cdk-preflight 0.0.41 → 0.0.43

package/.claude/skills/add-preflight-rule/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: add-preflight-rule
-description: cdk-preflight に新しいルールを追加する半自動パイプライン。制約の抽出（ドキュメント/エラーメッセージ）→ rule.rego と fail/pass テンプレート生成 → 重複ガードテスト → 実機再現ゲート → meta.yaml 記録 → PR 準備までを 1 セッションで行う。
+description: cdk-preflight に新しいルールを追加する半自動パイプライン。制約の抽出（ドキュメント/エラーメッセージ）→ rule.rego と fail/pass テンプレート生成 → 重複ガードテスト → 実機再現ゲート → meta.yaml 記録 → PR 準備まで。候補が複数ある場合はフェーズごとにセッションを分ける（「セッションの切り方」参照）。
 ---
 
 # add-preflight-rule
@@ -33,3 +33,20 @@ cdk-preflight のルール追加パイプライン。AGENTS.md の設計原則
    - **予想と違う理由**で失敗した場合（他アカウントの ARN、ドメイン所有権の検証など）は証拠にならない。サービスエラーが対象の制約そのものを名指しするまでテンプレートを作り直すか、除去できない交絡は `evidence` に明記する
    - `doc-only` は「再現に安価に作れないリソース（検証済み ACM 証明書、所有ドメイン等）が要る」場合に限る最終手段であって、まだ試していない制約への近道ではない。詳細は AGENTS.md の "A doc sentence is a hypothesis, not evidence" に従う
 6. **仕上げ**: `npx projen build` 全緑 → ブランチ作成 → conventional commit（`feat(rules): add <rule-id>`）→ PR 本文に: 制約の出典 / 重複チェック結果 / 実機再現ログ。
+
+## セッションの切り方（コンテキスト予算）
+
+API コストは **`往復回数 × 平均コンテキスト長`** でほぼ決まる（実測 2026-09-06: cache_read がトークン総量の 96%、AgentCore 回は 1,289 往復 × 平均 365k = 471M）。**1 サービスぶんを 1 セッションで通さない**。`find-preflight-rules` から `candidates.json` を受け取り、下の境界で `/clear` して scratchpad の `<service>/` 配下のファイルだけを引き継ぐ:
+
+| フェーズ | 入口 | 出口 |
+|---|---|---|
+| ⑤ ルール生成＋ローカルゲート | `candidates.json` | `rules/<service>/*`、`pending.txt`（実機ゲート待ちの rule id） |
+| ⑥ 実機ゲート | `pending.txt` | `bench-out/<rule-id>.log`、`meta.yaml#repro.evidence` |
+| ⑦ 仕上げ | ⑥ のログ | `pr-body.md` → commit / PR |
+
+守ること:
+
+- **rule.rego と fail/pass テンプレートを 1 本ずつヒアドキュメントで書かない**。`candidates.json` を読むジェネレータ（`rgen.py` 相当）を 1 個置き、直しはジェネレータ側に入れて再生成する。実測では打ち込んだコマンド文字列のコストが Bash 出力とほぼ同額（$318 対 $389）で、その 73% が 4k 超のヒアドキュメント
+- **書いたファイルを `cat` で読み返さない**。確認は `npx projen bundle-rules` と `npx jest` の結果だけで足りる
+- **実機ゲートは 1 本ずつ対話で回さない**。`pending.txt` を回す 1 スクリプトをバックグラウンドで走らせ、ログは `bench-out/<rule-id>.log` に書かせて、戻すのは 1 行のサマリだけにする。完了待ちのポーリングを 1 往復 1 回やらない（1 往復 ≒ 平均コンテキスト長ぶんの再読み込み）
+- ⑤ で候補が数十本あるなら、ジェネレータの入力（`candidates.json`）を直すサイクルに寄せる。個別ルールのデバッグは失敗した数本に絞る

package/.claude/skills/find-preflight-rules/SKILL.md

@@ -93,6 +93,28 @@ EOL ランタイム、廃止インスタンスタイプ、リージョン非対
 4. **issue に記録**。生き残った候補をチェックリストに、落ちた候補を理由つきで残す。落選理由を残すのが重要で、これが無いと次の担当が同じ調査を繰り返す
 5. **実装へ引き継ぐ**。採用候補 1 本ごとに `add-preflight-rule` を起動する。実機再現ゲートはそちら側の責務
 
+## セッションの切り方（コンテキスト予算）
+
+このパイプラインの API コストは **`往復回数 × 平均コンテキスト長`** でほぼ決まる。実測（2026-09-06、過去のサービス調査ジョブのトランスクリプト集計）では cache_read がトークン総量の 96%: AgentCore 回が 1,289 往復 × 平均 365k = 471M、Bedrock 回が 461 往復 × 平均 274k = 126M。**1 往復あたりの固定費がコンテキスト長に比例する**ので、長いセッションを続けること自体が課金される。
+
+後段が必要とするのは前段の**成果ファイルだけ**で会話履歴ではない。フェーズ境界で `/clear` し、受け渡しは scratchpad の `<service>/` 配下のファイルに限る:
+
+| フェーズ | 入口 | 出口 |
+|---|---|---|
+| ① 棚卸し | サービス名 | `inventory.md`（情報源 URL と拾った制約の生リスト） |
+| ② 仮説列挙（6 レンズ） | `inventory.md` | `candidates.json`（1 件 = id / 制約文 / レンズ / 出典 / fail テンプレート） |
+| ③ 重複ガード | `candidates.json` | `guard-out.txt` ＋ 生き残りだけにした `candidates.json` |
+| ④ issue コメント | ③ の出力 | `issue-comment.md` → 投稿。以降は `add-preflight-rule` へ |
+
+②→③ の境界が一番大きい。ドキュメント読みで膨らんだコンテキストは ③ 以降に一切要らない。① は「入力が巨大・出力は `inventory.md` だけ」という形なので subagent に投げてもよい。
+
+守ること:
+
+- **ドキュメント本文をコンテキストに残さない**。`read_documentation` / WebFetch は 1 ページ 20〜30k 文字がそのまま以後の全往復ぶん再読みされる（実測で 1 セッション 53 回・$122 相当）。ファイルに落として grep で必要な段落だけ読む
+- **同じテキストを二度載せない**。ヒアドキュメントで書く → `cat` で確認 → diff で再表示、で 3 倍払う。書いたものの確認は `wc -l` / `md5` / `assert` で済ませる。実測では**打ち込んだコマンド文字列のコストが出力とほぼ同額**（$318 対 $389）で、その 73% は 4k 超のヒアドキュメント
+- 候補テンプレートを 1 件ずつ手書きしない。`candidates.json` からジェネレータで吐き、重複ガードも 1 スクリプトで全件回してサマリ行だけ読む
+- 独立した呼び出しは 1 レスポンスにまとめる（実測 1,289 往復中 848 がツール 1 個だけだった）
+
 ## issue コメントの書式
 
 ```markdown

package/.jsii

@@ -9598,6 +9598,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.41",
-  "fingerprint": "psRz6YDSgwEg4ORyiDkQzoiCiLbO0gbtwIwQw3XEo/I="
+  "version": "0.0.43",
+  "fingerprint": "OkWhwr02Ynkja/+wWKd3MEJYhq+U84hqTFWzPxDsklE="
 }

package/AGENTS.md

@@ -172,6 +172,8 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **Bench templates that create a VPC hit the 5-per-region VPC quota**: run those rules with low parallelism (`-P 2`) or a stack takes `The maximum number of VPCs has been reached` and the run is INCONCLUSIVE (measured 2026-09-06 with eight parallel EFS mount-target probes).
 - **Prefer a fail fixture whose resource is never created.** A stack that got as far as two EFS mount targets spends 20+ minutes in `ROLLBACK_IN_PROGRESS` (subnet and security-group deletion wait on the ENIs), which outruns `poll_terminal` and reports TIMEOUT / INCONCLUSIVE even though the constraint fired. Pick the branch that fails on the first call — for `pf-efs-mount-target-availability-zone` the One Zone mismatch instead of the duplicate zone — and cover the slower branch with an inline test (measured 2026-09-06).
 - **The CloudFormation handler can be stricter than the service API** (measured 2026-09-06): `CreateReplicationGroup` accepts a single-cluster ElastiCache group, but the same template through CloudFormation fails with "When using automatic failover, there must be at least 2 cache clusters" unless `AutomaticFailoverEnabled: false` is explicit — the handler turns failover on by default. An API probe that succeeds does not clear a candidate; deploy the template too.
+- **A WASM trap poisons the engine for the rest of the process** (measured 2026-09-06). One bad template makes `validateDetailed` throw `RuntimeError: unreachable`, and *every subsequent template in the same process* throws the same thing — silently converting "the engine does not catch this" into "threw". A batch of 82 EC2 probes reported 70 spurious failures this way and would have hidden 70 live candidates. **Run one template per process** in duplication-guard sweeps; dropping the `cloudformation-validate` entries from `require.cache` and re-requiring does reset it, but it is far too slow to use for a sweep. Compile the probe into the repo (`.tmp/`, gitignored) rather than an outside directory — `loadEngine()` resolves `@aws/cloudformation-validate` through the repo's `node_modules` and returns `undefined` from elsewhere.
+- **A malformed identifier in a probe fixture is reported as an engine detection** (measured 2026-09-06). `VpcId: "vpc-1"` yields `E1151 'vpc-1' does not match format 'AWS::EC2::VPC.Id'` (ids need 8 or 17 hex chars, e.g. `vpc-11112222`), which reads exactly like the candidate being covered — two EC2 hypotheses (`GroupName: default`, ICMP type/code) were nearly recorded as Rejected on that basis and are clean once the id is valid. **Pair every probe with a control template that differs only in the property under test**; if the control is also flagged, the finding is about the fixture.
 - **A probe that "should fail" can create an expensive resource**: `create-cache-cluster --num-cache-nodes 41` was accepted (the documented cap of 40 is not enforced) and ElastiCache/MemoryDB refuse `delete-*` until the cluster reaches `available`, so the 41 nodes ran for ~20 minutes. Quantity and limit probes belong in CloudFormation (a rollback deletes what it made); when probing the API directly, arm a wait-then-delete loop in the same breath (measured 2026-09-06).
 - **Fixture name tagging must skip reference properties.** The generator that suffixes fixture names with the rule id has to key off the resource type: `ACLName` is the name on `AWS::MemoryDB::ACL` but a *reference* on `AWS::MemoryDB::Cluster`, and tagging it made every MemoryDB pass template fail with "ACL open-access-port not found" (measured 2026-09-06). Same for `ParameterGroupName` / `CacheParameterGroupName`.
 - **`bench/verify-rule.sh` polls for 30 minutes** (raised from 15 on 2026-09-06): ElastiCache and MemoryDB clusters take 10-25 minutes to create and about as long to roll back, and the shorter poll reported TIMEOUT / INCONCLUSIVE on rules whose constraint had already fired.

package/docs/rules.md

@@ -41,6 +41,87 @@
 | `pf-batch-retry-attempts` | AWS::Batch::JobDefinition | RetryStrategy.Attempts may not exceed 10 | none |
 | `pf-batch-timeout-minimum` | AWS::Batch::JobDefinition | Timeout.AttemptDurationSeconds must be at least 60 | none |
 | `pf-batch-unmanaged-fargate` | AWS::Batch::ComputeEnvironment | UNMANAGED compute environments cannot be Fargate | none |
+| `pf-bedrock-automated-reasoning-policy-names-unique` | AWS::Bedrock::AutomatedReasoningPolicy | Names and ids inside a policy definition must be unique | none |
+| `pf-bedrock-automated-reasoning-policy-variable-type` | AWS::Bedrock::AutomatedReasoningPolicy | Policy variables must use a type declared in PolicyDefinition.Types | none |
+| `pf-bedrock-automated-reasoning-policy-version` | AWS::Bedrock::AutomatedReasoningPolicy | PolicyDefinition.Version must be 1.0 | none |
+| `pf-bedrock-bda-blueprint-schema` | AWS::Bedrock::Blueprint | A blueprint schema needs class, description and properties | none |
+| `pf-bedrock-bda-project-blueprint-region` | AWS::Bedrock::DataAutomationProject | Blueprints must live in the project's Region | none |
+| `pf-bedrock-bda-project-blueprint-stage` | AWS::Bedrock::DataAutomationProject<br>AWS::Bedrock::Blueprint | Blueprint references must name a stage or version the blueprint has | none |
+| `pf-bedrock-bda-project-blueprints-unique` | AWS::Bedrock::DataAutomationProject<br>AWS::Bedrock::Blueprint | A project must not attach the same blueprint twice | none |
+| `pf-bedrock-bda-project-modality-routing` | AWS::Bedrock::DataAutomationProject | Modality routing overrides must fit the file type | none |
+| `pf-bedrock-bda-project-output-types` | AWS::Bedrock::DataAutomationProject | Document granularity and text-format type lists must not be empty | none |
+| `pf-bedrock-bda-project-standard-output-required` | AWS::Bedrock::DataAutomationProject | A Data Automation project needs StandardOutputConfiguration | none |
+| `pf-bedrock-bda-project-sync-modalities` | AWS::Bedrock::DataAutomationProject | A SYNC project cannot configure audio or video standard output | none |
+| `pf-bedrock-bda-project-transcript-configuration` | AWS::Bedrock::DataAutomationProject | Audio transcript settings need TRANSCRIPT among the extraction types | none |
+| `pf-bedrock-datasource-chunk-max-tokens` | AWS::Bedrock::DataSource | Fixed-size and semantic chunks are limited to 8192 tokens | none |
+| `pf-bedrock-datasource-chunk-tokens-embedding-limit` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Chunk size must not exceed the embedding model's token limit | none |
+| `pf-bedrock-datasource-chunking-configuration` | AWS::Bedrock::DataSource | ChunkingStrategy needs its matching configuration block | none |
+| `pf-bedrock-datasource-context-enrichment-neptune` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Context enrichment is only available on Neptune Analytics knowledge bases | none |
+| `pf-bedrock-datasource-hierarchical-levels` | AWS::Bedrock::DataSource | Hierarchical chunking levels must descend and OverlapTokens must stay below the child size | none |
+| `pf-bedrock-datasource-multimodal-supplemental-storage` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Multimodal parsing needs supplemental data storage on the knowledge base | none |
+| `pf-bedrock-datasource-parsing-configuration` | AWS::Bedrock::DataSource | BEDROCK_FOUNDATION_MODEL parsing needs BedrockFoundationModelConfiguration | none |
+| `pf-bedrock-datasource-parsing-model-region` | AWS::Bedrock::DataSource | The parsing model must be reachable from the data source's Region | none |
+| `pf-bedrock-datasource-supplemental-bucket-overlap` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | A data source must not share its bucket with the knowledge base's supplemental storage unless it has an inclusion prefix | none |
+| `pf-bedrock-datasource-transformation-bucket` | AWS::Bedrock::DataSource | Custom transformation intermediate storage must not use the data source bucket | none |
+| `pf-bedrock-datasource-type-configuration` | AWS::Bedrock::DataSource | DataSourceConfiguration.Type needs its matching configuration block | none |
+| `pf-bedrock-datasource-web-vector-store` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | A web crawler data source needs an OpenSearch Serverless knowledge base | none |
+| `pf-bedrock-flow-condition-default` | AWS::Bedrock::Flow | A Condition node needs a default condition | none |
+| `pf-bedrock-flow-condition-unique` | AWS::Bedrock::Flow | Conditions within a Condition node need unique names and expressions | none |
+| `pf-bedrock-flow-connection-condition` | AWS::Bedrock::Flow | A Conditional connection must leave a Condition node through one of its conditions | none |
+| `pf-bedrock-flow-connection-name-unique` | AWS::Bedrock::Flow | Flow connection names must be unique | none |
+| `pf-bedrock-flow-connection-nodes` | AWS::Bedrock::Flow | Flow connections must reference nodes that exist | none |
+| `pf-bedrock-flow-connection-ports` | AWS::Bedrock::Flow | Data connections must use outputs and inputs the nodes declare | none |
+| `pf-bedrock-flow-definition-source` | AWS::Bedrock::Flow | A flow takes exactly one of Definition, DefinitionString or DefinitionS3Location | none |
+| `pf-bedrock-flow-definition-string-json` | AWS::Bedrock::Flow | DefinitionString must be JSON | none |
+| `pf-bedrock-flow-input-expression` | AWS::Bedrock::Flow | A node input Expression must start with $.data | none |
+| `pf-bedrock-flow-input-node` | AWS::Bedrock::Flow | A flow has exactly one Input node | none |
+| `pf-bedrock-flow-input-node-output` | AWS::Bedrock::Flow | The Input node exposes a single output named document | none |
+| `pf-bedrock-flow-input-single-connection` | AWS::Bedrock::Flow | A node input accepts a single incoming connection | none |
+| `pf-bedrock-flow-node-configuration` | AWS::Bedrock::Flow | A flow node needs the Configuration member named after its Type | none |
+| `pf-bedrock-flow-node-name-unique` | AWS::Bedrock::Flow | Flow node names must be unique | none |
+| `pf-bedrock-guardrail-automated-reasoning-cross-region` | AWS::Bedrock::Guardrail | Automated Reasoning checks need CrossRegionConfig | none |
+| `pf-bedrock-guardrail-automated-reasoning-policy-region` | AWS::Bedrock::Guardrail | An Automated Reasoning policy must live in the guardrail's Region | none |
+| `pf-bedrock-guardrail-content-filter-unique` | AWS::Bedrock::Guardrail | A guardrail content policy must not list the same filter type twice | none |
+| `pf-bedrock-guardrail-grounding-filter-unique` | AWS::Bedrock::Guardrail | A contextual grounding policy must not list the same filter type twice | none |
+| `pf-bedrock-guardrail-grounding-threshold` | AWS::Bedrock::Guardrail | A contextual grounding threshold must be below 1 | none |
+| `pf-bedrock-guardrail-managed-word-list-unique` | AWS::Bedrock::Guardrail | A guardrail must not list the same managed word list twice | none |
+| `pf-bedrock-guardrail-pii-entity-unique` | AWS::Bedrock::Guardrail | A guardrail must not configure the same PII entity type twice | none |
+| `pf-bedrock-guardrail-policy-required` | AWS::Bedrock::Guardrail | A guardrail needs at least one policy | none |
+| `pf-bedrock-guardrail-profile-account` | AWS::Bedrock::Guardrail | A guardrail profile ARN must carry the deploying account | none |
+| `pf-bedrock-guardrail-profile-geo` | AWS::Bedrock::Guardrail | A guardrail profile must belong to the deploy Region's geography | none |
+| `pf-bedrock-guardrail-profile-region` | AWS::Bedrock::Guardrail | A guardrail profile ARN must carry the guardrail's own Region | none |
+| `pf-bedrock-guardrail-prompt-attack-output-strength` | AWS::Bedrock::Guardrail | The PROMPT_ATTACK content filter must use OutputStrength NONE | none |
+| `pf-bedrock-guardrail-regex-pattern-length` | AWS::Bedrock::Guardrail | A guardrail regex pattern is limited to 500 characters | none |
+| `pf-bedrock-guardrail-regex-unique` | AWS::Bedrock::Guardrail | Guardrail regex filters must have unique names and unique patterns | none |
+| `pf-bedrock-guardrail-standard-tier-cross-region` | AWS::Bedrock::Guardrail | The STANDARD safeguard tier needs CrossRegionConfig | none |
+| `pf-bedrock-guardrail-topic-definition-length` | AWS::Bedrock::Guardrail | A denied topic definition is limited to 200 characters on the CLASSIC tier | none |
+| `pf-bedrock-guardrail-topic-name-unique` | AWS::Bedrock::Guardrail | Denied topic names within a guardrail must be unique | none |
+| `pf-bedrock-guardrail-word-length` | AWS::Bedrock::Guardrail | A guardrail custom word is limited to 100 characters | none |
+| `pf-bedrock-guardrail-word-unique` | AWS::Bedrock::Guardrail | Guardrail custom words must be unique (case-insensitively) | none |
+| `pf-bedrock-inference-profile-model-source-required` | AWS::Bedrock::ApplicationInferenceProfile | An application inference profile needs ModelSource | none |
+| `pf-bedrock-inference-profile-source-region` | AWS::Bedrock::ApplicationInferenceProfile | An application inference profile copies from a model or profile of its own Region | none |
+| `pf-bedrock-kb-embedding-binary` | AWS::Bedrock::KnowledgeBase | BINARY embeddings need a model and a vector store that support them | none |
+| `pf-bedrock-kb-embedding-dimensions` | AWS::Bedrock::KnowledgeBase | Embedding Dimensions must be a size the embedding model supports | none |
+| `pf-bedrock-kb-embedding-model-region` | AWS::Bedrock::KnowledgeBase | The embedding model ARN must carry the knowledge base's Region | none |
+| `pf-bedrock-kb-s3-vectors-index-dimension` | AWS::Bedrock::KnowledgeBase | The embedding size must equal the S3 Vectors index Dimension | none |
+| `pf-bedrock-kb-sql-auth-configuration` | AWS::Bedrock::KnowledgeBase | Redshift AuthConfiguration must carry exactly the fields its Type needs | none |
+| `pf-bedrock-kb-sql-query-engine-configuration` | AWS::Bedrock::KnowledgeBase | A Redshift query engine needs the block matching its Type | none |
+| `pf-bedrock-kb-sql-storage-configuration` | AWS::Bedrock::KnowledgeBase | A Redshift storage configuration needs the block matching its Type | none |
+| `pf-bedrock-kb-storage-not-allowed` | AWS::Bedrock::KnowledgeBase | KENDRA and SQL knowledge bases must not carry StorageConfiguration | none |
+| `pf-bedrock-kb-storage-type-configuration` | AWS::Bedrock::KnowledgeBase | StorageConfiguration.Type needs its matching configuration block | none |
+| `pf-bedrock-kb-supplemental-storage-uri` | AWS::Bedrock::KnowledgeBase | Supplemental data storage must point at an S3 bucket root | none |
+| `pf-bedrock-kb-type-configuration` | AWS::Bedrock::KnowledgeBase | KnowledgeBaseConfiguration.Type needs its matching configuration block | none |
+| `pf-bedrock-kb-vector-storage-required` | AWS::Bedrock::KnowledgeBase | A VECTOR knowledge base needs StorageConfiguration | none |
+| `pf-bedrock-kb-vector-store-region` | AWS::Bedrock::KnowledgeBase | An S3 Vectors index must live in the knowledge base's Region | none |
+| `pf-bedrock-prompt-default-variant` | AWS::Bedrock::Prompt | DefaultVariant must name one of the prompt's variants | none |
+| `pf-bedrock-prompt-router-fallback-model` | AWS::Bedrock::IntelligentPromptRouter | The prompt router's fallback model must be one of its routed models | none |
+| `pf-bedrock-prompt-router-model-provider` | AWS::Bedrock::IntelligentPromptRouter | A prompt router's models must come from the same provider | none |
+| `pf-bedrock-prompt-router-model-region` | AWS::Bedrock::IntelligentPromptRouter | Prompt router models must be reachable from the deploy Region | none |
+| `pf-bedrock-prompt-router-models-count` | AWS::Bedrock::IntelligentPromptRouter | A prompt router routes between exactly two models | none |
+| `pf-bedrock-prompt-router-models-unique` | AWS::Bedrock::IntelligentPromptRouter | A prompt router must not list the same model twice | none |
+| `pf-bedrock-prompt-variant-model-or-agent` | AWS::Bedrock::Prompt | A prompt variant takes either ModelId or GenAiResource, not both | none |
+| `pf-bedrock-prompt-variant-name-unique` | AWS::Bedrock::Prompt | Prompt variant names must be unique | none |
+| `pf-bedrock-prompt-variant-template-type` | AWS::Bedrock::Prompt | A prompt variant's TemplateConfiguration must match its TemplateType | none |
 | `pf-agentcore-apikey-provider-secret-source` | AWS::BedrockAgentCore::ApiKeyCredentialProvider | An API key credential provider takes ApiKey when the secret is MANAGED and ApiKeySecretConfig when it is EXTERNAL, never both | none |
 | `pf-agentcore-config-bundle-components-empty` | AWS::BedrockAgentCore::ConfigurationBundle | A configuration bundle needs at least one component | none |
 | `pf-agentcore-dataset-source-exactly-one` | AWS::BedrockAgentCore::Dataset | Dataset Source must hold exactly one of InlineExamples or S3Source | none |
@@ -129,6 +210,12 @@
 | `pf-dynamodb-lsi-shape` | AWS::DynamoDB::Table | An LSI needs a RANGE key and the table's leading hash key | none |
 | `pf-dynamodb-table-name-format` | AWS::DynamoDB::Table<br>AWS::DynamoDB::GlobalTable | Table names allow only letters, numbers, underscore, dot and hyphen (max 255) | none |
 | `pf-dynamodb-table-name-length` | AWS::DynamoDB::Table | TableName must be at least 3 characters | pending-engine |
+| `pf-ec2-client-vpn-auth-type-config` | AWS::EC2::ClientVpnEndpoint | Client VPN AuthenticationOptions.Type must match the provided authentication sub-block | none |
+| `pf-ec2-client-vpn-authorization-rule-exclusive` | AWS::EC2::ClientVpnAuthorizationRule | Client VPN authorization rule cannot set both AccessGroupId and AuthorizeAllGroups | none |
+| `pf-ec2-client-vpn-cidr-size` | AWS::EC2::ClientVpnEndpoint | Client VPN ClientCidrBlock must be between /12 and /22 | none |
+| `pf-ec2-client-vpn-connection-log` | AWS::EC2::ClientVpnEndpoint | Client VPN ConnectionLogOptions.Enabled requires CloudwatchLogGroup | none |
+| `pf-ec2-client-vpn-port` | AWS::EC2::ClientVpnEndpoint | Client VPN VpnPort must be 443 or 1194 | none |
+| `pf-ec2-client-vpn-session-timeout` | AWS::EC2::ClientVpnEndpoint | Client VPN SessionTimeoutHours must be 8, 10, 12 or 24 | none |
 | `pf-ec2-instance-ami-arch` | AWS::EC2::Instance | Instance type architecture must match the SSM public-parameter AMI architecture | none |
 | `pf-ec2-launch-template-name` | AWS::EC2::LaunchTemplate | Launch template names are 3-128 chars of letters, numbers and -()./_ | none |
 | `pf-ec2-natgw-allocation` | AWS::EC2::NatGateway | NAT gateway AllocationId is required for public connectivity and forbidden for private | none |
@@ -140,6 +227,8 @@
 | `pf-ec2-sg-rule-description` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | Security group rule descriptions are limited to 255 chars of a restricted ASCII set | none |
 | `pf-ec2-sg-source-exclusive` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | A security group rule takes exactly one source/destination field | none |
 | `pf-ec2-subnet-cidr-size` | AWS::EC2::Subnet | Subnet IPv4 CIDR netmask must be between /16 and /28 | none |
+| `pf-ec2-tgw-amazon-side-asn` | AWS::EC2::TransitGateway | TransitGateway AmazonSideAsn must be in 64512-65534 or 4200000000-4294967294 | none |
+| `pf-ec2-tgw-cidr-block-size` | AWS::EC2::TransitGateway | TransitGatewayCidrBlocks must be /24 or larger for IPv4 | none |
 | `pf-ec2-userdata-size` | AWS::EC2::Instance<br>AWS::EC2::LaunchTemplate | EC2 user data is limited to 16384 bytes | none |
 | `pf-ec2-volume-iops` | AWS::EC2::Volume | EBS Iops/Throughput must match the volume type's supported ranges and ratios | none |
 | `pf-ec2-volume-iops-required` | AWS::EC2::Volume | io1 and io2 volumes require the Iops property | none |
@@ -149,6 +238,10 @@
 | `pf-ec2-vpce-gateway-service` | AWS::EC2::VPCEndpoint | Gateway VPC endpoints only exist for S3 and DynamoDB | none |
 | `pf-ec2-vpce-service-region` | AWS::EC2::VPCEndpoint | VPC endpoint service names must use the deploy region unless ServiceRegion is set | none |
 | `pf-ec2-vpce-type-config` | AWS::EC2::VPCEndpoint | SubnetIds are not supported on Gateway endpoints (and RouteTableIds only on Gateway) | none |
+| `pf-ec2-vpn-phase-lifetime-order` | AWS::EC2::VPNConnection | VPN Phase2LifetimeSeconds must be less than Phase1LifetimeSeconds | none |
+| `pf-ec2-vpn-pre-shared-key` | AWS::EC2::VPNConnection | VPN tunnel PreSharedKey must be 8-64 characters of [A-Za-z0-9._] and must not start with 0 | none |
+| `pf-ec2-vpn-rekey-margin` | AWS::EC2::VPNConnection | VPN RekeyMarginTimeSeconds must be less than half of Phase2LifetimeSeconds | none |
+| `pf-ec2-vpn-tunnel-inside-cidr` | AWS::EC2::VPNConnection | VPN TunnelInsideCidr must be a /30 inside 169.254.0.0/16 and not one of the reserved ranges | none |
 | `pf-ecr-encryption-configuration` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | KmsKey is only valid with EncryptionType KMS/KMS_DSSE and must live in the deploy region | none |
 | `pf-ecr-image-tag-mutability-filters` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | ImageTagMutabilityExclusionFilters requires a *_WITH_EXCLUSION mutability setting, and vice versa | none |
 | `pf-ecr-lifecycle-action` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The action type is expire or transition, and transition requires targetStorageClass: archive | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.41" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.43" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */