cdk-preflight 0.0.46 → 0.0.48

package/.jsii

@@ -9415,7 +9415,7 @@
   },
   "name": "cdk-preflight",
   "readme": {
-    "markdown": "# cdk-preflight\n\n[![monthly real-deploy verification](https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg)](https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml)\n\n**Catch deploy-time CloudFormation failures at `cdk synth` time.**\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS (or is explicitly marked `doc-only`). Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdk-preflight init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule, pass its id in `exclude`. In observe-only mode, individual findings can also be suppressed with the CDK acknowledge mechanism shown in the warning text.\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
+    "markdown": "# cdk-preflight\n\n[![monthly real-deploy verification](https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg)](https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml)\n\n**Catch deploy-time CloudFormation failures at `cdk synth` time.**\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS (or is explicitly marked `doc-only`). Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule, pass its id in `exclude`. In observe-only mode, individual findings can also be suppressed with the CDK acknowledge mechanism shown in the warning text.\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
   },
   "repository": {
     "type": "git",
@@ -9599,6 +9599,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.46",
-  "fingerprint": "e3/LW38yvBheUSkB4RG/26+4TadB4G1W8UxfoMQcJ7w="
+  "version": "0.0.48",
+  "fingerprint": "5DjHjJi6VamBDK0zNRfUa3sc9KWYP5bUMaYoWNRX254="
 }

package/README.md

@@ -17,7 +17,7 @@ The pack aims at **every deploy-time failure that no existing CDK mechanism alre
 
 ```bash
 npm i -D cdk-preflight
-npx cdk-preflight init   # inserts Preflight.apply(app) into your CDK app
+npx cdkpf init   # inserts Preflight.apply(app) into your CDK app
                          # (`npx cdkpf init` is the same command, shorter)
 ```
 

package/docs/rules.md

@@ -437,17 +437,85 @@
 | `pf-route53-weight-range` | AWS::Route53::RecordSet | Weight must be between 0 and 255 | pending-engine |
 | `pf-route53-zonename-trailing-dot` | AWS::Route53::RecordSet | HostedZoneName must end with a trailing dot | none |
 | `pf-s3-accelerate-dotted-name` | AWS::S3::Bucket | Transfer Acceleration rejects bucket names with periods | none |
+| `pf-s3-acl-public-blocked` | AWS::S3::Bucket | A public canned ACL cannot be applied while Block Public Access is on | none |
+| `pf-s3-ap-name-alias-suffix` | AWS::S3::AccessPoint | An access point name must not end with an alias suffix | none |
+| `pf-s3-bucket-name-double-dot` | AWS::S3::Bucket | A bucket name must not contain two adjacent periods | none |
+| `pf-s3-bucket-name-ip-address` | AWS::S3::Bucket | A bucket name must not look like an IP address | none |
+| `pf-s3-bucket-name-reserved-prefix` | AWS::S3::Bucket | A bucket name must not start with a reserved prefix | none |
+| `pf-s3-bucket-name-reserved-suffix` | AWS::S3::Bucket | A bucket name must not end with a reserved suffix | none |
+| `pf-s3-bucket-namespace-account-regional-name` | AWS::S3::Bucket | An account-regional bucket takes a BucketNamePrefix, not a BucketName | none |
 | `pf-s3-bucket-policy-action-resource` | AWS::S3::BucketPolicy | Object-level actions need an object-level Resource | none |
 | `pf-s3-bucket-policy-principal` | AWS::S3::BucketPolicy | Bucket policy statements need a Principal | none |
+| `pf-s3-bucket-policy-version` | AWS::S3::BucketPolicy | A policy document Version must be a known IAM policy language version | none |
+| `pf-s3-encryption-kms-key-with-aes256` | AWS::S3::Bucket | KMSMasterKeyID is only valid with a KMS server-side encryption algorithm | none |
+| `pf-s3-intelligent-tiering-archive-before-deep` | AWS::S3::Bucket | ARCHIVE_ACCESS must come before DEEP_ARCHIVE_ACCESS | none |
+| `pf-s3-intelligent-tiering-duplicate-tier` | AWS::S3::Bucket | An Intelligent-Tiering configuration must not repeat an access tier | none |
+| `pf-s3-lifecycle-abort-mpu-with-tag-filter` | AWS::S3::Bucket | AbortIncompleteMultipartUpload cannot be used in a tag-filtered rule | none |
+| `pf-s3-lifecycle-date-days-mix` | AWS::S3::Bucket | A lifecycle rule must not mix day-based and date-based schedules | none |
+| `pf-s3-lifecycle-date-midnight-utc` | AWS::S3::Bucket | Lifecycle dates must be UTC midnight | none |
 | `pf-s3-lifecycle-days-order` | AWS::S3::Bucket | Lifecycle archive transitions must come 30+ days after IA, and expiration after every transition | none |
+| `pf-s3-lifecycle-delete-marker-exclusive` | AWS::S3::Bucket | ExpiredObjectDeleteMarker cannot be combined with an expiration or a tag filter | none |
 | `pf-s3-lifecycle-expiration-positive` | AWS::S3::Bucket | ExpirationInDays must be a positive integer | pending-engine |
+| `pf-s3-lifecycle-min-storage-duration-chain` | AWS::S3::Bucket | A transition must wait out the minimum storage duration of the class it leaves | none |
+| `pf-s3-lifecycle-object-size-order` | AWS::S3::Bucket | ObjectSizeGreaterThan must be smaller than ObjectSizeLessThan | none |
+| `pf-s3-lifecycle-rule-id-duplicate` | AWS::S3::Bucket | Lifecycle rule ids must be unique within a bucket | none |
 | `pf-s3-lifecycle-rule-no-action` | AWS::S3::Bucket | A lifecycle rule needs at least one action | none |
+| `pf-s3-lifecycle-tag-key-duplicate` | AWS::S3::Bucket | Lifecycle tag filter keys must be unique within a rule | none |
+| `pf-s3-lifecycle-transition-singular-plural-exclusive` | AWS::S3::Bucket | A lifecycle rule must not use both the singular and the plural transition property | none |
+| `pf-s3-lifecycle-transition-storage-class-duplicate` | AWS::S3::Bucket | A lifecycle rule must not transition to the same storage class twice | none |
+| `pf-s3-lifecycle-transition-waterfall-order` | AWS::S3::Bucket | Lifecycle transitions may only move down the storage-class waterfall | none |
+| `pf-s3-metadata-kms-requires-key` | AWS::S3::Bucket | A KMS-encrypted metadata table needs a KmsKeyArn | none |
+| `pf-s3-metadata-record-expiration-days` | AWS::S3::Bucket | Metadata journal record expiration must be at least 7 days | none |
+| `pf-s3-metadata-v1-v2-exclusive` | AWS::S3::Bucket | MetadataConfiguration and MetadataTableConfiguration cannot both be set | none |
+| `pf-s3-notification-destination-region` | AWS::S3::Bucket | A notification destination must live in the bucket region | none |
+| `pf-s3-notification-duplicate-filter-type` | AWS::S3::Bucket | A notification filter may hold one prefix rule and one suffix rule | none |
+| `pf-s3-notification-event-name` | AWS::S3::Bucket | The notification Event must be an S3 event type | none |
+| `pf-s3-notification-fifo-queue` | AWS::S3::Bucket | S3 event notifications cannot target a FIFO SQS queue | none |
+| `pf-s3-notification-fifo-topic` | AWS::S3::Bucket | S3 event notifications cannot target a FIFO SNS topic | none |
 | `pf-s3-notification-overlapping-filters` | AWS::S3::Bucket | Notification entries must not overlap for the same event type | none |
 | `pf-s3-objectlock-requires-versioning` | AWS::S3::Bucket | ObjectLockConfiguration needs versioning enabled | none |
+| `pf-s3-objectlock-retention-days-years-exclusive` | AWS::S3::Bucket | DefaultRetention takes exactly one of Days or Years | none |
 | `pf-s3-objectlock-versioning-suspended` | AWS::S3::Bucket | Object Lock forbids suspending versioning | none |
+| `pf-s3-policy-public-with-block-public-policy` | AWS::S3::BucketPolicy<br>AWS::S3::Bucket | A public bucket policy cannot be put on a bucket that blocks public policies | none |
+| `pf-s3-replication-acl-translation-needs-account` | AWS::S3::Bucket | AccessControlTranslation requires the destination Account | none |
 | `pf-s3-replication-dest-versioning` | AWS::S3::Bucket | The replication destination bucket needs versioning enabled | none |
+| `pf-s3-replication-destination-bucket-arn` | AWS::S3::Bucket | The replication destination must be a bucket ARN, not a bucket name | none |
+| `pf-s3-replication-filter-requires-delete-marker` | AWS::S3::Bucket | A V2 replication rule with a Filter must also set Priority and DeleteMarkerReplication | none |
+| `pf-s3-replication-priority-duplicate` | AWS::S3::Bucket | Replication rule priorities must be unique | none |
 | `pf-s3-replication-requires-versioning` | AWS::S3::Bucket | ReplicationConfiguration requires versioning to be enabled on the source bucket | none |
+| `pf-s3-replication-rtc-minutes-15` | AWS::S3::Bucket | Replication Time Control accepts only 15 minutes | none |
+| `pf-s3-replication-rtc-needs-metrics` | AWS::S3::Bucket | Replication Time Control needs Metrics, and Metrics needs ReplicationTime | none |
+| `pf-s3-replication-sse-kms-needs-replica-key` | AWS::S3::Bucket | Replicating SSE-KMS objects requires a replica KMS key | none |
+| `pf-s3-replication-tag-filter-delete-marker` | AWS::S3::Bucket | A tag-filtered replication rule must disable delete marker replication | none |
+| `pf-s3-replication-v1-v2-mixed` | AWS::S3::Bucket | A replication rule must not mix the V1 Prefix with the V2 Filter | none |
+| `pf-s3-storagelens-bucket-level-needs-account-level` | AWS::S3::StorageLens | A bucket-level advanced metric must also be enabled at the account level | none |
+| `pf-s3-storagelens-buckets-arn` | AWS::S3::StorageLens | Storage Lens scope buckets are given as ARNs | none |
+| `pf-s3-storagelens-include-empty` | AWS::S3::StorageLens | A Storage Lens Include or Exclude must list at least one bucket or region | none |
+| `pf-s3-storagelens-include-exclude-exclusive` | AWS::S3::StorageLens | A Storage Lens configuration takes either Include or Exclude | none |
+| `pf-s3-storagelens-prefix-delimiter-length` | AWS::S3::StorageLens | PrefixDelimiter is a single character | none |
+| `pf-s3-storagelensgroup-match-any-max` | AWS::S3::StorageLensGroup | A Storage Lens group match list holds at most 10 entries | none |
+| `pf-s3-storagelensgroup-object-age-order` | AWS::S3::StorageLensGroup | MatchObjectAge DaysGreaterThan must be smaller than DaysLessThan | none |
+| `pf-s3-storagelensgroup-object-size-order` | AWS::S3::StorageLensGroup | MatchObjectSize BytesGreaterThan must be smaller than BytesLessThan | none |
+| `pf-s3-versioning-suspended-with-replication` | AWS::S3::Bucket | A replicating bucket must keep versioning enabled | none |
+| `pf-s3-website-empty-condition` | AWS::S3::Bucket | A RoutingRuleCondition needs a key prefix or an HTTP error code | none |
+| `pf-s3-website-empty-redirect-rule` | AWS::S3::Bucket | A RedirectRule must carry at least one element | none |
 | `pf-s3-website-redirect-exclusive` | AWS::S3::Bucket | RedirectAllRequestsTo excludes every other website setting | none |
+| `pf-s3-website-replace-key-exclusive` | AWS::S3::Bucket | ReplaceKeyWith and ReplaceKeyPrefixWith are mutually exclusive | none |
+| `pf-s3-website-routing-rules-need-index` | AWS::S3::Bucket | RoutingRules require an IndexDocument | none |
+| `pf-s3express-ap-name-suffix` | AWS::S3Express::AccessPoint | An S3 Express access point name must end with --<availability-zone-id>--xa-s3 | none |
+| `pf-s3express-ap-scope-permissions` | AWS::S3Express::AccessPoint | Access point scope permissions are bare API names, not s3: actions | none |
+| `pf-s3express-ap-zone-mismatch` | AWS::S3Express::AccessPoint | An S3 Express access point must carry the same zone id as its bucket | none |
+| `pf-s3express-bucket-key-enabled-false` | AWS::S3Express::DirectoryBucket | A directory bucket must keep BucketKeyEnabled true | none |
+| `pf-s3express-bucket-location-region` | AWS::S3Express::DirectoryBucket | LocationName must name a zone in the region the stack deploys to | none |
+| `pf-s3express-bucket-name-dot` | AWS::S3Express::DirectoryBucket | A directory bucket name must not contain a period | none |
+| `pf-s3express-bucket-name-reserved-prefix` | AWS::S3Express::DirectoryBucket | A directory bucket name must not start with a reserved prefix | none |
+| `pf-s3express-bucket-name-suffix` | AWS::S3Express::DirectoryBucket | A directory bucket name must end with --<availability-zone-id>--x-s3 | none |
+| `pf-s3express-bucket-redundancy-location` | AWS::S3Express::DirectoryBucket | DataRedundancy must match the kind of zone LocationName names | none |
+| `pf-s3express-bucket-zone-mismatch` | AWS::S3Express::DirectoryBucket | The zone id in a directory bucket name must equal LocationName | none |
+| `pf-s3express-kms-key-alias` | AWS::S3Express::DirectoryBucket | A directory bucket KMS key must be given as a key id or ARN, not an alias | none |
+| `pf-s3express-kms-key-with-aes256` | AWS::S3Express::DirectoryBucket | KMSMasterKeyID is only valid when SSEAlgorithm is aws:kms | none |
+| `pf-s3express-lifecycle-object-size-order` | AWS::S3Express::DirectoryBucket | ObjectSizeGreaterThan must be smaller than ObjectSizeLessThan | none |
+| `pf-s3express-lifecycle-rule-no-action` | AWS::S3Express::DirectoryBucket | A directory bucket lifecycle rule must declare an expiration or an abort action | none |
 | `pf-scheduler-flexible-window` | AWS::Scheduler::Schedule | FLEXIBLE mode needs MaximumWindowInMinutes, OFF forbids it | none |
 | `pf-scheduler-rate-positive` | AWS::Scheduler::Schedule | A Scheduler rate() value must be positive | none |
 | `pf-secretsmanager-generate-secret-string` | AWS::SecretsManager::Secret | GenerateSecretString must leave at least one character type, a PasswordLength (1..4096) that fits every required type, ExcludeCharacters under 4096 chars that does not wipe out a required type, and SecretStringTemplate (a JSON object) together with GenerateStringKey | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.46" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.48" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */