cdk-preflight 0.0.75 → 0.0.77

package/.jsii

@@ -9599,6 +9599,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.75",
-  "fingerprint": "tIkE9OmMEuBvnc3ZcUgbDlWSNpA4RGWZumHZi76p+sc="
+  "version": "0.0.77",
+  "fingerprint": "sL0Zdj2e7j1qnpJA2tJIRrYAmGzG7Ew7j8UMsVZs2Dw="
 }

package/docs/rules.md

@@ -5,23 +5,103 @@
 | Rule | Resource types | Constraint | Upstream status |
 |---|---|---|---|
 | `pf-apigw-access-log-format-request-id` | AWS::ApiGateway::Stage | Access log format must include a request id variable | none |
+| `pf-apigw-api-key-value-length` | AWS::ApiGateway::ApiKey | An API key value is at least 20 characters | none |
 | `pf-apigw-authorizer-ttl-range` | AWS::ApiGateway::Authorizer | AuthorizerResultTtlInSeconds tops out at 3600 | none |
+| `pf-apigw-authorizer-uri-format` | AWS::ApiGateway::Authorizer | An authorizer URI is an API Gateway invocation ARN | none |
 | `pf-apigw-cognito-authorizer-provider-arns` | AWS::ApiGateway::Authorizer | COGNITO_USER_POOLS authorizers need ProviderARNs | none |
 | `pf-apigw-deployment-no-methods` | AWS::ApiGateway::Deployment | A Deployment needs at least one Method on its REST API | none |
+| `pf-apigw-documentation-part-location` | AWS::ApiGateway::DocumentationPart | An API-level documentation part takes no path, method, status or name | none |
+| `pf-apigw-edge-certificate-property` | AWS::ApiGateway::DomainName | EDGE domain names read CertificateArn, not RegionalCertificateArn | none |
+| `pf-apigw-endpoint-configuration-single-type` | AWS::ApiGateway::RestApi | An API has exactly one endpoint type | none |
+| `pf-apigw-gateway-response-status-code` | AWS::ApiGateway::GatewayResponse | A gateway response status code is three digits | none |
+| `pf-apigw-integration-aws-uri` | AWS::ApiGateway::Method | An AWS integration URI is an API Gateway ARN, not the target's ARN | none |
+| `pf-apigw-integration-cache-key-parameters` | AWS::ApiGateway::Method | Cache key parameters must be declared method request parameters | none |
+| `pf-apigw-integration-credentials-arn` | AWS::ApiGateway::Method | Integration credentials must be an ARN | none |
 | `pf-apigw-integration-http-method` | AWS::ApiGateway::Method | Non-MOCK integrations need IntegrationHttpMethod | none |
+| `pf-apigw-integration-http-uri` | AWS::ApiGateway::Method | An HTTP integration URI is an http(s) URL | none |
+| `pf-apigw-integration-request-parameter-value` | AWS::ApiGateway::Method | Static integration request parameters must be single-quoted | none |
+| `pf-apigw-integration-response-selection-pattern` | AWS::ApiGateway::Method | SelectionPattern must be a valid regular expression | none |
+| `pf-apigw-integration-timeout-range` | AWS::ApiGateway::Method | REST integration timeouts are 50-29000 ms | none |
+| `pf-apigw-integration-vpc-link-connection-id` | AWS::ApiGateway::Method | A VPC_LINK integration needs a ConnectionId | none |
+| `pf-apigw-method-authorization-scopes-cognito` | AWS::ApiGateway::Method | AuthorizationScopes needs COGNITO_USER_POOLS authorization | none |
 | `pf-apigw-method-authorizer-id` | AWS::ApiGateway::Method | CUSTOM and COGNITO_USER_POOLS authorization need AuthorizerId | none |
+| `pf-apigw-method-http-verb` | AWS::ApiGateway::Method | HttpMethod is one of the eight API Gateway verbs | none |
+| `pf-apigw-method-request-parameter-key` | AWS::ApiGateway::Method | Method request parameter keys are mapping expressions | none |
+| `pf-apigw-minimum-compression-size-range` | AWS::ApiGateway::RestApi | MinimumCompressionSize is 0-10485760 | none |
+| `pf-apigw-model-content-type` | AWS::ApiGateway::Model | A model content type is a media type | none |
+| `pf-apigw-model-name-alphanumeric` | AWS::ApiGateway::Model | Model names are alphanumeric | none |
 | `pf-apigw-model-schema-type` | AWS::ApiGateway::Model | Model schema 'type' must be a JSON Schema draft-4 type | none |
+| `pf-apigw-mutual-tls-security-policy` | AWS::ApiGateway::DomainName | Mutual TLS requires SecurityPolicy TLS_1_2 | none |
+| `pf-apigw-regional-certificate-property` | AWS::ApiGateway::DomainName | REGIONAL domain names read RegionalCertificateArn, not CertificateArn | none |
+| `pf-apigw-regional-certificate-region` | AWS::ApiGateway::DomainName | A REGIONAL domain name needs a certificate from the deployment region | none |
+| `pf-apigw-request-authorizer-identity-source` | AWS::ApiGateway::Authorizer | REQUEST authorizer identity sources are mapping expressions | none |
 | `pf-apigw-resource-path-part` | AWS::ApiGateway::Resource | PathPart allows a-zA-Z0-9._-: or one curly-brace variable | none |
+| `pf-apigw-rest-api-policy-document` | AWS::ApiGateway::RestApi | A REST API policy must be a policy document | none |
+| `pf-apigw-stage-access-log-destination-arn` | AWS::ApiGateway::Stage | Access logs go to CloudWatch Logs or Firehose only | none |
+| `pf-apigw-stage-access-log-firehose-prefix` | AWS::ApiGateway::Stage | An access log delivery stream is named amazon-apigateway-* | none |
+| `pf-apigw-stage-cache-ttl-range` | AWS::ApiGateway::Stage | Method setting cache TTL tops out at 3600 seconds | none |
+| `pf-apigw-stage-method-setting-http-method` | AWS::ApiGateway::Stage | Method setting HttpMethod is a verb or * | none |
+| `pf-apigw-stage-method-setting-resource-path` | AWS::ApiGateway::Stage | Method setting paths start with / and encode slashes as ~1 | none |
+| `pf-apigw-stage-name-charset` | AWS::ApiGateway::Stage | Stage names allow only a-zA-Z0-9_ | none |
+| `pf-apigw-stage-variable-name` | AWS::ApiGateway::Stage | Stage variable names allow only word characters | none |
 | `pf-apigw-stage-variable-value` | AWS::ApiGateway::Stage | Stage variable values have a restricted character set | none |
 | `pf-apigw-token-authorizer-identity-source` | AWS::ApiGateway::Authorizer | TOKEN authorizers need IdentitySource | none |
+| `pf-apigw-usage-plan-api-stage-exists` | AWS::ApiGateway::UsagePlan | A usage plan references a stage the template creates | none |
+| `pf-apigw-usage-plan-quota-limit` | AWS::ApiGateway::UsagePlan | A usage plan quota limit is 1 or more | none |
+| `pf-apigw-usage-plan-quota-offset-range` | AWS::ApiGateway::UsagePlan | The quota offset ceiling depends on the quota period | none |
+| `pf-apigw-usage-plan-quota-period-required` | AWS::ApiGateway::UsagePlan | A usage plan quota needs a period | none |
+| `pf-apigw-usage-plan-throttle-key` | AWS::ApiGateway::UsagePlan | Per-method throttle keys are {resourcePath}/{httpMethod} | none |
+| `pf-apigw-vpc-endpoint-ids-private-only` | AWS::ApiGateway::RestApi | VpcEndpointIds belongs to PRIVATE APIs only | none |
+| `pf-apigw-vpc-link-single-target` | AWS::ApiGateway::VpcLink | A VPC link takes exactly one target load balancer | none |
+| `pf-apigwv2-access-log-destination-log-group` | AWS::ApiGatewayV2::Stage | HTTP/WebSocket access logs go to CloudWatch Logs only | none |
+| `pf-apigwv2-access-log-format-request-id` | AWS::ApiGatewayV2::Stage | An access log format must carry a request id | none |
 | `pf-apigwv2-api-name-required` | AWS::ApiGatewayV2::Api | An Api needs a Name unless an OpenAPI body provides one | none |
+| `pf-apigwv2-authorizer-ttl-identity-source` | AWS::ApiGatewayV2::Authorizer | Authorizer caching needs an identity source | none |
+| `pf-apigwv2-authorizer-ttl-range` | AWS::ApiGatewayV2::Authorizer | Authorizer result TTL tops out at 3600 seconds | none |
 | `pf-apigwv2-aws-proxy-payload-version` | AWS::ApiGatewayV2::Integration | AWS_PROXY integrations take PayloadFormatVersion 1.0 or 2.0 | none |
 | `pf-apigwv2-cors-credentials-wildcard` | AWS::ApiGatewayV2::Api | CORS AllowCredentials cannot pair with a wildcard origin | none |
+| `pf-apigwv2-domain-certificate-region` | AWS::ApiGatewayV2::DomainName | A custom domain needs a certificate from the deployment region | none |
+| `pf-apigwv2-domain-endpoint-type-regional` | AWS::ApiGatewayV2::DomainName | HTTP/WebSocket custom domains are REGIONAL only | none |
+| `pf-apigwv2-domain-name-charset` | AWS::ApiGatewayV2::DomainName | Custom domain names are lower case | none |
+| `pf-apigwv2-http-identity-source-expression` | AWS::ApiGatewayV2::Authorizer | HTTP API identity sources are $-prefixed selection expressions | none |
+| `pf-apigwv2-http-proxy-integration-method` | AWS::ApiGatewayV2::Integration | An HTTP_PROXY integration needs an IntegrationMethod | none |
 | `pf-apigwv2-http-proxy-payload-version` | AWS::ApiGatewayV2::Integration | HTTP_PROXY integrations only take PayloadFormatVersion 1.0 | none |
 | `pf-apigwv2-http-route-key` | AWS::ApiGatewayV2::Route | HTTP API route keys are "METHOD /path" or $default | none |
+| `pf-apigwv2-http-route-no-api-key` | AWS::ApiGatewayV2::Route | ApiKeyRequired is not supported on HTTP APIs | none |
 | `pf-apigwv2-http-route-selection` | AWS::ApiGatewayV2::Api | HTTP APIs accept only the method-path route selection expression | none |
+| `pf-apigwv2-integration-response-websocket-only` | AWS::ApiGatewayV2::IntegrationResponse | Integration responses exist on WebSocket APIs only | none |
+| `pf-apigwv2-integration-subtype-credentials` | AWS::ApiGatewayV2::Integration | A subtype integration needs a CredentialsArn | none |
+| `pf-apigwv2-integration-subtype-known` | AWS::ApiGatewayV2::Integration | IntegrationSubtype is one of the ten AWS service subtypes | none |
+| `pf-apigwv2-integration-subtype-payload-version` | AWS::ApiGatewayV2::Integration | Subtype integrations are payload format 1.0 only | none |
+| `pf-apigwv2-integration-subtype-required-parameters` | AWS::ApiGatewayV2::Integration | Each integration subtype has mandatory request parameters | none |
+| `pf-apigwv2-integration-timeout-range` | AWS::ApiGatewayV2::Integration | HTTP API integration timeouts are 50-30000 ms | none |
+| `pf-apigwv2-integration-vpc-link-connection-id` | AWS::ApiGatewayV2::Integration | A VPC_LINK integration needs a ConnectionId | none |
+| `pf-apigwv2-jwt-audience-required` | AWS::ApiGatewayV2::Authorizer | A JWT authorizer needs at least one audience | none |
 | `pf-apigwv2-jwt-authorizer-config` | AWS::ApiGatewayV2::Authorizer | JWT authorizers need JwtConfiguration | none |
+| `pf-apigwv2-jwt-issuer-https` | AWS::ApiGatewayV2::Authorizer | A JWT issuer is an https URL | none |
+| `pf-apigwv2-model-name-alphanumeric` | AWS::ApiGatewayV2::Model | Model names are alphanumeric | none |
+| `pf-apigwv2-model-websocket-only` | AWS::ApiGatewayV2::Model | Models exist on WebSocket APIs only | none |
 | `pf-apigwv2-request-authorizer-payload-version` | AWS::ApiGatewayV2::Authorizer | REQUEST authorizers on HTTP APIs need AuthorizerPayloadFormatVersion | none |
+| `pf-apigwv2-request-authorizer-uri-required` | AWS::ApiGatewayV2::Authorizer | A REQUEST authorizer needs an AuthorizerUri | none |
+| `pf-apigwv2-request-parameter-action` | AWS::ApiGatewayV2::Integration | Request parameter keys are <action>:<header|querystring|path>.<name> | none |
+| `pf-apigwv2-response-parameter-action` | AWS::ApiGatewayV2::Integration | Response parameter keys are <action>:<header.name|statuscode> | none |
+| `pf-apigwv2-response-parameter-status-code` | AWS::ApiGatewayV2::Integration | Response parameter mappings are keyed by a 200-599 status | none |
+| `pf-apigwv2-route-authorization-scopes-jwt` | AWS::ApiGatewayV2::Route | AuthorizationScopes needs JWT authorization | none |
+| `pf-apigwv2-route-jwt-authorizer-id` | AWS::ApiGatewayV2::Route | JWT authorization needs an AuthorizerId | none |
+| `pf-apigwv2-route-response-key-default` | AWS::ApiGatewayV2::RouteResponse | RouteResponseKey is $default | none |
+| `pf-apigwv2-route-response-websocket-only` | AWS::ApiGatewayV2::RouteResponse | Route responses exist on WebSocket APIs only | none |
+| `pf-apigwv2-route-target-format` | AWS::ApiGatewayV2::Route | A route target is integrations/<integration id> | none |
+| `pf-apigwv2-simple-responses-payload-version` | AWS::ApiGatewayV2::Authorizer | EnableSimpleResponses needs payload format 2.0 | none |
+| `pf-apigwv2-stage-name-charset` | AWS::ApiGatewayV2::Stage | Stage names allow only a-zA-Z0-9_ (or $default) | none |
+| `pf-apigwv2-stage-route-settings-key` | AWS::ApiGatewayV2::Stage | RouteSettings is keyed by an existing route key | none |
+| `pf-apigwv2-vpc-link-integration-uri` | AWS::ApiGatewayV2::Integration | A VPC link integration points at a listener, not a load balancer | none |
+| `pf-apigwv2-vpc-link-subnets-required` | AWS::ApiGatewayV2::VpcLink | A VPC link needs at least one subnet | none |
+| `pf-apigwv2-websocket-authorization-connect-only` | AWS::ApiGatewayV2::Route | WebSocket authorization is restricted to $connect | none |
+| `pf-apigwv2-websocket-authorizer-type` | AWS::ApiGatewayV2::Authorizer | WebSocket APIs only take REQUEST authorizers | none |
+| `pf-apigwv2-websocket-identity-source-expression` | AWS::ApiGatewayV2::Authorizer | WebSocket identity sources use route.request.* | none |
+| `pf-apigwv2-websocket-integration-timeout-range` | AWS::ApiGatewayV2::Integration | WebSocket integration timeouts are 50-29000 ms | none |
+| `pf-apigwv2-websocket-no-cors` | AWS::ApiGatewayV2::Api | WebSocket APIs take no CORS configuration | none |
+| `pf-apigwv2-websocket-payload-version` | AWS::ApiGatewayV2::Integration | WebSocket AWS_PROXY integrations reject payload format 2.0 | none |
 | `pf-apigwv2-websocket-route-selection` | AWS::ApiGatewayV2::Api | WebSocket APIs need RouteSelectionExpression | none |
 | `pf-asg-cooldown-non-negative` | AWS::AutoScaling::AutoScalingGroup | Cooldown cannot be negative | none |
 | `pf-asg-desired-capacity-range` | AWS::AutoScaling::AutoScalingGroup | DesiredCapacity must sit between MinSize and MaxSize | none |
@@ -169,19 +249,62 @@
 | `pf-cloudfront-origin-group-member-origin` | AWS::CloudFront::Distribution | Origin group members must reference an origin declared in the distribution | none |
 | `pf-cloudfront-ttl-order` | AWS::CloudFront::Distribution | Cache behavior TTLs must satisfy MinTTL <= DefaultTTL <= MaxTTL | none |
 | `pf-cloudfront-wafv2-webacl-scope` | AWS::CloudFront::Distribution | A WAFv2 web ACL attached to CloudFront must be globally scoped | none |
+| `pf-cloudwatch-alarm-action-vendor` | AWS::CloudWatch::Alarm | Alarm actions accept only the CloudWatch action vendors | none |
+| `pf-cloudwatch-alarm-actions-max` | AWS::CloudWatch::Alarm | Each alarm action list holds at most 5 ARNs | none |
+| `pf-cloudwatch-alarm-anomaly-autoscaling-action` | AWS::CloudWatch::Alarm | An anomaly-detection alarm cannot carry an Auto Scaling action | none |
+| `pf-cloudwatch-alarm-ec2-action-region` | AWS::CloudWatch::Alarm | An EC2 automate action must name the stack's own region | none |
+| `pf-cloudwatch-alarm-evaluation-window` | AWS::CloudWatch::Alarm | The evaluation window caps at 7 days (Period >= 3600) or 1 day (Period < 3600) | none |
+| `pf-cloudwatch-alarm-expressions-max` | AWS::CloudWatch::Alarm | An alarm takes at most 10 math expressions | none |
+| `pf-cloudwatch-alarm-low-sample-percentile` | AWS::CloudWatch::Alarm | EvaluateLowSampleCountPercentile only applies to percentile statistics | none |
+| `pf-cloudwatch-alarm-metrics-max` | AWS::CloudWatch::Alarm | An alarm takes at most 10 MetricStat queries | none |
 | `pf-cloudwatch-alarm-period` | AWS::CloudWatch::Alarm | Period must be 10, 20, 30 or a multiple of 60 | none |
+| `pf-cloudwatch-alarm-search-expression` | AWS::CloudWatch::Alarm | SEARCH() cannot be used in a metric alarm | none |
 | `pf-cloudwatch-alarm-threshold` | AWS::CloudWatch::Alarm | Standard operators need Threshold, range operators need ThresholdMetricId | none |
+| `pf-cloudwatch-anomaly-detector-excluded-range-order` | AWS::CloudWatch::AnomalyDetector | An excluded time range must start before it ends | none |
+| `pf-cloudwatch-anomaly-detector-exclusive` | AWS::CloudWatch::AnomalyDetector | SingleMetricAnomalyDetector and MetricMathAnomalyDetector are mutually exclusive | none |
+| `pf-cloudwatch-anomaly-detector-math-single-query` | AWS::CloudWatch::AnomalyDetector | A math detector needs more than one metric data query | none |
+| `pf-cloudwatch-anomaly-detector-math-toplevel` | AWS::CloudWatch::AnomalyDetector | MetricMathAnomalyDetector cannot be combined with the top-level metric properties | none |
+| `pf-cloudwatch-anomaly-detector-namespace-colon` | AWS::CloudWatch::AnomalyDetector | A metric namespace must not start with a colon | none |
+| `pf-cloudwatch-anomaly-detector-stat-syntax` | AWS::CloudWatch::AnomalyDetector | The anomaly detector Stat must be a CloudWatch statistic | none |
 | `pf-cloudwatch-composite-alarm-rule-syntax` | AWS::CloudWatch::CompositeAlarm | An AlarmRule must start with a valid expression token | none |
+| `pf-cloudwatch-composite-self-reference` | AWS::CloudWatch::CompositeAlarm | A composite alarm cannot reference itself in its AlarmRule | none |
+| `pf-cloudwatch-composite-suppressor-extension-period` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor requires ActionsSuppressorExtensionPeriod | none |
+| `pf-cloudwatch-composite-suppressor-format` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor must be an alarm name or a CloudWatch alarm ARN | none |
+| `pf-cloudwatch-composite-suppressor-required` | AWS::CloudWatch::CompositeAlarm | The suppressor periods require an ActionsSuppressor | none |
+| `pf-cloudwatch-composite-suppressor-wait-period` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor requires ActionsSuppressorWaitPeriod | none |
+| `pf-cloudwatch-dashboard-alarm-widget-alarms` | AWS::CloudWatch::Dashboard | An alarm widget requires properties.alarms | none |
 | `pf-cloudwatch-dashboard-body-json` | AWS::CloudWatch::Dashboard | DashboardBody must be valid JSON | none |
+| `pf-cloudwatch-dashboard-metric-widget-source` | AWS::CloudWatch::Dashboard | A metric widget needs a region and a data source | none |
 | `pf-cloudwatch-dashboard-name` | AWS::CloudWatch::Dashboard | Dashboard names allow only alphanumerics, dash and underscore | none |
+| `pf-cloudwatch-dashboard-text-widget-markdown` | AWS::CloudWatch::Dashboard | A text widget requires properties.markdown | none |
 | `pf-cloudwatch-dashboard-widget-fields` | AWS::CloudWatch::Dashboard | Every dashboard widget requires type and properties | none |
+| `pf-cloudwatch-dashboard-widget-height-max` | AWS::CloudWatch::Dashboard | Widget height tops out at 1000 | none |
+| `pf-cloudwatch-dashboard-widget-period` | AWS::CloudWatch::Dashboard | A widget period must be 1, 5, 10, 20, 30 or a multiple of 60 | none |
 | `pf-cloudwatch-dashboard-widget-position` | AWS::CloudWatch::Dashboard | Dashboard widget x tops out at 23 and width at 24 | none |
+| `pf-cloudwatch-dashboard-widget-position-min` | AWS::CloudWatch::Dashboard | Widget x and y must not be negative | none |
+| `pf-cloudwatch-dashboard-widget-stat-syntax` | AWS::CloudWatch::Dashboard | A widget stat must be a CloudWatch statistic | none |
 | `pf-cloudwatch-dashboard-widgets` | AWS::CloudWatch::Dashboard | DashboardBody requires a widgets array | none |
+| `pf-cloudwatch-dashboard-widgets-array` | AWS::CloudWatch::Dashboard | The widgets key must hold an array | none |
+| `pf-cloudwatch-dashboard-yaxis-range` | AWS::CloudWatch::Dashboard | A widget yAxis min must be below its max | none |
 | `pf-cloudwatch-datapoints-evaluation` | AWS::CloudWatch::Alarm | DatapointsToAlarm must not exceed EvaluationPeriods | none |
 | `pf-cloudwatch-extended-statistic` | AWS::CloudWatch::Alarm | A percentile statistic cannot exceed p100 | none |
+| `pf-cloudwatch-insight-rule-body-json` | AWS::CloudWatch::InsightRule | RuleBody must be valid JSON | none |
+| `pf-cloudwatch-insight-rule-body-unknown-key` | AWS::CloudWatch::InsightRule | The rule body top level takes only the documented keys | none |
+| `pf-cloudwatch-insight-rule-contribution-filters` | AWS::CloudWatch::InsightRule | Contribution requires a Filters key | none |
+| `pf-cloudwatch-insight-rule-keys-max` | AWS::CloudWatch::InsightRule | Contribution.Keys holds at most 4 keys | none |
+| `pf-cloudwatch-insight-rule-log-format` | AWS::CloudWatch::InsightRule | LogFormat must be JSON or CLF | none |
+| `pf-cloudwatch-insight-rule-log-groups` | AWS::CloudWatch::InsightRule | The rule body needs at least one log group | none |
+| `pf-cloudwatch-insight-rule-schema` | AWS::CloudWatch::InsightRule | The rule body Schema must be CloudWatchLogRule version 1 | none |
 | `pf-cloudwatch-metric-namespace-ascii` | AWS::CloudWatch::Alarm | Metric namespaces must not contain non-ASCII characters | none |
 | `pf-cloudwatch-metric-query-exclusive` | AWS::CloudWatch::Alarm | Expression and MetricStat are mutually exclusive per query | none |
-| `pf-cloudwatch-metric-query-returndata` | AWS::CloudWatch::Alarm | Exactly one metric query must return data | none |
+| `pf-cloudwatch-metric-query-returndata` | AWS::CloudWatch::Alarm | One metric query must return data, or two for an anomaly alarm | none |
+| `pf-cloudwatch-metric-stream-additional-statistic` | AWS::CloudWatch::MetricStream | AdditionalStatistics must be CloudWatch statistics | none |
+| `pf-cloudwatch-metric-stream-filters-exclusive` | AWS::CloudWatch::MetricStream | IncludeFilters and ExcludeFilters are mutually exclusive | none |
+| `pf-cloudwatch-metric-stream-firehose-account` | AWS::CloudWatch::MetricStream | FirehoseArn must be in the stack's own account | none |
+| `pf-cloudwatch-metric-stream-firehose-region` | AWS::CloudWatch::MetricStream | FirehoseArn must be in the stack's own region and partition | none |
+| `pf-cloudwatch-metric-stream-include-metrics` | AWS::CloudWatch::MetricStream | A statistics configuration needs at least one IncludeMetrics entry | none |
+| `pf-cloudwatch-metric-stream-role-account` | AWS::CloudWatch::MetricStream | RoleArn must be in the stack's own account | none |
+| `pf-cloudwatch-metricstat-stat-syntax` | AWS::CloudWatch::Alarm | MetricStat.Stat must be a CloudWatch statistic | none |
 | `pf-cloudwatch-threshold-metric-id` | AWS::CloudWatch::Alarm | ThresholdMetricId must match a metric query that returns data | none |
 | `pf-cognito-alias-username-exclusive` | AWS::Cognito::UserPool | AliasAttributes and UsernameAttributes are mutually exclusive | none |
 | `pf-cognito-client-credentials-exclusive` | AWS::Cognito::UserPoolClient | client_credentials cannot combine with code or implicit | none |
@@ -741,9 +864,41 @@
 | `pf-lambda-vpc-non-empty` | AWS::Lambda::Function | VpcConfig needs at least one subnet and one security group | none |
 | `pf-lambda-vpc-same-vpc` | AWS::Lambda::Function | Subnets and security groups belong to one VPC | none |
 | `pf-lambda-zip-no-imageuri` | AWS::Lambda::Function | A .zip function cannot carry Code.ImageUri | none |
+| `pf-logs-account-policy-document-json` | AWS::Logs::AccountPolicy | An account policy document must be valid JSON | none |
+| `pf-logs-account-policy-selection-criteria-prefix` | AWS::Logs::AccountPolicy | Field index and transformer account policies select with LogGroupNamePrefix | none |
+| `pf-logs-account-policy-selection-criteria-subscription` | AWS::Logs::AccountPolicy | A subscription account policy selects with LogGroupName NOT IN | none |
+| `pf-logs-account-policy-selection-criteria-unsupported` | AWS::Logs::AccountPolicy | A data protection account policy takes no SelectionCriteria | none |
+| `pf-logs-account-policy-subscription-document` | AWS::Logs::AccountPolicy | A subscription account policy document needs DestinationArn | none |
+| `pf-logs-account-policy-transformer-document` | AWS::Logs::AccountPolicy | A transformer account policy document is an array of processors | none |
+| `pf-logs-anomaly-detector-single-log-group` | AWS::Logs::LogAnomalyDetector | A log anomaly detector watches exactly one log group | none |
+| `pf-logs-data-protection-identifier-arn` | AWS::Logs::LogGroup | A data identifier must be a managed data-identifier ARN | none |
+| `pf-logs-data-protection-identifiers-match` | AWS::Logs::LogGroup | Both data protection statements must list the same data identifiers | none |
+| `pf-logs-data-protection-mask-config-empty` | AWS::Logs::LogGroup | Deidentify MaskConfig takes no fields | none |
+| `pf-logs-data-protection-policy-statements` | AWS::Logs::LogGroup | A data protection policy needs exactly two statements | none |
+| `pf-logs-data-protection-policy-version` | AWS::Logs::LogGroup | A data protection policy version must be 2021-06-01 | none |
+| `pf-logs-delivery-destination-output-format-enum` | AWS::Logs::DeliveryDestination | OutputFormat must be json, plain, w3c, raw or parquet | none |
+| `pf-logs-delivery-destination-output-format-target` | AWS::Logs::DeliveryDestination | A CloudWatch Logs delivery destination cannot use parquet | none |
+| `pf-logs-delivery-destination-region` | AWS::Logs::DeliveryDestination | A delivery destination must be in the stack's own region | none |
+| `pf-logs-destination-policy-json` | AWS::Logs::Destination | DestinationPolicy must be an IAM policy document | none |
+| `pf-logs-field-index-fields-max` | AWS::Logs::LogGroup | A field index policy indexes at most 20 fields | none |
+| `pf-logs-field-selection-criteria-syntax` | AWS::Logs::MetricFilter | FieldSelectionCriteria must reference an @aws system field | none |
+| `pf-logs-filter-name-charset` | AWS::Logs::MetricFilter | A filter name cannot contain a colon or an asterisk | none |
 | `pf-logs-filter-pattern-bracket` | AWS::Logs::MetricFilter<br>AWS::Logs::SubscriptionFilter | A filter pattern starting with '[' must end with ']' | none |
+| `pf-logs-infrequent-access-anomaly-detector` | AWS::Logs::LogGroup<br>AWS::Logs::LogAnomalyDetector | A log anomaly detector needs Standard-class log groups | none |
+| `pf-logs-infrequent-access-metric-filter` | AWS::Logs::LogGroup<br>AWS::Logs::MetricFilter | A metric filter needs a Standard-class log group | none |
+| `pf-logs-infrequent-access-subscription-filter` | AWS::Logs::LogGroup<br>AWS::Logs::SubscriptionFilter | A subscription filter needs a Standard-class log group | none |
+| `pf-logs-infrequent-access-transformer` | AWS::Logs::LogGroup<br>AWS::Logs::Transformer | A transformer needs a Standard-class log group | none |
+| `pf-logs-metric-dimension-selector` | AWS::Logs::MetricFilter | A metric filter dimension value must be a field selector | none |
 | `pf-logs-metric-dimensions-default-exclusive` | AWS::Logs::MetricFilter | Dimensions and DefaultValue are mutually exclusive | none |
+| `pf-logs-metric-namespace-reserved` | AWS::Logs::MetricFilter | A metric filter cannot publish into the AWS/ namespace | none |
+| `pf-logs-query-definition-log-groups-max` | AWS::Logs::QueryDefinition | A saved query names at most 50 log groups | none |
+| `pf-logs-resource-policy-json` | AWS::Logs::ResourcePolicy | PolicyDocument must be an IAM policy document | none |
+| `pf-logs-subscription-destination-vendor` | AWS::Logs::SubscriptionFilter | A subscription destination must be Lambda, Kinesis, Firehose or a Logs destination | none |
+| `pf-logs-subscription-firehose-role` | AWS::Logs::SubscriptionFilter | A Firehose destination needs RoleArn | none |
 | `pf-logs-subscription-kinesis-role` | AWS::Logs::SubscriptionFilter | A Kinesis destination needs RoleArn | none |
+| `pf-logs-subscription-lambda-no-role` | AWS::Logs::SubscriptionFilter | A Lambda destination must not carry RoleArn | none |
+| `pf-logs-transformer-grok-pattern` | AWS::Logs::Transformer | A grok match may only use supported pattern names | none |
+| `pf-logs-transformer-parser-first` | AWS::Logs::Transformer | A transformer config must begin with a parser | none |
 | `pf-memorydb-data-tiering-node-type` | AWS::MemoryDB::Cluster | DataTiering only works on r6gd node types | none |
 | `pf-memorydb-engine` | AWS::MemoryDB::Cluster | MemoryDB runs Valkey or Redis, not Memcached | none |
 | `pf-memorydb-kms-key-region` | AWS::MemoryDB::Cluster | KmsKeyId must name a key in the deploy region | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.75" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.77" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */