cdk-preflight 0.0.39 → 0.0.41

package/.jsii

@@ -9598,6 +9598,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.39",
-  "fingerprint": "O9P/njYME5vaWShuyu/yngQ6l+N//YxxGa46xwI0vcE="
+  "version": "0.0.41",
+  "fingerprint": "psRz6YDSgwEg4ORyiDkQzoiCiLbO0gbtwIwQw3XEo/I="
 }

package/AGENTS.md

@@ -30,7 +30,7 @@ Five other validation layers sit around a CDK app. Exactly one of them is a boun
 | CDK L1 generated validators (`CfnXxx`) | synth, every CDK app | type and required-property checks only — never value ranges, patterns, or cross-field rules | **No practical overlap**: pack rules are value / cross-field constraints by construction |
 | Bundled engine default rules (`@aws/cloudformation-validate`: SCHEMA / CFN_LINT / ENGINE) | synth, via this plugin | patched registry-schema ranges/patterns/enums + cfn-lint rules | **The hard boundary** (principle 1) **and the only retirement trigger**. If the bare engine reports ERROR/FATAL on the minimal violating template, the rule must not exist — enforced by the jest duplication guard, which turns red by itself when the engine catches up |
 | cfn-lint (external CLI) | outside the synth path (a separate CI step, if the user runs one) | near-parity with the bundled engine | **Not a boundary** — never disqualifies a rule. A check cfn-lint has but the engine lacks is an upstream-PR candidate *for the engine* (project policy: contribute to cloudformation-validate, not to cfn-lint) |
-| CloudFormation server-side pre-deploy validation | CreateStack / UpdateStack / CreateChangeSet, before resources are touched | property syntax against RAW registry schemas for non-excluded types; resource name conflicts | **Effectively no overlap** with this pack's domain: ~420 resource types are excluded (IAM, EC2 SG, ECS, RDS, SFN, …) and raw schemas carry none of the doc-only limits — 0/16 real-world cases detected (measured 2026-09, cdk-validation-gap-research). Never a reason to reject a rule |
+| CloudFormation server-side pre-deploy validation | CreateStack / UpdateStack / CreateChangeSet, before resources are touched | property syntax against RAW registry schemas for non-excluded types; resource name conflicts | **Almost no overlap** with this pack's domain: ~420 resource types are excluded (IAM, EC2 SG, ECS, RDS, SFN, …) and raw schemas carry none of the doc-only limits — 0/16 real-world cases detected (measured 2026-09, cdk-validation-gap-research). Not something to *look* for, but when it does fire it is a **retirement trigger** like the engine: a single-property range that the bundled schema misses can still be enforced here (`AWS::Kinesis::Stream.RetentionPeriodHours` < 24 fails as a stack-level `Validation failed with 1 error(s)`, measured 2026-09-06 — that candidate was dropped) |
 | CloudFormation + service APIs | deploy (CREATE/UPDATE) | everything else: cross-field rules, service-side business rules, quotas | **The target, not a duplicate to avoid.** A rule exists *iff* it front-runs a real deploy-time failure here; `meta.yaml#repro` (real-deploy gate) proves that equivalence |
 
 Selection algorithm for a new rule, in order: (1) duplication guard — run the minimal violating template through the bare engine; any built-in ERROR/FATAL kills the candidate. A **WARN-class-only** engine finding (`W…`) does *not* kill it but marks a gray zone: the engine knows about the constraint and under-classifies it, so nothing blocks the deploy (`strict` promotes only ERROR/FATAL) — prefer filing an upstream severity issue, and if a stopgap rule ships anyway, mark it `upstream: pending-engine` so it retires with the upstream fix. (2) real-deploy gate — the fail template must actually fail CREATE with the predicted service error; a fail template that deploys kills the candidate (it happened: the "30-day minimum before STANDARD_IA" and the "4096-char ZipFile" constraints are documented but not enforced, so those rules were dropped). There is no third gate: L1/L2 coverage, marginal value, and how exotic the mistake looks never disqualify a candidate.
@@ -171,4 +171,14 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **A fixture cannot reference its own resource**: `Fn::GetAtt` of the resource the property belongs to is `F3004` (circular dependency) — e.g. an EFS `FileSystemPolicy` naming its own file system ARN. Use `"*"` (or omit the field) in the pass template.
 - **Bench templates that create a VPC hit the 5-per-region VPC quota**: run those rules with low parallelism (`-P 2`) or a stack takes `The maximum number of VPCs has been reached` and the run is INCONCLUSIVE (measured 2026-09-06 with eight parallel EFS mount-target probes).
 - **Prefer a fail fixture whose resource is never created.** A stack that got as far as two EFS mount targets spends 20+ minutes in `ROLLBACK_IN_PROGRESS` (subnet and security-group deletion wait on the ENIs), which outruns `poll_terminal` and reports TIMEOUT / INCONCLUSIVE even though the constraint fired. Pick the branch that fails on the first call — for `pf-efs-mount-target-availability-zone` the One Zone mismatch instead of the duplicate zone — and cover the slower branch with an inline test (measured 2026-09-06).
+- **The CloudFormation handler can be stricter than the service API** (measured 2026-09-06): `CreateReplicationGroup` accepts a single-cluster ElastiCache group, but the same template through CloudFormation fails with "When using automatic failover, there must be at least 2 cache clusters" unless `AutomaticFailoverEnabled: false` is explicit — the handler turns failover on by default. An API probe that succeeds does not clear a candidate; deploy the template too.
+- **A probe that "should fail" can create an expensive resource**: `create-cache-cluster --num-cache-nodes 41` was accepted (the documented cap of 40 is not enforced) and ElastiCache/MemoryDB refuse `delete-*` until the cluster reaches `available`, so the 41 nodes ran for ~20 minutes. Quantity and limit probes belong in CloudFormation (a rollback deletes what it made); when probing the API directly, arm a wait-then-delete loop in the same breath (measured 2026-09-06).
+- **Fixture name tagging must skip reference properties.** The generator that suffixes fixture names with the rule id has to key off the resource type: `ACLName` is the name on `AWS::MemoryDB::ACL` but a *reference* on `AWS::MemoryDB::Cluster`, and tagging it made every MemoryDB pass template fail with "ACL open-access-port not found" (measured 2026-09-06). Same for `ParameterGroupName` / `CacheParameterGroupName`.
+- **`bench/verify-rule.sh` polls for 30 minutes** (raised from 15 on 2026-09-06): ElastiCache and MemoryDB clusters take 10-25 minutes to create and about as long to roll back, and the shorter poll reported TIMEOUT / INCONCLUSIVE on rules whose constraint had already fired.
 - **Probing the raw engine with custom rules**: the rule set must be named `violation` (`data.<pkg>.violation` is looked up; a `diagnostics` set fails with "not a valid rule path"), and hand-built diagnostic objects need lowercase severities (`error`, not `ERROR`/`CUSTOM` — those are display labels added by the wrapper). Pack rules never see this because `make_diag_full` handles the shape.
+- **`as` is a reserved keyword in the engine's Rego build** (measured 2026-09-06): `acts := object.get(s, "Action", null)` is fine but `as := ...` fails to parse ("unexpected keyword `as`") and, like every parse error, takes the whole custom package down — every rule stops firing, and the jest failure names an unrelated rule.
+- **A Managed Flink application deploys with no `ApplicationConfiguration` at all** (measured 2026-09-06), which is what makes `AWS::KinesisAnalyticsV2::Application` fixtures cheap: no S3 bucket, no JAR, no Glue database, just an IAM role the service can assume. Adding a "minimal" code stanza is worse than none — CreateApplication really fetches the S3 object (`We are unable to get the specified fileKey`) and rejects `PLAINTEXT` for a Flink runtime.
+- **A Studio (ZEPPELIN-FLINK) application cannot be created without `glue:GetDatabase` on its service role**, so a Studio *pass* fixture is expensive. Every Studio-specific check (application mode, snapshots, system rollback, custom artifacts, catalog region, note JSON) fires before the Glue call, so the fail fixture can be a Studio app while the clean fixture stays a plain Flink app (measured 2026-09-06).
+- **The CloudFormation handler can word the same rejection differently from the API** (measured 2026-09-06): CreateStream says `ShardCount cannot be set while creating stream in On-Demand StreamMode`, the stack event says `ShardCount is not expected when StreamMode=ON_DEMAND`. Quote the handler's wording in the rule message — that is the string the user will search for.
+- **Kinesis rejects a cross-region ARN before it looks the resource up** ("The region specified in the ARN ... does not match the endpoint region", measured 2026-09-06 for `RegisterStreamConsumer` and `PutResourcePolicy`; `StartStreamEncryption` answers `KMSNotFoundException: Invalid arn us-west-2`). A region-binding repro therefore needs no real resource in the other region.
