cdk-preflight 0.0.31 → 0.0.32

package/.jsii

@@ -9598,6 +9598,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.31",
-  "fingerprint": "/uRm7qstN05oVe237NEF3FTlwtFf45tgAKU/odn+AwY="
+  "version": "0.0.32",
+  "fingerprint": "qV3Ay+mWOX1FGMXlZIfrhDR5xYzXB/aWUl+2Mkp7pOQ="
 }

package/AGENTS.md

@@ -139,6 +139,8 @@ bench/                      # real-deploy verification (needs an AWS account; no
   - *Character classes are Unicode-aware.* `\w`, `\d` and `\s` match non-ASCII — `regex.match("[\\w]+", "テスト用")` is **true**. AWS API patterns like Cognito's `[\w\s+=,.@-]+` are ASCII-semantics, so copying one verbatim yields a rule that never fires. Write explicit ranges (`^[A-Za-z0-9_ \t+=,.@-]+$`).
   - *No lookahead/lookbehind.* ELBv2 publishes `(?!^-)(?!.*-$)^[A-Za-z0-9-]+$` for `targetGroupName`; that pattern does not compile here, and `regex.match` then returns false for **every** input — the rule fires on all values, which is worse than not firing. Rewrite without lookaround: `^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$`.
 - **The absence sentinel must not be a string.** The `object.get(props, "<Key>", "__pf_absent")` idiom is only safe when the next step is `== "__pf_absent"`. If the next step is `is_string(v)` followed by a format check, an *absent* key yields the sentinel string and the rule fires on every resource that omits the property. Use `null` as the default in that case — `is_string(null)` is false, so the rule skips. (This produced three false-positive rules in the 2026-09-04 batch, visible only because other rules' pass fixtures went red.)
+- **`resolve()` of `Fn::GetAtt <Resource>.<Attr>` also returns the target's logical ID** (measured 2026-09-05), exactly like a `Ref`. So `resolve(sub, "Properties.Endpoint")` on `Fn::GetAtt Queue.Arn` yields `"Queue"`, which can be fed to `resources_of_type(...)` membership and a second `resolve` on the target. When the *kind* of reference matters (a URL-taking property handed an ARN), read the raw document: `Ref` is `{"__kind": "resource", "__ref": "Q"}`, `Fn::GetAtt` is `{"__kind": "getatt:<Attr>", "__ref": "Q"}`; `flatten_list` drops `__kind`. Reference implementations: `pf-sqs-queue-policy-queues`, `pf-sns-topic-policy-topics`.
+- **Cross-resource checks the engine already does on `Ref`/`GetAtt` wiring can be blind to literal ARNs.** `E3502` compares a source queue's type with its dead-letter queue only when `deadLetterTargetArn` is `Fn::GetAtt` of a queue in the template; a literal `.fifo` ARN (an imported queue) passes (measured 2026-09-05). Probe both wirings before deciding a candidate is covered — `pf-sqs-dlq-same-type` exists only for the literal path.
 - **Tuple destructuring in `some [a, b] in <array literal>` does not schedule** ("statements not scheduled in query", measured 2026-09-04). Iterating a table of pairs inline is not available; build a set with one helper rule per case and destructure that set (`some [name, path, v] in _pf_x_bad`), which does work.
 - **Schema pattern/length coverage is per property, not per resource or per service.** `AWS::EC2::SecurityGroup.GroupDescription` carries a pattern (`F3031`) while the rule-level `SecurityGroupIngress[].Description` on the same resource carries none; DynamoDB's GSI `IndexName` has one while the table's own `TableName` does not. Never generalise "the engine handles names/lengths" from a sample — probe the exact property (measured 2026-09-04 across 57 templates).
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.

package/docs/rules.md

@@ -225,9 +225,30 @@
 | `pf-s3-website-redirect-exclusive` | AWS::S3::Bucket | RedirectAllRequestsTo excludes every other website setting | none |
 | `pf-scheduler-flexible-window` | AWS::Scheduler::Schedule | FLEXIBLE mode needs MaximumWindowInMinutes, OFF forbids it | none |
 | `pf-scheduler-rate-positive` | AWS::Scheduler::Schedule | A Scheduler rate() value must be positive | none |
+| `pf-sns-delivery-policy` | AWS::SNS::Subscription<br>AWS::SNS::Topic | HTTP/S DeliveryPolicy retry values: minDelayTarget >= 1, maxDelayTarget <= 3600 and >= minDelayTarget, numRetries 0..100 and at least the sum of the phase retries, phase counts >= 0, backoffFunction one of arithmetic|exponential|geometric|linear, maxReceivesPerSecond >= 1 (subscription DeliveryPolicy and topic DeliveryPolicy.http) | none |
+| `pf-sns-fifo-only-attributes` | AWS::SNS::Topic | ContentBasedDeduplication, ArchivePolicy and FifoThroughputScope are FIFO-only topic attributes, and ArchivePolicy.MessageRetentionPeriod is 1..365 days | none |
+| `pf-sns-fifo-queue-on-standard-topic` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A FIFO SQS queue cannot subscribe to a standard topic (a FIFO topic may fan out to standard queues, not the reverse) | none |
 | `pf-sns-fifo-topic-name` | AWS::SNS::Topic | FIFO topic names must end with '.fifo' (and '.fifo' names require FifoTopic) | none |
+| `pf-sns-fifo-topic-protocol` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A FIFO topic only accepts sqs subscriptions (lambda, http/https, email, email-json, sms, firehose are rejected) | none |
+| `pf-sns-filter-policy` | AWS::SNS::Subscription<br>AWS::SNS::Topic | FilterPolicy shape: at most 5 keys, every value an array or object, no empty arrays, no arrays inside arrays, nesting only with FilterPolicyScope MessageBody, and FilterPolicyScope is MessageAttributes or MessageBody | none |
+| `pf-sns-firehose-subscription-role` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A firehose subscription requires SubscriptionRoleArn | none |
+| `pf-sns-raw-message-delivery` | AWS::SNS::Subscription<br>AWS::SNS::Topic | RawMessageDelivery is only supported for sqs, http, https and firehose subscriptions | none |
+| `pf-sns-subscription-endpoint` | AWS::SNS::Subscription<br>AWS::SNS::Topic | Subscription Protocol is one of the nine SNS protocols and the Endpoint matches it: an ARN of the right service for sqs/lambda/firehose/application, an email address, a URL with the same scheme for http/https, a phone number for sms | none |
+| `pf-sns-subscription-redrive` | AWS::SNS::Subscription<br>AWS::SNS::Topic | Subscription RedrivePolicy needs deadLetterTargetArn, which must be an SQS queue ARN in the deploy region | none |
+| `pf-sns-subscription-region` | AWS::SNS::Subscription | Subscription.Region must be the topic's region (the region in a literal TopicArn, or the deploy region for a topic in this template) | none |
+| `pf-sns-topic-attribute-values` | AWS::SNS::Topic | Topic DisplayName is at most 100 characters, SignatureVersion is 1 or 2, and TracingConfig is PassThrough or Active | none |
 | `pf-sns-topic-name-format` | AWS::SNS::Topic | Topic names allow only letters, numbers, hyphen and underscore (plus a .fifo suffix) | none |
+| `pf-sns-topic-policy-topics` | AWS::SNS::TopicPolicy | TopicPolicy.Topics takes topic ARNs (Ref Topic), not topic names | none |
+| `pf-sqs-dlq-same-type` | AWS::SQS::Queue | A dead-letter queue named by a literal ARN must be the same type as its source (FIFO for FIFO, standard for standard); Fn::GetAtt wiring is covered by engine rule E3502 | none |
+| `pf-sqs-fifo-name-suffix` | AWS::SQS::Queue | A QueueName ending in .fifo requires FifoQueue: true (a FIFO queue without the suffix is engine rule E2504) | none |
+| `pf-sqs-fifo-only-attributes` | AWS::SQS::Queue | ContentBasedDeduplication, DeduplicationScope and FifoThroughputLimit are FIFO-only queue attributes (and the two enums are messageGroup|queue and perQueue|perMessageGroupId) | none |
+| `pf-sqs-high-throughput-pairing` | AWS::SQS::Queue | FifoThroughputLimit perMessageGroupId requires DeduplicationScope messageGroup | none |
 | `pf-sqs-queue-name-format` | AWS::SQS::Queue | Queue names allow only letters, numbers, hyphen and underscore (max 80, plus a .fifo suffix) | none |
+| `pf-sqs-queue-policy-queues` | AWS::SQS::QueuePolicy | QueuePolicy.Queues takes queue URLs (Ref Queue), never ARNs (Fn::GetAtt Queue.Arn), and must not be empty | none |
+| `pf-sqs-redrive-allow-policy` | AWS::SQS::Queue | RedriveAllowPolicy: redrivePermission is required (allowAll|denyAll|byQueue); byQueue needs 1..10 sourceQueueArns and the other two forbid them | none |
+| `pf-sqs-redrive-arn-region` | AWS::SQS::Queue | The dead-letter target and every RedriveAllowPolicy source queue must sit in the deploy region | none |
+| `pf-sqs-redrive-policy` | AWS::SQS::Queue | RedrivePolicy needs deadLetterTargetArn (an SQS queue ARN) and maxReceiveCount in 1..1000 | none |
+| `pf-sqs-sse-exclusive` | AWS::SQS::Queue | SqsManagedSseEnabled: true and KmsMasterKeyId are mutually exclusive (one SSE type per queue) | none |
 | `pf-sfn-asl-missing-state` | AWS::StepFunctions::StateMachine | ASL Next/Default/Choices must reference a defined state (top-level states; a dangling StartAt is covered by engine rule E3601) | none |
 | `pf-tags-aws-prefix` | * | Tag keys may not use the reserved aws: prefix | none |
 | `pf-tags-count-max` | * | A resource may carry at most 50 tags | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.31" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.32" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */