cdk-preflight 0.0.35 → 0.0.37

package/.claude/skills/find-preflight-rules/SKILL.md

@@ -87,6 +87,8 @@ EOL ランタイム、廃止インスタンスタイプ、リージョン非対
    console.log(JSON.stringify(r.diagnostics, null, 2));"
    ```
    `ERROR` / `FATAL`（`source` が `SCHEMA` か `CFN_LINT`）が出たら**その候補は捨てる**。`WARN` クラスだけ、あるいは `INFO` だけならグレーゾーンなので、上流に severity の issue を出す候補として記録し、つなぎで実装するなら `upstream: pending-engine` を付ける
+   - **CLI のサービスモデルが API より古いことがある**（2026-09-05、`aws wafv2` は `Monetize` と `PreParseTextTransformations` を知らず ParamValidation で落ちた）。CLI が拒否するフィールドだけスタックを立てる。名前が scope / region 単位で一意なサービス（WAFv2）は、並列 bench のフィクスチャ名にルール ID を混ぜる
+   - **`--cli-input-json` の blob は base64**（`SearchString` を平文で書くとクライアント側で "Invalid base64" になり、サーバに届かないまま全滅する）
    - **サービス API を直接叩けるものは先に叩く**（2026-09-05、KMS / Secrets Manager / SSM で実測）。CFN ハンドラが CreateKey / CreateAlias / ReplicateKey / GetRandomPassword / RotateSecret / PutParameter / CreateDocument / CreateMaintenanceWindow / CreateAssociation をそのまま呼ぶサービスでは、API の拒否＝スタックイベントの文面で、失敗した呼び出しは何も作らないのでタダ。ハンドラ独自の検査（`SecretString` と `GenerateSecretString` の排他、`HostedRotationLambda` の transform 要否など）だけスタックを立てる
 4. **issue に記録**。生き残った候補をチェックリストに、落ちた候補を理由つきで残す。落選理由を残すのが重要で、これが無いと次の担当が同じ調査を繰り返す
 5. **実装へ引き継ぐ**。採用候補 1 本ごとに `add-preflight-rule` を起動する。実機再現ゲートはそちら側の責務

package/.jsii

@@ -9598,6 +9598,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.35",
-  "fingerprint": "rEmIbtHTsuXmxpToUI/kkeCxK4LWv0Ll+OF+r5ZkCAY="
+  "version": "0.0.37",
+  "fingerprint": "Wx3euv/5NnO4in5gKeQ0rqAsbCWdzOMqdIvn/CN+JLI="
 }

package/AGENTS.md

@@ -155,4 +155,13 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **`resolve()` of `Fn::GetAtt <Resource>.<Attr>` also returns the target's logical ID** (measured 2026-09-05), exactly like a `Ref`. So `resolve(sub, "Properties.Endpoint")` on `Fn::GetAtt Queue.Arn` yields `"Queue"`, which can be fed to `resources_of_type(...)` membership and a second `resolve` on the target. When the *kind* of reference matters (a URL-taking property handed an ARN), read the raw document: `Ref` is `{"__kind": "resource", "__ref": "Q"}`, `Fn::GetAtt` is `{"__kind": "getatt:<Attr>", "__ref": "Q"}`; `flatten_list` drops `__kind`. Reference implementations: `pf-sqs-queue-policy-queues`, `pf-sns-topic-policy-topics`.
 - **Cross-resource checks the engine already does on `Ref`/`GetAtt` wiring can be blind to literal ARNs.** `E3502` compares a source queue's type with its dead-letter queue only when `deadLetterTargetArn` is `Fn::GetAtt` of a queue in the template; a literal `.fifo` ARN (an imported queue) passes (measured 2026-09-05). Probe both wirings before deciding a candidate is covered — `pf-sqs-dlq-same-type` exists only for the literal path.
 - **Schema pattern/length coverage is per property, not per resource or per service.** `AWS::EC2::SecurityGroup.GroupDescription` carries a pattern (`F3031`) while the rule-level `SecurityGroupIngress[].Description` on the same resource carries none; DynamoDB's GSI `IndexName` has one while the table's own `TableName` does not. Never generalise "the engine handles names/lengths" from a sample — probe the exact property (measured 2026-09-04 across 57 templates).
+- **Intrinsics reach Rego as marker objects** (measured 2026-09-05): `{"Fn::GetAtt": ["X", "Arn"]}` is `{"__kind": "getatt:Arn", "__ref": "X"}`, `{"Ref": "X"}` is `{"__kind": "resource", "__ref": "X"}`, and a `Fn::Sub` that still references a resource is `{"__dynamic": "Sub:..."}` (undefined under `resolve()`). `resolve()` turns the first two into the logical id `"X"`, so a "literal string" check must also require `not input.resources[s]` — `rules/_lib/wafv2.rego` has `_pf_waflib_getatt / _ref / _lit` for the three cases. Array elements resolve through dotted paths (`Properties.L.1`), not `L[1]`.
+- **More missing builtins (measured 2026-09-05)**: `net.cidr_is_valid` / `net.cidr_*` and `base64.decode`. CIDR parsing is regex + arithmetic with `bits.and` / `bits.lsh` (present, `pf-wafv2-ipset-addresses`); `ceil`, `floor`, `sum`, `sort`, `max`, `array.concat`, `trim_prefix` / `trim_suffix`, `to_number`, `regex.is_valid` (RE2-like: false for backreferences, lookaround, possessive / atomic groups) all work.
+- **Without `walk`, a recursive statement tree is unrolled level by level**: `rules/_lib/wafv2.rego` expands And / Or / Not / ScopeDown six levels deep into `[container, rule index, path, statement]` tuples that every WAFv2 rule iterates. Rego has no recursion, so the depth is a hard ceiling — say so in a `ponytail:` comment.
+- **A comprehension inside a rule head does not schedule** (`sprintf("%s", [concat(", ", [k | some k in keys])])` → "statements not scheduled" at evaluation, measured 2026-09-05). Bind it to a variable in the body and use the variable in the head.
+- **`some` cannot re-declare a variable that is already bound in the same body or an enclosing one** ("var `name` used before definition below"). Iterating the same tuple set twice needs fresh names plus equality checks (`some [nm, ii, m, l2, c2] in set; nm == name; ii == i`), and a comprehension inside a body must not reuse the body's variable names.
+- **`sprintf` with the wrong arity silently disables the rule**, like a bare `%`: `sprintf("%d %s", [n], extra)` never evaluates and nothing warns (measured 2026-09-05). Keep every argument inside the array.
+- **`meta.fixtureRegion` moves a rule's fixture evaluation off the harness default (us-east-1)**. Needed for rules about the deploy region itself (`pf-wafv2-scope-region`: CLOUDFRONT scope only in us-east-1) whose fail template cannot fire where the harness runs.
+- **WAFv2 names are unique per scope and region, so parallel bench runs collide on fixture names.** The WAFv2 generators suffix every `Name` with the rule id (`uniq()` in the scratch `gen-lib.js`); do the same for any service whose entity names are account-unique.
+- **The CLI's service model can lag the API** (measured 2026-09-05: `aws wafv2` had no `Monetize` action and no `PreParseTextTransformations`). Fields the CLI rejects with ParamValidation need a stack for triage; everything else is cheaper through `create-*` calls whose rejections create nothing (WAF: ~290 calls, 13 stacks for the whole survey). `aws wafv2 check-capacity` is the oracle for the WCU estimate in `pf-wafv2-capacity`.
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.

package/docs/rules.md

@@ -41,8 +41,40 @@
 | `pf-batch-retry-attempts` | AWS::Batch::JobDefinition | RetryStrategy.Attempts may not exceed 10 | none |
 | `pf-batch-timeout-minimum` | AWS::Batch::JobDefinition | Timeout.AttemptDurationSeconds must be at least 60 | none |
 | `pf-batch-unmanaged-fargate` | AWS::Batch::ComputeEnvironment | UNMANAGED compute environments cannot be Fargate | none |
-| `pf-agentcore-gateway-jwt-authorizer` | AWS::BedrockAgentCore::Gateway | Gateways with AuthorizerType CUSTOM_JWT require AuthorizerConfiguration | none |
+| `pf-agentcore-apikey-provider-secret-source` | AWS::BedrockAgentCore::ApiKeyCredentialProvider | An API key credential provider takes ApiKey when the secret is MANAGED and ApiKeySecretConfig when it is EXTERNAL, never both | none |
+| `pf-agentcore-config-bundle-components-empty` | AWS::BedrockAgentCore::ConfigurationBundle | A configuration bundle needs at least one component | none |
+| `pf-agentcore-dataset-source-exactly-one` | AWS::BedrockAgentCore::Dataset | Dataset Source must hold exactly one of InlineExamples or S3Source | none |
+| `pf-agentcore-evaluator-rating-scale-empty` | AWS::BedrockAgentCore::Evaluator | An LLM-as-a-judge evaluator RatingScale must list at least one scale entry | none |
+| `pf-agentcore-gateway-authorizer-config-unexpected` | AWS::BedrockAgentCore::Gateway | Gateways with AuthorizerType AWS_IAM or NONE must not set AuthorizerConfiguration | none |
+| `pf-agentcore-gateway-interceptor-point-unique` | AWS::BedrockAgentCore::Gateway | Gateway interceptors may bind each interception point (REQUEST / RESPONSE) only once | none |
+| `pf-agentcore-gateway-jwt-authorizer` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::PaymentManager | Gateways and payment managers with AuthorizerType CUSTOM_JWT require AuthorizerConfiguration | none |
+| `pf-agentcore-gateway-mcp-supported-versions` | AWS::BedrockAgentCore::Gateway | Gateway MCP SupportedVersions must be MCP protocol versions the service supports | none |
+| `pf-agentcore-gateway-target-credential-provider-required` | AWS::BedrockAgentCore::GatewayTarget | Gateway target credential types OAUTH and API_KEY require the matching CredentialProvider block | none |
+| `pf-agentcore-gateway-target-iam-credential-provider` | AWS::BedrockAgentCore::GatewayTarget | OpenAPI and MCP server gateway targets using GATEWAY_IAM_ROLE must set IamCredentialProvider (the SigV4 service) | none |
+| `pf-agentcore-gateway-target-lambda-credential-type` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets accept only the GATEWAY_IAM_ROLE credential provider | none |
+| `pf-agentcore-gateway-target-lambda-tool-name-unique` | AWS::BedrockAgentCore::GatewayTarget | Tool names in a Lambda gateway target's inline ToolSchema must be unique | none |
+| `pf-agentcore-gateway-target-lambda-tool-schema-empty` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets need at least one tool in ToolSchema.InlinePayload | none |
+| `pf-agentcore-gateway-target-openapi-schema` | AWS::BedrockAgentCore::GatewayTarget | Inline OpenAPI schemas for gateway targets must be OpenAPI 3 with a servers list and an operationId on every operation | none |
+| `pf-agentcore-jwt-authorizer-claims` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::Harness | A CustomJWTAuthorizer needs at least one of AllowedAudience, AllowedClients, AllowedScopes, or CustomClaims | none |
+| `pf-agentcore-memory-custom-strategy-execution-role` | AWS::BedrockAgentCore::Memory | Memories with a custom strategy require MemoryExecutionRoleArn | none |
+| `pf-agentcore-memory-strategy-exactly-one` | AWS::BedrockAgentCore::Memory | Each MemoryStrategies entry must hold exactly one strategy type, and a CustomMemoryStrategy exactly one Configuration override | pending-engine |
+| `pf-agentcore-memory-strategy-name-unique` | AWS::BedrockAgentCore::Memory | Memory strategy names must be unique within a memory | none |
+| `pf-agentcore-memory-strategy-namespaces-count` | AWS::BedrockAgentCore::Memory | A memory strategy accepts exactly one namespace | none |
+| `pf-agentcore-memory-strategy-type-unique` | AWS::BedrockAgentCore::Memory | A memory may carry at most one strategy of each built-in type | none |
+| `pf-agentcore-oauth2-provider-client-secret` | AWS::BedrockAgentCore::OAuth2CredentialProvider | A custom OAuth2 provider takes ClientSecret when the secret is MANAGED and ClientSecretConfig when it is EXTERNAL, never both | none |
+| `pf-agentcore-oauth2-provider-private-key-jwt` | AWS::BedrockAgentCore::OAuth2CredentialProvider | ClientAuthenticationMethod PRIVATE_KEY_JWT cannot be satisfied through CloudFormation (PrivateKeyJwtConfig is not in the resource schema) | none |
+| `pf-agentcore-oauth2-provider-vendor-config` | AWS::BedrockAgentCore::OAuth2CredentialProvider | Oauth2ProviderConfigInput must contain the config block that matches CredentialProviderVendor | none |
+| `pf-agentcore-online-eval-evaluator-unique` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config must not list the same evaluator twice | none |
+| `pf-agentcore-online-eval-evaluators-or-insights` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config needs a non-empty Evaluators list (or Insights) | none |
+| `pf-agentcore-payment-credential-provider-vendor-config` | AWS::BedrockAgentCore::PaymentCredentialProvider | ProviderConfigurationInput must contain the block matching CredentialProviderVendor (CoinbaseCDP / StripePrivy) | none |
+| `pf-agentcore-policy-cedar-statement` | AWS::BedrockAgentCore::Policy | A Cedar policy statement must be a permit/forbid clause that constrains the resource and, for permit, carries a condition | none |
+| `pf-agentcore-required-union-empty` | AWS::BedrockAgentCore::Evaluator<br>AWS::BedrockAgentCore::GatewayTarget<br>AWS::BedrockAgentCore::Policy | Required union blocks (EvaluatorConfig, TargetConfiguration, Definition) must not be empty objects | pending-engine |
+| `pf-agentcore-resource-policy-document` | AWS::BedrockAgentCore::ResourcePolicy | A resource policy must be a JSON policy whose statements carry Principal, bedrock-agentcore actions, and exactly one Resource ARN | none |
+| `pf-agentcore-runtime-artifact-exactly-one` | AWS::BedrockAgentCore::Runtime | AgentRuntimeArtifact must hold exactly one of ContainerConfiguration or CodeConfiguration | none |
+| `pf-agentcore-runtime-code-entrypoint-extension` | AWS::BedrockAgentCore::Runtime | A CodeConfiguration EntryPoint file must match the selected Runtime (.py for PYTHON_*) | none |
+| `pf-agentcore-runtime-env-var-count` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime EnvironmentVariables holds at most 50 entries | pending-engine |
 | `pf-agentcore-runtime-name` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime names must match [a-zA-Z][a-zA-Z0-9_]{0,47} (no hyphens) | pending-engine |
+| `pf-agentcore-vpc-network-mode-config` | AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::BrowserCustom<br>AWS::BedrockAgentCore::CodeInterpreterCustom<br>AWS::BedrockAgentCore::Harness | NetworkMode VPC requires the VPC config block, and PUBLIC forbids it (Runtime, Browser, Code Interpreter, Harness) | none |
 | `pf-cloudfront-acm-cert-region` | AWS::CloudFront::Distribution | CloudFront viewer certificates must live in us-east-1 | none |
 | `pf-cloudfront-aliases-require-custom-certificate` | AWS::CloudFront::Distribution | A distribution with Aliases cannot use the CloudFront default certificate | none |
 | `pf-cloudfront-cache-policy-name` | AWS::CloudFront::CachePolicy | Cache policy names allow only alphanumerics, dash and underscore | none |
@@ -312,3 +344,32 @@
 | `pf-sfn-name-charset` | AWS::StepFunctions::StateMachine<br>AWS::StepFunctions::Activity | StateMachineName and Activity Name may not contain whitespace, brackets (< > { } [ ]), wildcards (? *), the special characters " # % \ ^ | ~ ` $ & , ; : / or control characters (non-ASCII letters are accepted) | none |
 | `pf-tags-aws-prefix` | * | Tag keys may not use the reserved aws: prefix | none |
 | `pf-tags-count-max` | * | A resource may carry at most 50 tags | none |
+| `pf-wafv2-association-config-scope` | AWS::WAFv2::WebACL | AssociationConfig.RequestBody keys must match the web ACL Scope | none |
+| `pf-wafv2-association-resource-arn` | AWS::WAFv2::WebACLAssociation | ResourceArn must be a supported protected-resource ARN in the deploy account and region | none |
+| `pf-wafv2-association-webacl-arn` | AWS::WAFv2::WebACLAssociation | WebACLArn must be the ARN of a web ACL in the deploy region | none |
+| `pf-wafv2-byte-match` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | ByteMatchStatement: exactly one of SearchString / SearchStringBase64, at most 200 bytes, non-blank, and CONTAINS_WORD only with [A-Za-z0-9_] | none |
+| `pf-wafv2-capacity` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule group Capacity must be 1..5000 and cover the WCUs of its rules; a web ACL is limited to 5000 WCUs | none |
+| `pf-wafv2-challenge-immunity-time` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Challenge immunity time must be at least 300 seconds | none |
+| `pf-wafv2-cloudfront-only-features` | AWS::WAFv2::WebACL | ResponseInspection and the Monetize action only work in CLOUDFRONT-scoped web ACLs (Monetize also needs MonetizationConfig) | none |
+| `pf-wafv2-custom-request-handling` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Inserted request headers: unique names, at most 10 per action and 100 per web ACL / rule group | none |
+| `pf-wafv2-custom-response` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Custom responses: no content-type or duplicate headers, at most 10 headers, body keys must exist, bodies within 4 KB / 50 entries / 50 KB total | none |
+| `pf-wafv2-data-protection` | AWS::WAFv2::WebACL | Data protection fields: FieldKeys required for single-key types, forbidden for QUERY_STRING / BODY, one entry per field type | none |
+| `pf-wafv2-ipset-addresses` | AWS::WAFv2::IPSet | IP set addresses must be CIDR blocks of the declared version with a 1..32 / 1..128 prefix and no host bits set | none |
+| `pf-wafv2-label-syntax` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule labels and label match keys must follow the label syntax (no reserved words, no empty components, at most 8 components of 128 chars, no labels on rule group references) | none |
+| `pf-wafv2-logging-destination` | AWS::WAFv2::LoggingConfiguration | Exactly one log destination whose name starts with aws-waf-logs-, in the web ACL account and region | none |
+| `pf-wafv2-logging-filter-condition` | AWS::WAFv2::LoggingConfiguration | Each logging filter condition is exactly one of ActionCondition / LabelNameCondition | none |
+| `pf-wafv2-logging-unique` | AWS::WAFv2::LoggingConfiguration | One LoggingConfiguration per web ACL in a template | none |
+| `pf-wafv2-managed-rule-group` | AWS::WAFv2::WebACL | Managed rule group statements: known AWS group names, matching and complete ManagedRuleGroupConfigs, consistent overrides and response inspection | none |
+| `pf-wafv2-metric-name-reserved` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | MetricName Default_Action is reserved | none |
+| `pf-wafv2-name-unique` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::IPSet<br>AWS::WAFv2::RegexPatternSet | Two WAFv2 entities of the same type, Scope and Name in one template | none |
+| `pf-wafv2-rate-based-statement` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rate-based statement aggregation settings must be consistent (keys, forwarded IP config, scope-down, counts) | none |
+| `pf-wafv2-reference-arn` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | IP set / regex pattern set / rule group references must match the web ACL scope, region and account | none |
+| `pf-wafv2-regex-syntax` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::RegexPatternSet | Regular expressions must stay within the supported PCRE subset (no backreferences, lookaround, possessive / atomic groups, conditionals, recursion, \K, \R, control verbs), at most 10 per pattern set | none |
+| `pf-wafv2-rule-action` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule group references take OverrideAction, every other rule takes Action; each action object names exactly one action | none |
+| `pf-wafv2-rule-unique` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule priorities and names must be unique within a web ACL / rule group | none |
+| `pf-wafv2-scope-region` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::IPSet<br>AWS::WAFv2::RegexPatternSet | Scope CLOUDFRONT is only accepted in us-east-1 | none |
+| `pf-wafv2-statement-exactly-one` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Statement, FieldToMatch, MatchPattern and custom-key objects name exactly one alternative | none |
+| `pf-wafv2-statement-limits` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Statement limits: 50 country codes, 30-character query argument names, 50 reference statements per web ACL / rule group, unique header and cookie filters | none |
+| `pf-wafv2-statement-nesting` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | And/Or need two nested statements; managed rule group, rule group reference and rate-based statements cannot be nested | none |
+| `pf-wafv2-text-transformations` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Text transformations: unique priorities, at most 10, and pre-parse transformations only on query-argument components with pre-parse types | none |
+| `pf-wafv2-token-domains` | AWS::WAFv2::WebACL | Token domains must be registrable domains (no bare labels, TLDs or public suffixes), at most 10 | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.35" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.37" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */

package/lib/rules.generated.d.ts

@@ -5,6 +5,7 @@ export interface BundledRuleData {
     readonly title: string;
     readonly upstream: string;
     readonly resourceTypes: string[];
+    readonly fixtureRegion?: string;
     readonly rego: string;
 }
 export declare const BUNDLED_RULES: BundledRuleData[];