+- **CloudFormation's server-side validation does enforce some raw-schema ranges the bundled engine misses** (measured 2026-09-06): `RetentionPeriodHours: 12` on `AWS::Kinesis::Stream` fails before any resource is touched, as a stack-level `Validation failed with 1 error(s). Call DescribeEvents ...` with the stack itself as the LogicalResourceId — while the engine's patched schema carries only the 8760 maximum. A fail template that dies at the *stack* level rather than in a resource handler is the tell; the candidate is a duplicate and does not ship.

package/docs/rules.md

@@ -194,6 +194,25 @@
 | `pf-efs-performance-mode` | AWS::EFS::FileSystem | PerformanceMode maxIO works with neither One Zone storage nor elastic throughput | none |
 | `pf-efs-replication-destination` | AWS::EFS::FileSystem | A replication destination pairs Region with an Availability Zone and a KMS key of that same region | none |
 | `pf-efs-throughput-mode` | AWS::EFS::FileSystem | ProvisionedThroughputInMibps belongs to ThroughputMode: provisioned and nothing else | none |
+| `pf-elasticache-auth-token` | AWS::ElastiCache::ReplicationGroup | AuthToken needs in-transit encryption and must be 16-128 printable characters without slash, quotes or at-sign | none |
+| `pf-elasticache-cache-cluster-nodes` | AWS::ElastiCache::CacheCluster | A Redis cluster holds one node and cross-az needs at least two | none |
+| `pf-elasticache-cluster-mode-parameter-group` | AWS::ElastiCache::ReplicationGroup | More than one node group needs a parameter group with cluster-enabled set to yes | none |
+| `pf-elasticache-data-tiering-node-type` | AWS::ElastiCache::ReplicationGroup | DataTieringEnabled only works on r6gd node types | none |
+| `pf-elasticache-engine` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | Replication groups do not run Memcached and cache clusters do not run Valkey | none |
+| `pf-elasticache-identifier` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | A replication group or cluster name starts with a letter and holds no consecutive or trailing hyphens | none |
+| `pf-elasticache-kms-key` | AWS::ElastiCache::ReplicationGroup | KmsKeyId needs AtRestEncryptionEnabled and a key in the deploy region | none |
+| `pf-elasticache-maintenance-window` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | PreferredMaintenanceWindow must be ddd:hh24:mi-ddd:hh24:mi and span at least 60 minutes | none |
+| `pf-elasticache-port` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | Port must be in 1150-8004 or 8006-65535 | none |
+| `pf-elasticache-preferred-availability-zones` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | The preferred Availability Zone list must have exactly one entry per node | none |
+| `pf-elasticache-replication-group-clusters` | AWS::ElastiCache::ReplicationGroup | Automatic failover needs at least two cache clusters (CloudFormation turns it on by default), and NumCacheClusters cannot be combined with NumNodeGroups | none |
+| `pf-elasticache-snapshot-retention` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | SnapshotRetentionLimit is 0-35 days and Memcached does not support snapshots at all | none |
+| `pf-elasticache-snapshot-source-engine` | AWS::ElastiCache::CacheCluster | SnapshotArns and SnapshotName only restore Redis clusters | none |
+| `pf-elasticache-snapshot-window` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | SnapshotWindow must be hh24:mi-hh24:mi and must not overlap the maintenance window | none |
+| `pf-elasticache-snapshotting-cluster` | AWS::ElastiCache::ReplicationGroup | SnapshottingClusterId cannot be set on a cluster mode enabled replication group | none |
+| `pf-elasticache-user-access-string` | AWS::ElastiCache::User | The access string uses Redis ACL rules; password rules and reset are rejected and categories must exist | none |
+| `pf-elasticache-user-authentication` | AWS::ElastiCache::User | A user needs exactly one authentication mode, and passwords are 16-128 characters with at most two per user | none |
+| `pf-elasticache-user-group-default-user` | AWS::ElastiCache::UserGroup | A Redis user group must contain a user named default, and a Valkey group rejects password-less users | none |
+| `pf-elasticache-user-group-transit-encryption` | AWS::ElastiCache::ReplicationGroup | UserGroupIds requires in-transit encryption | none |
 | `pf-elbv2-alb-subnet-count` | AWS::ElasticLoadBalancingV2::LoadBalancer | Application load balancers need at least two subnets | none |
 | `pf-elbv2-app-cookie-name` | AWS::ElasticLoadBalancingV2::TargetGroup | app_cookie stickiness requires a cookie name | none |
 | `pf-elbv2-hc-timeout-interval` | AWS::ElasticLoadBalancingV2::TargetGroup | Health check timeout must be strictly smaller than the interval | none |
@@ -233,6 +252,39 @@
 | `pf-iam-policy-version` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Policy Version must be 2012-10-17 or 2008-10-17 | none |
 | `pf-iam-trust-policy-no-resource` | AWS::IAM::Role | Trust policies cannot carry a Resource field | none |
 | `pf-iam-trust-policy-service-principal` | AWS::IAM::Role | Service principals live under amazonaws.com | none |
+| `pf-kinesis-consumer-duplicate-name` | AWS::Kinesis::StreamConsumer | Two consumers of one stream cannot share a ConsumerName | none |
+| `pf-kinesis-consumer-stream-region` | AWS::Kinesis::StreamConsumer | A stream consumer must reference a stream in its own region | none |
+| `pf-kinesis-encryption-key-region` | AWS::Kinesis::Stream | The stream encryption key must live in the stream region | none |
+| `pf-kinesis-on-demand-shard-count` | AWS::Kinesis::Stream | An on-demand stream cannot set ShardCount | none |
+| `pf-kinesis-provisioned-shard-count` | AWS::Kinesis::Stream | A provisioned stream must set ShardCount | none |
+| `pf-kinesis-resource-policy-action` | AWS::Kinesis::ResourcePolicy | Resource policy actions must be plain kinesis: actions | none |
+| `pf-kinesis-resource-policy-principal` | AWS::Kinesis::ResourcePolicy | Every policy statement needs a Principal (and no NotPrincipal) | none |
+| `pf-kinesis-resource-policy-region` | AWS::Kinesis::ResourcePolicy | A resource policy must target a stream in its own region | none |
+| `pf-kinesis-resource-policy-resource` | AWS::Kinesis::ResourcePolicy | Every policy statement Resource must equal the ResourceArn | none |
+| `pf-kinesis-shard-level-metrics-all` | AWS::Kinesis::Stream | DesiredShardLevelMetrics cannot mix ALL with named metrics | none |
+| `pf-kinesis-warm-throughput-shard-count` | AWS::Kinesis::Stream | WarmThroughputMiBps cannot be combined with ShardCount or provisioned mode | none |
+| `pf-kinesisanalytics-application-mode-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationMode must match the runtime family | none |
+| `pf-kinesisanalytics-checkpoint-configuration-type` | AWS::KinesisAnalyticsV2::Application | CheckpointConfiguration needs ConfigurationType CUSTOM to carry values | none |
+| `pf-kinesisanalytics-code-content-member` | AWS::KinesisAnalyticsV2::Application | CodeContent must carry exactly the member its type names | none |
+| `pf-kinesisanalytics-code-content-type` | AWS::KinesisAnalyticsV2::Application | CodeContentType must match the runtime family | none |
+| `pf-kinesisanalytics-custom-artifact-source` | AWS::KinesisAnalyticsV2::Application | Every Studio custom artifact needs an S3 location or a Maven reference | none |
+| `pf-kinesisanalytics-encryption-key-type` | AWS::KinesisAnalyticsV2::Application | KeyId presence must match the encryption KeyType | none |
+| `pf-kinesisanalytics-glue-database-region` | AWS::KinesisAnalyticsV2::Application | The Studio Glue catalog database must be in the application region | none |
+| `pf-kinesisanalytics-log-stream-arn` | AWS::KinesisAnalyticsV2::ApplicationCloudWatchLoggingOption | LogStreamARN must name a log stream, not a log group | none |
+| `pf-kinesisanalytics-maven-artifact-type` | AWS::KinesisAnalyticsV2::Application | MavenReference is only valid for DEPENDENCY_JAR artifacts | none |
+| `pf-kinesisanalytics-monitoring-configuration-type` | AWS::KinesisAnalyticsV2::Application | MonitoringConfiguration needs ConfigurationType CUSTOM to carry values | none |
+| `pf-kinesisanalytics-parallelism-configuration-type` | AWS::KinesisAnalyticsV2::Application | ParallelismConfiguration needs ConfigurationType CUSTOM to carry values | none |
+| `pf-kinesisanalytics-parallelism-per-kpu` | AWS::KinesisAnalyticsV2::Application | ParallelismPerKPU cannot exceed 8 | none |
+| `pf-kinesisanalytics-property-group-duplicate` | AWS::KinesisAnalyticsV2::Application | PropertyGroupId must be unique within an application | none |
+| `pf-kinesisanalytics-runtime-deprecated` | AWS::KinesisAnalyticsV2::Application | Deprecated runtime environments can no longer be created | none |
+| `pf-kinesisanalytics-service-role-account` | AWS::KinesisAnalyticsV2::Application | ServiceExecutionRole must belong to the deploying account | none |
+| `pf-kinesisanalytics-snapshot-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationSnapshotConfiguration is not applicable to Studio runtimes | none |
+| `pf-kinesisanalytics-sql-configuration-runtime` | AWS::KinesisAnalyticsV2::Application | SqlApplicationConfiguration belongs to the SQL runtime only | none |
+| `pf-kinesisanalytics-sql-only-resource` | AWS::KinesisAnalyticsV2::ApplicationOutput<br>AWS::KinesisAnalyticsV2::ApplicationReferenceDataSource | Outputs and reference data sources need a SQL application | none |
+| `pf-kinesisanalytics-sql-runtime-unsupported` | AWS::KinesisAnalyticsV2::Application | SQL applications can no longer be created | none |
+| `pf-kinesisanalytics-system-rollback-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationSystemRollbackConfiguration is not applicable to Studio runtimes | none |
+| `pf-kinesisanalytics-zeppelin-configuration-runtime` | AWS::KinesisAnalyticsV2::Application | ZeppelinApplicationConfiguration belongs to Studio runtimes only | none |
+| `pf-kinesisanalytics-zeppelin-note-json` | AWS::KinesisAnalyticsV2::Application | Studio TextContent must be a Zeppelin note JSON | none |
 | `pf-kms-alias-name` | AWS::KMS::Alias | AliasName must not start with alias/aws/ (reserved for AWS managed keys) and may not contain a colon (the CloudFormation schema allows it, CreateAlias does not) | none |
 | `pf-kms-alias-target` | AWS::KMS::Alias | TargetKeyId must be a key id or key ARN (not an alias) of a key in the same account and region | none |
 | `pf-kms-key-origin` | AWS::KMS::Key | Origin AWS_CLOUDHSM and EXTERNAL_KEY_STORE cannot be created by CloudFormation, and Origin EXTERNAL does not support ML-DSA key specs | none |
@@ -257,6 +309,15 @@
 | `pf-logs-filter-pattern-bracket` | AWS::Logs::MetricFilter<br>AWS::Logs::SubscriptionFilter | A filter pattern starting with '[' must end with ']' | none |
 | `pf-logs-metric-dimensions-default-exclusive` | AWS::Logs::MetricFilter | Dimensions and DefaultValue are mutually exclusive | none |
 | `pf-logs-subscription-kinesis-role` | AWS::Logs::SubscriptionFilter | A Kinesis destination needs RoleArn | none |
+| `pf-memorydb-data-tiering-node-type` | AWS::MemoryDB::Cluster | DataTiering only works on r6gd node types | none |
+| `pf-memorydb-engine` | AWS::MemoryDB::Cluster | MemoryDB runs Valkey or Redis, not Memcached | none |
+| `pf-memorydb-kms-key-region` | AWS::MemoryDB::Cluster | KmsKeyId must name a key in the deploy region | none |
+| `pf-memorydb-maintenance-window` | AWS::MemoryDB::Cluster | MaintenanceWindow must be ddd:hh24:mi-ddd:hh24:mi and span at least 60 minutes | none |
+| `pf-memorydb-port` | AWS::MemoryDB::Cluster | Port must be in 1150-8004 or 8006-65535 | none |
+| `pf-memorydb-replicas-per-shard` | AWS::MemoryDB::Cluster | NumReplicasPerShard is 0-5 | none |
+| `pf-memorydb-snapshot-retention` | AWS::MemoryDB::Cluster | SnapshotRetentionLimit is 0-35 days | none |
+| `pf-memorydb-snapshot-window` | AWS::MemoryDB::Cluster | SnapshotWindow must be hh24:mi-hh24:mi and must not overlap the maintenance window | none |
+| `pf-memorydb-user-password` | AWS::MemoryDB::User | A password user needs passwords of 16-128 characters | none |
 | `pf-rds-backtrack` | AWS::RDS::DBCluster | Backtrack only works on aurora-mysql, with a window of at most 259200 seconds | none |
 | `pf-rds-backup-retention-range` | AWS::RDS::DBInstance | BackupRetentionPeriod must be at most 35 days | none |
 | `pf-rds-backup-window-duration` | AWS::RDS::DBInstance | The backup window must be at least 30 minutes | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.39" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.41" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */