cdk-preflight 0.0.80 → 0.0.82

package/.jsii

@@ -9599,6 +9599,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.80",
-  "fingerprint": "+FnZbdbMVvHcVmUO+i58EvbeN2Dq+KN7tPbpdvP0Iso="
+  "version": "0.0.82",
+  "fingerprint": "0BDPdPdA6URoRAPMl509DD3MyD7SF71W8GWzyBN+YiI="
 }

package/docs/rules.md

@@ -241,13 +241,101 @@
 | `pf-agentcore-runtime-session-storage-single` | AWS::BedrockAgentCore::Runtime | An AgentCore Runtime allows at most one SessionStorage filesystem configuration | none |
 | `pf-agentcore-vpc-network-mode-config` | AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::BrowserCustom<br>AWS::BedrockAgentCore::CodeInterpreterCustom<br>AWS::BedrockAgentCore::Harness | NetworkMode VPC requires the VPC config block, and PUBLIC forbids it (Runtime, Browser, Code Interpreter, Harness) | none |
 | `pf-cloudfront-acm-cert-region` | AWS::CloudFront::Distribution | CloudFront viewer certificates must live in us-east-1 | none |
+| `pf-cloudfront-alias-unique` | AWS::CloudFront::Distribution | Aliases must not contain duplicates | none |
 | `pf-cloudfront-aliases-require-custom-certificate` | AWS::CloudFront::Distribution | A distribution with Aliases cannot use the CloudFront default certificate | none |
+| `pf-cloudfront-allowed-methods-set` | AWS::CloudFront::Distribution | AllowedMethods must be one of the three sets CloudFront supports | none |
+| `pf-cloudfront-anycast-ip-list-count` | AWS::CloudFront::AnycastIpList | AnycastIpList IpCount must be 21 | none |
+| `pf-cloudfront-cache-behavior-path-pattern-unique` | AWS::CloudFront::Distribution | Cache behavior PathPattern values must be unique | none |
+| `pf-cloudfront-cache-behavior-target-origin-exists` | AWS::CloudFront::Distribution | Cache behavior TargetOriginId must match an origin or origin group Id | none |
+| `pf-cloudfront-cache-policy-accept-encoding-conflict` | AWS::CloudFront::CachePolicy | Accept-Encoding cannot be whitelisted while EnableAcceptEncodingGzip/Brotli is true | none |
+| `pf-cloudfront-cache-policy-cookie-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy CookieBehavior whitelist / allExcept requires Cookies | none |
+| `pf-cloudfront-cache-policy-header-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy HeaderBehavior whitelist requires Headers | none |
+| `pf-cloudfront-cache-policy-header-behavior-none-items` | AWS::CloudFront::CachePolicy | Cache policy HeaderBehavior none cannot carry Headers | none |
 | `pf-cloudfront-cache-policy-name` | AWS::CloudFront::CachePolicy | Cache policy names allow only alphanumerics, dash and underscore | none |
+| `pf-cloudfront-cache-policy-or-forwarded-values-required` | AWS::CloudFront::Distribution | A cache behavior must set either CachePolicyId or ForwardedValues | none |
+| `pf-cloudfront-cache-policy-query-string-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy QueryStringBehavior whitelist / allExcept requires QueryStrings | none |
+| `pf-cloudfront-cache-policy-ttl-default-in-range` | AWS::CloudFront::CachePolicy | Cache policy DefaultTTL must be between MinTTL and MaxTTL | none |
 | `pf-cloudfront-cached-methods-subset` | AWS::CloudFront::Distribution | CachedMethods must be a subset of AllowedMethods | none |
+| `pf-cloudfront-continuous-deployment-header-prefix` | AWS::CloudFront::ContinuousDeploymentPolicy | SingleHeaderConfig Header must start with aws-cf-cd- | none |
+| `pf-cloudfront-continuous-deployment-policy-excludes-staging` | AWS::CloudFront::Distribution | ContinuousDeploymentPolicyId cannot be set on a staging distribution | none |
+| `pf-cloudfront-continuous-deployment-session-ttl-order` | AWS::CloudFront::ContinuousDeploymentPolicy | SessionStickinessConfig IdleTTL cannot exceed MaximumTTL | none |
+| `pf-cloudfront-continuous-deployment-staging-dns-count` | AWS::CloudFront::ContinuousDeploymentPolicy | A continuous deployment policy takes exactly one staging distribution DNS name | none |
+| `pf-cloudfront-continuous-deployment-traffic-config-match` | AWS::CloudFront::ContinuousDeploymentPolicy | TrafficConfig Type must match the config block that is present | none |
+| `pf-cloudfront-continuous-deployment-weight-range` | AWS::CloudFront::ContinuousDeploymentPolicy | SingleWeightConfig Weight must be between 0 and 0.15 | none |
+| `pf-cloudfront-custom-error-response-code` | AWS::CloudFront::Distribution | CustomErrorResponses ErrorCode must be one of the codes CloudFront caches | pending-engine |
+| `pf-cloudfront-custom-error-response-page-path-format` | AWS::CloudFront::Distribution | ResponsePagePath must start with / | none |
+| `pf-cloudfront-custom-error-response-page-path-pair` | AWS::CloudFront::Distribution | ResponsePagePath and ResponseCode must be specified together | none |
 | `pf-cloudfront-edge-lambda-region` | AWS::CloudFront::Distribution | Lambda@Edge functions associated with a distribution must be in us-east-1 | none |
 | `pf-cloudfront-edge-lambda-version` | AWS::CloudFront::Distribution | Lambda@Edge associations must reference a version ARN, not an alias or $LATEST | none |
+| `pf-cloudfront-field-level-encryption-requires-post` | AWS::CloudFront::Distribution | FieldLevelEncryptionId requires POST or PUT in AllowedMethods | none |
+| `pf-cloudfront-function-association-event-type` | AWS::CloudFront::Distribution | CloudFront Functions only support viewer-request and viewer-response | none |
+| `pf-cloudfront-function-association-event-type-unique` | AWS::CloudFront::Distribution | Each CloudFront Function EventType can appear only once per cache behavior | none |
+| `pf-cloudfront-function-code-size` | AWS::CloudFront::Function | CloudFront Function code is limited to 10 KB | none |
+| `pf-cloudfront-function-kvs-association-count` | AWS::CloudFront::Function | A CloudFront Function can associate at most one key value store | none |
+| `pf-cloudfront-function-kvs-requires-runtime-2` | AWS::CloudFront::Function | KeyValueStoreAssociations require the cloudfront-js-2.0 runtime | none |
+| `pf-cloudfront-function-runtime-enum` | AWS::CloudFront::Function | CloudFront Function Runtime must be cloudfront-js-1.0 or cloudfront-js-2.0 | pending-engine |
+| `pf-cloudfront-geo-restriction-country-code` | AWS::CloudFront::Distribution | GeoRestriction locations must be two-letter uppercase country codes | pending-engine |
+| `pf-cloudfront-geo-restriction-locations-exclusive` | AWS::CloudFront::Distribution | RestrictionType none cannot carry Locations | none |
+| `pf-cloudfront-grpc-requires-http2` | AWS::CloudFront::Distribution | GrpcConfig requires an HTTP/2 capable HttpVersion | none |
+| `pf-cloudfront-grpc-requires-post-method` | AWS::CloudFront::Distribution | GrpcConfig requires POST in AllowedMethods | none |
+| `pf-cloudfront-http-version-enum` | AWS::CloudFront::Distribution | HttpVersion must be http1.1, http2, http2and3 or http3 | pending-engine |
+| `pf-cloudfront-key-group-item-count` | AWS::CloudFront::KeyGroup | A key group holds at most 5 public keys | none |
+| `pf-cloudfront-key-group-item-unique` | AWS::CloudFront::KeyGroup | A key group must not list the same public key twice | none |
+| `pf-cloudfront-key-value-store-import-source-arn` | AWS::CloudFront::KeyValueStore | KeyValueStore ImportSource SourceArn must be an S3 object ARN | none |
+| `pf-cloudfront-key-value-store-import-source-type` | AWS::CloudFront::KeyValueStore | KeyValueStore ImportSource SourceType must be S3 | pending-engine |
+| `pf-cloudfront-lambda-association-event-type-unique` | AWS::CloudFront::Distribution | Each Lambda@Edge EventType can appear only once per cache behavior | none |
+| `pf-cloudfront-lambda-association-include-body-event-type` | AWS::CloudFront::Distribution | IncludeBody is only valid for viewer-request and origin-request | none |
+| `pf-cloudfront-logging-bucket-format` | AWS::CloudFront::Distribution | Logging.Bucket must be the S3 bucket DNS name, not the bare bucket name | none |
+| `pf-cloudfront-oac-excludes-origin-access-identity` | AWS::CloudFront::Distribution | OriginAccessControlId and S3OriginConfig.OriginAccessIdentity are mutually exclusive | none |
+| `pf-cloudfront-origin-config-required` | AWS::CloudFront::Distribution | Every origin must declare exactly one origin type configuration | none |
+| `pf-cloudfront-origin-connection-attempts-range` | AWS::CloudFront::Distribution | ConnectionAttempts must be between 1 and 3 | none |
+| `pf-cloudfront-origin-connection-timeout-range` | AWS::CloudFront::Distribution | ConnectionTimeout must be between 1 and 10 | none |
+| `pf-cloudfront-origin-custom-header-blocklist` | AWS::CloudFront::Distribution | OriginCustomHeaders cannot carry headers CloudFront reserves | none |
+| `pf-cloudfront-origin-custom-header-name-unique` | AWS::CloudFront::Distribution | OriginCustomHeaders header names must be unique per origin | none |
+| `pf-cloudfront-origin-group-failover-status-codes` | AWS::CloudFront::Distribution | Origin group failover status codes are limited to a fixed set | none |
+| `pf-cloudfront-origin-group-id-collides-with-origin` | AWS::CloudFront::Distribution | An origin group Id cannot reuse an origin Id | none |
 | `pf-cloudfront-origin-group-member-origin` | AWS::CloudFront::Distribution | Origin group members must reference an origin declared in the distribution | none |
+| `pf-cloudfront-origin-http-port-range` | AWS::CloudFront::Distribution | HTTPPort must be 80, 443 or in 1024-65535 | none |
+| `pf-cloudfront-origin-https-port-range` | AWS::CloudFront::Distribution | HTTPSPort must be 80, 443 or in 1024-65535 | none |
+| `pf-cloudfront-origin-id-unique` | AWS::CloudFront::Distribution | Origin Id values must be unique within a distribution | none |
+| `pf-cloudfront-origin-keepalive-timeout-range` | AWS::CloudFront::Distribution | OriginKeepaliveTimeout must be between 1 and 300 | none |
+| `pf-cloudfront-origin-path-format` | AWS::CloudFront::Distribution | OriginPath must start with / and must not end with / | none |
+| `pf-cloudfront-origin-protocol-policy-enum` | AWS::CloudFront::Distribution | OriginProtocolPolicy must be http-only, https-only or match-viewer | none |
+| `pf-cloudfront-origin-read-timeout-range` | AWS::CloudFront::Distribution | OriginReadTimeout must be between 1 and 120 | none |
+| `pf-cloudfront-origin-request-policy-cloudfront-headers` | AWS::CloudFront::OriginRequestPolicy | allViewerAndWhitelistCloudFront only accepts CloudFront-* headers | none |
+| `pf-cloudfront-origin-request-policy-cookie-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy CookieBehavior whitelist / allExcept requires Cookies | none |
+| `pf-cloudfront-origin-request-policy-excludes-forwarded-values` | AWS::CloudFront::Distribution | A cache behavior cannot set both OriginRequestPolicyId and ForwardedValues | none |
+| `pf-cloudfront-origin-request-policy-header-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy HeaderBehavior whitelist / allExcept requires Headers | none |
+| `pf-cloudfront-origin-request-policy-name-charset` | AWS::CloudFront::OriginRequestPolicy | Origin request policy names allow only alphanumerics, dash and underscore | none |
+| `pf-cloudfront-origin-request-policy-query-string-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy QueryStringBehavior whitelist / allExcept requires QueryStrings | none |
+| `pf-cloudfront-origin-shield-region-required` | AWS::CloudFront::Distribution | Enabling Origin Shield requires OriginShieldRegion | none |
+| `pf-cloudfront-origin-shield-region-supported` | AWS::CloudFront::Distribution | OriginShieldRegion must be a region where CloudFront offers Origin Shield | none |
+| `pf-cloudfront-price-class-enum` | AWS::CloudFront::Distribution | PriceClass must be PriceClass_100, PriceClass_200 or PriceClass_All | pending-engine |
+| `pf-cloudfront-public-key-pem-format` | AWS::CloudFront::PublicKey | PublicKey EncodedKey must be a PEM-encoded public key | none |
+| `pf-cloudfront-realtime-log-endpoint-count` | AWS::CloudFront::RealtimeLogConfig | A real-time log configuration takes exactly one endpoint | none |
+| `pf-cloudfront-realtime-log-endpoint-stream-type` | AWS::CloudFront::RealtimeLogConfig | Real-time log endpoints must have StreamType Kinesis | none |
+| `pf-cloudfront-realtime-log-field-names` | AWS::CloudFront::RealtimeLogConfig | Real-time log Fields must name fields CloudFront defines | none |
+| `pf-cloudfront-response-headers-policy-name-charset` | AWS::CloudFront::ResponseHeadersPolicy | Response headers policy names allow only alphanumerics, dash and underscore | none |
+| `pf-cloudfront-rhp-content-security-policy-length` | AWS::CloudFront::ResponseHeadersPolicy | ContentSecurityPolicy is limited to 1783 characters | none |
+| `pf-cloudfront-rhp-cors-allow-methods-enum` | AWS::CloudFront::ResponseHeadersPolicy | AccessControlAllowMethods accepts only the eight documented values | pending-engine |
+| `pf-cloudfront-rhp-custom-header-blocklist` | AWS::CloudFront::ResponseHeadersPolicy | CustomHeadersConfig cannot carry headers CloudFront reserves | none |
+| `pf-cloudfront-rhp-custom-header-unique` | AWS::CloudFront::ResponseHeadersPolicy | CustomHeadersConfig must not repeat a header name | none |
+| `pf-cloudfront-rhp-remove-header-blocklist` | AWS::CloudFront::ResponseHeadersPolicy | RemoveHeadersConfig cannot remove headers CloudFront controls | none |
+| `pf-cloudfront-rhp-server-timing-sampling-rate-required` | AWS::CloudFront::ResponseHeadersPolicy | ServerTimingHeadersConfig requires SamplingRate when enabled | none |
+| `pf-cloudfront-rhp-xss-protection-report-uri-mode-block` | AWS::CloudFront::ResponseHeadersPolicy | XSSProtection cannot set both ReportUri and ModeBlock | none |
+| `pf-cloudfront-rhp-xss-protection-report-uri-requires-protection` | AWS::CloudFront::ResponseHeadersPolicy | XSSProtection ReportUri requires Protection true | none |
+| `pf-cloudfront-s3-website-endpoint-custom-origin` | AWS::CloudFront::Distribution | An S3 website endpoint origin must use CustomOriginConfig, not S3OriginConfig | none |
+| `pf-cloudfront-staging-requires-no-aliases` | AWS::CloudFront::Distribution | A staging distribution cannot have Aliases | none |
+| `pf-cloudfront-trusted-key-groups-excludes-trusted-signers` | AWS::CloudFront::Distribution | TrustedKeyGroups and TrustedSigners cannot both be used on a cache behavior | none |
+| `pf-cloudfront-trusted-signers-account-format` | AWS::CloudFront::Distribution | TrustedSigners entries must be self or a 12-digit account id | none |
 | `pf-cloudfront-ttl-order` | AWS::CloudFront::Distribution | Cache behavior TTLs must satisfy MinTTL <= DefaultTTL <= MaxTTL | none |
+| `pf-cloudfront-viewer-certificate-exactly-one` | AWS::CloudFront::Distribution | ViewerCertificate must name exactly one certificate source | none |
+| `pf-cloudfront-viewer-certificate-sni-min-protocol` | AWS::CloudFront::Distribution | sni-only requires MinimumProtocolVersion of TLSv1 or higher | none |
+| `pf-cloudfront-viewer-certificate-vip-deprecated` | AWS::CloudFront::Distribution | SslSupportMethod vip cannot be used for new distributions | none |
+| `pf-cloudfront-viewer-protocol-policy-enum` | AWS::CloudFront::Distribution | ViewerProtocolPolicy must be allow-all, https-only or redirect-to-https | pending-engine |
+| `pf-cloudfront-vpc-origin-arn-type` | AWS::CloudFront::VpcOrigin | A VPC origin ARN must point at an ALB, NLB or EC2 instance | none |
+| `pf-cloudfront-vpc-origin-port-range` | AWS::CloudFront::VpcOrigin | VPC origin HTTPPort and HTTPSPort must be between 1 and 65535 | none |
+| `pf-cloudfront-vpc-origin-ssl-protocols-required` | AWS::CloudFront::VpcOrigin | An HTTPS-capable VPC origin must list OriginSSLProtocols | none |
 | `pf-cloudfront-wafv2-webacl-scope` | AWS::CloudFront::Distribution | A WAFv2 web ACL attached to CloudFront must be globally scoped | none |
 | `pf-cloudwatch-alarm-action-vendor` | AWS::CloudWatch::Alarm | Alarm actions accept only the CloudWatch action vendors | none |
 | `pf-cloudwatch-alarm-actions-max` | AWS::CloudWatch::Alarm | Each alarm action list holds at most 5 ARNs | none |
@@ -307,19 +395,118 @@
 | `pf-cloudwatch-metricstat-stat-syntax` | AWS::CloudWatch::Alarm | MetricStat.Stat must be a CloudWatch statistic | none |
 | `pf-cloudwatch-threshold-metric-id` | AWS::CloudWatch::Alarm | ThresholdMetricId must match a metric query that returns data | none |
 | `pf-cognito-alias-username-exclusive` | AWS::Cognito::UserPool | AliasAttributes and UsernameAttributes are mutually exclusive | none |
+| `pf-cognito-analytics-application-requires-role` | AWS::Cognito::UserPoolClient | Pinpoint ApplicationId needs a RoleArn | none |
+| `pf-cognito-analytics-arn-region` | AWS::Cognito::UserPoolClient | The Pinpoint analytics app must be in the pool region | none |
+| `pf-cognito-analytics-config-exclusive` | AWS::Cognito::UserPoolClient | Pinpoint ApplicationArn excludes the id/role form | none |
+| `pf-cognito-auto-verified-attributes-enum` | AWS::Cognito::UserPool | Only email and phone_number can be auto-verified | none |
+| `pf-cognito-auto-verified-username-consistency` | AWS::Cognito::UserPool | Auto-verifying phone_number requires an SmsConfiguration | none |
+| `pf-cognito-callback-url-fragment` | AWS::Cognito::UserPoolClient | Callback URLs cannot carry a fragment | none |
+| `pf-cognito-callback-url-https` | AWS::Cognito::UserPoolClient | Callback URLs must use https (except localhost) | none |
+| `pf-cognito-callback-urls-max` | AWS::Cognito::UserPoolClient | At most 100 callback URLs per client | none |
 | `pf-cognito-client-credentials-exclusive` | AWS::Cognito::UserPoolClient | client_credentials cannot combine with code or implicit | none |
 | `pf-cognito-client-credentials-secret` | AWS::Cognito::UserPoolClient | client_credentials needs a client secret | none |
 | `pf-cognito-client-name` | AWS::Cognito::UserPoolClient | User pool client names allow only word characters, spaces and +=,.@- | none |
+| `pf-cognito-custom-domain-cert-region` | AWS::Cognito::UserPoolDomain | A custom domain certificate must be in us-east-1 | none |
+| `pf-cognito-custom-domain-fqdn` | AWS::Cognito::UserPoolDomain | A custom domain must be a fully qualified domain name | none |
+| `pf-cognito-custom-email-sender-kms` | AWS::Cognito::UserPool | A custom email sender trigger requires LambdaConfig.KMSKeyID | none |
+| `pf-cognito-custom-sender-kms-region` | AWS::Cognito::UserPool | The custom sender KMS key must be in the pool region | none |
+| `pf-cognito-custom-sms-sender-kms` | AWS::Cognito::UserPool | A custom SMS sender trigger requires LambdaConfig.KMSKeyID | none |
+| `pf-cognito-default-redirect-uri-member` | AWS::Cognito::UserPoolClient | DefaultRedirectURI must be one of the callback URLs | none |
+| `pf-cognito-developer-provider-name-format` | AWS::Cognito::IdentityPool | DeveloperProviderName takes no spaces | none |
+| `pf-cognito-domain-prefix-format` | AWS::Cognito::UserPoolDomain | A hosted UI domain prefix takes lower-case letters, digits and hyphens | none |
+| `pf-cognito-domain-prefix-length` | AWS::Cognito::UserPoolDomain | A hosted UI domain prefix is capped at 63 characters | none |
 | `pf-cognito-domain-reserved-word` | AWS::Cognito::UserPoolDomain | Domain prefixes cannot contain reserved words | none |
+| `pf-cognito-email-cognito-default-with-sourcearn` | AWS::Cognito::UserPool | COGNITO_DEFAULT email sending takes no SourceArn | none |
+| `pf-cognito-email-developer-requires-sourcearn` | AWS::Cognito::UserPool | DEVELOPER email sending needs a SES SourceArn | none |
+| `pf-cognito-email-from-format` | AWS::Cognito::UserPool | EmailConfiguration.From must be an email address | none |
+| `pf-cognito-email-reply-to-format` | AWS::Cognito::UserPool | ReplyToEmailAddress must be an email address | none |
+| `pf-cognito-email-sourcearn-region` | AWS::Cognito::UserPool | The SES SourceArn must be in a Cognito-supported SES region | none |
+| `pf-cognito-email-verification-message-placeholder` | AWS::Cognito::UserPool | EmailVerificationMessage needs the {####} code placeholder | none |
+| `pf-cognito-explicit-auth-flows-legacy-mix` | AWS::Cognito::UserPoolClient | Legacy and ALLOW_ auth flow names cannot be mixed | none |
+| `pf-cognito-group-role-arn-account` | AWS::Cognito::UserPoolGroup | A group role must be in the deploying account | none |
+| `pf-cognito-identity-pool-provider-name-format` | AWS::Cognito::IdentityPool | A user pool provider name is the full cognito-idp endpoint | none |
+| `pf-cognito-identity-pool-saml-arn-account` | AWS::Cognito::IdentityPool | SAML provider ARNs must be in the deploying account | none |
+| `pf-cognito-idp-apple-required-keys` | AWS::Cognito::UserPoolIdentityProvider | Sign in with Apple needs team_id, key_id and private_key | none |
+| `pf-cognito-idp-identifiers-max` | AWS::Cognito::UserPoolIdentityProvider | At most 50 IdP identifiers | none |
+| `pf-cognito-idp-oidc-attributes-request-method` | AWS::Cognito::UserPoolIdentityProvider | attributes_request_method is GET or POST | none |
+| `pf-cognito-idp-oidc-issuer-https` | AWS::Cognito::UserPoolIdentityProvider | The OIDC issuer must be an https URL | none |
+| `pf-cognito-idp-oidc-required-keys` | AWS::Cognito::UserPoolIdentityProvider | An OIDC provider needs four ProviderDetails keys | none |
+| `pf-cognito-idp-provider-name-length` | AWS::Cognito::UserPoolIdentityProvider | A provider name is capped at 32 characters | none |
+| `pf-cognito-idp-saml-metadata-exclusive` | AWS::Cognito::UserPoolIdentityProvider | MetadataURL and MetadataFile are exclusive | none |
+| `pf-cognito-idp-saml-metadata-required` | AWS::Cognito::UserPoolIdentityProvider | A SAML provider needs MetadataURL or MetadataFile | none |
+| `pf-cognito-idp-social-provider-name-fixed` | AWS::Cognito::UserPoolIdentityProvider | A social provider name is fixed to its type | none |
+| `pf-cognito-idp-social-required-keys` | AWS::Cognito::UserPoolIdentityProvider | A social provider needs client_id, client_secret and authorize_scopes | none |
+| `pf-cognito-invite-message-username-placeholder` | AWS::Cognito::UserPool | The invite email needs {username} and {####} | none |
+| `pf-cognito-invite-sms-message-placeholder` | AWS::Cognito::UserPool | The invite SMS needs {username} and {####} | none |
+| `pf-cognito-lambda-config-region` | AWS::Cognito::UserPool | User pool triggers must be Lambda functions in the same region | none |
+| `pf-cognito-log-delivery-event-source-duplicate` | AWS::Cognito::LogDeliveryConfiguration | One log configuration per event source | none |
+| `pf-cognito-log-delivery-log-group-region` | AWS::Cognito::LogDeliveryConfiguration | The log group must be in the pool region | none |
+| `pf-cognito-log-delivery-user-auth-events-tier` | AWS::Cognito::LogDeliveryConfiguration<br>AWS::Cognito::UserPool | userAuthEvents logging needs the PLUS tier | none |
+| `pf-cognito-logout-url-https` | AWS::Cognito::UserPoolClient | Logout URLs must use https (except localhost) | none |
+| `pf-cognito-managed-login-branding-asset-extension` | AWS::Cognito::ManagedLoginBranding | Only a favicon asset takes the ICO extension | none |
+| `pf-cognito-managed-login-branding-values-exclusive` | AWS::Cognito::ManagedLoginBranding | UseCognitoProvidedValues excludes Settings | none |
+| `pf-cognito-managed-login-version-tier` | AWS::Cognito::UserPoolDomain<br>AWS::Cognito::UserPool | Managed login version 2 needs ESSENTIALS or PLUS | none |
+| `pf-cognito-mfa-email-otp-requires-developer` | AWS::Cognito::UserPool | EMAIL_OTP needs the DEVELOPER email sending account | none |
+| `pf-cognito-mfa-off-with-enabled-mfas` | AWS::Cognito::UserPool | MfaConfiguration OFF takes no EnabledMfas | none |
 | `pf-cognito-mfa-sms-config` | AWS::Cognito::UserPool | MFA without any factor configuration cannot deploy | none |
 | `pf-cognito-oauth-callback-required` | AWS::Cognito::UserPoolClient | code and implicit OAuth flows need CallbackURLs | none |
 | `pf-cognito-oauth-flows-scopes-required` | AWS::Cognito::UserPoolClient | Enabling OAuth requires both AllowedOAuthFlows and AllowedOAuthScopes | none |
+| `pf-cognito-oauth-scopes-unknown` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPoolResourceServer | OAuth scopes must be standard or come from a resource server | none |
+| `pf-cognito-password-history-size-range` | AWS::Cognito::UserPool | PasswordHistorySize must be between 0 and 24 | none |
 | `pf-cognito-password-min-length` | AWS::Cognito::UserPool | PasswordPolicy MinimumLength runs 6 to 99 | none |
+| `pf-cognito-pre-token-generation-config-tier` | AWS::Cognito::UserPool | Pre token generation V2_0 and later need ESSENTIALS or PLUS | none |
+| `pf-cognito-pre-token-generation-legacy-mix` | AWS::Cognito::UserPool | PreTokenGeneration and PreTokenGenerationConfig must name the same function | none |
+| `pf-cognito-propagate-context-requires-secret` | AWS::Cognito::UserPoolClient | Propagating user context data requires a client secret | none |
+| `pf-cognito-read-attributes-exists` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPool | ReadAttributes must name attributes the pool has | none |
+| `pf-cognito-recovery-admin-only-alone` | AWS::Cognito::UserPool | admin_only cannot be combined with other recovery mechanisms | none |
 | `pf-cognito-recovery-duplicate` | AWS::Cognito::UserPool | Recovery mechanisms cannot repeat priorities or names | none |
+| `pf-cognito-recovery-mechanisms-max` | AWS::Cognito::UserPool | At most two account recovery mechanisms | none |
+| `pf-cognito-resource-server-identifier-charset` | AWS::Cognito::UserPoolResourceServer | A resource server identifier takes no spaces | none |
+| `pf-cognito-resource-server-scope-name-charset` | AWS::Cognito::UserPoolResourceServer | Scope names take no spaces or quotes | none |
+| `pf-cognito-resource-server-scopes-max` | AWS::Cognito::UserPoolResourceServer | At most 100 scopes per resource server | none |
+| `pf-cognito-risk-account-takeover-event-action-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Account takeover actions take four values | none |
+| `pf-cognito-risk-compromised-event-action-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Compromised credentials action is BLOCK or NO_ACTION | none |
+| `pf-cognito-risk-compromised-event-filter-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Compromised credentials event filter takes three values | none |
+| `pf-cognito-risk-ip-range-cidr` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Blocked and skipped IP ranges are CIDR blocks | none |
+| `pf-cognito-risk-ip-range-max` | AWS::Cognito::UserPoolRiskConfigurationAttachment | At most 200 blocked IP ranges | none |
+| `pf-cognito-risk-notify-source-arn-region` | AWS::Cognito::UserPoolRiskConfigurationAttachment | The notification SourceArn must be in a Cognito-supported SES region | none |
+| `pf-cognito-role-attachment-roles-keys` | AWS::Cognito::IdentityPoolRoleAttachment | Roles keys are authenticated and unauthenticated | none |
+| `pf-cognito-role-mapping-rule-match-type` | AWS::Cognito::IdentityPoolRoleAttachment | MatchType is Equals, Contains, StartsWith or NotEqual | none |
+| `pf-cognito-role-mapping-rules-max` | AWS::Cognito::IdentityPoolRoleAttachment | At most 25 rules per role mapping | none |
+| `pf-cognito-role-mappings-ambiguous-required` | AWS::Cognito::IdentityPoolRoleAttachment | A role mapping needs AmbiguousRoleResolution | none |
+| `pf-cognito-role-mappings-key-format` | AWS::Cognito::IdentityPoolRoleAttachment | A role mapping key is a provider name | none |
+| `pf-cognito-role-mappings-rules-required` | AWS::Cognito::IdentityPoolRoleAttachment | A Rules role mapping needs RulesConfiguration | none |
+| `pf-cognito-role-mappings-token-no-rules` | AWS::Cognito::IdentityPoolRoleAttachment | A Token role mapping takes no RulesConfiguration | none |
 | `pf-cognito-schema-attr-length-order` | AWS::Cognito::UserPool | Schema attribute MaxLength cannot undercut MinLength | none |
+| `pf-cognito-schema-attr-max` | AWS::Cognito::UserPool | A user pool takes at most 50 custom attributes | none |
+| `pf-cognito-schema-custom-name-length` | AWS::Cognito::UserPool | A schema attribute name is capped at 20 characters | none |
+| `pf-cognito-schema-custom-required` | AWS::Cognito::UserPool | Custom attributes cannot be required | none |
+| `pf-cognito-schema-name-duplicate` | AWS::Cognito::UserPool | Schema attribute names must be unique | none |
+| `pf-cognito-schema-number-min-max-order` | AWS::Cognito::UserPool | Number attribute MinValue must not exceed MaxValue | none |
+| `pf-cognito-schema-standard-attr-datatype` | AWS::Cognito::UserPool | Standard attributes keep their fixed data type | none |
+| `pf-cognito-signin-policy-password-required` | AWS::Cognito::UserPool | AllowedFirstAuthFactors must include PASSWORD | none |
+| `pf-cognito-signin-policy-webauthn-tier` | AWS::Cognito::UserPool | Passwordless sign-in factors need ESSENTIALS or PLUS | none |
+| `pf-cognito-sms-authentication-message-placeholder` | AWS::Cognito::UserPool | SmsAuthenticationMessage needs the {####} code placeholder | none |
+| `pf-cognito-sms-caller-arn-account` | AWS::Cognito::UserPool | The SMS caller role must be in the deploying account | none |
+| `pf-cognito-sms-configuration-sns-region` | AWS::Cognito::UserPool | SnsRegion must be the region the pool deploys to | none |
+| `pf-cognito-sms-verification-message-placeholder` | AWS::Cognito::UserPool | SmsVerificationMessage needs the {####} code placeholder | none |
+| `pf-cognito-supported-identity-providers-exists` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPoolIdentityProvider | Supported identity providers must exist on the pool | none |
+| `pf-cognito-temporary-password-validity-range` | AWS::Cognito::UserPool | TemporaryPasswordValidityDays must be between 0 and 365 | none |
 | `pf-cognito-token-expiration-order` | AWS::Cognito::UserPoolClient | Access and id tokens cannot outlive the refresh token | none |
 | `pf-cognito-token-validity-range` | AWS::Cognito::UserPoolClient | Token validity ranges depend on token type and unit | none |
+| `pf-cognito-ui-customization-css-properties` | AWS::Cognito::UserPoolUICustomizationAttachment | Hosted UI CSS only styles the -customizable classes | none |
+| `pf-cognito-ui-customization-requires-domain` | AWS::Cognito::UserPoolUICustomizationAttachment<br>AWS::Cognito::UserPoolDomain | Hosted UI customization requires a domain on the pool | none |
+| `pf-cognito-unused-account-validity-exclusive` | AWS::Cognito::UserPool | UnusedAccountValidityDays and TemporaryPasswordValidityDays are exclusive | none |
+| `pf-cognito-unused-account-validity-range` | AWS::Cognito::UserPool | UnusedAccountValidityDays must be between 0 and 365 | none |
+| `pf-cognito-user-attribute-update-requires-auto-verified` | AWS::Cognito::UserPool | Attributes requiring verification before update must be auto-verified | none |
+| `pf-cognito-user-attribute-update-settings-enum` | AWS::Cognito::UserPool | Only email and phone_number can require verification before update | none |
 | `pf-cognito-user-pool-name` | AWS::Cognito::UserPool | User pool names allow only word characters, spaces and +=,.@- | none |
+| `pf-cognito-verification-code-placeholder` | AWS::Cognito::UserPool | The verification email needs the {####} code placeholder | none |
+| `pf-cognito-verification-email-subject-length` | AWS::Cognito::UserPool | The verification email subject is capped at 140 characters | none |
+| `pf-cognito-verification-link-placeholder` | AWS::Cognito::UserPool | A link verification message needs the {##...##} placeholder | none |
+| `pf-cognito-verification-sms-placeholder` | AWS::Cognito::UserPool | The verification SMS needs the {####} code placeholder | none |
+| `pf-cognito-web-authn-relying-party-format` | AWS::Cognito::UserPool | WebAuthnRelyingPartyID is a bare domain name | none |
+| `pf-cognito-write-attributes-immutable` | AWS::Cognito::UserPoolClient | Verified-status attributes cannot be written by a client | none |
 | `pf-dynamodb-attribute-definitions-usage` | AWS::DynamoDB::Table | Every AttributeDefinitions entry must be used by a key schema | none |
 | `pf-dynamodb-attribute-type` | AWS::DynamoDB::Table | AttributeType must be S, N or B | pending-engine |
 | `pf-dynamodb-billing-throughput` | AWS::DynamoDB::Table | ProvisionedThroughput must match BillingMode (required for PROVISIONED, forbidden for PAY_PER_REQUEST) | none |
@@ -600,19 +787,167 @@
 | `pf-elasticache-user-authentication` | AWS::ElastiCache::User | A user needs exactly one authentication mode, and passwords are 16-128 characters with at most two per user | none |
 | `pf-elasticache-user-group-default-user` | AWS::ElastiCache::UserGroup | A Redis user group must contain a user named default, and a Valkey group rejects password-less users | none |
 | `pf-elasticache-user-group-transit-encryption` | AWS::ElastiCache::ReplicationGroup | UserGroupIds requires in-transit encryption | none |
+| `pf-elbv2-action-cognito-userpool-region` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | The Cognito user pool sits in the load balancer region | none |
+| `pf-elbv2-action-fixed-response-content-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A fixed response uses one of the five supported content types | none |
+| `pf-elbv2-action-forward-same-ip-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target groups in one forward action share a IP address type | none |
+| `pf-elbv2-action-forward-same-protocol` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target groups in one forward action share a protocol | none |
+| `pf-elbv2-action-forward-stickiness-duration-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target group stickiness lasts between 1 and 604800 seconds | none |
+| `pf-elbv2-action-forward-stickiness-duration-required` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Enabled target group stickiness carries a duration | none |
+| `pf-elbv2-action-forward-stickiness-tls` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A TLS listener cannot turn on target group stickiness | none |
+| `pf-elbv2-action-forward-tg-count-max` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A forward action spreads over at most five target groups | none |
+| `pf-elbv2-action-forward-tgarn-conflict` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | TargetGroupArn and ForwardConfig name the same single target group | none |
+| `pf-elbv2-action-forward-weight-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A target group weight is between 0 and 999 | none |
+| `pf-elbv2-action-forward-weight-required-multi` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Every target group of a multi-target forward action has a weight | none |
+| `pf-elbv2-action-oidc-endpoint-https` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Every OIDC endpoint is a full HTTPS URL | none |
+| `pf-elbv2-action-oidc-extra-params-max` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An authentication action carries at most ten extra parameters | none |
+| `pf-elbv2-action-oidc-on-unauthenticated-values` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | OnUnauthenticatedRequest is deny, allow or authenticate | none |
+| `pf-elbv2-action-redirect-https-to-http` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An HTTPS listener does not redirect down to HTTP | none |
+| `pf-elbv2-action-redirect-no-change` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect changes at least one part of the URI | none |
+| `pf-elbv2-action-redirect-path-leading-slash` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect path is absolute | none |
+| `pf-elbv2-action-redirect-port-value` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect port is a port number or #{port} | none |
+| `pf-elbv2-action-redirect-status-code` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect answers with HTTP_301 or HTTP_302 | none |
+| `pf-elbv2-action-session-timeout-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An authentication session lasts between 1 and 604800 seconds | none |
 | `pf-elbv2-alb-subnet-count` | AWS::ElasticLoadBalancingV2::LoadBalancer | Application load balancers need at least two subnets | none |
 | `pf-elbv2-app-cookie-name` | AWS::ElasticLoadBalancingV2::TargetGroup | app_cookie stickiness requires a cookie name | none |
 | `pf-elbv2-hc-timeout-interval` | AWS::ElasticLoadBalancingV2::TargetGroup | Health check timeout must be strictly smaller than the interval | none |
 | `pf-elbv2-lambda-target-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | Lambda target groups cannot specify Protocol | none |
+| `pf-elbv2-lb-attr-access-logs-bucket-required` | AWS::ElasticLoadBalancingV2::LoadBalancer | Enabling access logs needs the destination bucket | none |
+| `pf-elbv2-lb-attr-alb-cross-zone-immutable` | AWS::ElasticLoadBalancingV2::LoadBalancer | Cross-zone load balancing cannot be turned off on an application load balancer | none |
+| `pf-elbv2-lb-attr-alb-only-on-gwlb` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer takes only the two common attributes | none |
+| `pf-elbv2-lb-attr-boolean-value` | AWS::ElasticLoadBalancingV2::LoadBalancer | A boolean load balancer attribute takes only true or false | none |
+| `pf-elbv2-lb-attr-client-keep-alive-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | The client keep-alive duration is 60-604800 seconds | none |
+| `pf-elbv2-lb-attr-connection-logs-bucket-required` | AWS::ElasticLoadBalancingV2::LoadBalancer | Enabling connection logs needs the destination bucket | none |
+| `pf-elbv2-lb-attr-count-max` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer carries at most 20 attributes | none |
+| `pf-elbv2-lb-attr-desync-mitigation-mode` | AWS::ElasticLoadBalancingV2::LoadBalancer | Desync mitigation mode is monitor, defensive or strictest | none |
+| `pf-elbv2-lb-attr-dns-record-client-routing-policy` | AWS::ElasticLoadBalancingV2::LoadBalancer | The DNS client routing policy is one of three zonal affinity values | none |
+| `pf-elbv2-lb-attr-duplicate-key` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key appears at most once | none |
+| `pf-elbv2-lb-attr-key-known` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key must be one the service recognises | none |
+| `pf-elbv2-lb-attr-key-lb-type` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key is bound to the load balancer type | none |
+| `pf-elbv2-lb-attr-secondary-ips-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | Auto-assigned secondary IPs per subnet are 0-7 | none |
+| `pf-elbv2-lb-attr-xff-header-processing-mode` | AWS::ElasticLoadBalancingV2::LoadBalancer | X-Forwarded-For processing is append, preserve or remove | none |
+| `pf-elbv2-lb-dualstack-no-public-ipv4-alb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | dualstack-without-public-ipv4 is an application load balancer address type | none |
+| `pf-elbv2-lb-eip-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | Only a network load balancer takes Elastic IPs | none |
+| `pf-elbv2-lb-eip-with-private-ipv4` | AWS::ElasticLoadBalancingV2::LoadBalancer | One subnet mapping cannot carry both an Elastic IP and a private IPv4 address | none |
+| `pf-elbv2-lb-enforce-sg-privatelink-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | PrivateLink inbound-rule enforcement is a network load balancer setting | none |
+| `pf-elbv2-lb-enforce-sg-privatelink-requires-sg` | AWS::ElasticLoadBalancingV2::LoadBalancer | PrivateLink inbound-rule enforcement needs security groups on the load balancer | none |
+| `pf-elbv2-lb-gwlb-no-scheme` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer cannot declare a Scheme | none |
+| `pf-elbv2-lb-gwlb-no-security-groups` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer cannot carry security groups | none |
 | `pf-elbv2-lb-idle-timeout-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | ALB idle_timeout.timeout_seconds must be between 1 and 4000 | none |
+| `pf-elbv2-lb-ipv6-address-internet-facing-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | A mapped IPv6 address needs an internet-facing load balancer | none |
+| `pf-elbv2-lb-mtls-verify-listener-max` | AWS::ElasticLoadBalancingV2::LoadBalancer<br>AWS::ElasticLoadBalancingV2::Listener | A load balancer runs at most two mTLS verify listeners | none |
 | `pf-elbv2-lb-name` | AWS::ElasticLoadBalancingV2::LoadBalancer | Load balancer names are at most 32 alphanumeric/hyphen chars and cannot begin with internal- or a hyphen | none |
+| `pf-elbv2-lb-one-subnet-per-az` | AWS::ElasticLoadBalancingV2::LoadBalancer<br>AWS::EC2::Subnet | A load balancer takes at most one subnet per availability zone | none |
+| `pf-elbv2-lb-private-ipv4-internal-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | A private IPv4 address needs an internal network load balancer | none |
+| `pf-elbv2-lb-sg-vpc-match` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer security group lives in the VPC of its subnets | none |
+| `pf-elbv2-lb-source-nat-prefix-netmask` | AWS::ElasticLoadBalancingV2::LoadBalancer | A source NAT IPv6 prefix is a /80 or auto_assigned | none |
+| `pf-elbv2-lb-source-nat-prefix-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | IPv6 source NAT prefixes are a network load balancer feature | none |
+| `pf-elbv2-lb-source-nat-prefix-requires-dualstack` | AWS::ElasticLoadBalancingV2::LoadBalancer | IPv6 source NAT prefixes need a dualstack load balancer | none |
+| `pf-elbv2-listener-action-config-type-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An action config must match the action type | none |
+| `pf-elbv2-listener-action-order-required` | AWS::ElasticLoadBalancingV2::Listener | Several actions on one listener need an explicit order | none |
+| `pf-elbv2-listener-alb-target-tg-listener-protocol` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A target group of Application Load Balancers hangs off a TCP listener | none |
+| `pf-elbv2-listener-alpn-single` | AWS::ElasticLoadBalancingV2::Listener | A listener carries a single ALPN policy | none |
+| `pf-elbv2-listener-alpn-tls-only` | AWS::ElasticLoadBalancingV2::Listener | ALPN is negotiated on a TLS listener only | none |
+| `pf-elbv2-listener-alpn-values` | AWS::ElasticLoadBalancingV2::Listener | An ALPN policy is one of five named values | none |
+| `pf-elbv2-listener-attr-header-name-format` | AWS::ElasticLoadBalancingV2::Listener | A renamed request header is a valid HTTP header name | none |
+| `pf-elbv2-listener-attr-key-known` | AWS::ElasticLoadBalancingV2::Listener | A listener attribute key is one the service knows | none |
+| `pf-elbv2-listener-attr-key-lb-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A listener attribute belongs to the load balancer type it is set on | none |
+| `pf-elbv2-listener-attr-server-enabled-value` | AWS::ElasticLoadBalancingV2::Listener | The response server header switch is true or false | none |
+| `pf-elbv2-listener-attr-tcp-idle-timeout-range` | AWS::ElasticLoadBalancingV2::Listener | The TCP idle timeout runs from 60 to 6000 seconds | none |
+| `pf-elbv2-listener-attr-x-content-type-options-value` | AWS::ElasticLoadBalancingV2::Listener | X-Content-Type-Options is nosniff | none |
+| `pf-elbv2-listener-attr-x-frame-options-value` | AWS::ElasticLoadBalancingV2::Listener | X-Frame-Options is DENY or SAMEORIGIN | none |
+| `pf-elbv2-listener-auth-action-https-only` | AWS::ElasticLoadBalancingV2::Listener | Authentication actions need an HTTPS listener | none |
+| `pf-elbv2-listener-cert-exactly-one` | AWS::ElasticLoadBalancingV2::Listener | A listener declares a single default certificate | none |
+| `pf-elbv2-listener-cert-insecure-protocol` | AWS::ElasticLoadBalancingV2::Listener | Only an HTTPS or TLS listener takes a certificate | none |
+| `pf-elbv2-listener-cert-not-acm-or-iam` | AWS::ElasticLoadBalancingV2::Listener | A listener certificate comes from ACM or IAM | none |
+| `pf-elbv2-listener-cert-region` | AWS::ElasticLoadBalancingV2::Listener | A listener certificate lives in the load balancer region | none |
+| `pf-elbv2-listener-certificate-region` | AWS::ElasticLoadBalancingV2::ListenerCertificate | An extra certificate lives in the load balancer region | none |
+| `pf-elbv2-listener-certificate-secure-listener` | AWS::ElasticLoadBalancingV2::ListenerCertificate<br>AWS::ElasticLoadBalancingV2::Listener | Extra certificates go on an HTTPS or TLS listener | none |
+| `pf-elbv2-listener-default-action-routing-last` | AWS::ElasticLoadBalancingV2::Listener | The last default action routes the request | none |
+| `pf-elbv2-listener-mtls-advertise-verify-only` | AWS::ElasticLoadBalancingV2::Listener | Advertising trust store CA names only applies to verify mode | none |
+| `pf-elbv2-listener-mtls-https-only` | AWS::ElasticLoadBalancingV2::Listener | Mutual authentication is an HTTPS listener feature | none |
+| `pf-elbv2-listener-mtls-ignore-expiry-verify-only` | AWS::ElasticLoadBalancingV2::Listener | Ignoring certificate expiry only applies to verify mode | none |
+| `pf-elbv2-listener-mtls-mode-values` | AWS::ElasticLoadBalancingV2::Listener | The mutual authentication mode is off, passthrough or verify | none |
+| `pf-elbv2-listener-mtls-truststore-region` | AWS::ElasticLoadBalancingV2::Listener | A trust store lives in the load balancer region | none |
+| `pf-elbv2-listener-mtls-truststore-required` | AWS::ElasticLoadBalancingV2::Listener | Verify mode needs a trust store | none |
+| `pf-elbv2-listener-mtls-truststore-verify-only` | AWS::ElasticLoadBalancingV2::Listener | A trust store only belongs to verify mode | none |
+| `pf-elbv2-listener-nlb-action-forward-only` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A network or gateway load balancer listener only forwards | none |
+| `pf-elbv2-listener-port-required` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A listener needs a port unless it is on a gateway load balancer | none |
 | `pf-elbv2-listener-protocol-lb-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | Listener protocols must match the load balancer type | none |
+| `pf-elbv2-listener-sslpolicy-known` | AWS::ElasticLoadBalancingV2::Listener | A security policy name must be one the service predefines | none |
+| `pf-elbv2-listener-sslpolicy-secure-only` | AWS::ElasticLoadBalancingV2::Listener | A security policy belongs to an HTTPS or TLS listener | none |
+| `pf-elbv2-listener-tg-protocol-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A listener forwards to a target group of a compatible protocol | none |
+| `pf-elbv2-listener-tg-vpc-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A target group lives in the VPC of the load balancer | none |
+| `pf-elbv2-listener-udp-dualstack` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A dualstack network load balancer takes no UDP listener | none |
+| `pf-elbv2-rule-actions-exactly-one-routing` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule ends on exactly one routing action | none |
+| `pf-elbv2-rule-condition-duplicate-field` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule uses each single-valued condition field once | none |
+| `pf-elbv2-rule-condition-empty-values` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition matches at least one value | none |
+| `pf-elbv2-rule-condition-field-config-match` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition carries the config that belongs to its field | none |
+| `pf-elbv2-rule-condition-field-values` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition uses one of the six condition fields | none |
+| `pf-elbv2-rule-condition-values-max` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule matches at most five condition values | none |
+| `pf-elbv2-rule-conditions-required` | AWS::ElasticLoadBalancingV2::ListenerRule | A listener rule has at least one condition | none |
+| `pf-elbv2-rule-host-header-format` | AWS::ElasticLoadBalancingV2::ListenerRule | A host-header value is a host name | none |
+| `pf-elbv2-rule-http-header-name-length` | AWS::ElasticLoadBalancingV2::ListenerRule | An http-header condition names a header of at most 40 characters | none |
+| `pf-elbv2-rule-http-header-not-host` | AWS::ElasticLoadBalancingV2::ListenerRule | The Host header is matched by a host-header condition | none |
+| `pf-elbv2-rule-http-method-charset` | AWS::ElasticLoadBalancingV2::ListenerRule | An HTTP method condition is written in upper case | none |
 | `pf-elbv2-rule-priority-unique` | AWS::ElasticLoadBalancingV2::ListenerRule | Listener rules on the same listener must have distinct priorities | none |
+| `pf-elbv2-rule-regex-and-values-exclusive` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition matches either literals or a regex | none |
+| `pf-elbv2-rule-regex-values-fields` | AWS::ElasticLoadBalancingV2::ListenerRule | Only three condition fields take a regular expression | none |
+| `pf-elbv2-rule-source-ip-cidr` | AWS::ElasticLoadBalancingV2::ListenerRule | A source-ip condition takes CIDR blocks | none |
+| `pf-elbv2-rule-value-length-128` | AWS::ElasticLoadBalancingV2::ListenerRule | A condition value is at most 128 characters | none |
 | `pf-elbv2-stickiness-type-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | Stickiness type lb_cookie needs an HTTP-protocol target group, source_ip a TCP one | none |
 | `pf-elbv2-tcp-health-check-path` | AWS::ElasticLoadBalancingV2::TargetGroup | TCP health checks cannot take a health check path | none |
+| `pf-elbv2-tg-alb-single-target` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group of type alb holds a single load balancer | none |
+| `pf-elbv2-tg-alb-target-type-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group of Application Load Balancers speaks TCP | none |
+| `pf-elbv2-tg-attr-algorithm-type` | AWS::ElasticLoadBalancingV2::TargetGroup | The load balancing algorithm is one of three named values | none |
+| `pf-elbv2-tg-attr-anomaly-mitigation-requires-weighted-random` | AWS::ElasticLoadBalancingV2::TargetGroup | Anomaly mitigation needs the weighted random algorithm | none |
+| `pf-elbv2-tg-attr-anomaly-mitigation-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Anomaly mitigation is on or off | none |
+| `pf-elbv2-tg-attr-app-cookie-duration-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Application cookie stickiness lasts 1-604800 seconds | none |
+| `pf-elbv2-tg-attr-boolean-value` | AWS::ElasticLoadBalancingV2::TargetGroup | A boolean target group attribute takes only true or false | none |
+| `pf-elbv2-tg-attr-cross-zone-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group cross-zone load balancing takes a third value | none |
+| `pf-elbv2-tg-attr-dereg-delay-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group has no deregistration delay | none |
+| `pf-elbv2-tg-attr-dns-failover-threshold-order` | AWS::ElasticLoadBalancingV2::TargetGroup | The DNS failover threshold is at least the unhealthy-state routing threshold | none |
+| `pf-elbv2-tg-attr-draining-interval-requires-termination-off` | AWS::ElasticLoadBalancingV2::TargetGroup | An unhealthy draining interval needs connection termination off | none |
+| `pf-elbv2-tg-attr-duplicate-key` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key appears at most once | none |
+| `pf-elbv2-tg-attr-health-count-value` | AWS::ElasticLoadBalancingV2::TargetGroup | A minimum healthy target count is off or a positive integer | none |
+| `pf-elbv2-tg-attr-health-percentage-range` | AWS::ElasticLoadBalancingV2::TargetGroup | A minimum healthy target percentage is off or 1-100 | none |
+| `pf-elbv2-tg-attr-key-known` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key must be one the service recognises | none |
+| `pf-elbv2-tg-attr-key-protocol-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key is bound to the target group protocol | none |
+| `pf-elbv2-tg-attr-lambda-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | Multi-value headers are a Lambda target group setting | none |
+| `pf-elbv2-tg-attr-lb-cookie-duration-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Load balancer cookie stickiness lasts 1-604800 seconds | none |
+| `pf-elbv2-tg-attr-preserve-client-ip-udp` | AWS::ElasticLoadBalancingV2::TargetGroup | Client IP preservation cannot be turned off for UDP target groups | none |
+| `pf-elbv2-tg-attr-send-tcp-reset-gwlb-only` | AWS::ElasticLoadBalancingV2::TargetGroup | TCP reset attributes belong to a GENEVE target group | none |
+| `pf-elbv2-tg-attr-slow-start-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | Slow start needs an HTTP target group of instances or IPs | none |
+| `pf-elbv2-tg-attr-stickiness-type-gwlb` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group sticks on the IP tuple | none |
+| `pf-elbv2-tg-attr-target-failover-pair-equal` | AWS::ElasticLoadBalancingV2::TargetGroup | The two target failover attributes must agree | none |
+| `pf-elbv2-tg-attr-target-failover-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Target failover is rebalance or no_rebalance | none |
+| `pf-elbv2-tg-attr-unhealthy-draining-interval-range` | AWS::ElasticLoadBalancingV2::TargetGroup | The unhealthy draining interval is 0-360000 seconds | none |
 | `pf-elbv2-tg-deregistration-delay-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group deregistration_delay.timeout_seconds must be between 0 and 3600 | none |
+| `pf-elbv2-tg-geneve-port` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group listens on port 6081 | none |
+| `pf-elbv2-tg-hc-enabled-required` | AWS::ElasticLoadBalancingV2::TargetGroup | Health checks can only be turned off for a Lambda target group | none |
+| `pf-elbv2-tg-hc-port-format` | AWS::ElasticLoadBalancingV2::TargetGroup | The health check port is traffic-port or a port number | none |
+| `pf-elbv2-tg-hc-protocol-unsupported` | AWS::ElasticLoadBalancingV2::TargetGroup | Health checks run over HTTP, HTTPS or TCP only | none |
+| `pf-elbv2-tg-hc-tcp-for-http-tg` | AWS::ElasticLoadBalancingV2::TargetGroup | An HTTP or HTTPS target group is health checked over HTTP or HTTPS | none |
+| `pf-elbv2-tg-ipv6-with-ipv4-lb` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | An IPv6 target group needs a dualstack load balancer | none |
+| `pf-elbv2-tg-ipv6-with-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group has no IPv6 address type | none |
+| `pf-elbv2-tg-ipv6-with-quic` | AWS::ElasticLoadBalancingV2::TargetGroup | QUIC target groups are IPv4 | none |
+| `pf-elbv2-tg-lambda-no-port` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group cannot declare a Port | none |
+| `pf-elbv2-tg-lambda-no-vpc` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group cannot declare a VpcId | none |
+| `pf-elbv2-tg-lambda-single-target` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group holds a single function | none |
+| `pf-elbv2-tg-matcher-grpc-range` | AWS::ElasticLoadBalancingV2::TargetGroup | gRPC status codes run from 0 to 99 | none |
+| `pf-elbv2-tg-matcher-grpc-requires-grpc` | AWS::ElasticLoadBalancingV2::TargetGroup | A gRPC matcher needs ProtocolVersion GRPC | none |
+| `pf-elbv2-tg-matcher-range-alb` | AWS::ElasticLoadBalancingV2::TargetGroup | HTTP success codes run from 200 to 499 | none |
+| `pf-elbv2-tg-matcher-range-geneve` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group accepts success codes 200 to 399 | none |
 | `pf-elbv2-tg-name` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group names are at most 32 alphanumeric/hyphen chars and cannot start or end with a hyphen | none |
+| `pf-elbv2-tg-protocol-required-non-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A non-Lambda target group needs Protocol and Port | none |
+| `pf-elbv2-tg-protocol-version-http-only` | AWS::ElasticLoadBalancingV2::TargetGroup | ProtocolVersion belongs to an HTTP or HTTPS target group | none |
+| `pf-elbv2-tg-protocol-version-values` | AWS::ElasticLoadBalancingV2::TargetGroup | ProtocolVersion is GRPC, HTTP1 or HTTP2 | none |
+| `pf-elbv2-tg-single-load-balancer` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group belongs to one load balancer | none |
 | `pf-elbv2-tg-slow-start-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group slow_start.duration_seconds must be 0 or between 30 and 900 | none |
+| `pf-elbv2-tg-target-control-port-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | TargetControlPort needs an HTTP target group of instances or IPs | none |
+| `pf-elbv2-tg-target-ip-not-public` | AWS::ElasticLoadBalancingV2::TargetGroup | IP targets are private addresses | none |
+| `pf-elbv2-tg-vpc-required-non-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A non-Lambda target group needs a VpcId | none |
+| `pf-elbv2-truststore-bundle-key-requires-bucket` | AWS::ElasticLoadBalancingV2::TrustStore | A CA bundle needs both its bucket and its key | none |
+| `pf-elbv2-truststore-revocation-content-required` | AWS::ElasticLoadBalancingV2::TrustStoreRevocation | A trust store revocation carries a revocation list | none |
 | `pf-events-apidestination-endpoint` | AWS::Events::ApiDestination | An API destination needs an HTTPS endpoint and a same-Region connection | none |
 | `pf-events-archive-source` | AWS::Events::Archive | An archive source must be an event bus in the archive's Region | none |
 | `pf-events-bus-dlq-arn-type` | AWS::Events::EventBus | An event bus dead-letter queue must be an SQS queue | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.80" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.82" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */