cdk-preflight 0.0.38 → 0.0.40

package/.jsii

@@ -9598,6 +9598,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.38",
-  "fingerprint": "fwhHqPtlXH+TB6CO+I7WbOQ5G6tt5W+soZqV+peK7uU="
+  "version": "0.0.40",
+  "fingerprint": "PbEn3YhgIMxnTYEt8A4pmaqh3sYJbtevFgL42ipTfWM="
 }

package/AGENTS.md

@@ -171,4 +171,8 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **A fixture cannot reference its own resource**: `Fn::GetAtt` of the resource the property belongs to is `F3004` (circular dependency) — e.g. an EFS `FileSystemPolicy` naming its own file system ARN. Use `"*"` (or omit the field) in the pass template.
 - **Bench templates that create a VPC hit the 5-per-region VPC quota**: run those rules with low parallelism (`-P 2`) or a stack takes `The maximum number of VPCs has been reached` and the run is INCONCLUSIVE (measured 2026-09-06 with eight parallel EFS mount-target probes).
 - **Prefer a fail fixture whose resource is never created.** A stack that got as far as two EFS mount targets spends 20+ minutes in `ROLLBACK_IN_PROGRESS` (subnet and security-group deletion wait on the ENIs), which outruns `poll_terminal` and reports TIMEOUT / INCONCLUSIVE even though the constraint fired. Pick the branch that fails on the first call — for `pf-efs-mount-target-availability-zone` the One Zone mismatch instead of the duplicate zone — and cover the slower branch with an inline test (measured 2026-09-06).
+- **The CloudFormation handler can be stricter than the service API** (measured 2026-09-06): `CreateReplicationGroup` accepts a single-cluster ElastiCache group, but the same template through CloudFormation fails with "When using automatic failover, there must be at least 2 cache clusters" unless `AutomaticFailoverEnabled: false` is explicit — the handler turns failover on by default. An API probe that succeeds does not clear a candidate; deploy the template too.
+- **A probe that "should fail" can create an expensive resource**: `create-cache-cluster --num-cache-nodes 41` was accepted (the documented cap of 40 is not enforced) and ElastiCache/MemoryDB refuse `delete-*` until the cluster reaches `available`, so the 41 nodes ran for ~20 minutes. Quantity and limit probes belong in CloudFormation (a rollback deletes what it made); when probing the API directly, arm a wait-then-delete loop in the same breath (measured 2026-09-06).
+- **Fixture name tagging must skip reference properties.** The generator that suffixes fixture names with the rule id has to key off the resource type: `ACLName` is the name on `AWS::MemoryDB::ACL` but a *reference* on `AWS::MemoryDB::Cluster`, and tagging it made every MemoryDB pass template fail with "ACL open-access-port not found" (measured 2026-09-06). Same for `ParameterGroupName` / `CacheParameterGroupName`.
+- **`bench/verify-rule.sh` polls for 30 minutes** (raised from 15 on 2026-09-06): ElastiCache and MemoryDB clusters take 10-25 minutes to create and about as long to roll back, and the shorter poll reported TIMEOUT / INCONCLUSIVE on rules whose constraint had already fired.
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.

package/docs/rules.md

@@ -52,6 +52,7 @@
 | `pf-agentcore-gateway-target-credential-provider-required` | AWS::BedrockAgentCore::GatewayTarget | Gateway target credential types OAUTH and API_KEY require the matching CredentialProvider block | none |
 | `pf-agentcore-gateway-target-iam-credential-provider` | AWS::BedrockAgentCore::GatewayTarget | OpenAPI and MCP server gateway targets using GATEWAY_IAM_ROLE must set IamCredentialProvider (the SigV4 service) | none |
 | `pf-agentcore-gateway-target-lambda-credential-type` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets accept only the GATEWAY_IAM_ROLE credential provider | none |
+| `pf-agentcore-gateway-target-lambda-region` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets must be in the gateway's own region | none |
 | `pf-agentcore-gateway-target-lambda-tool-name-unique` | AWS::BedrockAgentCore::GatewayTarget | Tool names in a Lambda gateway target's inline ToolSchema must be unique | none |
 | `pf-agentcore-gateway-target-lambda-tool-schema-empty` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets need at least one tool in ToolSchema.InlinePayload | none |
 | `pf-agentcore-gateway-target-openapi-schema` | AWS::BedrockAgentCore::GatewayTarget | Inline OpenAPI schemas for gateway targets must be OpenAPI 3 with a servers list and an operationId on every operation | none |
@@ -72,8 +73,11 @@
 | `pf-agentcore-resource-policy-document` | AWS::BedrockAgentCore::ResourcePolicy | A resource policy must be a JSON policy whose statements carry Principal, bedrock-agentcore actions, and exactly one Resource ARN | none |
 | `pf-agentcore-runtime-artifact-exactly-one` | AWS::BedrockAgentCore::Runtime | AgentRuntimeArtifact must hold exactly one of ContainerConfiguration or CodeConfiguration | none |
 | `pf-agentcore-runtime-code-entrypoint-extension` | AWS::BedrockAgentCore::Runtime | A CodeConfiguration EntryPoint file must match the selected Runtime (.py for PYTHON_*) | none |
+| `pf-agentcore-runtime-endpoint-name-default` | AWS::BedrockAgentCore::RuntimeEndpoint | A RuntimeEndpoint cannot be named DEFAULT (the runtime already owns that endpoint) | none |
 | `pf-agentcore-runtime-env-var-count` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime EnvironmentVariables holds at most 50 entries | pending-engine |
+| `pf-agentcore-runtime-lifecycle-timeout-order` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime IdleRuntimeSessionTimeout must not exceed MaxLifetime | none |
 | `pf-agentcore-runtime-name` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime names must match [a-zA-Z][a-zA-Z0-9_]{0,47} (no hyphens) | pending-engine |
+| `pf-agentcore-runtime-session-storage-single` | AWS::BedrockAgentCore::Runtime | An AgentCore Runtime allows at most one SessionStorage filesystem configuration | none |
 | `pf-agentcore-vpc-network-mode-config` | AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::BrowserCustom<br>AWS::BedrockAgentCore::CodeInterpreterCustom<br>AWS::BedrockAgentCore::Harness | NetworkMode VPC requires the VPC config block, and PUBLIC forbids it (Runtime, Browser, Code Interpreter, Harness) | none |
 | `pf-cloudfront-acm-cert-region` | AWS::CloudFront::Distribution | CloudFront viewer certificates must live in us-east-1 | none |
 | `pf-cloudfront-aliases-require-custom-certificate` | AWS::CloudFront::Distribution | A distribution with Aliases cannot use the CloudFront default certificate | none |
@@ -190,6 +194,25 @@
 | `pf-efs-performance-mode` | AWS::EFS::FileSystem | PerformanceMode maxIO works with neither One Zone storage nor elastic throughput | none |
 | `pf-efs-replication-destination` | AWS::EFS::FileSystem | A replication destination pairs Region with an Availability Zone and a KMS key of that same region | none |
 | `pf-efs-throughput-mode` | AWS::EFS::FileSystem | ProvisionedThroughputInMibps belongs to ThroughputMode: provisioned and nothing else | none |
+| `pf-elasticache-auth-token` | AWS::ElastiCache::ReplicationGroup | AuthToken needs in-transit encryption and must be 16-128 printable characters without slash, quotes or at-sign | none |
+| `pf-elasticache-cache-cluster-nodes` | AWS::ElastiCache::CacheCluster | A Redis cluster holds one node and cross-az needs at least two | none |
+| `pf-elasticache-cluster-mode-parameter-group` | AWS::ElastiCache::ReplicationGroup | More than one node group needs a parameter group with cluster-enabled set to yes | none |
+| `pf-elasticache-data-tiering-node-type` | AWS::ElastiCache::ReplicationGroup | DataTieringEnabled only works on r6gd node types | none |
+| `pf-elasticache-engine` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | Replication groups do not run Memcached and cache clusters do not run Valkey | none |
+| `pf-elasticache-identifier` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | A replication group or cluster name starts with a letter and holds no consecutive or trailing hyphens | none |
+| `pf-elasticache-kms-key` | AWS::ElastiCache::ReplicationGroup | KmsKeyId needs AtRestEncryptionEnabled and a key in the deploy region | none |
+| `pf-elasticache-maintenance-window` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | PreferredMaintenanceWindow must be ddd:hh24:mi-ddd:hh24:mi and span at least 60 minutes | none |
+| `pf-elasticache-port` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | Port must be in 1150-8004 or 8006-65535 | none |
+| `pf-elasticache-preferred-availability-zones` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | The preferred Availability Zone list must have exactly one entry per node | none |
+| `pf-elasticache-replication-group-clusters` | AWS::ElastiCache::ReplicationGroup | Automatic failover needs at least two cache clusters (CloudFormation turns it on by default), and NumCacheClusters cannot be combined with NumNodeGroups | none |
+| `pf-elasticache-snapshot-retention` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | SnapshotRetentionLimit is 0-35 days and Memcached does not support snapshots at all | none |
+| `pf-elasticache-snapshot-source-engine` | AWS::ElastiCache::CacheCluster | SnapshotArns and SnapshotName only restore Redis clusters | none |
+| `pf-elasticache-snapshot-window` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | SnapshotWindow must be hh24:mi-hh24:mi and must not overlap the maintenance window | none |
+| `pf-elasticache-snapshotting-cluster` | AWS::ElastiCache::ReplicationGroup | SnapshottingClusterId cannot be set on a cluster mode enabled replication group | none |
+| `pf-elasticache-user-access-string` | AWS::ElastiCache::User | The access string uses Redis ACL rules; password rules and reset are rejected and categories must exist | none |
+| `pf-elasticache-user-authentication` | AWS::ElastiCache::User | A user needs exactly one authentication mode, and passwords are 16-128 characters with at most two per user | none |
+| `pf-elasticache-user-group-default-user` | AWS::ElastiCache::UserGroup | A Redis user group must contain a user named default, and a Valkey group rejects password-less users | none |
+| `pf-elasticache-user-group-transit-encryption` | AWS::ElastiCache::ReplicationGroup | UserGroupIds requires in-transit encryption | none |
 | `pf-elbv2-alb-subnet-count` | AWS::ElasticLoadBalancingV2::LoadBalancer | Application load balancers need at least two subnets | none |
 | `pf-elbv2-app-cookie-name` | AWS::ElasticLoadBalancingV2::TargetGroup | app_cookie stickiness requires a cookie name | none |
 | `pf-elbv2-hc-timeout-interval` | AWS::ElasticLoadBalancingV2::TargetGroup | Health check timeout must be strictly smaller than the interval | none |
@@ -253,6 +276,15 @@
 | `pf-logs-filter-pattern-bracket` | AWS::Logs::MetricFilter<br>AWS::Logs::SubscriptionFilter | A filter pattern starting with '[' must end with ']' | none |
 | `pf-logs-metric-dimensions-default-exclusive` | AWS::Logs::MetricFilter | Dimensions and DefaultValue are mutually exclusive | none |
 | `pf-logs-subscription-kinesis-role` | AWS::Logs::SubscriptionFilter | A Kinesis destination needs RoleArn | none |
+| `pf-memorydb-data-tiering-node-type` | AWS::MemoryDB::Cluster | DataTiering only works on r6gd node types | none |
+| `pf-memorydb-engine` | AWS::MemoryDB::Cluster | MemoryDB runs Valkey or Redis, not Memcached | none |
+| `pf-memorydb-kms-key-region` | AWS::MemoryDB::Cluster | KmsKeyId must name a key in the deploy region | none |
+| `pf-memorydb-maintenance-window` | AWS::MemoryDB::Cluster | MaintenanceWindow must be ddd:hh24:mi-ddd:hh24:mi and span at least 60 minutes | none |
+| `pf-memorydb-port` | AWS::MemoryDB::Cluster | Port must be in 1150-8004 or 8006-65535 | none |
+| `pf-memorydb-replicas-per-shard` | AWS::MemoryDB::Cluster | NumReplicasPerShard is 0-5 | none |
+| `pf-memorydb-snapshot-retention` | AWS::MemoryDB::Cluster | SnapshotRetentionLimit is 0-35 days | none |
+| `pf-memorydb-snapshot-window` | AWS::MemoryDB::Cluster | SnapshotWindow must be hh24:mi-hh24:mi and must not overlap the maintenance window | none |
+| `pf-memorydb-user-password` | AWS::MemoryDB::User | A password user needs passwords of 16-128 characters | none |
 | `pf-rds-backtrack` | AWS::RDS::DBCluster | Backtrack only works on aurora-mysql, with a window of at most 259200 seconds | none |
 | `pf-rds-backup-retention-range` | AWS::RDS::DBInstance | BackupRetentionPeriod must be at most 35 days | none |
 | `pf-rds-backup-window-duration` | AWS::RDS::DBInstance | The backup window must be at least 30 minutes | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.38" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.40" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */