids",
+      ...instances.map(([, meta]) => meta.physicalId as string),
+    ]);
+    if (described.exitCode !== 0) return { resources: {}, edges: [] };
+
+    const placement = new Map<
+      string,
+      { subnetId?: string; vpcId?: string; securityGroupIds: string[]; launchTemplateId?: string }
+    >();
+    for (const reservation of (JSON.parse(described.stdout).Reservations ?? []) as Array<{
+      Instances?: Array<{
+        InstanceId: string;
+        SubnetId?: string;
+        VpcId?: string;
+        SecurityGroups?: Array<{ GroupId?: string }>;
+        LaunchTemplate?: { LaunchTemplateId?: string };
+      }>;
+    }>) {
+      for (const instance of reservation.Instances ?? []) {
+        placement.set(instance.InstanceId, {
+          subnetId: instance.SubnetId,
+          vpcId: instance.VpcId,
+          securityGroupIds: (instance.SecurityGroups ?? [])
+            .map((g) => g.GroupId)
+            .filter((id): id is string => typeof id === "string"),
+          ...(instance.LaunchTemplate?.LaunchTemplateId
+            ? { launchTemplateId: instance.LaunchTemplate.LaunchTemplateId }
+            : {}),
+        });
+      }
+    }
+
+    const tablesResult = await run(["ec2", "describe-route-tables"]);
+    if (tablesResult.exitCode !== 0) return { resources: {}, edges: [] };
+    const tables = (JSON.parse(tablesResult.stdout).RouteTables ?? []) as RawRouteTable[];
+
+    // Which table serves which subnet, and which is a VPC's main table — the
+    // two ways an instance's subnet resolves to routing.
+    const bySubnet = new Map<string, RawRouteTable>();
+    const mainByVpc = new Map<string, RawRouteTable>();
+    for (const table of tables) {
+      for (const association of table.Associations ?? []) {
+        if (association.SubnetId) bySubnet.set(association.SubnetId, table);
+        if (association.Main && table.VpcId) mainByVpc.set(table.VpcId, table);
+      }
+    }
+
+    // Security groups and launch templates the estate is guarded by (#1276).
+    // `effectiveIngress` resolved these from the declared graph alone, which is
+    // right until an instance sits in a group it did not declare — a shared
+    // group, one attached through someone else's launch template. Then the
+    // group is not a node, its rules are never read, and the instance reads as
+    // less exposed than it is. Under-reporting is the dangerous direction for a
+    // query whose whole purpose is finding what the internet can reach.
+    const declaredGroupIds = new Set(
+      Object.values(options.observed)
+        .filter((m) => m.type === "AWS::EC2::SecurityGroup" && m.physicalId)
+        .map((m) => m.physicalId as string),
+    );
+    const declaredTemplateIds = new Set(
+      Object.values(options.observed)
+        .filter((m) => m.type === "AWS::EC2::LaunchTemplate" && m.physicalId)
+        .map((m) => m.physicalId as string),
+    );
+    const groupsById = new Map<string, Record<string, unknown>>();
+    const wantedGroups = new Set<string>();
+    const templatesById = new Map<string, string[]>();
+
+    for (const [, meta] of instances) {
+      const where = placement.get(meta.physicalId as string);
+      if (!where) continue;
+      for (const id of where.securityGroupIds) if (!declaredGroupIds.has(id)) wantedGroups.add(id);
+      if (where.launchTemplateId && !declaredTemplateIds.has(where.launchTemplateId)) {
+        const versions = await run([
+          "ec2",
+          "describe-launch-template-versions",
+          "--launch-template-id",
+          where.launchTemplateId,
+          "--versions",
+          "$Latest",
+        ]);
+        if (versions.exitCode === 0) {
+          const templateGroups = (
+            (JSON.parse(versions.stdout).LaunchTemplateVersions ?? []) as Array<{
+              LaunchTemplateData?: { SecurityGroupIds?: string[] };
+            }>
+          ).flatMap((v) => v.LaunchTemplateData?.SecurityGroupIds ?? []);
+          templatesById.set(where.launchTemplateId, templateGroups);
+          for (const id of templateGroups) if (!declaredGroupIds.has(id)) wantedGroups.add(id);
+        }
+      }
+    }
+
+    if (wantedGroups.size > 0) {
+      const described = await run(["ec2", "describe-security-groups", "--group-ids", ...wantedGroups]);
+      if (described.exitCode === 0) {
+        for (const group of (JSON.parse(described.stdout).SecurityGroups ?? []) as Array<{
+          GroupId?: string;
+          VpcId?: string;
+          IpPermissions?: RawIpPermission[];
+        }>) {
+          if (!group.GroupId) continue;
+          groupsById.set(group.GroupId, {
+            GroupId: group.GroupId,
+            VpcId: group.VpcId,
+            SecurityGroupIngress: toIngressRules(group.IpPermissions ?? []),
+          });
+        }
+      }
+    }
+
+    const record = (
+      logicalId: string,
+      id: string,
+      type: string,
+      physicalId: string | undefined,
+      attrs: Record<string, unknown>,
+    ) => {
+      const existing = resources[id];
+      resources[id] = {
+        type,
+        status: "OBSERVED",
+        ...(physicalId ? { physicalId } : {}),
+        attributes: attrs,
+        ownership: "foreign",
+        referencedBy: [...new Set([...(existing?.referencedBy ?? []), logicalId])],
+      };
+    };
+
+    for (const [logicalId, meta] of instances) {
+      const where = placement.get(meta.physicalId as string);
+      if (!where) continue;
+
+      // Guarding first, and unconditionally: an instance with no internet route
+      // still has security groups, and `effectiveIngress` is asked about
+      // instances that are not internet-facing too.
+      for (const groupId of where.securityGroupIds) {
+        const attrs = groupsById.get(groupId);
+        if (!attrs) continue; // declared, or unreadable — either way not a dependency
+        record(logicalId, nodeId(groupId), "AWS::EC2::SecurityGroup", groupId, attrs);
+        edges.push({ from: logicalId, to: nodeId(groupId), kind: "ref", viaAttr: "SecurityGroupIds" });
+      }
+      const templateGroups = where.launchTemplateId ? templatesById.get(where.launchTemplateId) : undefined;
+      if (where.launchTemplateId && templateGroups) {
+        const templateNode = nodeId(where.launchTemplateId);
+        record(logicalId, templateNode, "AWS::EC2::LaunchTemplate", where.launchTemplateId, {
+          LaunchTemplateId: where.launchTemplateId,
+          LaunchTemplateData: { SecurityGroupIds: templateGroups },
+        });
+        edges.push({ from: logicalId, to: templateNode, kind: "ref", viaAttr: "LaunchTemplateId" });
+        for (const groupId of templateGroups) {
+          const attrs = groupsById.get(groupId);
+          if (!attrs) continue;
+          record(logicalId, nodeId(groupId), "AWS::EC2::SecurityGroup", groupId, attrs);
+          edges.push({ from: templateNode, to: nodeId(groupId), kind: "ref", viaAttr: "SecurityGroupIds" });
+        }
+      }
+
+      // Explicit subnet association first, else the VPC's main table — the two
+      // ways an instance's placement resolves to routing.
+      const table: RawRouteTable | undefined =
+        (where.subnetId ? bySubnet.get(where.subnetId) : undefined) ??
+        (where.vpcId ? mainByVpc.get(where.vpcId) : undefined);
+      if (!table?.RouteTableId) continue;
+
+      // Only routing that actually reaches the internet is worth reporting: an
+      // internal table adds a node and an edge and answers nothing.
+      const igwRoute = (table.Routes ?? []).find(
+        (route) =>
+          typeof route.GatewayId === "string" &&
+          route.GatewayId.startsWith("igw-") &&
+          (route.DestinationCidrBlock == null || route.DestinationCidrBlock === "0.0.0.0/0"),
+      );
+      if (!igwRoute?.GatewayId) continue;
+
+      const subnetNode = where.subnetId ? nodeId(where.subnetId) : undefined;
+      const tableNode = nodeId(table.RouteTableId);
+      const gatewayNode = nodeId(igwRoute.GatewayId);
+      const associationNode = `${tableNode}::assoc::${subnetNode ?? table.VpcId ?? "main"}`;
+      const routeNode = `${tableNode}::route::${gatewayNode}`;
+
+      if (subnetNode) record(logicalId, subnetNode, "AWS::EC2::Subnet", where.subnetId, { VpcId: where.vpcId });
+      record(logicalId, tableNode, "AWS::EC2::RouteTable", table.RouteTableId, { VpcId: table.VpcId });
+      record(logicalId, gatewayNode, "AWS::EC2::InternetGateway", igwRoute.GatewayId, {
+        InternetGatewayId: igwRoute.GatewayId,
+      });
+      record(logicalId, associationNode, "AWS::EC2::SubnetRouteTableAssociation", undefined, {
+        SubnetId: where.subnetId,
+        RouteTableId: table.RouteTableId,
+      });
+      record(logicalId, routeNode, "AWS::EC2::Route", undefined, {
+        RouteTableId: table.RouteTableId,
+        GatewayId: igwRoute.GatewayId,
+        DestinationCidrBlock: igwRoute.DestinationCidrBlock ?? "0.0.0.0/0",
+      });
+
+      // The chain enrichEffectiveTopology walks, reported explicitly rather
+      // than left to be reconstructed: an association and a route have no
+      // physical id of their own, so no identity index can resolve them.
+      if (subnetNode) {
+        edges.push({ from: logicalId, to: subnetNode, kind: "ref", viaAttr: "SubnetId" });
+        edges.push({ from: associationNode, to: subnetNode, kind: "ref", viaAttr: "SubnetId" });
+      }
+      edges.push({ from: associationNode, to: tableNode, kind: "ref", viaAttr: "RouteTableId" });
+      edges.push({ from: routeNode, to: tableNode, kind: "ref", viaAttr: "RouteTableId" });
+      edges.push({ from: routeNode, to: gatewayNode, kind: "ref", viaAttr: "GatewayId" });
+    }
+  } catch {
+    // Best-effort: the managed observation is complete and useful on its own,
+    // and failing it because an ambient dependency could not be read would
+    // trade a whole answer for a partial one.
+    return { resources: {}, edges: [] };
+  }
+
+  return { resources, edges };
+}

package/src/generated/index.d.ts

@@ -16403,6 +16403,38 @@ export declare class Harness {
   readonly Version: string;
 }
 
+export declare class HarnessEndpoint {
+  constructor(props: {
+    /** The name of the endpoint. Must start with a letter and contain only alphanumeric characters and underscores. */
+    EndpointName: string;
+    /** The ID of the harness that the endpoint belongs to. */
+    HarnessId: string;
+    /** The Amazon Resource Name (ARN) of the endpoint. */
+    Arn?: string;
+    /** The timestamp when the endpoint was created. */
+    CreatedAt?: string;
+    /** The description of the endpoint. */
+    Description?: string;
+    /** The name of the harness that the endpoint belongs to. */
+    HarnessName?: string;
+    /** The harness version that the endpoint is currently serving. */
+    LiveVersion?: string;
+    Status?: HarnessEndpoint_HarnessEndpointStatus;
+    /** Tags to apply to the harness endpoint resource. */
+    Tags?: HarnessEndpoint_Tag[];
+    /** The harness version that the endpoint points to and serves invocations from. */
+    TargetVersion?: string;
+    /** The timestamp when the endpoint was last updated. */
+    UpdatedAt?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreatedAt: string;
+  readonly HarnessName: string;
+  readonly LiveVersion: string;
+  readonly Status: HarnessEndpoint_HarnessEndpointStatus;
+  readonly UpdatedAt: string;
+}
+
 export declare class HealthCheck {
   constructor(props: {
     /** A complex type that contains information about the health check. */
@@ -32859,6 +32891,27 @@ export declare class ServiceProfile {
   readonly LoRaWAN_UlRatePolicy: string;
 }
 
+export declare class ServiceSetting {
+  constructor(props: {
+    /** The ID of the service setting, such as /ssm/parameter-store/high-throughput-enabled. */
+    SettingId: string;
+    /** The value of the service setting. */
+    SettingValue: string;
+    /** The ARN of the service setting. */
+    Arn?: string;
+    /** The last time the service setting was modified. */
+    LastModifiedDate?: string;
+    /** The ARN of the last modified user. */
+    LastModifiedUser?: string;
+    /** The status of the service setting. The value can be Default, Customized or PendingUpdate. */
+    Status?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly LastModifiedDate: string;
+  readonly LastModifiedUser: string;
+  readonly Status: string;
+}
+
 export declare class ServiceTemplate {
   constructor(props: {
     /** <p>The Amazon Resource Name (ARN) of the service template.</p> */
@@ -57089,7 +57142,7 @@ export declare class ContainerRecipe_EbsInstanceBlockDeviceSpecification {
     /** Use to override the device's volume size. */
     VolumeSize?: number;
     /** Use to override the device's volume type. */
-    VolumeType?: "gp2" | "gp3" | "io1" | "io2" | "sc1" | "st1" | "standard";
+    VolumeType?: "gp2" | "gp3" | "gp3a" | "io1" | "io2" | "io2a" | "sc1" | "st1" | "standard";
   });
 }
 
@@ -75141,7 +75194,7 @@ export declare class GlobalTable_ReplicaSSESpecification {
 
 export declare class GlobalTable_ReplicaStreamSpecification {
   constructor(props: {
-    ResourcePolicy?: GlobalTable_ResourcePolicy;
+    ResourcePolicy: GlobalTable_ResourcePolicy;
   });
 }
 
@@ -76693,6 +76746,13 @@ export declare class HarnessBedrockModelConfig {
   });
 }
 
+export declare class HarnessEndpoint_Tag {
+  constructor(props: {
+    Key: string;
+    Value: string;
+  });
+}
+
 export declare class HarnessEnvironmentArtifact {
   constructor(props: {
     ContainerConfiguration?: Harness_ContainerConfiguration;
@@ -78724,7 +78784,7 @@ export declare class ImageRecipe_EbsInstanceBlockDeviceSpecification {
     /** Use to override the device's volume size. */
     VolumeSize?: number;
     /** Use to override the device's volume type. */
-    VolumeType?: "gp2" | "gp3" | "io1" | "io2" | "sc1" | "st1" | "standard";
+    VolumeType?: "gp2" | "gp3" | "gp3a" | "io1" | "io2" | "io2a" | "sc1" | "st1" | "standard";
   });
 }
 
@@ -86435,7 +86495,9 @@ export declare class Listener_RedirectConfig {
 
 export declare class Listener_Tag {
   constructor(props: {
+    /** The key of the tag. */
     Key: string;
+    /** The value of the tag. */
     Value: string;
   });
 }
@@ -106283,7 +106345,7 @@ export declare class ReplicaSSESpecification {
 
 export declare class ReplicaStreamSpecification {
   constructor(props: {
-    ResourcePolicy?: GlobalTable_ResourcePolicy;
+    ResourcePolicy: GlobalTable_ResourcePolicy;
   });
 }
 
@@ -112163,6 +112225,8 @@ export declare class Scraper_Destination {
   constructor(props: {
     /** Configuration for Amazon Managed Prometheus metrics destination */
     AmpConfiguration?: Record<string, unknown>;
+    /** Configuration for CloudWatch metrics destination */
+    CloudWatchConfiguration?: Record<string, unknown>;
   });
 }
 
@@ -130350,6 +130414,15 @@ export type Harness_HarnessStatus =
   | "UPDATE_FAILED"
   | "UPDATING";
 
+export type HarnessEndpoint_HarnessEndpointStatus =
+  | "CREATE_FAILED"
+  | "CREATING"
+  | "DELETE_FAILED"
+  | "DELETING"
+  | "READY"
+  | "UPDATE_FAILED"
+  | "UPDATING";
+
 export type HealthImagingDatastore_DatastoreStatus =
   | "ACTIVE"
   | "CREATE_FAILED"

package/src/generated/index.ts

@@ -640,6 +640,7 @@ export const GuardHook = createResource("AWS::CloudFormation::GuardHook", "aws",
 export const Guardrail = createResource("AWS::Bedrock::Guardrail", "aws", {"CreatedAt":"CreatedAt","FailureRecommendations":"FailureRecommendations","GuardrailArn":"GuardrailArn","GuardrailId":"GuardrailId","Status":"Status","StatusReasons":"StatusReasons","UpdatedAt":"UpdatedAt","Version":"Version"});
 export const GuardrailVersion = createResource("AWS::Bedrock::GuardrailVersion", "aws", {"GuardrailArn":"GuardrailArn","GuardrailId":"GuardrailId","Version":"Version"});
 export const Harness = createResource("AWS::BedrockAgentCore::Harness", "aws", {"Arn":"Arn","HarnessId":"HarnessId","Status":"Status","Version":"Version","CreatedAt":"CreatedAt","UpdatedAt":"UpdatedAt","Memory_ManagedMemoryConfiguration_Arn":"Memory.ManagedMemoryConfiguration.Arn","Environment_AgentCoreRuntimeEnvironment_AgentRuntimeArn":"Environment.AgentCoreRuntimeEnvironment.AgentRuntimeArn","Environment_AgentCoreRuntimeEnvironment_AgentRuntimeName":"Environment.AgentCoreRuntimeEnvironment.AgentRuntimeName","Environment_AgentCoreRuntimeEnvironment_AgentRuntimeId":"Environment.AgentCoreRuntimeEnvironment.AgentRuntimeId"});
+export const HarnessEndpoint = createResource("AWS::BedrockAgentCore::HarnessEndpoint", "aws", {"Arn":"Arn","HarnessName":"HarnessName","Status":"Status","LiveVersion":"LiveVersion","CreatedAt":"CreatedAt","UpdatedAt":"UpdatedAt"});
 export const HealthCheck = createResource("AWS::Route53::HealthCheck", "aws", {"HealthCheckId":"HealthCheckId"});
 export const HealthImagingDatastore = createResource("AWS::HealthImaging::Datastore", "aws", {"DatastoreArn":"DatastoreArn","CreatedAt":"CreatedAt","UpdatedAt":"UpdatedAt","DatastoreId":"DatastoreId","DatastoreStatus":"DatastoreStatus"});
 export const HookDefaultVersion = createResource("AWS::CloudFormation::HookDefaultVersion", "aws", {"Arn":"Arn"});
@@ -1355,6 +1356,7 @@ export const ServiceNetworkServiceAssociation = createResource("AWS::VpcLattice:
 export const ServiceNetworkVpcAssociation = createResource("AWS::VpcLattice::ServiceNetworkVpcAssociation", "aws", {"Arn":"Arn","CreatedAt":"CreatedAt","Id":"Id","ServiceNetworkArn":"ServiceNetworkArn","ServiceNetworkId":"ServiceNetworkId","ServiceNetworkName":"ServiceNetworkName","Status":"Status","VpcId":"VpcId"});
 export const ServicePrincipalName = createResource("AWS::PCAConnectorAD::ServicePrincipalName", "aws", {});
 export const ServiceProfile = createResource("AWS::IoTWireless::ServiceProfile", "aws", {"Id":"Id","Arn":"Arn","LoRaWAN_UlRate":"LoRaWAN.UlRate","LoRaWAN_UlBucketSize":"LoRaWAN.UlBucketSize","LoRaWAN_UlRatePolicy":"LoRaWAN.UlRatePolicy","LoRaWAN_DlRate":"LoRaWAN.DlRate","LoRaWAN_DlBucketSize":"LoRaWAN.DlBucketSize","LoRaWAN_DlRatePolicy":"LoRaWAN.DlRatePolicy","LoRaWAN_DevStatusReqFreq":"LoRaWAN.DevStatusReqFreq","LoRaWAN_ReportDevStatusBattery":"LoRaWAN.ReportDevStatusBattery","LoRaWAN_ReportDevStatusMargin":"LoRaWAN.ReportDevStatusMargin","LoRaWAN_DrMin":"LoRaWAN.DrMin","LoRaWAN_DrMax":"LoRaWAN.DrMax","LoRaWAN_ChannelMask":"LoRaWAN.ChannelMask","LoRaWAN_HrAllowed":"LoRaWAN.HrAllowed","LoRaWAN_NwkGeoLoc":"LoRaWAN.NwkGeoLoc","LoRaWAN_TargetPer":"LoRaWAN.TargetPer","LoRaWAN_MinGwDiversity":"LoRaWAN.MinGwDiversity"});
+export const ServiceSetting = createResource("AWS::SSM::ServiceSetting", "aws", {"Status":"Status","LastModifiedDate":"LastModifiedDate","LastModifiedUser":"LastModifiedUser","Arn":"Arn"});
 export const ServiceTemplate = createResource("AWS::Proton::ServiceTemplate", "aws", {"Arn":"Arn"});
 export const SESConfigurationSet = createResource("AWS::SES::ConfigurationSet", "aws", {});
 export const SESConfigurationSetEventDestination = createResource("AWS::SES::ConfigurationSetEventDestination", "aws", {"Id":"Id"});
@@ -5495,6 +5497,7 @@ export const HarnessAgentCoreGatewayConfig = createProperty("AWS::BedrockAgentCo
 export const HarnessAgentCoreMemoryConfiguration = createProperty("AWS::BedrockAgentCore::Harness.HarnessAgentCoreMemoryConfiguration", "aws");
 export const HarnessAgentCoreRuntimeEnvironment = createProperty("AWS::BedrockAgentCore::Harness.HarnessAgentCoreRuntimeEnvironment", "aws");
 export const HarnessBedrockModelConfig = createProperty("AWS::BedrockAgentCore::Harness.HarnessBedrockModelConfig", "aws");
+export const HarnessEndpoint_Tag = createProperty("AWS::BedrockAgentCore::HarnessEndpoint.Tag", "aws");
 export const HarnessEnvironmentArtifact = createProperty("AWS::BedrockAgentCore::Harness.HarnessEnvironmentArtifact", "aws");
 export const HarnessEnvironmentProvider = createProperty("AWS::BedrockAgentCore::Harness.HarnessEnvironmentProvider", "aws");
 export const HarnessGeminiModelConfig = createProperty("AWS::BedrockAgentCore::Harness.HarnessGeminiModelConfig", "aws");

package/src/generated/lexicon-aws.json

@@ -44553,6 +44553,67 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "HarnessEndpoint": {
+    "resourceType": "AWS::BedrockAgentCore::HarnessEndpoint",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "HarnessName": "HarnessName",
+      "Status": "Status",
+      "LiveVersion": "LiveVersion",
+      "CreatedAt": "CreatedAt",
+      "UpdatedAt": "UpdatedAt"
+    },
+    "propertyConstraints": {
+      "HarnessId": {
+        "pattern": "^[a-zA-Z][a-zA-Z0-9_]{0,39}-[a-zA-Z0-9]{10}$"
+      },
+      "EndpointName": {
+        "pattern": "^[a-zA-Z][a-zA-Z0-9_]{0,47}$"
+      },
+      "TargetVersion": {
+        "pattern": "^([1-9][0-9]{0,4})$",
+        "minLength": 1,
+        "maxLength": 5
+      },
+      "LiveVersion": {
+        "pattern": "^([1-9][0-9]{0,4})$",
+        "minLength": 1,
+        "maxLength": 5
+      },
+      "Description": {
+        "minLength": 1,
+        "maxLength": 256
+      },
+      "CreatedAt": {
+        "format": "date-time"
+      },
+      "UpdatedAt": {
+        "format": "date-time"
+      }
+    },
+    "createOnly": [
+      "HarnessId",
+      "EndpointName"
+    ],
+    "writeOnly": [
+      "TargetVersion"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
+  "HarnessEndpoint_Tag": {
+    "resourceType": "AWS::BedrockAgentCore::HarnessEndpoint.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "HarnessEnvironmentArtifact": {
     "resourceType": "AWS::BedrockAgentCore::Harness.HarnessEnvironmentArtifact",
     "kind": "property",
@@ -70884,7 +70945,7 @@
         "maxLength": 256
       },
       "FunctionName": {
-        "pattern": "^(arn:(aws[a-zA-Z-]*)?:lambda:)?((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
+        "pattern": "^(arn:(aws[a-zA-Z-]*)?:lambda:)?((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST(\\.PUBLISHED)?|[a-zA-Z0-9-_]+))?$",
         "minLength": 1,
         "maxLength": 140
       },
@@ -91147,6 +91208,36 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ServiceSetting": {
+    "resourceType": "AWS::SSM::ServiceSetting",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Status": "Status",
+      "LastModifiedDate": "LastModifiedDate",
+      "LastModifiedUser": "LastModifiedUser",
+      "Arn": "Arn"
+    },
+    "propertyConstraints": {
+      "SettingId": {
+        "minLength": 1,
+        "maxLength": 1000
+      },
+      "SettingValue": {
+        "minLength": 1,
+        "maxLength": 4096
+      },
+      "LastModifiedDate": {
+        "format": "date-time"
+      }
+    },
+    "createOnly": [
+      "SettingId"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ]
+  },
   "ServiceSoftwareOptions": {
     "resourceType": "AWS::OpenSearchService::Domain.ServiceSoftwareOptions",
     "kind": "property",