cdk-preflight 0.0.79 → 0.0.81

package/.jsii

@@ -9599,6 +9599,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.79",
-  "fingerprint": "ktJ2AIupP4U7OEAsvFEJaDUKEKzi/aCAcqsMnODs2Hs="
+  "version": "0.0.81",
+  "fingerprint": "8ZiRCfehgBMMHqIGEhn82oBU91gnUVosfts+fMvJsKU="
 }

package/docs/rules.md

@@ -241,13 +241,101 @@
 | `pf-agentcore-runtime-session-storage-single` | AWS::BedrockAgentCore::Runtime | An AgentCore Runtime allows at most one SessionStorage filesystem configuration | none |
 | `pf-agentcore-vpc-network-mode-config` | AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::BrowserCustom<br>AWS::BedrockAgentCore::CodeInterpreterCustom<br>AWS::BedrockAgentCore::Harness | NetworkMode VPC requires the VPC config block, and PUBLIC forbids it (Runtime, Browser, Code Interpreter, Harness) | none |
 | `pf-cloudfront-acm-cert-region` | AWS::CloudFront::Distribution | CloudFront viewer certificates must live in us-east-1 | none |
+| `pf-cloudfront-alias-unique` | AWS::CloudFront::Distribution | Aliases must not contain duplicates | none |
 | `pf-cloudfront-aliases-require-custom-certificate` | AWS::CloudFront::Distribution | A distribution with Aliases cannot use the CloudFront default certificate | none |
+| `pf-cloudfront-allowed-methods-set` | AWS::CloudFront::Distribution | AllowedMethods must be one of the three sets CloudFront supports | none |
+| `pf-cloudfront-anycast-ip-list-count` | AWS::CloudFront::AnycastIpList | AnycastIpList IpCount must be 21 | none |
+| `pf-cloudfront-cache-behavior-path-pattern-unique` | AWS::CloudFront::Distribution | Cache behavior PathPattern values must be unique | none |
+| `pf-cloudfront-cache-behavior-target-origin-exists` | AWS::CloudFront::Distribution | Cache behavior TargetOriginId must match an origin or origin group Id | none |
+| `pf-cloudfront-cache-policy-accept-encoding-conflict` | AWS::CloudFront::CachePolicy | Accept-Encoding cannot be whitelisted while EnableAcceptEncodingGzip/Brotli is true | none |
+| `pf-cloudfront-cache-policy-cookie-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy CookieBehavior whitelist / allExcept requires Cookies | none |
+| `pf-cloudfront-cache-policy-header-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy HeaderBehavior whitelist requires Headers | none |
+| `pf-cloudfront-cache-policy-header-behavior-none-items` | AWS::CloudFront::CachePolicy | Cache policy HeaderBehavior none cannot carry Headers | none |
 | `pf-cloudfront-cache-policy-name` | AWS::CloudFront::CachePolicy | Cache policy names allow only alphanumerics, dash and underscore | none |
+| `pf-cloudfront-cache-policy-or-forwarded-values-required` | AWS::CloudFront::Distribution | A cache behavior must set either CachePolicyId or ForwardedValues | none |
+| `pf-cloudfront-cache-policy-query-string-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy QueryStringBehavior whitelist / allExcept requires QueryStrings | none |
+| `pf-cloudfront-cache-policy-ttl-default-in-range` | AWS::CloudFront::CachePolicy | Cache policy DefaultTTL must be between MinTTL and MaxTTL | none |
 | `pf-cloudfront-cached-methods-subset` | AWS::CloudFront::Distribution | CachedMethods must be a subset of AllowedMethods | none |
+| `pf-cloudfront-continuous-deployment-header-prefix` | AWS::CloudFront::ContinuousDeploymentPolicy | SingleHeaderConfig Header must start with aws-cf-cd- | none |
+| `pf-cloudfront-continuous-deployment-policy-excludes-staging` | AWS::CloudFront::Distribution | ContinuousDeploymentPolicyId cannot be set on a staging distribution | none |
+| `pf-cloudfront-continuous-deployment-session-ttl-order` | AWS::CloudFront::ContinuousDeploymentPolicy | SessionStickinessConfig IdleTTL cannot exceed MaximumTTL | none |
+| `pf-cloudfront-continuous-deployment-staging-dns-count` | AWS::CloudFront::ContinuousDeploymentPolicy | A continuous deployment policy takes exactly one staging distribution DNS name | none |
+| `pf-cloudfront-continuous-deployment-traffic-config-match` | AWS::CloudFront::ContinuousDeploymentPolicy | TrafficConfig Type must match the config block that is present | none |
+| `pf-cloudfront-continuous-deployment-weight-range` | AWS::CloudFront::ContinuousDeploymentPolicy | SingleWeightConfig Weight must be between 0 and 0.15 | none |
+| `pf-cloudfront-custom-error-response-code` | AWS::CloudFront::Distribution | CustomErrorResponses ErrorCode must be one of the codes CloudFront caches | pending-engine |
+| `pf-cloudfront-custom-error-response-page-path-format` | AWS::CloudFront::Distribution | ResponsePagePath must start with / | none |
+| `pf-cloudfront-custom-error-response-page-path-pair` | AWS::CloudFront::Distribution | ResponsePagePath and ResponseCode must be specified together | none |
 | `pf-cloudfront-edge-lambda-region` | AWS::CloudFront::Distribution | Lambda@Edge functions associated with a distribution must be in us-east-1 | none |
 | `pf-cloudfront-edge-lambda-version` | AWS::CloudFront::Distribution | Lambda@Edge associations must reference a version ARN, not an alias or $LATEST | none |
+| `pf-cloudfront-field-level-encryption-requires-post` | AWS::CloudFront::Distribution | FieldLevelEncryptionId requires POST or PUT in AllowedMethods | none |
+| `pf-cloudfront-function-association-event-type` | AWS::CloudFront::Distribution | CloudFront Functions only support viewer-request and viewer-response | none |
+| `pf-cloudfront-function-association-event-type-unique` | AWS::CloudFront::Distribution | Each CloudFront Function EventType can appear only once per cache behavior | none |
+| `pf-cloudfront-function-code-size` | AWS::CloudFront::Function | CloudFront Function code is limited to 10 KB | none |
+| `pf-cloudfront-function-kvs-association-count` | AWS::CloudFront::Function | A CloudFront Function can associate at most one key value store | none |
+| `pf-cloudfront-function-kvs-requires-runtime-2` | AWS::CloudFront::Function | KeyValueStoreAssociations require the cloudfront-js-2.0 runtime | none |
+| `pf-cloudfront-function-runtime-enum` | AWS::CloudFront::Function | CloudFront Function Runtime must be cloudfront-js-1.0 or cloudfront-js-2.0 | pending-engine |
+| `pf-cloudfront-geo-restriction-country-code` | AWS::CloudFront::Distribution | GeoRestriction locations must be two-letter uppercase country codes | pending-engine |
+| `pf-cloudfront-geo-restriction-locations-exclusive` | AWS::CloudFront::Distribution | RestrictionType none cannot carry Locations | none |
+| `pf-cloudfront-grpc-requires-http2` | AWS::CloudFront::Distribution | GrpcConfig requires an HTTP/2 capable HttpVersion | none |
+| `pf-cloudfront-grpc-requires-post-method` | AWS::CloudFront::Distribution | GrpcConfig requires POST in AllowedMethods | none |
+| `pf-cloudfront-http-version-enum` | AWS::CloudFront::Distribution | HttpVersion must be http1.1, http2, http2and3 or http3 | pending-engine |
+| `pf-cloudfront-key-group-item-count` | AWS::CloudFront::KeyGroup | A key group holds at most 5 public keys | none |
+| `pf-cloudfront-key-group-item-unique` | AWS::CloudFront::KeyGroup | A key group must not list the same public key twice | none |
+| `pf-cloudfront-key-value-store-import-source-arn` | AWS::CloudFront::KeyValueStore | KeyValueStore ImportSource SourceArn must be an S3 object ARN | none |
+| `pf-cloudfront-key-value-store-import-source-type` | AWS::CloudFront::KeyValueStore | KeyValueStore ImportSource SourceType must be S3 | pending-engine |
+| `pf-cloudfront-lambda-association-event-type-unique` | AWS::CloudFront::Distribution | Each Lambda@Edge EventType can appear only once per cache behavior | none |
+| `pf-cloudfront-lambda-association-include-body-event-type` | AWS::CloudFront::Distribution | IncludeBody is only valid for viewer-request and origin-request | none |
+| `pf-cloudfront-logging-bucket-format` | AWS::CloudFront::Distribution | Logging.Bucket must be the S3 bucket DNS name, not the bare bucket name | none |
+| `pf-cloudfront-oac-excludes-origin-access-identity` | AWS::CloudFront::Distribution | OriginAccessControlId and S3OriginConfig.OriginAccessIdentity are mutually exclusive | none |
+| `pf-cloudfront-origin-config-required` | AWS::CloudFront::Distribution | Every origin must declare exactly one origin type configuration | none |
+| `pf-cloudfront-origin-connection-attempts-range` | AWS::CloudFront::Distribution | ConnectionAttempts must be between 1 and 3 | none |
+| `pf-cloudfront-origin-connection-timeout-range` | AWS::CloudFront::Distribution | ConnectionTimeout must be between 1 and 10 | none |
+| `pf-cloudfront-origin-custom-header-blocklist` | AWS::CloudFront::Distribution | OriginCustomHeaders cannot carry headers CloudFront reserves | none |
+| `pf-cloudfront-origin-custom-header-name-unique` | AWS::CloudFront::Distribution | OriginCustomHeaders header names must be unique per origin | none |
+| `pf-cloudfront-origin-group-failover-status-codes` | AWS::CloudFront::Distribution | Origin group failover status codes are limited to a fixed set | none |
+| `pf-cloudfront-origin-group-id-collides-with-origin` | AWS::CloudFront::Distribution | An origin group Id cannot reuse an origin Id | none |
 | `pf-cloudfront-origin-group-member-origin` | AWS::CloudFront::Distribution | Origin group members must reference an origin declared in the distribution | none |
+| `pf-cloudfront-origin-http-port-range` | AWS::CloudFront::Distribution | HTTPPort must be 80, 443 or in 1024-65535 | none |
+| `pf-cloudfront-origin-https-port-range` | AWS::CloudFront::Distribution | HTTPSPort must be 80, 443 or in 1024-65535 | none |
+| `pf-cloudfront-origin-id-unique` | AWS::CloudFront::Distribution | Origin Id values must be unique within a distribution | none |
+| `pf-cloudfront-origin-keepalive-timeout-range` | AWS::CloudFront::Distribution | OriginKeepaliveTimeout must be between 1 and 300 | none |
+| `pf-cloudfront-origin-path-format` | AWS::CloudFront::Distribution | OriginPath must start with / and must not end with / | none |
+| `pf-cloudfront-origin-protocol-policy-enum` | AWS::CloudFront::Distribution | OriginProtocolPolicy must be http-only, https-only or match-viewer | none |
+| `pf-cloudfront-origin-read-timeout-range` | AWS::CloudFront::Distribution | OriginReadTimeout must be between 1 and 120 | none |
+| `pf-cloudfront-origin-request-policy-cloudfront-headers` | AWS::CloudFront::OriginRequestPolicy | allViewerAndWhitelistCloudFront only accepts CloudFront-* headers | none |
+| `pf-cloudfront-origin-request-policy-cookie-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy CookieBehavior whitelist / allExcept requires Cookies | none |
+| `pf-cloudfront-origin-request-policy-excludes-forwarded-values` | AWS::CloudFront::Distribution | A cache behavior cannot set both OriginRequestPolicyId and ForwardedValues | none |
+| `pf-cloudfront-origin-request-policy-header-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy HeaderBehavior whitelist / allExcept requires Headers | none |
+| `pf-cloudfront-origin-request-policy-name-charset` | AWS::CloudFront::OriginRequestPolicy | Origin request policy names allow only alphanumerics, dash and underscore | none |
+| `pf-cloudfront-origin-request-policy-query-string-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy QueryStringBehavior whitelist / allExcept requires QueryStrings | none |
+| `pf-cloudfront-origin-shield-region-required` | AWS::CloudFront::Distribution | Enabling Origin Shield requires OriginShieldRegion | none |
+| `pf-cloudfront-origin-shield-region-supported` | AWS::CloudFront::Distribution | OriginShieldRegion must be a region where CloudFront offers Origin Shield | none |
+| `pf-cloudfront-price-class-enum` | AWS::CloudFront::Distribution | PriceClass must be PriceClass_100, PriceClass_200 or PriceClass_All | pending-engine |
+| `pf-cloudfront-public-key-pem-format` | AWS::CloudFront::PublicKey | PublicKey EncodedKey must be a PEM-encoded public key | none |
+| `pf-cloudfront-realtime-log-endpoint-count` | AWS::CloudFront::RealtimeLogConfig | A real-time log configuration takes exactly one endpoint | none |
+| `pf-cloudfront-realtime-log-endpoint-stream-type` | AWS::CloudFront::RealtimeLogConfig | Real-time log endpoints must have StreamType Kinesis | none |
+| `pf-cloudfront-realtime-log-field-names` | AWS::CloudFront::RealtimeLogConfig | Real-time log Fields must name fields CloudFront defines | none |
+| `pf-cloudfront-response-headers-policy-name-charset` | AWS::CloudFront::ResponseHeadersPolicy | Response headers policy names allow only alphanumerics, dash and underscore | none |
+| `pf-cloudfront-rhp-content-security-policy-length` | AWS::CloudFront::ResponseHeadersPolicy | ContentSecurityPolicy is limited to 1783 characters | none |
+| `pf-cloudfront-rhp-cors-allow-methods-enum` | AWS::CloudFront::ResponseHeadersPolicy | AccessControlAllowMethods accepts only the eight documented values | pending-engine |
+| `pf-cloudfront-rhp-custom-header-blocklist` | AWS::CloudFront::ResponseHeadersPolicy | CustomHeadersConfig cannot carry headers CloudFront reserves | none |
+| `pf-cloudfront-rhp-custom-header-unique` | AWS::CloudFront::ResponseHeadersPolicy | CustomHeadersConfig must not repeat a header name | none |
+| `pf-cloudfront-rhp-remove-header-blocklist` | AWS::CloudFront::ResponseHeadersPolicy | RemoveHeadersConfig cannot remove headers CloudFront controls | none |
+| `pf-cloudfront-rhp-server-timing-sampling-rate-required` | AWS::CloudFront::ResponseHeadersPolicy | ServerTimingHeadersConfig requires SamplingRate when enabled | none |
+| `pf-cloudfront-rhp-xss-protection-report-uri-mode-block` | AWS::CloudFront::ResponseHeadersPolicy | XSSProtection cannot set both ReportUri and ModeBlock | none |
+| `pf-cloudfront-rhp-xss-protection-report-uri-requires-protection` | AWS::CloudFront::ResponseHeadersPolicy | XSSProtection ReportUri requires Protection true | none |
+| `pf-cloudfront-s3-website-endpoint-custom-origin` | AWS::CloudFront::Distribution | An S3 website endpoint origin must use CustomOriginConfig, not S3OriginConfig | none |
+| `pf-cloudfront-staging-requires-no-aliases` | AWS::CloudFront::Distribution | A staging distribution cannot have Aliases | none |
+| `pf-cloudfront-trusted-key-groups-excludes-trusted-signers` | AWS::CloudFront::Distribution | TrustedKeyGroups and TrustedSigners cannot both be used on a cache behavior | none |
+| `pf-cloudfront-trusted-signers-account-format` | AWS::CloudFront::Distribution | TrustedSigners entries must be self or a 12-digit account id | none |
 | `pf-cloudfront-ttl-order` | AWS::CloudFront::Distribution | Cache behavior TTLs must satisfy MinTTL <= DefaultTTL <= MaxTTL | none |
+| `pf-cloudfront-viewer-certificate-exactly-one` | AWS::CloudFront::Distribution | ViewerCertificate must name exactly one certificate source | none |
+| `pf-cloudfront-viewer-certificate-sni-min-protocol` | AWS::CloudFront::Distribution | sni-only requires MinimumProtocolVersion of TLSv1 or higher | none |
+| `pf-cloudfront-viewer-certificate-vip-deprecated` | AWS::CloudFront::Distribution | SslSupportMethod vip cannot be used for new distributions | none |
+| `pf-cloudfront-viewer-protocol-policy-enum` | AWS::CloudFront::Distribution | ViewerProtocolPolicy must be allow-all, https-only or redirect-to-https | pending-engine |
+| `pf-cloudfront-vpc-origin-arn-type` | AWS::CloudFront::VpcOrigin | A VPC origin ARN must point at an ALB, NLB or EC2 instance | none |
+| `pf-cloudfront-vpc-origin-port-range` | AWS::CloudFront::VpcOrigin | VPC origin HTTPPort and HTTPSPort must be between 1 and 65535 | none |
+| `pf-cloudfront-vpc-origin-ssl-protocols-required` | AWS::CloudFront::VpcOrigin | An HTTPS-capable VPC origin must list OriginSSLProtocols | none |
 | `pf-cloudfront-wafv2-webacl-scope` | AWS::CloudFront::Distribution | A WAFv2 web ACL attached to CloudFront must be globally scoped | none |
 | `pf-cloudwatch-alarm-action-vendor` | AWS::CloudWatch::Alarm | Alarm actions accept only the CloudWatch action vendors | none |
 | `pf-cloudwatch-alarm-actions-max` | AWS::CloudWatch::Alarm | Each alarm action list holds at most 5 ARNs | none |
@@ -307,19 +395,118 @@
 | `pf-cloudwatch-metricstat-stat-syntax` | AWS::CloudWatch::Alarm | MetricStat.Stat must be a CloudWatch statistic | none |
 | `pf-cloudwatch-threshold-metric-id` | AWS::CloudWatch::Alarm | ThresholdMetricId must match a metric query that returns data | none |
 | `pf-cognito-alias-username-exclusive` | AWS::Cognito::UserPool | AliasAttributes and UsernameAttributes are mutually exclusive | none |
+| `pf-cognito-analytics-application-requires-role` | AWS::Cognito::UserPoolClient | Pinpoint ApplicationId needs a RoleArn | none |
+| `pf-cognito-analytics-arn-region` | AWS::Cognito::UserPoolClient | The Pinpoint analytics app must be in the pool region | none |
+| `pf-cognito-analytics-config-exclusive` | AWS::Cognito::UserPoolClient | Pinpoint ApplicationArn excludes the id/role form | none |
+| `pf-cognito-auto-verified-attributes-enum` | AWS::Cognito::UserPool | Only email and phone_number can be auto-verified | none |
+| `pf-cognito-auto-verified-username-consistency` | AWS::Cognito::UserPool | Auto-verifying phone_number requires an SmsConfiguration | none |
+| `pf-cognito-callback-url-fragment` | AWS::Cognito::UserPoolClient | Callback URLs cannot carry a fragment | none |
+| `pf-cognito-callback-url-https` | AWS::Cognito::UserPoolClient | Callback URLs must use https (except localhost) | none |
+| `pf-cognito-callback-urls-max` | AWS::Cognito::UserPoolClient | At most 100 callback URLs per client | none |
 | `pf-cognito-client-credentials-exclusive` | AWS::Cognito::UserPoolClient | client_credentials cannot combine with code or implicit | none |
 | `pf-cognito-client-credentials-secret` | AWS::Cognito::UserPoolClient | client_credentials needs a client secret | none |
 | `pf-cognito-client-name` | AWS::Cognito::UserPoolClient | User pool client names allow only word characters, spaces and +=,.@- | none |
+| `pf-cognito-custom-domain-cert-region` | AWS::Cognito::UserPoolDomain | A custom domain certificate must be in us-east-1 | none |
+| `pf-cognito-custom-domain-fqdn` | AWS::Cognito::UserPoolDomain | A custom domain must be a fully qualified domain name | none |
+| `pf-cognito-custom-email-sender-kms` | AWS::Cognito::UserPool | A custom email sender trigger requires LambdaConfig.KMSKeyID | none |
+| `pf-cognito-custom-sender-kms-region` | AWS::Cognito::UserPool | The custom sender KMS key must be in the pool region | none |
+| `pf-cognito-custom-sms-sender-kms` | AWS::Cognito::UserPool | A custom SMS sender trigger requires LambdaConfig.KMSKeyID | none |
+| `pf-cognito-default-redirect-uri-member` | AWS::Cognito::UserPoolClient | DefaultRedirectURI must be one of the callback URLs | none |
+| `pf-cognito-developer-provider-name-format` | AWS::Cognito::IdentityPool | DeveloperProviderName takes no spaces | none |
+| `pf-cognito-domain-prefix-format` | AWS::Cognito::UserPoolDomain | A hosted UI domain prefix takes lower-case letters, digits and hyphens | none |
+| `pf-cognito-domain-prefix-length` | AWS::Cognito::UserPoolDomain | A hosted UI domain prefix is capped at 63 characters | none |
 | `pf-cognito-domain-reserved-word` | AWS::Cognito::UserPoolDomain | Domain prefixes cannot contain reserved words | none |
+| `pf-cognito-email-cognito-default-with-sourcearn` | AWS::Cognito::UserPool | COGNITO_DEFAULT email sending takes no SourceArn | none |
+| `pf-cognito-email-developer-requires-sourcearn` | AWS::Cognito::UserPool | DEVELOPER email sending needs a SES SourceArn | none |
+| `pf-cognito-email-from-format` | AWS::Cognito::UserPool | EmailConfiguration.From must be an email address | none |
+| `pf-cognito-email-reply-to-format` | AWS::Cognito::UserPool | ReplyToEmailAddress must be an email address | none |
+| `pf-cognito-email-sourcearn-region` | AWS::Cognito::UserPool | The SES SourceArn must be in a Cognito-supported SES region | none |
+| `pf-cognito-email-verification-message-placeholder` | AWS::Cognito::UserPool | EmailVerificationMessage needs the {####} code placeholder | none |
+| `pf-cognito-explicit-auth-flows-legacy-mix` | AWS::Cognito::UserPoolClient | Legacy and ALLOW_ auth flow names cannot be mixed | none |
+| `pf-cognito-group-role-arn-account` | AWS::Cognito::UserPoolGroup | A group role must be in the deploying account | none |
+| `pf-cognito-identity-pool-provider-name-format` | AWS::Cognito::IdentityPool | A user pool provider name is the full cognito-idp endpoint | none |
+| `pf-cognito-identity-pool-saml-arn-account` | AWS::Cognito::IdentityPool | SAML provider ARNs must be in the deploying account | none |
+| `pf-cognito-idp-apple-required-keys` | AWS::Cognito::UserPoolIdentityProvider | Sign in with Apple needs team_id, key_id and private_key | none |
+| `pf-cognito-idp-identifiers-max` | AWS::Cognito::UserPoolIdentityProvider | At most 50 IdP identifiers | none |
+| `pf-cognito-idp-oidc-attributes-request-method` | AWS::Cognito::UserPoolIdentityProvider | attributes_request_method is GET or POST | none |
+| `pf-cognito-idp-oidc-issuer-https` | AWS::Cognito::UserPoolIdentityProvider | The OIDC issuer must be an https URL | none |
+| `pf-cognito-idp-oidc-required-keys` | AWS::Cognito::UserPoolIdentityProvider | An OIDC provider needs four ProviderDetails keys | none |
+| `pf-cognito-idp-provider-name-length` | AWS::Cognito::UserPoolIdentityProvider | A provider name is capped at 32 characters | none |
+| `pf-cognito-idp-saml-metadata-exclusive` | AWS::Cognito::UserPoolIdentityProvider | MetadataURL and MetadataFile are exclusive | none |
+| `pf-cognito-idp-saml-metadata-required` | AWS::Cognito::UserPoolIdentityProvider | A SAML provider needs MetadataURL or MetadataFile | none |
+| `pf-cognito-idp-social-provider-name-fixed` | AWS::Cognito::UserPoolIdentityProvider | A social provider name is fixed to its type | none |
+| `pf-cognito-idp-social-required-keys` | AWS::Cognito::UserPoolIdentityProvider | A social provider needs client_id, client_secret and authorize_scopes | none |
+| `pf-cognito-invite-message-username-placeholder` | AWS::Cognito::UserPool | The invite email needs {username} and {####} | none |
+| `pf-cognito-invite-sms-message-placeholder` | AWS::Cognito::UserPool | The invite SMS needs {username} and {####} | none |
+| `pf-cognito-lambda-config-region` | AWS::Cognito::UserPool | User pool triggers must be Lambda functions in the same region | none |
+| `pf-cognito-log-delivery-event-source-duplicate` | AWS::Cognito::LogDeliveryConfiguration | One log configuration per event source | none |
+| `pf-cognito-log-delivery-log-group-region` | AWS::Cognito::LogDeliveryConfiguration | The log group must be in the pool region | none |
+| `pf-cognito-log-delivery-user-auth-events-tier` | AWS::Cognito::LogDeliveryConfiguration<br>AWS::Cognito::UserPool | userAuthEvents logging needs the PLUS tier | none |
+| `pf-cognito-logout-url-https` | AWS::Cognito::UserPoolClient | Logout URLs must use https (except localhost) | none |
+| `pf-cognito-managed-login-branding-asset-extension` | AWS::Cognito::ManagedLoginBranding | Only a favicon asset takes the ICO extension | none |
+| `pf-cognito-managed-login-branding-values-exclusive` | AWS::Cognito::ManagedLoginBranding | UseCognitoProvidedValues excludes Settings | none |
+| `pf-cognito-managed-login-version-tier` | AWS::Cognito::UserPoolDomain<br>AWS::Cognito::UserPool | Managed login version 2 needs ESSENTIALS or PLUS | none |
+| `pf-cognito-mfa-email-otp-requires-developer` | AWS::Cognito::UserPool | EMAIL_OTP needs the DEVELOPER email sending account | none |
+| `pf-cognito-mfa-off-with-enabled-mfas` | AWS::Cognito::UserPool | MfaConfiguration OFF takes no EnabledMfas | none |
 | `pf-cognito-mfa-sms-config` | AWS::Cognito::UserPool | MFA without any factor configuration cannot deploy | none |
 | `pf-cognito-oauth-callback-required` | AWS::Cognito::UserPoolClient | code and implicit OAuth flows need CallbackURLs | none |
 | `pf-cognito-oauth-flows-scopes-required` | AWS::Cognito::UserPoolClient | Enabling OAuth requires both AllowedOAuthFlows and AllowedOAuthScopes | none |
+| `pf-cognito-oauth-scopes-unknown` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPoolResourceServer | OAuth scopes must be standard or come from a resource server | none |
+| `pf-cognito-password-history-size-range` | AWS::Cognito::UserPool | PasswordHistorySize must be between 0 and 24 | none |
 | `pf-cognito-password-min-length` | AWS::Cognito::UserPool | PasswordPolicy MinimumLength runs 6 to 99 | none |
+| `pf-cognito-pre-token-generation-config-tier` | AWS::Cognito::UserPool | Pre token generation V2_0 and later need ESSENTIALS or PLUS | none |
+| `pf-cognito-pre-token-generation-legacy-mix` | AWS::Cognito::UserPool | PreTokenGeneration and PreTokenGenerationConfig must name the same function | none |
+| `pf-cognito-propagate-context-requires-secret` | AWS::Cognito::UserPoolClient | Propagating user context data requires a client secret | none |
+| `pf-cognito-read-attributes-exists` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPool | ReadAttributes must name attributes the pool has | none |
+| `pf-cognito-recovery-admin-only-alone` | AWS::Cognito::UserPool | admin_only cannot be combined with other recovery mechanisms | none |
 | `pf-cognito-recovery-duplicate` | AWS::Cognito::UserPool | Recovery mechanisms cannot repeat priorities or names | none |
+| `pf-cognito-recovery-mechanisms-max` | AWS::Cognito::UserPool | At most two account recovery mechanisms | none |
+| `pf-cognito-resource-server-identifier-charset` | AWS::Cognito::UserPoolResourceServer | A resource server identifier takes no spaces | none |
+| `pf-cognito-resource-server-scope-name-charset` | AWS::Cognito::UserPoolResourceServer | Scope names take no spaces or quotes | none |
+| `pf-cognito-resource-server-scopes-max` | AWS::Cognito::UserPoolResourceServer | At most 100 scopes per resource server | none |
+| `pf-cognito-risk-account-takeover-event-action-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Account takeover actions take four values | none |
+| `pf-cognito-risk-compromised-event-action-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Compromised credentials action is BLOCK or NO_ACTION | none |
+| `pf-cognito-risk-compromised-event-filter-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Compromised credentials event filter takes three values | none |
+| `pf-cognito-risk-ip-range-cidr` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Blocked and skipped IP ranges are CIDR blocks | none |
+| `pf-cognito-risk-ip-range-max` | AWS::Cognito::UserPoolRiskConfigurationAttachment | At most 200 blocked IP ranges | none |
+| `pf-cognito-risk-notify-source-arn-region` | AWS::Cognito::UserPoolRiskConfigurationAttachment | The notification SourceArn must be in a Cognito-supported SES region | none |
+| `pf-cognito-role-attachment-roles-keys` | AWS::Cognito::IdentityPoolRoleAttachment | Roles keys are authenticated and unauthenticated | none |
+| `pf-cognito-role-mapping-rule-match-type` | AWS::Cognito::IdentityPoolRoleAttachment | MatchType is Equals, Contains, StartsWith or NotEqual | none |
+| `pf-cognito-role-mapping-rules-max` | AWS::Cognito::IdentityPoolRoleAttachment | At most 25 rules per role mapping | none |
+| `pf-cognito-role-mappings-ambiguous-required` | AWS::Cognito::IdentityPoolRoleAttachment | A role mapping needs AmbiguousRoleResolution | none |
+| `pf-cognito-role-mappings-key-format` | AWS::Cognito::IdentityPoolRoleAttachment | A role mapping key is a provider name | none |
+| `pf-cognito-role-mappings-rules-required` | AWS::Cognito::IdentityPoolRoleAttachment | A Rules role mapping needs RulesConfiguration | none |
+| `pf-cognito-role-mappings-token-no-rules` | AWS::Cognito::IdentityPoolRoleAttachment | A Token role mapping takes no RulesConfiguration | none |
 | `pf-cognito-schema-attr-length-order` | AWS::Cognito::UserPool | Schema attribute MaxLength cannot undercut MinLength | none |
+| `pf-cognito-schema-attr-max` | AWS::Cognito::UserPool | A user pool takes at most 50 custom attributes | none |
+| `pf-cognito-schema-custom-name-length` | AWS::Cognito::UserPool | A schema attribute name is capped at 20 characters | none |
+| `pf-cognito-schema-custom-required` | AWS::Cognito::UserPool | Custom attributes cannot be required | none |
+| `pf-cognito-schema-name-duplicate` | AWS::Cognito::UserPool | Schema attribute names must be unique | none |
+| `pf-cognito-schema-number-min-max-order` | AWS::Cognito::UserPool | Number attribute MinValue must not exceed MaxValue | none |
+| `pf-cognito-schema-standard-attr-datatype` | AWS::Cognito::UserPool | Standard attributes keep their fixed data type | none |
+| `pf-cognito-signin-policy-password-required` | AWS::Cognito::UserPool | AllowedFirstAuthFactors must include PASSWORD | none |
+| `pf-cognito-signin-policy-webauthn-tier` | AWS::Cognito::UserPool | Passwordless sign-in factors need ESSENTIALS or PLUS | none |
+| `pf-cognito-sms-authentication-message-placeholder` | AWS::Cognito::UserPool | SmsAuthenticationMessage needs the {####} code placeholder | none |
+| `pf-cognito-sms-caller-arn-account` | AWS::Cognito::UserPool | The SMS caller role must be in the deploying account | none |
+| `pf-cognito-sms-configuration-sns-region` | AWS::Cognito::UserPool | SnsRegion must be the region the pool deploys to | none |
+| `pf-cognito-sms-verification-message-placeholder` | AWS::Cognito::UserPool | SmsVerificationMessage needs the {####} code placeholder | none |
+| `pf-cognito-supported-identity-providers-exists` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPoolIdentityProvider | Supported identity providers must exist on the pool | none |
+| `pf-cognito-temporary-password-validity-range` | AWS::Cognito::UserPool | TemporaryPasswordValidityDays must be between 0 and 365 | none |
 | `pf-cognito-token-expiration-order` | AWS::Cognito::UserPoolClient | Access and id tokens cannot outlive the refresh token | none |
 | `pf-cognito-token-validity-range` | AWS::Cognito::UserPoolClient | Token validity ranges depend on token type and unit | none |
+| `pf-cognito-ui-customization-css-properties` | AWS::Cognito::UserPoolUICustomizationAttachment | Hosted UI CSS only styles the -customizable classes | none |
+| `pf-cognito-ui-customization-requires-domain` | AWS::Cognito::UserPoolUICustomizationAttachment<br>AWS::Cognito::UserPoolDomain | Hosted UI customization requires a domain on the pool | none |
+| `pf-cognito-unused-account-validity-exclusive` | AWS::Cognito::UserPool | UnusedAccountValidityDays and TemporaryPasswordValidityDays are exclusive | none |
+| `pf-cognito-unused-account-validity-range` | AWS::Cognito::UserPool | UnusedAccountValidityDays must be between 0 and 365 | none |
+| `pf-cognito-user-attribute-update-requires-auto-verified` | AWS::Cognito::UserPool | Attributes requiring verification before update must be auto-verified | none |
+| `pf-cognito-user-attribute-update-settings-enum` | AWS::Cognito::UserPool | Only email and phone_number can require verification before update | none |
 | `pf-cognito-user-pool-name` | AWS::Cognito::UserPool | User pool names allow only word characters, spaces and +=,.@- | none |
+| `pf-cognito-verification-code-placeholder` | AWS::Cognito::UserPool | The verification email needs the {####} code placeholder | none |
+| `pf-cognito-verification-email-subject-length` | AWS::Cognito::UserPool | The verification email subject is capped at 140 characters | none |
+| `pf-cognito-verification-link-placeholder` | AWS::Cognito::UserPool | A link verification message needs the {##...##} placeholder | none |
+| `pf-cognito-verification-sms-placeholder` | AWS::Cognito::UserPool | The verification SMS needs the {####} code placeholder | none |
+| `pf-cognito-web-authn-relying-party-format` | AWS::Cognito::UserPool | WebAuthnRelyingPartyID is a bare domain name | none |
+| `pf-cognito-write-attributes-immutable` | AWS::Cognito::UserPoolClient | Verified-status attributes cannot be written by a client | none |
 | `pf-dynamodb-attribute-definitions-usage` | AWS::DynamoDB::Table | Every AttributeDefinitions entry must be used by a key schema | none |
 | `pf-dynamodb-attribute-type` | AWS::DynamoDB::Table | AttributeType must be S, N or B | pending-engine |
 | `pf-dynamodb-billing-throughput` | AWS::DynamoDB::Table | ProvisionedThroughput must match BillingMode (required for PROVISIONED, forbidden for PAY_PER_REQUEST) | none |
@@ -377,6 +564,7 @@
 | `pf-dynamodb-warm-throughput-minimum` | AWS::DynamoDB::Table | WarmThroughput cannot go below the default 12000 read / 4000 write | none |
 | `pf-ec2-client-vpn-auth-type-config` | AWS::EC2::ClientVpnEndpoint | Client VPN AuthenticationOptions.Type must match the provided authentication sub-block | none |
 | `pf-ec2-client-vpn-authorization-rule-exclusive` | AWS::EC2::ClientVpnAuthorizationRule | Client VPN authorization rule cannot set both AccessGroupId and AuthorizeAllGroups | none |
+| `pf-ec2-client-vpn-cert-region` | AWS::EC2::ClientVpnEndpoint | The Client VPN server certificate must be in the deploy region | none |
 | `pf-ec2-client-vpn-cidr-size` | AWS::EC2::ClientVpnEndpoint | Client VPN ClientCidrBlock must be between /12 and /22 | none |
 | `pf-ec2-client-vpn-connection-log` | AWS::EC2::ClientVpnEndpoint | Client VPN ConnectionLogOptions.Enabled requires CloudwatchLogGroup | none |
 | `pf-ec2-client-vpn-port` | AWS::EC2::ClientVpnEndpoint | Client VPN VpnPort must be 443 or 1194 | none |
@@ -419,9 +607,11 @@
 | `pf-ec2-sg-rule-description` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | Security group rule descriptions are limited to 255 chars of a restricted ASCII set | none |
 | `pf-ec2-sg-source-exclusive` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | A security group rule takes exactly one source/destination field | none |
 | `pf-ec2-subnet-cidr-size` | AWS::EC2::Subnet | Subnet IPv4 CIDR netmask must be between /16 and /28 | none |
+| `pf-ec2-subnet-dns64-ipv6` | AWS::EC2::Subnet | EnableDns64 requires the subnet to have an IPv6 CIDR | none |
 | `pf-ec2-subnet-ipv6-native-cidr` | AWS::EC2::Subnet | An IPv6-only subnet cannot carry IPv4 addressing | none |
 | `pf-ec2-tgw-amazon-side-asn` | AWS::EC2::TransitGateway | TransitGateway AmazonSideAsn must be in 64512-65534 or 4200000000-4294967294 | none |
 | `pf-ec2-tgw-cidr-block-size` | AWS::EC2::TransitGateway | TransitGatewayCidrBlocks must be /24 or larger for IPv4 | none |
+| `pf-ec2-tgw-route-blackhole-exclusive` | AWS::EC2::TransitGatewayRoute | A blackhole transit gateway route cannot name an attachment | none |
 | `pf-ec2-traffic-mirror-target-exactly-one` | AWS::EC2::TrafficMirrorTarget | A traffic mirror target names exactly one destination | none |
 | `pf-ec2-userdata-size` | AWS::EC2::Instance<br>AWS::EC2::LaunchTemplate | EC2 user data is limited to 16384 bytes | none |
 | `pf-ec2-volume-iops` | AWS::EC2::Volume | EBS Iops/Throughput must match the volume type's supported ranges and ratios | none |
@@ -432,11 +622,13 @@
 | `pf-ec2-volume-throughput-type` | AWS::EC2::Volume | EBS Throughput applies only to gp3 volumes | none |
 | `pf-ec2-vpc-cidr-block-overlap` | AWS::EC2::VPCCidrBlock | A secondary VPC CIDR cannot overlap the primary | none |
 | `pf-ec2-vpc-cidr-block-size` | AWS::EC2::VPC | VPC IPv4 CIDR block netmask must be between /16 and /28 | none |
+| `pf-ec2-vpc-cidr-reserved-range` | AWS::EC2::VPC | A VPC CIDR must not overlap a reserved IPv4 range | none |
 | `pf-ec2-vpc-single-igw` | AWS::EC2::VPCGatewayAttachment | A VPC accepts only one internet gateway attachment | none |
 | `pf-ec2-vpce-gateway-service` | AWS::EC2::VPCEndpoint | Gateway VPC endpoints only exist for S3 and DynamoDB | none |
 | `pf-ec2-vpce-service-region` | AWS::EC2::VPCEndpoint | VPC endpoint service names must use the deploy region unless ServiceRegion is set | none |
 | `pf-ec2-vpce-subnet-az-unique` | AWS::EC2::VPCEndpoint | An interface VPC endpoint takes at most one subnet per availability zone | none |
 | `pf-ec2-vpce-type-config` | AWS::EC2::VPCEndpoint | SubnetIds are not supported on Gateway endpoints (and RouteTableIds only on Gateway) | none |
+| `pf-ec2-vpn-gateway-exclusive` | AWS::EC2::VPNConnection | A VPN connection cannot name both a VPN gateway and a transit gateway | none |
 | `pf-ec2-vpn-phase-lifetime-order` | AWS::EC2::VPNConnection | VPN Phase2LifetimeSeconds must be less than Phase1LifetimeSeconds | none |
 | `pf-ec2-vpn-pre-shared-key` | AWS::EC2::VPNConnection | VPN tunnel PreSharedKey must be 8-64 characters of [A-Za-z0-9._] and must not start with 0 | none |
 | `pf-ec2-vpn-rekey-margin` | AWS::EC2::VPNConnection | VPN RekeyMarginTimeSeconds must be less than half of Phase2LifetimeSeconds | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.79" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.81" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */