cdk-preflight 0.0.36 → 0.0.38

package/.jsii

@@ -9598,6 +9598,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.36",
-  "fingerprint": "8dI0CJwBXHHN290HYbubn8Iqxzg1WM2YT14NLd2xt20="
+  "version": "0.0.38",
+  "fingerprint": "fwhHqPtlXH+TB6CO+I7WbOQ5G6tt5W+soZqV+peK7uU="
 }

package/AGENTS.md

@@ -164,4 +164,11 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **`meta.fixtureRegion` moves a rule's fixture evaluation off the harness default (us-east-1)**. Needed for rules about the deploy region itself (`pf-wafv2-scope-region`: CLOUDFRONT scope only in us-east-1) whose fail template cannot fire where the harness runs.
 - **WAFv2 names are unique per scope and region, so parallel bench runs collide on fixture names.** The WAFv2 generators suffix every `Name` with the rule id (`uniq()` in the scratch `gen-lib.js`); do the same for any service whose entity names are account-unique.
 - **The CLI's service model can lag the API** (measured 2026-09-05: `aws wafv2` had no `Monetize` action and no `PreParseTextTransformations`). Fields the CLI rejects with ParamValidation need a stack for triage; everything else is cheaper through `create-*` calls whose rejections create nothing (WAF: ~290 calls, 13 stacks for the whole survey). `aws wafv2 check-capacity` is the oracle for the WCU estimate in `pf-wafv2-capacity`.
+- **`resolve(...) != <value>` never fires on an absent property** (measured 2026-09-06): `resolve()` is undefined for a missing key, so `resolve(name, "Properties.Encrypted") != true` skips exactly the templates that omit the property — the case the rule is usually about. Write the positive helper and negate it (`_pf_x_encrypted(name) if resolve(name, "Properties.Encrypted") == true` … `not _pf_x_encrypted(name)`). Reference: `pf-efs-kms-key`, `pf-efs-file-system-policy`.
+- **`E3019` already checks primary-identifier uniqueness across resources** (measured 2026-09-06: two `AWS::ECR::RepositoryCreationTemplate` with the same `Prefix` → ERROR). A "two resources share the same name" rule is a duplicate whenever that name is the type's primary identifier — probe before writing one.
+- **Registry `maxItems` can be stricter *or* looser than the service** (measured 2026-09-06): ECR replication rules are capped at 10 by the schema although the quota is 25 (so `F3032` blocks first), while an EFS mount target's `SecurityGroups` accepts 100 in the schema and 5 in the service. Neither direction can be assumed — probe the number.
+- **A property can behave differently through CloudFormation than through the API** (measured 2026-09-06): two `AWS::EFS::AccessPoint` resources sharing a `ClientToken` both deploy fine, while `CreateAccessPoint` with a repeated token returns `AccessPointAlreadyExists` — CloudFormation supplies its own idempotency token. An API rejection is a hypothesis; only the real-deploy gate settles it.
+- **A fixture cannot reference its own resource**: `Fn::GetAtt` of the resource the property belongs to is `F3004` (circular dependency) — e.g. an EFS `FileSystemPolicy` naming its own file system ARN. Use `"*"` (or omit the field) in the pass template.
+- **Bench templates that create a VPC hit the 5-per-region VPC quota**: run those rules with low parallelism (`-P 2`) or a stack takes `The maximum number of VPCs has been reached` and the run is INCONCLUSIVE (measured 2026-09-06 with eight parallel EFS mount-target probes).
+- **Prefer a fail fixture whose resource is never created.** A stack that got as far as two EFS mount targets spends 20+ minutes in `ROLLBACK_IN_PROGRESS` (subnet and security-group deletion wait on the ENIs), which outruns `poll_terminal` and reports TIMEOUT / INCONCLUSIVE even though the constraint fired. Pick the branch that fails on the first call — for `pf-efs-mount-target-availability-zone` the One Zone mismatch instead of the duplicate zone — and cover the slower branch with an inline test (measured 2026-09-06).
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.

package/docs/rules.md

@@ -41,8 +41,40 @@
 | `pf-batch-retry-attempts` | AWS::Batch::JobDefinition | RetryStrategy.Attempts may not exceed 10 | none |
 | `pf-batch-timeout-minimum` | AWS::Batch::JobDefinition | Timeout.AttemptDurationSeconds must be at least 60 | none |
 | `pf-batch-unmanaged-fargate` | AWS::Batch::ComputeEnvironment | UNMANAGED compute environments cannot be Fargate | none |
-| `pf-agentcore-gateway-jwt-authorizer` | AWS::BedrockAgentCore::Gateway | Gateways with AuthorizerType CUSTOM_JWT require AuthorizerConfiguration | none |
+| `pf-agentcore-apikey-provider-secret-source` | AWS::BedrockAgentCore::ApiKeyCredentialProvider | An API key credential provider takes ApiKey when the secret is MANAGED and ApiKeySecretConfig when it is EXTERNAL, never both | none |
+| `pf-agentcore-config-bundle-components-empty` | AWS::BedrockAgentCore::ConfigurationBundle | A configuration bundle needs at least one component | none |
+| `pf-agentcore-dataset-source-exactly-one` | AWS::BedrockAgentCore::Dataset | Dataset Source must hold exactly one of InlineExamples or S3Source | none |
+| `pf-agentcore-evaluator-rating-scale-empty` | AWS::BedrockAgentCore::Evaluator | An LLM-as-a-judge evaluator RatingScale must list at least one scale entry | none |
+| `pf-agentcore-gateway-authorizer-config-unexpected` | AWS::BedrockAgentCore::Gateway | Gateways with AuthorizerType AWS_IAM or NONE must not set AuthorizerConfiguration | none |
+| `pf-agentcore-gateway-interceptor-point-unique` | AWS::BedrockAgentCore::Gateway | Gateway interceptors may bind each interception point (REQUEST / RESPONSE) only once | none |
+| `pf-agentcore-gateway-jwt-authorizer` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::PaymentManager | Gateways and payment managers with AuthorizerType CUSTOM_JWT require AuthorizerConfiguration | none |
+| `pf-agentcore-gateway-mcp-supported-versions` | AWS::BedrockAgentCore::Gateway | Gateway MCP SupportedVersions must be MCP protocol versions the service supports | none |
+| `pf-agentcore-gateway-target-credential-provider-required` | AWS::BedrockAgentCore::GatewayTarget | Gateway target credential types OAUTH and API_KEY require the matching CredentialProvider block | none |
+| `pf-agentcore-gateway-target-iam-credential-provider` | AWS::BedrockAgentCore::GatewayTarget | OpenAPI and MCP server gateway targets using GATEWAY_IAM_ROLE must set IamCredentialProvider (the SigV4 service) | none |
+| `pf-agentcore-gateway-target-lambda-credential-type` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets accept only the GATEWAY_IAM_ROLE credential provider | none |
+| `pf-agentcore-gateway-target-lambda-tool-name-unique` | AWS::BedrockAgentCore::GatewayTarget | Tool names in a Lambda gateway target's inline ToolSchema must be unique | none |
+| `pf-agentcore-gateway-target-lambda-tool-schema-empty` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets need at least one tool in ToolSchema.InlinePayload | none |
+| `pf-agentcore-gateway-target-openapi-schema` | AWS::BedrockAgentCore::GatewayTarget | Inline OpenAPI schemas for gateway targets must be OpenAPI 3 with a servers list and an operationId on every operation | none |
+| `pf-agentcore-jwt-authorizer-claims` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::Harness | A CustomJWTAuthorizer needs at least one of AllowedAudience, AllowedClients, AllowedScopes, or CustomClaims | none |
+| `pf-agentcore-memory-custom-strategy-execution-role` | AWS::BedrockAgentCore::Memory | Memories with a custom strategy require MemoryExecutionRoleArn | none |
+| `pf-agentcore-memory-strategy-exactly-one` | AWS::BedrockAgentCore::Memory | Each MemoryStrategies entry must hold exactly one strategy type, and a CustomMemoryStrategy exactly one Configuration override | pending-engine |
+| `pf-agentcore-memory-strategy-name-unique` | AWS::BedrockAgentCore::Memory | Memory strategy names must be unique within a memory | none |
+| `pf-agentcore-memory-strategy-namespaces-count` | AWS::BedrockAgentCore::Memory | A memory strategy accepts exactly one namespace | none |
+| `pf-agentcore-memory-strategy-type-unique` | AWS::BedrockAgentCore::Memory | A memory may carry at most one strategy of each built-in type | none |
+| `pf-agentcore-oauth2-provider-client-secret` | AWS::BedrockAgentCore::OAuth2CredentialProvider | A custom OAuth2 provider takes ClientSecret when the secret is MANAGED and ClientSecretConfig when it is EXTERNAL, never both | none |
+| `pf-agentcore-oauth2-provider-private-key-jwt` | AWS::BedrockAgentCore::OAuth2CredentialProvider | ClientAuthenticationMethod PRIVATE_KEY_JWT cannot be satisfied through CloudFormation (PrivateKeyJwtConfig is not in the resource schema) | none |
+| `pf-agentcore-oauth2-provider-vendor-config` | AWS::BedrockAgentCore::OAuth2CredentialProvider | Oauth2ProviderConfigInput must contain the config block that matches CredentialProviderVendor | none |
+| `pf-agentcore-online-eval-evaluator-unique` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config must not list the same evaluator twice | none |
+| `pf-agentcore-online-eval-evaluators-or-insights` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config needs a non-empty Evaluators list (or Insights) | none |
+| `pf-agentcore-payment-credential-provider-vendor-config` | AWS::BedrockAgentCore::PaymentCredentialProvider | ProviderConfigurationInput must contain the block matching CredentialProviderVendor (CoinbaseCDP / StripePrivy) | none |
+| `pf-agentcore-policy-cedar-statement` | AWS::BedrockAgentCore::Policy | A Cedar policy statement must be a permit/forbid clause that constrains the resource and, for permit, carries a condition | none |
+| `pf-agentcore-required-union-empty` | AWS::BedrockAgentCore::Evaluator<br>AWS::BedrockAgentCore::GatewayTarget<br>AWS::BedrockAgentCore::Policy | Required union blocks (EvaluatorConfig, TargetConfiguration, Definition) must not be empty objects | pending-engine |
+| `pf-agentcore-resource-policy-document` | AWS::BedrockAgentCore::ResourcePolicy | A resource policy must be a JSON policy whose statements carry Principal, bedrock-agentcore actions, and exactly one Resource ARN | none |
+| `pf-agentcore-runtime-artifact-exactly-one` | AWS::BedrockAgentCore::Runtime | AgentRuntimeArtifact must hold exactly one of ContainerConfiguration or CodeConfiguration | none |
+| `pf-agentcore-runtime-code-entrypoint-extension` | AWS::BedrockAgentCore::Runtime | A CodeConfiguration EntryPoint file must match the selected Runtime (.py for PYTHON_*) | none |
+| `pf-agentcore-runtime-env-var-count` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime EnvironmentVariables holds at most 50 entries | pending-engine |
 | `pf-agentcore-runtime-name` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime names must match [a-zA-Z][a-zA-Z0-9_]{0,47} (no hyphens) | pending-engine |
+| `pf-agentcore-vpc-network-mode-config` | AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::BrowserCustom<br>AWS::BedrockAgentCore::CodeInterpreterCustom<br>AWS::BedrockAgentCore::Harness | NetworkMode VPC requires the VPC config block, and PUBLIC forbids it (Runtime, Browser, Code Interpreter, Harness) | none |
 | `pf-cloudfront-acm-cert-region` | AWS::CloudFront::Distribution | CloudFront viewer certificates must live in us-east-1 | none |
 | `pf-cloudfront-aliases-require-custom-certificate` | AWS::CloudFront::Distribution | A distribution with Aliases cannot use the CloudFront default certificate | none |
 | `pf-cloudfront-cache-policy-name` | AWS::CloudFront::CachePolicy | Cache policy names allow only alphanumerics, dash and underscore | none |
@@ -113,6 +145,20 @@
 | `pf-ec2-vpce-gateway-service` | AWS::EC2::VPCEndpoint | Gateway VPC endpoints only exist for S3 and DynamoDB | none |
 | `pf-ec2-vpce-service-region` | AWS::EC2::VPCEndpoint | VPC endpoint service names must use the deploy region unless ServiceRegion is set | none |
 | `pf-ec2-vpce-type-config` | AWS::EC2::VPCEndpoint | SubnetIds are not supported on Gateway endpoints (and RouteTableIds only on Gateway) | none |
+| `pf-ecr-encryption-configuration` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | KmsKey is only valid with EncryptionType KMS/KMS_DSSE and must live in the deploy region | none |
+| `pf-ecr-image-tag-mutability-filters` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | ImageTagMutabilityExclusionFilters requires a *_WITH_EXCLUSION mutability setting, and vice versa | none |
+| `pf-ecr-lifecycle-action` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The action type is expire or transition, and transition requires targetStorageClass: archive | none |
+| `pf-ecr-lifecycle-count` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | countUnit belongs to the sinceImage* count types only, countNumber must be positive and storageClass follows countType | none |
+| `pf-ecr-lifecycle-policy-syntax` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The lifecycle policy must be a JSON document with 1-50 rules, each holding rulePriority, selection and action and no other keys | none |
+| `pf-ecr-lifecycle-rule-priority` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | rulePriority must be unique and >= 1, and the single tagStatus=any rule must carry the highest priority | none |
+| `pf-ecr-lifecycle-tag-status` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | tagStatus=tagged needs exactly one of tagPrefixList / tagPatternList, tagStatus=untagged or any takes neither | none |
+| `pf-ecr-pull-through-cache-credential` | AWS::ECR::PullThroughCacheRule | CredentialArn is required for the authenticated upstream registries, rejected for the open ones, and must name a secret in the deploy account and region | none |
+| `pf-ecr-pull-through-cache-registry-match` | AWS::ECR::PullThroughCacheRule | UpstreamRegistry must name the registry the URL belongs to | none |
+| `pf-ecr-pull-through-cache-url` | AWS::ECR::PullThroughCacheRule | UpstreamRegistryUrl must be one of the supported upstream endpoints and cannot be this registry itself | none |
+| `pf-ecr-registry-scanning-configuration` | AWS::ECR::RegistryScanningConfiguration | BASIC scanning supports SCAN_ON_PUSH only, and two rules cannot share a scan frequency | none |
+| `pf-ecr-replication-destination` | AWS::ECR::ReplicationConfiguration | A replication destination must be another registry: not the deploy account in the deploy region, and not another partition | none |
+| `pf-ecr-repository-creation-template-applied-for` | AWS::ECR::RepositoryCreationTemplate | AppliedFor accepts REPLICATION, PULL_THROUGH_CACHE and CREATE_ON_PUSH only | none |
+| `pf-ecr-signing-profile-region` | AWS::ECR::SigningConfiguration | A signing profile ARN must be in the same region as the registry | none |
 | `pf-ecs-cluster-name` | AWS::ECS::Cluster | ECS cluster names allow only letters, numbers, hyphen and underscore (max 255) | none |
 | `pf-ecs-container-definitions-empty` | AWS::ECS::TaskDefinition | ContainerDefinitions must contain at least one container | pending-engine |
 | `pf-ecs-container-memory-over-task` | AWS::ECS::TaskDefinition | A container Memory must not exceed the task-level Memory | none |
@@ -133,6 +179,17 @@
 | `pf-ecs-service-network-config-mode` | AWS::ECS::Service<br>AWS::ECS::TaskDefinition | NetworkConfiguration requires an awsvpc task definition | none |
 | `pf-ecs-service-platform-version-ec2` | AWS::ECS::Service | PlatformVersion is not allowed with the EC2 launch type | none |
 | `pf-ecs-taskdef-family` | AWS::ECS::TaskDefinition | Task definition Family allows only letters, numbers, hyphen and underscore | none |
+| `pf-efs-availability-zone-region` | AWS::EFS::FileSystem | AvailabilityZoneName must name an Availability Zone of the deploy region | none |
+| `pf-efs-file-system-policy` | AWS::EFS::FileSystem | A file system policy may only name its own file system and must not lock out PutFileSystemPolicy | none |
+| `pf-efs-file-system-reference-region` | AWS::EFS::MountTarget<br>AWS::EFS::AccessPoint | A file system ARN passed as FileSystemId must be in the deploy region | none |
+| `pf-efs-kms-key` | AWS::EFS::FileSystem | KmsKeyId requires Encrypted: true and a key in the deploy region | none |
+| `pf-efs-lifecycle-policy` | AWS::EFS::FileSystem | Each LifecyclePolicy object carries exactly one transition, transitions cannot repeat, Archive must be later than IA and needs elastic or provisioned throughput | none |
+| `pf-efs-mount-target-availability-zone` | AWS::EFS::MountTarget | A file system takes one mount target per Availability Zone, and a One Zone file system only in its own zone | none |
+| `pf-efs-mount-target-ip-address` | AWS::EFS::MountTarget | IpAddress must fall inside the subnet CIDR and match IpAddressType, and IPv6 needs an IPv6 subnet | none |
+| `pf-efs-mount-target-network` | AWS::EFS::MountTarget | A mount target takes at most five security groups, all in the subnet VPC, and every mount target of a file system shares one VPC | none |
+| `pf-efs-performance-mode` | AWS::EFS::FileSystem | PerformanceMode maxIO works with neither One Zone storage nor elastic throughput | none |
+| `pf-efs-replication-destination` | AWS::EFS::FileSystem | A replication destination pairs Region with an Availability Zone and a KMS key of that same region | none |
+| `pf-efs-throughput-mode` | AWS::EFS::FileSystem | ProvisionedThroughputInMibps belongs to ThroughputMode: provisioned and nothing else | none |
 | `pf-elbv2-alb-subnet-count` | AWS::ElasticLoadBalancingV2::LoadBalancer | Application load balancers need at least two subnets | none |
 | `pf-elbv2-app-cookie-name` | AWS::ElasticLoadBalancingV2::TargetGroup | app_cookie stickiness requires a cookie name | none |
 | `pf-elbv2-hc-timeout-interval` | AWS::ElasticLoadBalancingV2::TargetGroup | Health check timeout must be strictly smaller than the interval | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.36" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.38" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */