cdk-preflight 0.0.37 → 0.0.38

package/.jsii

@@ -9598,6 +9598,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.37",
-  "fingerprint": "Wx3euv/5NnO4in5gKeQ0rqAsbCWdzOMqdIvn/CN+JLI="
+  "version": "0.0.38",
+  "fingerprint": "fwhHqPtlXH+TB6CO+I7WbOQ5G6tt5W+soZqV+peK7uU="
 }

package/AGENTS.md

@@ -164,4 +164,11 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **`meta.fixtureRegion` moves a rule's fixture evaluation off the harness default (us-east-1)**. Needed for rules about the deploy region itself (`pf-wafv2-scope-region`: CLOUDFRONT scope only in us-east-1) whose fail template cannot fire where the harness runs.
 - **WAFv2 names are unique per scope and region, so parallel bench runs collide on fixture names.** The WAFv2 generators suffix every `Name` with the rule id (`uniq()` in the scratch `gen-lib.js`); do the same for any service whose entity names are account-unique.
 - **The CLI's service model can lag the API** (measured 2026-09-05: `aws wafv2` had no `Monetize` action and no `PreParseTextTransformations`). Fields the CLI rejects with ParamValidation need a stack for triage; everything else is cheaper through `create-*` calls whose rejections create nothing (WAF: ~290 calls, 13 stacks for the whole survey). `aws wafv2 check-capacity` is the oracle for the WCU estimate in `pf-wafv2-capacity`.
+- **`resolve(...) != <value>` never fires on an absent property** (measured 2026-09-06): `resolve()` is undefined for a missing key, so `resolve(name, "Properties.Encrypted") != true` skips exactly the templates that omit the property — the case the rule is usually about. Write the positive helper and negate it (`_pf_x_encrypted(name) if resolve(name, "Properties.Encrypted") == true` … `not _pf_x_encrypted(name)`). Reference: `pf-efs-kms-key`, `pf-efs-file-system-policy`.
+- **`E3019` already checks primary-identifier uniqueness across resources** (measured 2026-09-06: two `AWS::ECR::RepositoryCreationTemplate` with the same `Prefix` → ERROR). A "two resources share the same name" rule is a duplicate whenever that name is the type's primary identifier — probe before writing one.
+- **Registry `maxItems` can be stricter *or* looser than the service** (measured 2026-09-06): ECR replication rules are capped at 10 by the schema although the quota is 25 (so `F3032` blocks first), while an EFS mount target's `SecurityGroups` accepts 100 in the schema and 5 in the service. Neither direction can be assumed — probe the number.
+- **A property can behave differently through CloudFormation than through the API** (measured 2026-09-06): two `AWS::EFS::AccessPoint` resources sharing a `ClientToken` both deploy fine, while `CreateAccessPoint` with a repeated token returns `AccessPointAlreadyExists` — CloudFormation supplies its own idempotency token. An API rejection is a hypothesis; only the real-deploy gate settles it.
+- **A fixture cannot reference its own resource**: `Fn::GetAtt` of the resource the property belongs to is `F3004` (circular dependency) — e.g. an EFS `FileSystemPolicy` naming its own file system ARN. Use `"*"` (or omit the field) in the pass template.
+- **Bench templates that create a VPC hit the 5-per-region VPC quota**: run those rules with low parallelism (`-P 2`) or a stack takes `The maximum number of VPCs has been reached` and the run is INCONCLUSIVE (measured 2026-09-06 with eight parallel EFS mount-target probes).
+- **Prefer a fail fixture whose resource is never created.** A stack that got as far as two EFS mount targets spends 20+ minutes in `ROLLBACK_IN_PROGRESS` (subnet and security-group deletion wait on the ENIs), which outruns `poll_terminal` and reports TIMEOUT / INCONCLUSIVE even though the constraint fired. Pick the branch that fails on the first call — for `pf-efs-mount-target-availability-zone` the One Zone mismatch instead of the duplicate zone — and cover the slower branch with an inline test (measured 2026-09-06).
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.

package/docs/rules.md

@@ -145,6 +145,20 @@
 | `pf-ec2-vpce-gateway-service` | AWS::EC2::VPCEndpoint | Gateway VPC endpoints only exist for S3 and DynamoDB | none |
 | `pf-ec2-vpce-service-region` | AWS::EC2::VPCEndpoint | VPC endpoint service names must use the deploy region unless ServiceRegion is set | none |
 | `pf-ec2-vpce-type-config` | AWS::EC2::VPCEndpoint | SubnetIds are not supported on Gateway endpoints (and RouteTableIds only on Gateway) | none |
+| `pf-ecr-encryption-configuration` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | KmsKey is only valid with EncryptionType KMS/KMS_DSSE and must live in the deploy region | none |
+| `pf-ecr-image-tag-mutability-filters` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | ImageTagMutabilityExclusionFilters requires a *_WITH_EXCLUSION mutability setting, and vice versa | none |
+| `pf-ecr-lifecycle-action` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The action type is expire or transition, and transition requires targetStorageClass: archive | none |
+| `pf-ecr-lifecycle-count` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | countUnit belongs to the sinceImage* count types only, countNumber must be positive and storageClass follows countType | none |
+| `pf-ecr-lifecycle-policy-syntax` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The lifecycle policy must be a JSON document with 1-50 rules, each holding rulePriority, selection and action and no other keys | none |
+| `pf-ecr-lifecycle-rule-priority` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | rulePriority must be unique and >= 1, and the single tagStatus=any rule must carry the highest priority | none |
+| `pf-ecr-lifecycle-tag-status` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | tagStatus=tagged needs exactly one of tagPrefixList / tagPatternList, tagStatus=untagged or any takes neither | none |
+| `pf-ecr-pull-through-cache-credential` | AWS::ECR::PullThroughCacheRule | CredentialArn is required for the authenticated upstream registries, rejected for the open ones, and must name a secret in the deploy account and region | none |
+| `pf-ecr-pull-through-cache-registry-match` | AWS::ECR::PullThroughCacheRule | UpstreamRegistry must name the registry the URL belongs to | none |
+| `pf-ecr-pull-through-cache-url` | AWS::ECR::PullThroughCacheRule | UpstreamRegistryUrl must be one of the supported upstream endpoints and cannot be this registry itself | none |
+| `pf-ecr-registry-scanning-configuration` | AWS::ECR::RegistryScanningConfiguration | BASIC scanning supports SCAN_ON_PUSH only, and two rules cannot share a scan frequency | none |
+| `pf-ecr-replication-destination` | AWS::ECR::ReplicationConfiguration | A replication destination must be another registry: not the deploy account in the deploy region, and not another partition | none |
+| `pf-ecr-repository-creation-template-applied-for` | AWS::ECR::RepositoryCreationTemplate | AppliedFor accepts REPLICATION, PULL_THROUGH_CACHE and CREATE_ON_PUSH only | none |
+| `pf-ecr-signing-profile-region` | AWS::ECR::SigningConfiguration | A signing profile ARN must be in the same region as the registry | none |
 | `pf-ecs-cluster-name` | AWS::ECS::Cluster | ECS cluster names allow only letters, numbers, hyphen and underscore (max 255) | none |
 | `pf-ecs-container-definitions-empty` | AWS::ECS::TaskDefinition | ContainerDefinitions must contain at least one container | pending-engine |
 | `pf-ecs-container-memory-over-task` | AWS::ECS::TaskDefinition | A container Memory must not exceed the task-level Memory | none |
@@ -165,6 +179,17 @@
 | `pf-ecs-service-network-config-mode` | AWS::ECS::Service<br>AWS::ECS::TaskDefinition | NetworkConfiguration requires an awsvpc task definition | none |
 | `pf-ecs-service-platform-version-ec2` | AWS::ECS::Service | PlatformVersion is not allowed with the EC2 launch type | none |
 | `pf-ecs-taskdef-family` | AWS::ECS::TaskDefinition | Task definition Family allows only letters, numbers, hyphen and underscore | none |
+| `pf-efs-availability-zone-region` | AWS::EFS::FileSystem | AvailabilityZoneName must name an Availability Zone of the deploy region | none |
+| `pf-efs-file-system-policy` | AWS::EFS::FileSystem | A file system policy may only name its own file system and must not lock out PutFileSystemPolicy | none |
+| `pf-efs-file-system-reference-region` | AWS::EFS::MountTarget<br>AWS::EFS::AccessPoint | A file system ARN passed as FileSystemId must be in the deploy region | none |
+| `pf-efs-kms-key` | AWS::EFS::FileSystem | KmsKeyId requires Encrypted: true and a key in the deploy region | none |
+| `pf-efs-lifecycle-policy` | AWS::EFS::FileSystem | Each LifecyclePolicy object carries exactly one transition, transitions cannot repeat, Archive must be later than IA and needs elastic or provisioned throughput | none |
+| `pf-efs-mount-target-availability-zone` | AWS::EFS::MountTarget | A file system takes one mount target per Availability Zone, and a One Zone file system only in its own zone | none |
+| `pf-efs-mount-target-ip-address` | AWS::EFS::MountTarget | IpAddress must fall inside the subnet CIDR and match IpAddressType, and IPv6 needs an IPv6 subnet | none |
+| `pf-efs-mount-target-network` | AWS::EFS::MountTarget | A mount target takes at most five security groups, all in the subnet VPC, and every mount target of a file system shares one VPC | none |
+| `pf-efs-performance-mode` | AWS::EFS::FileSystem | PerformanceMode maxIO works with neither One Zone storage nor elastic throughput | none |
+| `pf-efs-replication-destination` | AWS::EFS::FileSystem | A replication destination pairs Region with an Availability Zone and a KMS key of that same region | none |
+| `pf-efs-throughput-mode` | AWS::EFS::FileSystem | ProvisionedThroughputInMibps belongs to ThroughputMode: provisioned and nothing else | none |
 | `pf-elbv2-alb-subnet-count` | AWS::ElasticLoadBalancingV2::LoadBalancer | Application load balancers need at least two subnets | none |
 | `pf-elbv2-app-cookie-name` | AWS::ElasticLoadBalancingV2::TargetGroup | app_cookie stickiness requires a cookie name | none |
 | `pf-elbv2-hc-timeout-interval` | AWS::ElasticLoadBalancingV2::TargetGroup | Health check timeout must be strictly smaller than the interval | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.37" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.38" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */