cdk-preflight 0.0.83 → 0.0.85

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/.jsii +3 -3
  2. package/AGENTS.md +2 -0
  3. package/README.md +7 -1
  4. package/docs/rules.md +1637 -1540
  5. package/lib/index.js +1 -1
  6. package/lib/private/enforce.d.ts +5 -0
  7. package/lib/private/enforce.js +81 -11
  8. package/lib/rules.generated.js +1104 -30
  9. package/package.json +1 -1
package/docs/rules.md CHANGED
@@ -2,1543 +2,1640 @@
2
2
 
3
3
  <!-- Generated by scripts/bundle-rules.ts. Do not edit by hand. -->
4
4
 
5
- | Rule | Resource types | Constraint | Upstream status |
6
- |---|---|---|---|
7
- | `pf-apigw-access-log-format-request-id` | AWS::ApiGateway::Stage | Access log format must include a request id variable | none |
8
- | `pf-apigw-api-key-value-length` | AWS::ApiGateway::ApiKey | An API key value is at least 20 characters | none |
9
- | `pf-apigw-authorizer-ttl-range` | AWS::ApiGateway::Authorizer | AuthorizerResultTtlInSeconds tops out at 3600 | none |
10
- | `pf-apigw-authorizer-uri-format` | AWS::ApiGateway::Authorizer | An authorizer URI is an API Gateway invocation ARN | none |
11
- | `pf-apigw-cognito-authorizer-provider-arns` | AWS::ApiGateway::Authorizer | COGNITO_USER_POOLS authorizers need ProviderARNs | none |
12
- | `pf-apigw-deployment-no-methods` | AWS::ApiGateway::Deployment | A Deployment needs at least one Method on its REST API | none |
13
- | `pf-apigw-documentation-part-location` | AWS::ApiGateway::DocumentationPart | An API-level documentation part takes no path, method, status or name | none |
14
- | `pf-apigw-edge-certificate-property` | AWS::ApiGateway::DomainName | EDGE domain names read CertificateArn, not RegionalCertificateArn | none |
15
- | `pf-apigw-endpoint-configuration-single-type` | AWS::ApiGateway::RestApi | An API has exactly one endpoint type | none |
16
- | `pf-apigw-gateway-response-status-code` | AWS::ApiGateway::GatewayResponse | A gateway response status code is three digits | none |
17
- | `pf-apigw-integration-aws-uri` | AWS::ApiGateway::Method | An AWS integration URI is an API Gateway ARN, not the target's ARN | none |
18
- | `pf-apigw-integration-cache-key-parameters` | AWS::ApiGateway::Method | Cache key parameters must be declared method request parameters | none |
19
- | `pf-apigw-integration-credentials-arn` | AWS::ApiGateway::Method | Integration credentials must be an ARN | none |
20
- | `pf-apigw-integration-http-method` | AWS::ApiGateway::Method | Non-MOCK integrations need IntegrationHttpMethod | none |
21
- | `pf-apigw-integration-http-uri` | AWS::ApiGateway::Method | An HTTP integration URI is an http(s) URL | none |
22
- | `pf-apigw-integration-request-parameter-value` | AWS::ApiGateway::Method | Static integration request parameters must be single-quoted | none |
23
- | `pf-apigw-integration-response-selection-pattern` | AWS::ApiGateway::Method | SelectionPattern must be a valid regular expression | none |
24
- | `pf-apigw-integration-timeout-range` | AWS::ApiGateway::Method | REST integration timeouts are 50-29000 ms | none |
25
- | `pf-apigw-integration-vpc-link-connection-id` | AWS::ApiGateway::Method | A VPC_LINK integration needs a ConnectionId | none |
26
- | `pf-apigw-method-authorization-scopes-cognito` | AWS::ApiGateway::Method | AuthorizationScopes needs COGNITO_USER_POOLS authorization | none |
27
- | `pf-apigw-method-authorizer-id` | AWS::ApiGateway::Method | CUSTOM and COGNITO_USER_POOLS authorization need AuthorizerId | none |
28
- | `pf-apigw-method-http-verb` | AWS::ApiGateway::Method | HttpMethod is one of the eight API Gateway verbs | none |
29
- | `pf-apigw-method-request-parameter-key` | AWS::ApiGateway::Method | Method request parameter keys are mapping expressions | none |
30
- | `pf-apigw-minimum-compression-size-range` | AWS::ApiGateway::RestApi | MinimumCompressionSize is 0-10485760 | none |
31
- | `pf-apigw-model-content-type` | AWS::ApiGateway::Model | A model content type is a media type | none |
32
- | `pf-apigw-model-name-alphanumeric` | AWS::ApiGateway::Model | Model names are alphanumeric | none |
33
- | `pf-apigw-model-schema-type` | AWS::ApiGateway::Model | Model schema 'type' must be a JSON Schema draft-4 type | none |
34
- | `pf-apigw-mutual-tls-security-policy` | AWS::ApiGateway::DomainName | Mutual TLS requires SecurityPolicy TLS_1_2 | none |
35
- | `pf-apigw-regional-certificate-property` | AWS::ApiGateway::DomainName | REGIONAL domain names read RegionalCertificateArn, not CertificateArn | none |
36
- | `pf-apigw-regional-certificate-region` | AWS::ApiGateway::DomainName | A REGIONAL domain name needs a certificate from the deployment region | none |
37
- | `pf-apigw-request-authorizer-identity-source` | AWS::ApiGateway::Authorizer | REQUEST authorizer identity sources are mapping expressions | none |
38
- | `pf-apigw-resource-path-part` | AWS::ApiGateway::Resource | PathPart allows a-zA-Z0-9._-: or one curly-brace variable | none |
39
- | `pf-apigw-rest-api-policy-document` | AWS::ApiGateway::RestApi | A REST API policy must be a policy document | none |
40
- | `pf-apigw-stage-access-log-destination-arn` | AWS::ApiGateway::Stage | Access logs go to CloudWatch Logs or Firehose only | none |
41
- | `pf-apigw-stage-access-log-firehose-prefix` | AWS::ApiGateway::Stage | An access log delivery stream is named amazon-apigateway-* | none |
42
- | `pf-apigw-stage-cache-ttl-range` | AWS::ApiGateway::Stage | Method setting cache TTL tops out at 3600 seconds | none |
43
- | `pf-apigw-stage-method-setting-http-method` | AWS::ApiGateway::Stage | Method setting HttpMethod is a verb or * | none |
44
- | `pf-apigw-stage-method-setting-resource-path` | AWS::ApiGateway::Stage | Method setting paths start with / and encode slashes as ~1 | none |
45
- | `pf-apigw-stage-name-charset` | AWS::ApiGateway::Stage | Stage names allow only a-zA-Z0-9_ | none |
46
- | `pf-apigw-stage-variable-name` | AWS::ApiGateway::Stage | Stage variable names allow only word characters | none |
47
- | `pf-apigw-stage-variable-value` | AWS::ApiGateway::Stage | Stage variable values have a restricted character set | none |
48
- | `pf-apigw-token-authorizer-identity-source` | AWS::ApiGateway::Authorizer | TOKEN authorizers need IdentitySource | none |
49
- | `pf-apigw-usage-plan-api-stage-exists` | AWS::ApiGateway::UsagePlan | A usage plan references a stage the template creates | none |
50
- | `pf-apigw-usage-plan-quota-limit` | AWS::ApiGateway::UsagePlan | A usage plan quota limit is 1 or more | none |
51
- | `pf-apigw-usage-plan-quota-offset-range` | AWS::ApiGateway::UsagePlan | The quota offset ceiling depends on the quota period | none |
52
- | `pf-apigw-usage-plan-quota-period-required` | AWS::ApiGateway::UsagePlan | A usage plan quota needs a period | none |
53
- | `pf-apigw-usage-plan-throttle-key` | AWS::ApiGateway::UsagePlan | Per-method throttle keys are {resourcePath}/{httpMethod} | none |
54
- | `pf-apigw-vpc-endpoint-ids-private-only` | AWS::ApiGateway::RestApi | VpcEndpointIds belongs to PRIVATE APIs only | none |
55
- | `pf-apigw-vpc-link-single-target` | AWS::ApiGateway::VpcLink | A VPC link takes exactly one target load balancer | none |
56
- | `pf-apigwv2-access-log-destination-log-group` | AWS::ApiGatewayV2::Stage | HTTP/WebSocket access logs go to CloudWatch Logs only | none |
57
- | `pf-apigwv2-access-log-format-request-id` | AWS::ApiGatewayV2::Stage | An access log format must carry a request id | none |
58
- | `pf-apigwv2-api-name-required` | AWS::ApiGatewayV2::Api | An Api needs a Name unless an OpenAPI body provides one | none |
59
- | `pf-apigwv2-authorizer-ttl-identity-source` | AWS::ApiGatewayV2::Authorizer | Authorizer caching needs an identity source | none |
60
- | `pf-apigwv2-authorizer-ttl-range` | AWS::ApiGatewayV2::Authorizer | Authorizer result TTL tops out at 3600 seconds | none |
61
- | `pf-apigwv2-aws-proxy-payload-version` | AWS::ApiGatewayV2::Integration | AWS_PROXY integrations take PayloadFormatVersion 1.0 or 2.0 | none |
62
- | `pf-apigwv2-cors-credentials-wildcard` | AWS::ApiGatewayV2::Api | CORS AllowCredentials cannot pair with a wildcard origin | none |
63
- | `pf-apigwv2-domain-certificate-region` | AWS::ApiGatewayV2::DomainName | A custom domain needs a certificate from the deployment region | none |
64
- | `pf-apigwv2-domain-endpoint-type-regional` | AWS::ApiGatewayV2::DomainName | HTTP/WebSocket custom domains are REGIONAL only | none |
65
- | `pf-apigwv2-domain-name-charset` | AWS::ApiGatewayV2::DomainName | Custom domain names are lower case | none |
66
- | `pf-apigwv2-http-identity-source-expression` | AWS::ApiGatewayV2::Authorizer | HTTP API identity sources are $-prefixed selection expressions | none |
67
- | `pf-apigwv2-http-proxy-integration-method` | AWS::ApiGatewayV2::Integration | An HTTP_PROXY integration needs an IntegrationMethod | none |
68
- | `pf-apigwv2-http-proxy-payload-version` | AWS::ApiGatewayV2::Integration | HTTP_PROXY integrations only take PayloadFormatVersion 1.0 | none |
69
- | `pf-apigwv2-http-route-key` | AWS::ApiGatewayV2::Route | HTTP API route keys are "METHOD /path" or $default | none |
70
- | `pf-apigwv2-http-route-no-api-key` | AWS::ApiGatewayV2::Route | ApiKeyRequired is not supported on HTTP APIs | none |
71
- | `pf-apigwv2-http-route-selection` | AWS::ApiGatewayV2::Api | HTTP APIs accept only the method-path route selection expression | none |
72
- | `pf-apigwv2-integration-response-websocket-only` | AWS::ApiGatewayV2::IntegrationResponse | Integration responses exist on WebSocket APIs only | none |
73
- | `pf-apigwv2-integration-subtype-credentials` | AWS::ApiGatewayV2::Integration | A subtype integration needs a CredentialsArn | none |
74
- | `pf-apigwv2-integration-subtype-known` | AWS::ApiGatewayV2::Integration | IntegrationSubtype is one of the ten AWS service subtypes | none |
75
- | `pf-apigwv2-integration-subtype-payload-version` | AWS::ApiGatewayV2::Integration | Subtype integrations are payload format 1.0 only | none |
76
- | `pf-apigwv2-integration-subtype-required-parameters` | AWS::ApiGatewayV2::Integration | Each integration subtype has mandatory request parameters | none |
77
- | `pf-apigwv2-integration-timeout-range` | AWS::ApiGatewayV2::Integration | HTTP API integration timeouts are 50-30000 ms | none |
78
- | `pf-apigwv2-integration-vpc-link-connection-id` | AWS::ApiGatewayV2::Integration | A VPC_LINK integration needs a ConnectionId | none |
79
- | `pf-apigwv2-jwt-audience-required` | AWS::ApiGatewayV2::Authorizer | A JWT authorizer needs at least one audience | none |
80
- | `pf-apigwv2-jwt-authorizer-config` | AWS::ApiGatewayV2::Authorizer | JWT authorizers need JwtConfiguration | none |
81
- | `pf-apigwv2-jwt-issuer-https` | AWS::ApiGatewayV2::Authorizer | A JWT issuer is an https URL | none |
82
- | `pf-apigwv2-model-name-alphanumeric` | AWS::ApiGatewayV2::Model | Model names are alphanumeric | none |
83
- | `pf-apigwv2-model-websocket-only` | AWS::ApiGatewayV2::Model | Models exist on WebSocket APIs only | none |
84
- | `pf-apigwv2-request-authorizer-payload-version` | AWS::ApiGatewayV2::Authorizer | REQUEST authorizers on HTTP APIs need AuthorizerPayloadFormatVersion | none |
85
- | `pf-apigwv2-request-authorizer-uri-required` | AWS::ApiGatewayV2::Authorizer | A REQUEST authorizer needs an AuthorizerUri | none |
86
- | `pf-apigwv2-request-parameter-action` | AWS::ApiGatewayV2::Integration | Request parameter keys are <action>:<header|querystring|path>.<name> | none |
87
- | `pf-apigwv2-response-parameter-action` | AWS::ApiGatewayV2::Integration | Response parameter keys are <action>:<header.name|statuscode> | none |
88
- | `pf-apigwv2-response-parameter-status-code` | AWS::ApiGatewayV2::Integration | Response parameter mappings are keyed by a 200-599 status | none |
89
- | `pf-apigwv2-route-authorization-scopes-jwt` | AWS::ApiGatewayV2::Route | AuthorizationScopes needs JWT authorization | none |
90
- | `pf-apigwv2-route-jwt-authorizer-id` | AWS::ApiGatewayV2::Route | JWT authorization needs an AuthorizerId | none |
91
- | `pf-apigwv2-route-response-key-default` | AWS::ApiGatewayV2::RouteResponse | RouteResponseKey is $default | none |
92
- | `pf-apigwv2-route-response-websocket-only` | AWS::ApiGatewayV2::RouteResponse | Route responses exist on WebSocket APIs only | none |
93
- | `pf-apigwv2-route-target-format` | AWS::ApiGatewayV2::Route | A route target is integrations/<integration id> | none |
94
- | `pf-apigwv2-simple-responses-payload-version` | AWS::ApiGatewayV2::Authorizer | EnableSimpleResponses needs payload format 2.0 | none |
95
- | `pf-apigwv2-stage-name-charset` | AWS::ApiGatewayV2::Stage | Stage names allow only a-zA-Z0-9_ (or $default) | none |
96
- | `pf-apigwv2-stage-route-settings-key` | AWS::ApiGatewayV2::Stage | RouteSettings is keyed by an existing route key | none |
97
- | `pf-apigwv2-vpc-link-integration-uri` | AWS::ApiGatewayV2::Integration | A VPC link integration points at a listener, not a load balancer | none |
98
- | `pf-apigwv2-vpc-link-subnets-required` | AWS::ApiGatewayV2::VpcLink | A VPC link needs at least one subnet | none |
99
- | `pf-apigwv2-websocket-authorization-connect-only` | AWS::ApiGatewayV2::Route | WebSocket authorization is restricted to $connect | none |
100
- | `pf-apigwv2-websocket-authorizer-type` | AWS::ApiGatewayV2::Authorizer | WebSocket APIs only take REQUEST authorizers | none |
101
- | `pf-apigwv2-websocket-identity-source-expression` | AWS::ApiGatewayV2::Authorizer | WebSocket identity sources use route.request.* | none |
102
- | `pf-apigwv2-websocket-integration-timeout-range` | AWS::ApiGatewayV2::Integration | WebSocket integration timeouts are 50-29000 ms | none |
103
- | `pf-apigwv2-websocket-no-cors` | AWS::ApiGatewayV2::Api | WebSocket APIs take no CORS configuration | none |
104
- | `pf-apigwv2-websocket-payload-version` | AWS::ApiGatewayV2::Integration | WebSocket AWS_PROXY integrations reject payload format 2.0 | none |
105
- | `pf-apigwv2-websocket-route-selection` | AWS::ApiGatewayV2::Api | WebSocket APIs need RouteSelectionExpression | none |
106
- | `pf-asg-cooldown-non-negative` | AWS::AutoScaling::AutoScalingGroup | Cooldown cannot be negative | none |
107
- | `pf-asg-desired-capacity-range` | AWS::AutoScaling::AutoScalingGroup | DesiredCapacity must sit between MinSize and MaxSize | none |
108
- | `pf-asg-health-check-grace-period` | AWS::AutoScaling::AutoScalingGroup | HealthCheckGracePeriod cannot be negative | none |
109
- | `pf-asg-ondemand-percentage-max` | AWS::AutoScaling::AutoScalingGroup | OnDemandPercentageAboveBaseCapacity tops out at 100 | none |
110
- | `pf-asg-target-value-positive` | AWS::AutoScaling::ScalingPolicy | Target tracking needs a positive TargetValue | none |
111
- | `pf-asg-zone-or-subnet-required` | AWS::AutoScaling::AutoScalingGroup | A group needs AvailabilityZones, AvailabilityZoneIds, or subnets | none |
112
- | `pf-batch-ce-name` | AWS::Batch::ComputeEnvironment | Compute environment names allow only letters, numbers, hyphen and underscore | none |
113
- | `pf-batch-ce-vcpus-order` | AWS::Batch::ComputeEnvironment | MaxvCpus must be at least MinvCpus | none |
114
- | `pf-batch-fargate-ce-fields` | AWS::Batch::ComputeEnvironment | Fargate compute environments cannot take AllocationStrategy or InstanceTypes | none |
115
- | `pf-batch-fargate-cpu-memory` | AWS::Batch::JobDefinition | Fargate job definitions must use a supported vCPU/memory combination | none |
116
- | `pf-batch-fargate-execution-role` | AWS::Batch::JobDefinition | Fargate job definitions require ExecutionRoleArn | none |
117
- | `pf-batch-fargate-multinode` | AWS::Batch::JobDefinition | Multi-node parallel jobs are not supported on Fargate | none |
118
- | `pf-batch-jd-name` | AWS::Batch::JobDefinition | Job definition names allow only letters, numbers, hyphen and underscore | none |
119
- | `pf-batch-managed-compute-resources` | AWS::Batch::ComputeEnvironment | MANAGED compute environments require ComputeResources | none |
120
- | `pf-batch-queue-order-required` | AWS::Batch::JobQueue | ComputeEnvironmentOrder may not be empty | none |
121
- | `pf-batch-retry-attempts` | AWS::Batch::JobDefinition | RetryStrategy.Attempts may not exceed 10 | none |
122
- | `pf-batch-timeout-minimum` | AWS::Batch::JobDefinition | Timeout.AttemptDurationSeconds must be at least 60 | none |
123
- | `pf-batch-unmanaged-fargate` | AWS::Batch::ComputeEnvironment | UNMANAGED compute environments cannot be Fargate | none |
124
- | `pf-bedrock-automated-reasoning-policy-names-unique` | AWS::Bedrock::AutomatedReasoningPolicy | Names and ids inside a policy definition must be unique | none |
125
- | `pf-bedrock-automated-reasoning-policy-variable-type` | AWS::Bedrock::AutomatedReasoningPolicy | Policy variables must use a type declared in PolicyDefinition.Types | none |
126
- | `pf-bedrock-automated-reasoning-policy-version` | AWS::Bedrock::AutomatedReasoningPolicy | PolicyDefinition.Version must be 1.0 | none |
127
- | `pf-bedrock-bda-blueprint-schema` | AWS::Bedrock::Blueprint | A blueprint schema needs class, description and properties | none |
128
- | `pf-bedrock-bda-project-blueprint-region` | AWS::Bedrock::DataAutomationProject | Blueprints must live in the project's Region | none |
129
- | `pf-bedrock-bda-project-blueprint-stage` | AWS::Bedrock::DataAutomationProject<br>AWS::Bedrock::Blueprint | Blueprint references must name a stage or version the blueprint has | none |
130
- | `pf-bedrock-bda-project-blueprints-unique` | AWS::Bedrock::DataAutomationProject<br>AWS::Bedrock::Blueprint | A project must not attach the same blueprint twice | none |
131
- | `pf-bedrock-bda-project-modality-routing` | AWS::Bedrock::DataAutomationProject | Modality routing overrides must fit the file type | none |
132
- | `pf-bedrock-bda-project-output-types` | AWS::Bedrock::DataAutomationProject | Document granularity and text-format type lists must not be empty | none |
133
- | `pf-bedrock-bda-project-standard-output-required` | AWS::Bedrock::DataAutomationProject | A Data Automation project needs StandardOutputConfiguration | none |
134
- | `pf-bedrock-bda-project-sync-modalities` | AWS::Bedrock::DataAutomationProject | A SYNC project cannot configure audio or video standard output | none |
135
- | `pf-bedrock-bda-project-transcript-configuration` | AWS::Bedrock::DataAutomationProject | Audio transcript settings need TRANSCRIPT among the extraction types | none |
136
- | `pf-bedrock-datasource-chunk-max-tokens` | AWS::Bedrock::DataSource | Fixed-size and semantic chunks are limited to 8192 tokens | none |
137
- | `pf-bedrock-datasource-chunk-tokens-embedding-limit` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Chunk size must not exceed the embedding model's token limit | none |
138
- | `pf-bedrock-datasource-chunking-configuration` | AWS::Bedrock::DataSource | ChunkingStrategy needs its matching configuration block | none |
139
- | `pf-bedrock-datasource-context-enrichment-neptune` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Context enrichment is only available on Neptune Analytics knowledge bases | none |
140
- | `pf-bedrock-datasource-hierarchical-levels` | AWS::Bedrock::DataSource | Hierarchical chunking levels must descend and OverlapTokens must stay below the child size | none |
141
- | `pf-bedrock-datasource-multimodal-supplemental-storage` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Multimodal parsing needs supplemental data storage on the knowledge base | none |
142
- | `pf-bedrock-datasource-parsing-configuration` | AWS::Bedrock::DataSource | BEDROCK_FOUNDATION_MODEL parsing needs BedrockFoundationModelConfiguration | none |
143
- | `pf-bedrock-datasource-parsing-model-region` | AWS::Bedrock::DataSource | The parsing model must be reachable from the data source's Region | none |
144
- | `pf-bedrock-datasource-supplemental-bucket-overlap` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | A data source must not share its bucket with the knowledge base's supplemental storage unless it has an inclusion prefix | none |
145
- | `pf-bedrock-datasource-transformation-bucket` | AWS::Bedrock::DataSource | Custom transformation intermediate storage must not use the data source bucket | none |
146
- | `pf-bedrock-datasource-type-configuration` | AWS::Bedrock::DataSource | DataSourceConfiguration.Type needs its matching configuration block | none |
147
- | `pf-bedrock-datasource-web-vector-store` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | A web crawler data source needs an OpenSearch Serverless knowledge base | none |
148
- | `pf-bedrock-flow-condition-default` | AWS::Bedrock::Flow | A Condition node needs a default condition | none |
149
- | `pf-bedrock-flow-condition-unique` | AWS::Bedrock::Flow | Conditions within a Condition node need unique names and expressions | none |
150
- | `pf-bedrock-flow-connection-condition` | AWS::Bedrock::Flow | A Conditional connection must leave a Condition node through one of its conditions | none |
151
- | `pf-bedrock-flow-connection-name-unique` | AWS::Bedrock::Flow | Flow connection names must be unique | none |
152
- | `pf-bedrock-flow-connection-nodes` | AWS::Bedrock::Flow | Flow connections must reference nodes that exist | none |
153
- | `pf-bedrock-flow-connection-ports` | AWS::Bedrock::Flow | Data connections must use outputs and inputs the nodes declare | none |
154
- | `pf-bedrock-flow-definition-source` | AWS::Bedrock::Flow | A flow takes exactly one of Definition, DefinitionString or DefinitionS3Location | none |
155
- | `pf-bedrock-flow-definition-string-json` | AWS::Bedrock::Flow | DefinitionString must be JSON | none |
156
- | `pf-bedrock-flow-input-expression` | AWS::Bedrock::Flow | A node input Expression must start with $.data | none |
157
- | `pf-bedrock-flow-input-node` | AWS::Bedrock::Flow | A flow has exactly one Input node | none |
158
- | `pf-bedrock-flow-input-node-output` | AWS::Bedrock::Flow | The Input node exposes a single output named document | none |
159
- | `pf-bedrock-flow-input-single-connection` | AWS::Bedrock::Flow | A node input accepts a single incoming connection | none |
160
- | `pf-bedrock-flow-node-configuration` | AWS::Bedrock::Flow | A flow node needs the Configuration member named after its Type | none |
161
- | `pf-bedrock-flow-node-name-unique` | AWS::Bedrock::Flow | Flow node names must be unique | none |
162
- | `pf-bedrock-guardrail-automated-reasoning-cross-region` | AWS::Bedrock::Guardrail | Automated Reasoning checks need CrossRegionConfig | none |
163
- | `pf-bedrock-guardrail-automated-reasoning-policy-region` | AWS::Bedrock::Guardrail | An Automated Reasoning policy must live in the guardrail's Region | none |
164
- | `pf-bedrock-guardrail-content-filter-unique` | AWS::Bedrock::Guardrail | A guardrail content policy must not list the same filter type twice | none |
165
- | `pf-bedrock-guardrail-grounding-filter-unique` | AWS::Bedrock::Guardrail | A contextual grounding policy must not list the same filter type twice | none |
166
- | `pf-bedrock-guardrail-grounding-threshold` | AWS::Bedrock::Guardrail | A contextual grounding threshold must be below 1 | none |
167
- | `pf-bedrock-guardrail-managed-word-list-unique` | AWS::Bedrock::Guardrail | A guardrail must not list the same managed word list twice | none |
168
- | `pf-bedrock-guardrail-pii-entity-unique` | AWS::Bedrock::Guardrail | A guardrail must not configure the same PII entity type twice | none |
169
- | `pf-bedrock-guardrail-policy-required` | AWS::Bedrock::Guardrail | A guardrail needs at least one policy | none |
170
- | `pf-bedrock-guardrail-profile-account` | AWS::Bedrock::Guardrail | A guardrail profile ARN must carry the deploying account | none |
171
- | `pf-bedrock-guardrail-profile-geo` | AWS::Bedrock::Guardrail | A guardrail profile must belong to the deploy Region's geography | none |
172
- | `pf-bedrock-guardrail-profile-region` | AWS::Bedrock::Guardrail | A guardrail profile ARN must carry the guardrail's own Region | none |
173
- | `pf-bedrock-guardrail-prompt-attack-output-strength` | AWS::Bedrock::Guardrail | The PROMPT_ATTACK content filter must use OutputStrength NONE | none |
174
- | `pf-bedrock-guardrail-regex-pattern-length` | AWS::Bedrock::Guardrail | A guardrail regex pattern is limited to 500 characters | none |
175
- | `pf-bedrock-guardrail-regex-unique` | AWS::Bedrock::Guardrail | Guardrail regex filters must have unique names and unique patterns | none |
176
- | `pf-bedrock-guardrail-standard-tier-cross-region` | AWS::Bedrock::Guardrail | The STANDARD safeguard tier needs CrossRegionConfig | none |
177
- | `pf-bedrock-guardrail-topic-definition-length` | AWS::Bedrock::Guardrail | A denied topic definition is limited to 200 characters on the CLASSIC tier | none |
178
- | `pf-bedrock-guardrail-topic-name-unique` | AWS::Bedrock::Guardrail | Denied topic names within a guardrail must be unique | none |
179
- | `pf-bedrock-guardrail-word-length` | AWS::Bedrock::Guardrail | A guardrail custom word is limited to 100 characters | none |
180
- | `pf-bedrock-guardrail-word-unique` | AWS::Bedrock::Guardrail | Guardrail custom words must be unique (case-insensitively) | none |
181
- | `pf-bedrock-inference-profile-model-source-required` | AWS::Bedrock::ApplicationInferenceProfile | An application inference profile needs ModelSource | none |
182
- | `pf-bedrock-inference-profile-source-region` | AWS::Bedrock::ApplicationInferenceProfile | An application inference profile copies from a model or profile of its own Region | none |
183
- | `pf-bedrock-kb-embedding-binary` | AWS::Bedrock::KnowledgeBase | BINARY embeddings need a model and a vector store that support them | none |
184
- | `pf-bedrock-kb-embedding-dimensions` | AWS::Bedrock::KnowledgeBase | Embedding Dimensions must be a size the embedding model supports | none |
185
- | `pf-bedrock-kb-embedding-model-region` | AWS::Bedrock::KnowledgeBase | The embedding model ARN must carry the knowledge base's Region | none |
186
- | `pf-bedrock-kb-s3-vectors-index-dimension` | AWS::Bedrock::KnowledgeBase | The embedding size must equal the S3 Vectors index Dimension | none |
187
- | `pf-bedrock-kb-sql-auth-configuration` | AWS::Bedrock::KnowledgeBase | Redshift AuthConfiguration must carry exactly the fields its Type needs | none |
188
- | `pf-bedrock-kb-sql-query-engine-configuration` | AWS::Bedrock::KnowledgeBase | A Redshift query engine needs the block matching its Type | none |
189
- | `pf-bedrock-kb-sql-storage-configuration` | AWS::Bedrock::KnowledgeBase | A Redshift storage configuration needs the block matching its Type | none |
190
- | `pf-bedrock-kb-storage-not-allowed` | AWS::Bedrock::KnowledgeBase | KENDRA and SQL knowledge bases must not carry StorageConfiguration | none |
191
- | `pf-bedrock-kb-storage-type-configuration` | AWS::Bedrock::KnowledgeBase | StorageConfiguration.Type needs its matching configuration block | none |
192
- | `pf-bedrock-kb-supplemental-storage-uri` | AWS::Bedrock::KnowledgeBase | Supplemental data storage must point at an S3 bucket root | none |
193
- | `pf-bedrock-kb-type-configuration` | AWS::Bedrock::KnowledgeBase | KnowledgeBaseConfiguration.Type needs its matching configuration block | none |
194
- | `pf-bedrock-kb-vector-storage-required` | AWS::Bedrock::KnowledgeBase | A VECTOR knowledge base needs StorageConfiguration | none |
195
- | `pf-bedrock-kb-vector-store-region` | AWS::Bedrock::KnowledgeBase | An S3 Vectors index must live in the knowledge base's Region | none |
196
- | `pf-bedrock-prompt-default-variant` | AWS::Bedrock::Prompt | DefaultVariant must name one of the prompt's variants | none |
197
- | `pf-bedrock-prompt-router-fallback-model` | AWS::Bedrock::IntelligentPromptRouter | The prompt router's fallback model must be one of its routed models | none |
198
- | `pf-bedrock-prompt-router-model-provider` | AWS::Bedrock::IntelligentPromptRouter | A prompt router's models must come from the same provider | none |
199
- | `pf-bedrock-prompt-router-model-region` | AWS::Bedrock::IntelligentPromptRouter | Prompt router models must be reachable from the deploy Region | none |
200
- | `pf-bedrock-prompt-router-models-count` | AWS::Bedrock::IntelligentPromptRouter | A prompt router routes between exactly two models | none |
201
- | `pf-bedrock-prompt-router-models-unique` | AWS::Bedrock::IntelligentPromptRouter | A prompt router must not list the same model twice | none |
202
- | `pf-bedrock-prompt-variant-model-or-agent` | AWS::Bedrock::Prompt | A prompt variant takes either ModelId or GenAiResource, not both | none |
203
- | `pf-bedrock-prompt-variant-name-unique` | AWS::Bedrock::Prompt | Prompt variant names must be unique | none |
204
- | `pf-bedrock-prompt-variant-template-type` | AWS::Bedrock::Prompt | A prompt variant's TemplateConfiguration must match its TemplateType | none |
205
- | `pf-agentcore-apikey-provider-secret-source` | AWS::BedrockAgentCore::ApiKeyCredentialProvider | An API key credential provider takes ApiKey when the secret is MANAGED and ApiKeySecretConfig when it is EXTERNAL, never both | none |
206
- | `pf-agentcore-config-bundle-components-empty` | AWS::BedrockAgentCore::ConfigurationBundle | A configuration bundle needs at least one component | none |
207
- | `pf-agentcore-dataset-source-exactly-one` | AWS::BedrockAgentCore::Dataset | Dataset Source must hold exactly one of InlineExamples or S3Source | none |
208
- | `pf-agentcore-evaluator-rating-scale-empty` | AWS::BedrockAgentCore::Evaluator | An LLM-as-a-judge evaluator RatingScale must list at least one scale entry | none |
209
- | `pf-agentcore-gateway-authorizer-config-unexpected` | AWS::BedrockAgentCore::Gateway | Gateways with AuthorizerType AWS_IAM or NONE must not set AuthorizerConfiguration | none |
210
- | `pf-agentcore-gateway-interceptor-point-unique` | AWS::BedrockAgentCore::Gateway | Gateway interceptors may bind each interception point (REQUEST / RESPONSE) only once | none |
211
- | `pf-agentcore-gateway-jwt-authorizer` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::PaymentManager | Gateways and payment managers with AuthorizerType CUSTOM_JWT require AuthorizerConfiguration | none |
212
- | `pf-agentcore-gateway-mcp-supported-versions` | AWS::BedrockAgentCore::Gateway | Gateway MCP SupportedVersions must be MCP protocol versions the service supports | none |
213
- | `pf-agentcore-gateway-target-credential-provider-required` | AWS::BedrockAgentCore::GatewayTarget | Gateway target credential types OAUTH and API_KEY require the matching CredentialProvider block | none |
214
- | `pf-agentcore-gateway-target-iam-credential-provider` | AWS::BedrockAgentCore::GatewayTarget | OpenAPI and MCP server gateway targets using GATEWAY_IAM_ROLE must set IamCredentialProvider (the SigV4 service) | none |
215
- | `pf-agentcore-gateway-target-lambda-credential-type` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets accept only the GATEWAY_IAM_ROLE credential provider | none |
216
- | `pf-agentcore-gateway-target-lambda-region` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets must be in the gateway's own region | none |
217
- | `pf-agentcore-gateway-target-lambda-tool-name-unique` | AWS::BedrockAgentCore::GatewayTarget | Tool names in a Lambda gateway target's inline ToolSchema must be unique | none |
218
- | `pf-agentcore-gateway-target-lambda-tool-schema-empty` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets need at least one tool in ToolSchema.InlinePayload | none |
219
- | `pf-agentcore-gateway-target-openapi-schema` | AWS::BedrockAgentCore::GatewayTarget | Inline OpenAPI schemas for gateway targets must be OpenAPI 3 with a servers list and an operationId on every operation | none |
220
- | `pf-agentcore-jwt-authorizer-claims` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::Harness | A CustomJWTAuthorizer needs at least one of AllowedAudience, AllowedClients, AllowedScopes, or CustomClaims | none |
221
- | `pf-agentcore-memory-custom-strategy-execution-role` | AWS::BedrockAgentCore::Memory | Memories with a custom strategy require MemoryExecutionRoleArn | none |
222
- | `pf-agentcore-memory-strategy-exactly-one` | AWS::BedrockAgentCore::Memory | Each MemoryStrategies entry must hold exactly one strategy type, and a CustomMemoryStrategy exactly one Configuration override | pending-engine |
223
- | `pf-agentcore-memory-strategy-name-unique` | AWS::BedrockAgentCore::Memory | Memory strategy names must be unique within a memory | none |
224
- | `pf-agentcore-memory-strategy-namespaces-count` | AWS::BedrockAgentCore::Memory | A memory strategy accepts exactly one namespace | none |
225
- | `pf-agentcore-memory-strategy-type-unique` | AWS::BedrockAgentCore::Memory | A memory may carry at most one strategy of each built-in type | none |
226
- | `pf-agentcore-oauth2-provider-client-secret` | AWS::BedrockAgentCore::OAuth2CredentialProvider | A custom OAuth2 provider takes ClientSecret when the secret is MANAGED and ClientSecretConfig when it is EXTERNAL, never both | none |
227
- | `pf-agentcore-oauth2-provider-private-key-jwt` | AWS::BedrockAgentCore::OAuth2CredentialProvider | ClientAuthenticationMethod PRIVATE_KEY_JWT cannot be satisfied through CloudFormation (PrivateKeyJwtConfig is not in the resource schema) | none |
228
- | `pf-agentcore-oauth2-provider-vendor-config` | AWS::BedrockAgentCore::OAuth2CredentialProvider | Oauth2ProviderConfigInput must contain the config block that matches CredentialProviderVendor | none |
229
- | `pf-agentcore-online-eval-evaluator-unique` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config must not list the same evaluator twice | none |
230
- | `pf-agentcore-online-eval-evaluators-or-insights` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config needs a non-empty Evaluators list (or Insights) | none |
231
- | `pf-agentcore-payment-credential-provider-vendor-config` | AWS::BedrockAgentCore::PaymentCredentialProvider | ProviderConfigurationInput must contain the block matching CredentialProviderVendor (CoinbaseCDP / StripePrivy) | none |
232
- | `pf-agentcore-policy-cedar-statement` | AWS::BedrockAgentCore::Policy | A Cedar policy statement must be a permit/forbid clause that constrains the resource and, for permit, carries a condition | none |
233
- | `pf-agentcore-required-union-empty` | AWS::BedrockAgentCore::Evaluator<br>AWS::BedrockAgentCore::GatewayTarget<br>AWS::BedrockAgentCore::Policy | Required union blocks (EvaluatorConfig, TargetConfiguration, Definition) must not be empty objects | pending-engine |
234
- | `pf-agentcore-resource-policy-document` | AWS::BedrockAgentCore::ResourcePolicy | A resource policy must be a JSON policy whose statements carry Principal, bedrock-agentcore actions, and exactly one Resource ARN | none |
235
- | `pf-agentcore-runtime-artifact-exactly-one` | AWS::BedrockAgentCore::Runtime | AgentRuntimeArtifact must hold exactly one of ContainerConfiguration or CodeConfiguration | none |
236
- | `pf-agentcore-runtime-code-entrypoint-extension` | AWS::BedrockAgentCore::Runtime | A CodeConfiguration EntryPoint file must match the selected Runtime (.py for PYTHON_*) | none |
237
- | `pf-agentcore-runtime-endpoint-name-default` | AWS::BedrockAgentCore::RuntimeEndpoint | A RuntimeEndpoint cannot be named DEFAULT (the runtime already owns that endpoint) | none |
238
- | `pf-agentcore-runtime-env-var-count` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime EnvironmentVariables holds at most 50 entries | pending-engine |
239
- | `pf-agentcore-runtime-lifecycle-timeout-order` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime IdleRuntimeSessionTimeout must not exceed MaxLifetime | none |
240
- | `pf-agentcore-runtime-name` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime names must match [a-zA-Z][a-zA-Z0-9_]{0,47} (no hyphens) | pending-engine |
241
- | `pf-agentcore-runtime-session-storage-single` | AWS::BedrockAgentCore::Runtime | An AgentCore Runtime allows at most one SessionStorage filesystem configuration | none |
242
- | `pf-agentcore-vpc-network-mode-config` | AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::BrowserCustom<br>AWS::BedrockAgentCore::CodeInterpreterCustom<br>AWS::BedrockAgentCore::Harness | NetworkMode VPC requires the VPC config block, and PUBLIC forbids it (Runtime, Browser, Code Interpreter, Harness) | none |
243
- | `pf-cloudfront-acm-cert-region` | AWS::CloudFront::Distribution | CloudFront viewer certificates must live in us-east-1 | none |
244
- | `pf-cloudfront-alias-unique` | AWS::CloudFront::Distribution | Aliases must not contain duplicates | none |
245
- | `pf-cloudfront-aliases-require-custom-certificate` | AWS::CloudFront::Distribution | A distribution with Aliases cannot use the CloudFront default certificate | none |
246
- | `pf-cloudfront-allowed-methods-set` | AWS::CloudFront::Distribution | AllowedMethods must be one of the three sets CloudFront supports | none |
247
- | `pf-cloudfront-anycast-ip-list-count` | AWS::CloudFront::AnycastIpList | AnycastIpList IpCount must be 21 | none |
248
- | `pf-cloudfront-cache-behavior-path-pattern-unique` | AWS::CloudFront::Distribution | Cache behavior PathPattern values must be unique | none |
249
- | `pf-cloudfront-cache-behavior-target-origin-exists` | AWS::CloudFront::Distribution | Cache behavior TargetOriginId must match an origin or origin group Id | none |
250
- | `pf-cloudfront-cache-policy-accept-encoding-conflict` | AWS::CloudFront::CachePolicy | Accept-Encoding cannot be whitelisted while EnableAcceptEncodingGzip/Brotli is true | none |
251
- | `pf-cloudfront-cache-policy-cookie-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy CookieBehavior whitelist / allExcept requires Cookies | none |
252
- | `pf-cloudfront-cache-policy-header-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy HeaderBehavior whitelist requires Headers | none |
253
- | `pf-cloudfront-cache-policy-header-behavior-none-items` | AWS::CloudFront::CachePolicy | Cache policy HeaderBehavior none cannot carry Headers | none |
254
- | `pf-cloudfront-cache-policy-name` | AWS::CloudFront::CachePolicy | Cache policy names allow only alphanumerics, dash and underscore | none |
255
- | `pf-cloudfront-cache-policy-or-forwarded-values-required` | AWS::CloudFront::Distribution | A cache behavior must set either CachePolicyId or ForwardedValues | none |
256
- | `pf-cloudfront-cache-policy-query-string-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy QueryStringBehavior whitelist / allExcept requires QueryStrings | none |
257
- | `pf-cloudfront-cache-policy-ttl-default-in-range` | AWS::CloudFront::CachePolicy | Cache policy DefaultTTL must be between MinTTL and MaxTTL | none |
258
- | `pf-cloudfront-cached-methods-subset` | AWS::CloudFront::Distribution | CachedMethods must be a subset of AllowedMethods | none |
259
- | `pf-cloudfront-continuous-deployment-header-prefix` | AWS::CloudFront::ContinuousDeploymentPolicy | SingleHeaderConfig Header must start with aws-cf-cd- | none |
260
- | `pf-cloudfront-continuous-deployment-policy-excludes-staging` | AWS::CloudFront::Distribution | ContinuousDeploymentPolicyId cannot be set on a staging distribution | none |
261
- | `pf-cloudfront-continuous-deployment-session-ttl-order` | AWS::CloudFront::ContinuousDeploymentPolicy | SessionStickinessConfig IdleTTL cannot exceed MaximumTTL | none |
262
- | `pf-cloudfront-continuous-deployment-staging-dns-count` | AWS::CloudFront::ContinuousDeploymentPolicy | A continuous deployment policy takes exactly one staging distribution DNS name | none |
263
- | `pf-cloudfront-continuous-deployment-traffic-config-match` | AWS::CloudFront::ContinuousDeploymentPolicy | TrafficConfig Type must match the config block that is present | none |
264
- | `pf-cloudfront-continuous-deployment-weight-range` | AWS::CloudFront::ContinuousDeploymentPolicy | SingleWeightConfig Weight must be between 0 and 0.15 | none |
265
- | `pf-cloudfront-custom-error-response-code` | AWS::CloudFront::Distribution | CustomErrorResponses ErrorCode must be one of the codes CloudFront caches | pending-engine |
266
- | `pf-cloudfront-custom-error-response-page-path-format` | AWS::CloudFront::Distribution | ResponsePagePath must start with / | none |
267
- | `pf-cloudfront-custom-error-response-page-path-pair` | AWS::CloudFront::Distribution | ResponsePagePath and ResponseCode must be specified together | none |
268
- | `pf-cloudfront-edge-lambda-region` | AWS::CloudFront::Distribution | Lambda@Edge functions associated with a distribution must be in us-east-1 | none |
269
- | `pf-cloudfront-edge-lambda-version` | AWS::CloudFront::Distribution | Lambda@Edge associations must reference a version ARN, not an alias or $LATEST | none |
270
- | `pf-cloudfront-field-level-encryption-requires-post` | AWS::CloudFront::Distribution | FieldLevelEncryptionId requires POST or PUT in AllowedMethods | none |
271
- | `pf-cloudfront-function-association-event-type` | AWS::CloudFront::Distribution | CloudFront Functions only support viewer-request and viewer-response | none |
272
- | `pf-cloudfront-function-association-event-type-unique` | AWS::CloudFront::Distribution | Each CloudFront Function EventType can appear only once per cache behavior | none |
273
- | `pf-cloudfront-function-code-size` | AWS::CloudFront::Function | CloudFront Function code is limited to 10 KB | none |
274
- | `pf-cloudfront-function-kvs-association-count` | AWS::CloudFront::Function | A CloudFront Function can associate at most one key value store | none |
275
- | `pf-cloudfront-function-kvs-requires-runtime-2` | AWS::CloudFront::Function | KeyValueStoreAssociations require the cloudfront-js-2.0 runtime | none |
276
- | `pf-cloudfront-function-runtime-enum` | AWS::CloudFront::Function | CloudFront Function Runtime must be cloudfront-js-1.0 or cloudfront-js-2.0 | pending-engine |
277
- | `pf-cloudfront-geo-restriction-country-code` | AWS::CloudFront::Distribution | GeoRestriction locations must be two-letter uppercase country codes | pending-engine |
278
- | `pf-cloudfront-geo-restriction-locations-exclusive` | AWS::CloudFront::Distribution | RestrictionType none cannot carry Locations | none |
279
- | `pf-cloudfront-grpc-requires-http2` | AWS::CloudFront::Distribution | GrpcConfig requires an HTTP/2 capable HttpVersion | none |
280
- | `pf-cloudfront-grpc-requires-post-method` | AWS::CloudFront::Distribution | GrpcConfig requires POST in AllowedMethods | none |
281
- | `pf-cloudfront-http-version-enum` | AWS::CloudFront::Distribution | HttpVersion must be http1.1, http2, http2and3 or http3 | pending-engine |
282
- | `pf-cloudfront-key-group-item-count` | AWS::CloudFront::KeyGroup | A key group holds at most 5 public keys | none |
283
- | `pf-cloudfront-key-group-item-unique` | AWS::CloudFront::KeyGroup | A key group must not list the same public key twice | none |
284
- | `pf-cloudfront-key-value-store-import-source-arn` | AWS::CloudFront::KeyValueStore | KeyValueStore ImportSource SourceArn must be an S3 object ARN | none |
285
- | `pf-cloudfront-key-value-store-import-source-type` | AWS::CloudFront::KeyValueStore | KeyValueStore ImportSource SourceType must be S3 | pending-engine |
286
- | `pf-cloudfront-lambda-association-event-type-unique` | AWS::CloudFront::Distribution | Each Lambda@Edge EventType can appear only once per cache behavior | none |
287
- | `pf-cloudfront-lambda-association-include-body-event-type` | AWS::CloudFront::Distribution | IncludeBody is only valid for viewer-request and origin-request | none |
288
- | `pf-cloudfront-logging-bucket-format` | AWS::CloudFront::Distribution | Logging.Bucket must be the S3 bucket DNS name, not the bare bucket name | none |
289
- | `pf-cloudfront-oac-excludes-origin-access-identity` | AWS::CloudFront::Distribution | OriginAccessControlId and S3OriginConfig.OriginAccessIdentity are mutually exclusive | none |
290
- | `pf-cloudfront-origin-config-required` | AWS::CloudFront::Distribution | Every origin must declare exactly one origin type configuration | none |
291
- | `pf-cloudfront-origin-connection-attempts-range` | AWS::CloudFront::Distribution | ConnectionAttempts must be between 1 and 3 | none |
292
- | `pf-cloudfront-origin-connection-timeout-range` | AWS::CloudFront::Distribution | ConnectionTimeout must be between 1 and 10 | none |
293
- | `pf-cloudfront-origin-custom-header-blocklist` | AWS::CloudFront::Distribution | OriginCustomHeaders cannot carry headers CloudFront reserves | none |
294
- | `pf-cloudfront-origin-custom-header-name-unique` | AWS::CloudFront::Distribution | OriginCustomHeaders header names must be unique per origin | none |
295
- | `pf-cloudfront-origin-group-failover-status-codes` | AWS::CloudFront::Distribution | Origin group failover status codes are limited to a fixed set | none |
296
- | `pf-cloudfront-origin-group-id-collides-with-origin` | AWS::CloudFront::Distribution | An origin group Id cannot reuse an origin Id | none |
297
- | `pf-cloudfront-origin-group-member-origin` | AWS::CloudFront::Distribution | Origin group members must reference an origin declared in the distribution | none |
298
- | `pf-cloudfront-origin-http-port-range` | AWS::CloudFront::Distribution | HTTPPort must be 80, 443 or in 1024-65535 | none |
299
- | `pf-cloudfront-origin-https-port-range` | AWS::CloudFront::Distribution | HTTPSPort must be 80, 443 or in 1024-65535 | none |
300
- | `pf-cloudfront-origin-id-unique` | AWS::CloudFront::Distribution | Origin Id values must be unique within a distribution | none |
301
- | `pf-cloudfront-origin-keepalive-timeout-range` | AWS::CloudFront::Distribution | OriginKeepaliveTimeout must be between 1 and 300 | none |
302
- | `pf-cloudfront-origin-path-format` | AWS::CloudFront::Distribution | OriginPath must start with / and must not end with / | none |
303
- | `pf-cloudfront-origin-protocol-policy-enum` | AWS::CloudFront::Distribution | OriginProtocolPolicy must be http-only, https-only or match-viewer | none |
304
- | `pf-cloudfront-origin-read-timeout-range` | AWS::CloudFront::Distribution | OriginReadTimeout must be between 1 and 120 | none |
305
- | `pf-cloudfront-origin-request-policy-cloudfront-headers` | AWS::CloudFront::OriginRequestPolicy | allViewerAndWhitelistCloudFront only accepts CloudFront-* headers | none |
306
- | `pf-cloudfront-origin-request-policy-cookie-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy CookieBehavior whitelist / allExcept requires Cookies | none |
307
- | `pf-cloudfront-origin-request-policy-excludes-forwarded-values` | AWS::CloudFront::Distribution | A cache behavior cannot set both OriginRequestPolicyId and ForwardedValues | none |
308
- | `pf-cloudfront-origin-request-policy-header-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy HeaderBehavior whitelist / allExcept requires Headers | none |
309
- | `pf-cloudfront-origin-request-policy-name-charset` | AWS::CloudFront::OriginRequestPolicy | Origin request policy names allow only alphanumerics, dash and underscore | none |
310
- | `pf-cloudfront-origin-request-policy-query-string-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy QueryStringBehavior whitelist / allExcept requires QueryStrings | none |
311
- | `pf-cloudfront-origin-shield-region-required` | AWS::CloudFront::Distribution | Enabling Origin Shield requires OriginShieldRegion | none |
312
- | `pf-cloudfront-origin-shield-region-supported` | AWS::CloudFront::Distribution | OriginShieldRegion must be a region where CloudFront offers Origin Shield | none |
313
- | `pf-cloudfront-price-class-enum` | AWS::CloudFront::Distribution | PriceClass must be PriceClass_100, PriceClass_200 or PriceClass_All | pending-engine |
314
- | `pf-cloudfront-public-key-pem-format` | AWS::CloudFront::PublicKey | PublicKey EncodedKey must be a PEM-encoded public key | none |
315
- | `pf-cloudfront-realtime-log-endpoint-count` | AWS::CloudFront::RealtimeLogConfig | A real-time log configuration takes exactly one endpoint | none |
316
- | `pf-cloudfront-realtime-log-endpoint-stream-type` | AWS::CloudFront::RealtimeLogConfig | Real-time log endpoints must have StreamType Kinesis | none |
317
- | `pf-cloudfront-realtime-log-field-names` | AWS::CloudFront::RealtimeLogConfig | Real-time log Fields must name fields CloudFront defines | none |
318
- | `pf-cloudfront-response-headers-policy-name-charset` | AWS::CloudFront::ResponseHeadersPolicy | Response headers policy names allow only alphanumerics, dash and underscore | none |
319
- | `pf-cloudfront-rhp-content-security-policy-length` | AWS::CloudFront::ResponseHeadersPolicy | ContentSecurityPolicy is limited to 1783 characters | none |
320
- | `pf-cloudfront-rhp-cors-allow-methods-enum` | AWS::CloudFront::ResponseHeadersPolicy | AccessControlAllowMethods accepts only the eight documented values | pending-engine |
321
- | `pf-cloudfront-rhp-custom-header-blocklist` | AWS::CloudFront::ResponseHeadersPolicy | CustomHeadersConfig cannot carry headers CloudFront reserves | none |
322
- | `pf-cloudfront-rhp-custom-header-unique` | AWS::CloudFront::ResponseHeadersPolicy | CustomHeadersConfig must not repeat a header name | none |
323
- | `pf-cloudfront-rhp-remove-header-blocklist` | AWS::CloudFront::ResponseHeadersPolicy | RemoveHeadersConfig cannot remove headers CloudFront controls | none |
324
- | `pf-cloudfront-rhp-server-timing-sampling-rate-required` | AWS::CloudFront::ResponseHeadersPolicy | ServerTimingHeadersConfig requires SamplingRate when enabled | none |
325
- | `pf-cloudfront-rhp-xss-protection-report-uri-mode-block` | AWS::CloudFront::ResponseHeadersPolicy | XSSProtection cannot set both ReportUri and ModeBlock | none |
326
- | `pf-cloudfront-rhp-xss-protection-report-uri-requires-protection` | AWS::CloudFront::ResponseHeadersPolicy | XSSProtection ReportUri requires Protection true | none |
327
- | `pf-cloudfront-s3-website-endpoint-custom-origin` | AWS::CloudFront::Distribution | An S3 website endpoint origin must use CustomOriginConfig, not S3OriginConfig | none |
328
- | `pf-cloudfront-staging-requires-no-aliases` | AWS::CloudFront::Distribution | A staging distribution cannot have Aliases | none |
329
- | `pf-cloudfront-trusted-key-groups-excludes-trusted-signers` | AWS::CloudFront::Distribution | TrustedKeyGroups and TrustedSigners cannot both be used on a cache behavior | none |
330
- | `pf-cloudfront-trusted-signers-account-format` | AWS::CloudFront::Distribution | TrustedSigners entries must be self or a 12-digit account id | none |
331
- | `pf-cloudfront-ttl-order` | AWS::CloudFront::Distribution | Cache behavior TTLs must satisfy MinTTL <= DefaultTTL <= MaxTTL | none |
332
- | `pf-cloudfront-viewer-certificate-exactly-one` | AWS::CloudFront::Distribution | ViewerCertificate must name exactly one certificate source | none |
333
- | `pf-cloudfront-viewer-certificate-sni-min-protocol` | AWS::CloudFront::Distribution | sni-only requires MinimumProtocolVersion of TLSv1 or higher | none |
334
- | `pf-cloudfront-viewer-certificate-vip-deprecated` | AWS::CloudFront::Distribution | SslSupportMethod vip cannot be used for new distributions | none |
335
- | `pf-cloudfront-viewer-protocol-policy-enum` | AWS::CloudFront::Distribution | ViewerProtocolPolicy must be allow-all, https-only or redirect-to-https | pending-engine |
336
- | `pf-cloudfront-vpc-origin-arn-type` | AWS::CloudFront::VpcOrigin | A VPC origin ARN must point at an ALB, NLB or EC2 instance | none |
337
- | `pf-cloudfront-vpc-origin-port-range` | AWS::CloudFront::VpcOrigin | VPC origin HTTPPort and HTTPSPort must be between 1 and 65535 | none |
338
- | `pf-cloudfront-vpc-origin-ssl-protocols-required` | AWS::CloudFront::VpcOrigin | An HTTPS-capable VPC origin must list OriginSSLProtocols | none |
339
- | `pf-cloudfront-wafv2-webacl-scope` | AWS::CloudFront::Distribution | A WAFv2 web ACL attached to CloudFront must be globally scoped | none |
340
- | `pf-cloudwatch-alarm-action-vendor` | AWS::CloudWatch::Alarm | Alarm actions accept only the CloudWatch action vendors | none |
341
- | `pf-cloudwatch-alarm-actions-max` | AWS::CloudWatch::Alarm | Each alarm action list holds at most 5 ARNs | none |
342
- | `pf-cloudwatch-alarm-anomaly-autoscaling-action` | AWS::CloudWatch::Alarm | An anomaly-detection alarm cannot carry an Auto Scaling action | none |
343
- | `pf-cloudwatch-alarm-ec2-action-region` | AWS::CloudWatch::Alarm | An EC2 automate action must name the stack's own region | none |
344
- | `pf-cloudwatch-alarm-evaluation-window` | AWS::CloudWatch::Alarm | The evaluation window caps at 7 days (Period >= 3600) or 1 day (Period < 3600) | none |
345
- | `pf-cloudwatch-alarm-expressions-max` | AWS::CloudWatch::Alarm | An alarm takes at most 10 math expressions | none |
346
- | `pf-cloudwatch-alarm-low-sample-percentile` | AWS::CloudWatch::Alarm | EvaluateLowSampleCountPercentile only applies to percentile statistics | none |
347
- | `pf-cloudwatch-alarm-metrics-max` | AWS::CloudWatch::Alarm | An alarm takes at most 10 MetricStat queries | none |
348
- | `pf-cloudwatch-alarm-period` | AWS::CloudWatch::Alarm | Period must be 10, 20, 30 or a multiple of 60 | none |
349
- | `pf-cloudwatch-alarm-search-expression` | AWS::CloudWatch::Alarm | SEARCH() cannot be used in a metric alarm | none |
350
- | `pf-cloudwatch-alarm-threshold` | AWS::CloudWatch::Alarm | Standard operators need Threshold, range operators need ThresholdMetricId | none |
351
- | `pf-cloudwatch-anomaly-detector-excluded-range-order` | AWS::CloudWatch::AnomalyDetector | An excluded time range must start before it ends | none |
352
- | `pf-cloudwatch-anomaly-detector-exclusive` | AWS::CloudWatch::AnomalyDetector | SingleMetricAnomalyDetector and MetricMathAnomalyDetector are mutually exclusive | none |
353
- | `pf-cloudwatch-anomaly-detector-math-single-query` | AWS::CloudWatch::AnomalyDetector | A math detector needs more than one metric data query | none |
354
- | `pf-cloudwatch-anomaly-detector-math-toplevel` | AWS::CloudWatch::AnomalyDetector | MetricMathAnomalyDetector cannot be combined with the top-level metric properties | none |
355
- | `pf-cloudwatch-anomaly-detector-namespace-colon` | AWS::CloudWatch::AnomalyDetector | A metric namespace must not start with a colon | none |
356
- | `pf-cloudwatch-anomaly-detector-stat-syntax` | AWS::CloudWatch::AnomalyDetector | The anomaly detector Stat must be a CloudWatch statistic | none |
357
- | `pf-cloudwatch-composite-alarm-rule-syntax` | AWS::CloudWatch::CompositeAlarm | An AlarmRule must start with a valid expression token | none |
358
- | `pf-cloudwatch-composite-self-reference` | AWS::CloudWatch::CompositeAlarm | A composite alarm cannot reference itself in its AlarmRule | none |
359
- | `pf-cloudwatch-composite-suppressor-extension-period` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor requires ActionsSuppressorExtensionPeriod | none |
360
- | `pf-cloudwatch-composite-suppressor-format` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor must be an alarm name or a CloudWatch alarm ARN | none |
361
- | `pf-cloudwatch-composite-suppressor-required` | AWS::CloudWatch::CompositeAlarm | The suppressor periods require an ActionsSuppressor | none |
362
- | `pf-cloudwatch-composite-suppressor-wait-period` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor requires ActionsSuppressorWaitPeriod | none |
363
- | `pf-cloudwatch-dashboard-alarm-widget-alarms` | AWS::CloudWatch::Dashboard | An alarm widget requires properties.alarms | none |
364
- | `pf-cloudwatch-dashboard-body-json` | AWS::CloudWatch::Dashboard | DashboardBody must be valid JSON | none |
365
- | `pf-cloudwatch-dashboard-metric-widget-source` | AWS::CloudWatch::Dashboard | A metric widget needs a region and a data source | none |
366
- | `pf-cloudwatch-dashboard-name` | AWS::CloudWatch::Dashboard | Dashboard names allow only alphanumerics, dash and underscore | none |
367
- | `pf-cloudwatch-dashboard-text-widget-markdown` | AWS::CloudWatch::Dashboard | A text widget requires properties.markdown | none |
368
- | `pf-cloudwatch-dashboard-widget-fields` | AWS::CloudWatch::Dashboard | Every dashboard widget requires type and properties | none |
369
- | `pf-cloudwatch-dashboard-widget-height-max` | AWS::CloudWatch::Dashboard | Widget height tops out at 1000 | none |
370
- | `pf-cloudwatch-dashboard-widget-period` | AWS::CloudWatch::Dashboard | A widget period must be 1, 5, 10, 20, 30 or a multiple of 60 | none |
371
- | `pf-cloudwatch-dashboard-widget-position` | AWS::CloudWatch::Dashboard | Dashboard widget x tops out at 23 and width at 24 | none |
372
- | `pf-cloudwatch-dashboard-widget-position-min` | AWS::CloudWatch::Dashboard | Widget x and y must not be negative | none |
373
- | `pf-cloudwatch-dashboard-widget-stat-syntax` | AWS::CloudWatch::Dashboard | A widget stat must be a CloudWatch statistic | none |
374
- | `pf-cloudwatch-dashboard-widgets` | AWS::CloudWatch::Dashboard | DashboardBody requires a widgets array | none |
375
- | `pf-cloudwatch-dashboard-widgets-array` | AWS::CloudWatch::Dashboard | The widgets key must hold an array | none |
376
- | `pf-cloudwatch-dashboard-yaxis-range` | AWS::CloudWatch::Dashboard | A widget yAxis min must be below its max | none |
377
- | `pf-cloudwatch-datapoints-evaluation` | AWS::CloudWatch::Alarm | DatapointsToAlarm must not exceed EvaluationPeriods | none |
378
- | `pf-cloudwatch-extended-statistic` | AWS::CloudWatch::Alarm | A percentile statistic cannot exceed p100 | none |
379
- | `pf-cloudwatch-insight-rule-body-json` | AWS::CloudWatch::InsightRule | RuleBody must be valid JSON | none |
380
- | `pf-cloudwatch-insight-rule-body-unknown-key` | AWS::CloudWatch::InsightRule | The rule body top level takes only the documented keys | none |
381
- | `pf-cloudwatch-insight-rule-contribution-filters` | AWS::CloudWatch::InsightRule | Contribution requires a Filters key | none |
382
- | `pf-cloudwatch-insight-rule-keys-max` | AWS::CloudWatch::InsightRule | Contribution.Keys holds at most 4 keys | none |
383
- | `pf-cloudwatch-insight-rule-log-format` | AWS::CloudWatch::InsightRule | LogFormat must be JSON or CLF | none |
384
- | `pf-cloudwatch-insight-rule-log-groups` | AWS::CloudWatch::InsightRule | The rule body needs at least one log group | none |
385
- | `pf-cloudwatch-insight-rule-schema` | AWS::CloudWatch::InsightRule | The rule body Schema must be CloudWatchLogRule version 1 | none |
386
- | `pf-cloudwatch-metric-namespace-ascii` | AWS::CloudWatch::Alarm | Metric namespaces must not contain non-ASCII characters | none |
387
- | `pf-cloudwatch-metric-query-exclusive` | AWS::CloudWatch::Alarm | Expression and MetricStat are mutually exclusive per query | none |
388
- | `pf-cloudwatch-metric-query-returndata` | AWS::CloudWatch::Alarm | One metric query must return data, or two for an anomaly alarm | none |
389
- | `pf-cloudwatch-metric-stream-additional-statistic` | AWS::CloudWatch::MetricStream | AdditionalStatistics must be CloudWatch statistics | none |
390
- | `pf-cloudwatch-metric-stream-filters-exclusive` | AWS::CloudWatch::MetricStream | IncludeFilters and ExcludeFilters are mutually exclusive | none |
391
- | `pf-cloudwatch-metric-stream-firehose-account` | AWS::CloudWatch::MetricStream | FirehoseArn must be in the stack's own account | none |
392
- | `pf-cloudwatch-metric-stream-firehose-region` | AWS::CloudWatch::MetricStream | FirehoseArn must be in the stack's own region and partition | none |
393
- | `pf-cloudwatch-metric-stream-include-metrics` | AWS::CloudWatch::MetricStream | A statistics configuration needs at least one IncludeMetrics entry | none |
394
- | `pf-cloudwatch-metric-stream-role-account` | AWS::CloudWatch::MetricStream | RoleArn must be in the stack's own account | none |
395
- | `pf-cloudwatch-metricstat-stat-syntax` | AWS::CloudWatch::Alarm | MetricStat.Stat must be a CloudWatch statistic | none |
396
- | `pf-cloudwatch-threshold-metric-id` | AWS::CloudWatch::Alarm | ThresholdMetricId must match a metric query that returns data | none |
397
- | `pf-cognito-alias-username-exclusive` | AWS::Cognito::UserPool | AliasAttributes and UsernameAttributes are mutually exclusive | none |
398
- | `pf-cognito-analytics-application-requires-role` | AWS::Cognito::UserPoolClient | Pinpoint ApplicationId needs a RoleArn | none |
399
- | `pf-cognito-analytics-arn-region` | AWS::Cognito::UserPoolClient | The Pinpoint analytics app must be in the pool region | none |
400
- | `pf-cognito-analytics-config-exclusive` | AWS::Cognito::UserPoolClient | Pinpoint ApplicationArn excludes the id/role form | none |
401
- | `pf-cognito-auto-verified-attributes-enum` | AWS::Cognito::UserPool | Only email and phone_number can be auto-verified | none |
402
- | `pf-cognito-auto-verified-username-consistency` | AWS::Cognito::UserPool | Auto-verifying phone_number requires an SmsConfiguration | none |
403
- | `pf-cognito-callback-url-fragment` | AWS::Cognito::UserPoolClient | Callback URLs cannot carry a fragment | none |
404
- | `pf-cognito-callback-url-https` | AWS::Cognito::UserPoolClient | Callback URLs must use https (except localhost) | none |
405
- | `pf-cognito-callback-urls-max` | AWS::Cognito::UserPoolClient | At most 100 callback URLs per client | none |
406
- | `pf-cognito-client-credentials-exclusive` | AWS::Cognito::UserPoolClient | client_credentials cannot combine with code or implicit | none |
407
- | `pf-cognito-client-credentials-secret` | AWS::Cognito::UserPoolClient | client_credentials needs a client secret | none |
408
- | `pf-cognito-client-name` | AWS::Cognito::UserPoolClient | User pool client names allow only word characters, spaces and +=,.@- | none |
409
- | `pf-cognito-custom-domain-cert-region` | AWS::Cognito::UserPoolDomain | A custom domain certificate must be in us-east-1 | none |
410
- | `pf-cognito-custom-domain-fqdn` | AWS::Cognito::UserPoolDomain | A custom domain must be a fully qualified domain name | none |
411
- | `pf-cognito-custom-email-sender-kms` | AWS::Cognito::UserPool | A custom email sender trigger requires LambdaConfig.KMSKeyID | none |
412
- | `pf-cognito-custom-sender-kms-region` | AWS::Cognito::UserPool | The custom sender KMS key must be in the pool region | none |
413
- | `pf-cognito-custom-sms-sender-kms` | AWS::Cognito::UserPool | A custom SMS sender trigger requires LambdaConfig.KMSKeyID | none |
414
- | `pf-cognito-default-redirect-uri-member` | AWS::Cognito::UserPoolClient | DefaultRedirectURI must be one of the callback URLs | none |
415
- | `pf-cognito-developer-provider-name-format` | AWS::Cognito::IdentityPool | DeveloperProviderName takes no spaces | none |
416
- | `pf-cognito-domain-prefix-format` | AWS::Cognito::UserPoolDomain | A hosted UI domain prefix takes lower-case letters, digits and hyphens | none |
417
- | `pf-cognito-domain-prefix-length` | AWS::Cognito::UserPoolDomain | A hosted UI domain prefix is capped at 63 characters | none |
418
- | `pf-cognito-domain-reserved-word` | AWS::Cognito::UserPoolDomain | Domain prefixes cannot contain reserved words | none |
419
- | `pf-cognito-email-cognito-default-with-sourcearn` | AWS::Cognito::UserPool | COGNITO_DEFAULT email sending takes no SourceArn | none |
420
- | `pf-cognito-email-developer-requires-sourcearn` | AWS::Cognito::UserPool | DEVELOPER email sending needs a SES SourceArn | none |
421
- | `pf-cognito-email-from-format` | AWS::Cognito::UserPool | EmailConfiguration.From must be an email address | none |
422
- | `pf-cognito-email-reply-to-format` | AWS::Cognito::UserPool | ReplyToEmailAddress must be an email address | none |
423
- | `pf-cognito-email-sourcearn-region` | AWS::Cognito::UserPool | The SES SourceArn must be in a Cognito-supported SES region | none |
424
- | `pf-cognito-email-verification-message-placeholder` | AWS::Cognito::UserPool | EmailVerificationMessage needs the {####} code placeholder | none |
425
- | `pf-cognito-explicit-auth-flows-legacy-mix` | AWS::Cognito::UserPoolClient | Legacy and ALLOW_ auth flow names cannot be mixed | none |
426
- | `pf-cognito-group-role-arn-account` | AWS::Cognito::UserPoolGroup | A group role must be in the deploying account | none |
427
- | `pf-cognito-identity-pool-provider-name-format` | AWS::Cognito::IdentityPool | A user pool provider name is the full cognito-idp endpoint | none |
428
- | `pf-cognito-identity-pool-saml-arn-account` | AWS::Cognito::IdentityPool | SAML provider ARNs must be in the deploying account | none |
429
- | `pf-cognito-idp-apple-required-keys` | AWS::Cognito::UserPoolIdentityProvider | Sign in with Apple needs team_id, key_id and private_key | none |
430
- | `pf-cognito-idp-identifiers-max` | AWS::Cognito::UserPoolIdentityProvider | At most 50 IdP identifiers | none |
431
- | `pf-cognito-idp-oidc-attributes-request-method` | AWS::Cognito::UserPoolIdentityProvider | attributes_request_method is GET or POST | none |
432
- | `pf-cognito-idp-oidc-issuer-https` | AWS::Cognito::UserPoolIdentityProvider | The OIDC issuer must be an https URL | none |
433
- | `pf-cognito-idp-oidc-required-keys` | AWS::Cognito::UserPoolIdentityProvider | An OIDC provider needs four ProviderDetails keys | none |
434
- | `pf-cognito-idp-provider-name-length` | AWS::Cognito::UserPoolIdentityProvider | A provider name is capped at 32 characters | none |
435
- | `pf-cognito-idp-saml-metadata-exclusive` | AWS::Cognito::UserPoolIdentityProvider | MetadataURL and MetadataFile are exclusive | none |
436
- | `pf-cognito-idp-saml-metadata-required` | AWS::Cognito::UserPoolIdentityProvider | A SAML provider needs MetadataURL or MetadataFile | none |
437
- | `pf-cognito-idp-social-provider-name-fixed` | AWS::Cognito::UserPoolIdentityProvider | A social provider name is fixed to its type | none |
438
- | `pf-cognito-idp-social-required-keys` | AWS::Cognito::UserPoolIdentityProvider | A social provider needs client_id, client_secret and authorize_scopes | none |
439
- | `pf-cognito-invite-message-username-placeholder` | AWS::Cognito::UserPool | The invite email needs {username} and {####} | none |
440
- | `pf-cognito-invite-sms-message-placeholder` | AWS::Cognito::UserPool | The invite SMS needs {username} and {####} | none |
441
- | `pf-cognito-lambda-config-region` | AWS::Cognito::UserPool | User pool triggers must be Lambda functions in the same region | none |
442
- | `pf-cognito-log-delivery-event-source-duplicate` | AWS::Cognito::LogDeliveryConfiguration | One log configuration per event source | none |
443
- | `pf-cognito-log-delivery-log-group-region` | AWS::Cognito::LogDeliveryConfiguration | The log group must be in the pool region | none |
444
- | `pf-cognito-log-delivery-user-auth-events-tier` | AWS::Cognito::LogDeliveryConfiguration<br>AWS::Cognito::UserPool | userAuthEvents logging needs the PLUS tier | none |
445
- | `pf-cognito-logout-url-https` | AWS::Cognito::UserPoolClient | Logout URLs must use https (except localhost) | none |
446
- | `pf-cognito-managed-login-branding-asset-extension` | AWS::Cognito::ManagedLoginBranding | Only a favicon asset takes the ICO extension | none |
447
- | `pf-cognito-managed-login-branding-values-exclusive` | AWS::Cognito::ManagedLoginBranding | UseCognitoProvidedValues excludes Settings | none |
448
- | `pf-cognito-managed-login-version-tier` | AWS::Cognito::UserPoolDomain<br>AWS::Cognito::UserPool | Managed login version 2 needs ESSENTIALS or PLUS | none |
449
- | `pf-cognito-mfa-email-otp-requires-developer` | AWS::Cognito::UserPool | EMAIL_OTP needs the DEVELOPER email sending account | none |
450
- | `pf-cognito-mfa-off-with-enabled-mfas` | AWS::Cognito::UserPool | MfaConfiguration OFF takes no EnabledMfas | none |
451
- | `pf-cognito-mfa-sms-config` | AWS::Cognito::UserPool | MFA without any factor configuration cannot deploy | none |
452
- | `pf-cognito-oauth-callback-required` | AWS::Cognito::UserPoolClient | code and implicit OAuth flows need CallbackURLs | none |
453
- | `pf-cognito-oauth-flows-scopes-required` | AWS::Cognito::UserPoolClient | Enabling OAuth requires both AllowedOAuthFlows and AllowedOAuthScopes | none |
454
- | `pf-cognito-oauth-scopes-unknown` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPoolResourceServer | OAuth scopes must be standard or come from a resource server | none |
455
- | `pf-cognito-password-history-size-range` | AWS::Cognito::UserPool | PasswordHistorySize must be between 0 and 24 | none |
456
- | `pf-cognito-password-min-length` | AWS::Cognito::UserPool | PasswordPolicy MinimumLength runs 6 to 99 | none |
457
- | `pf-cognito-pre-token-generation-config-tier` | AWS::Cognito::UserPool | Pre token generation V2_0 and later need ESSENTIALS or PLUS | none |
458
- | `pf-cognito-pre-token-generation-legacy-mix` | AWS::Cognito::UserPool | PreTokenGeneration and PreTokenGenerationConfig must name the same function | none |
459
- | `pf-cognito-propagate-context-requires-secret` | AWS::Cognito::UserPoolClient | Propagating user context data requires a client secret | none |
460
- | `pf-cognito-read-attributes-exists` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPool | ReadAttributes must name attributes the pool has | none |
461
- | `pf-cognito-recovery-admin-only-alone` | AWS::Cognito::UserPool | admin_only cannot be combined with other recovery mechanisms | none |
462
- | `pf-cognito-recovery-duplicate` | AWS::Cognito::UserPool | Recovery mechanisms cannot repeat priorities or names | none |
463
- | `pf-cognito-recovery-mechanisms-max` | AWS::Cognito::UserPool | At most two account recovery mechanisms | none |
464
- | `pf-cognito-resource-server-identifier-charset` | AWS::Cognito::UserPoolResourceServer | A resource server identifier takes no spaces | none |
465
- | `pf-cognito-resource-server-scope-name-charset` | AWS::Cognito::UserPoolResourceServer | Scope names take no spaces or quotes | none |
466
- | `pf-cognito-resource-server-scopes-max` | AWS::Cognito::UserPoolResourceServer | At most 100 scopes per resource server | none |
467
- | `pf-cognito-risk-account-takeover-event-action-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Account takeover actions take four values | none |
468
- | `pf-cognito-risk-compromised-event-action-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Compromised credentials action is BLOCK or NO_ACTION | none |
469
- | `pf-cognito-risk-compromised-event-filter-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Compromised credentials event filter takes three values | none |
470
- | `pf-cognito-risk-ip-range-cidr` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Blocked and skipped IP ranges are CIDR blocks | none |
471
- | `pf-cognito-risk-ip-range-max` | AWS::Cognito::UserPoolRiskConfigurationAttachment | At most 200 blocked IP ranges | none |
472
- | `pf-cognito-risk-notify-source-arn-region` | AWS::Cognito::UserPoolRiskConfigurationAttachment | The notification SourceArn must be in a Cognito-supported SES region | none |
473
- | `pf-cognito-role-attachment-roles-keys` | AWS::Cognito::IdentityPoolRoleAttachment | Roles keys are authenticated and unauthenticated | none |
474
- | `pf-cognito-role-mapping-rule-match-type` | AWS::Cognito::IdentityPoolRoleAttachment | MatchType is Equals, Contains, StartsWith or NotEqual | none |
475
- | `pf-cognito-role-mapping-rules-max` | AWS::Cognito::IdentityPoolRoleAttachment | At most 25 rules per role mapping | none |
476
- | `pf-cognito-role-mappings-ambiguous-required` | AWS::Cognito::IdentityPoolRoleAttachment | A role mapping needs AmbiguousRoleResolution | none |
477
- | `pf-cognito-role-mappings-key-format` | AWS::Cognito::IdentityPoolRoleAttachment | A role mapping key is a provider name | none |
478
- | `pf-cognito-role-mappings-rules-required` | AWS::Cognito::IdentityPoolRoleAttachment | A Rules role mapping needs RulesConfiguration | none |
479
- | `pf-cognito-role-mappings-token-no-rules` | AWS::Cognito::IdentityPoolRoleAttachment | A Token role mapping takes no RulesConfiguration | none |
480
- | `pf-cognito-schema-attr-length-order` | AWS::Cognito::UserPool | Schema attribute MaxLength cannot undercut MinLength | none |
481
- | `pf-cognito-schema-attr-max` | AWS::Cognito::UserPool | A user pool takes at most 50 custom attributes | none |
482
- | `pf-cognito-schema-custom-name-length` | AWS::Cognito::UserPool | A schema attribute name is capped at 20 characters | none |
483
- | `pf-cognito-schema-custom-required` | AWS::Cognito::UserPool | Custom attributes cannot be required | none |
484
- | `pf-cognito-schema-name-duplicate` | AWS::Cognito::UserPool | Schema attribute names must be unique | none |
485
- | `pf-cognito-schema-number-min-max-order` | AWS::Cognito::UserPool | Number attribute MinValue must not exceed MaxValue | none |
486
- | `pf-cognito-schema-standard-attr-datatype` | AWS::Cognito::UserPool | Standard attributes keep their fixed data type | none |
487
- | `pf-cognito-signin-policy-password-required` | AWS::Cognito::UserPool | AllowedFirstAuthFactors must include PASSWORD | none |
488
- | `pf-cognito-signin-policy-webauthn-tier` | AWS::Cognito::UserPool | Passwordless sign-in factors need ESSENTIALS or PLUS | none |
489
- | `pf-cognito-sms-authentication-message-placeholder` | AWS::Cognito::UserPool | SmsAuthenticationMessage needs the {####} code placeholder | none |
490
- | `pf-cognito-sms-caller-arn-account` | AWS::Cognito::UserPool | The SMS caller role must be in the deploying account | none |
491
- | `pf-cognito-sms-configuration-sns-region` | AWS::Cognito::UserPool | SnsRegion must be the region the pool deploys to | none |
492
- | `pf-cognito-sms-verification-message-placeholder` | AWS::Cognito::UserPool | SmsVerificationMessage needs the {####} code placeholder | none |
493
- | `pf-cognito-supported-identity-providers-exists` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPoolIdentityProvider | Supported identity providers must exist on the pool | none |
494
- | `pf-cognito-temporary-password-validity-range` | AWS::Cognito::UserPool | TemporaryPasswordValidityDays must be between 0 and 365 | none |
495
- | `pf-cognito-token-expiration-order` | AWS::Cognito::UserPoolClient | Access and id tokens cannot outlive the refresh token | none |
496
- | `pf-cognito-token-validity-range` | AWS::Cognito::UserPoolClient | Token validity ranges depend on token type and unit | none |
497
- | `pf-cognito-ui-customization-css-properties` | AWS::Cognito::UserPoolUICustomizationAttachment | Hosted UI CSS only styles the -customizable classes | none |
498
- | `pf-cognito-ui-customization-requires-domain` | AWS::Cognito::UserPoolUICustomizationAttachment<br>AWS::Cognito::UserPoolDomain | Hosted UI customization requires a domain on the pool | none |
499
- | `pf-cognito-unused-account-validity-exclusive` | AWS::Cognito::UserPool | UnusedAccountValidityDays and TemporaryPasswordValidityDays are exclusive | none |
500
- | `pf-cognito-unused-account-validity-range` | AWS::Cognito::UserPool | UnusedAccountValidityDays must be between 0 and 365 | none |
501
- | `pf-cognito-user-attribute-update-requires-auto-verified` | AWS::Cognito::UserPool | Attributes requiring verification before update must be auto-verified | none |
502
- | `pf-cognito-user-attribute-update-settings-enum` | AWS::Cognito::UserPool | Only email and phone_number can require verification before update | none |
503
- | `pf-cognito-user-pool-name` | AWS::Cognito::UserPool | User pool names allow only word characters, spaces and +=,.@- | none |
504
- | `pf-cognito-verification-code-placeholder` | AWS::Cognito::UserPool | The verification email needs the {####} code placeholder | none |
505
- | `pf-cognito-verification-email-subject-length` | AWS::Cognito::UserPool | The verification email subject is capped at 140 characters | none |
506
- | `pf-cognito-verification-link-placeholder` | AWS::Cognito::UserPool | A link verification message needs the {##...##} placeholder | none |
507
- | `pf-cognito-verification-sms-placeholder` | AWS::Cognito::UserPool | The verification SMS needs the {####} code placeholder | none |
508
- | `pf-cognito-web-authn-relying-party-format` | AWS::Cognito::UserPool | WebAuthnRelyingPartyID is a bare domain name | none |
509
- | `pf-cognito-write-attributes-immutable` | AWS::Cognito::UserPoolClient | Verified-status attributes cannot be written by a client | none |
510
- | `pf-dynamodb-attribute-definitions-usage` | AWS::DynamoDB::Table | Every AttributeDefinitions entry must be used by a key schema | none |
511
- | `pf-dynamodb-attribute-type` | AWS::DynamoDB::Table | AttributeType must be S, N or B | pending-engine |
512
- | `pf-dynamodb-billing-throughput` | AWS::DynamoDB::Table | ProvisionedThroughput must match BillingMode (required for PROVISIONED, forbidden for PAY_PER_REQUEST) | none |
513
- | `pf-dynamodb-contributor-insights-mode` | AWS::DynamoDB::Table | Contributor Insights Mode must be ACCESSED_AND_THROTTLED_KEYS or THROTTLED_KEYS | pending-engine |
514
- | `pf-dynamodb-duplicate-attribute-definitions` | AWS::DynamoDB::Table | AttributeDefinitions must not define the same attribute twice | none |
515
- | `pf-dynamodb-duplicate-index-name` | AWS::DynamoDB::Table | Secondary index names must be unique | none |
516
- | `pf-dynamodb-global-table-attribute-definitions` | AWS::DynamoDB::GlobalTable | GlobalTable AttributeDefinitions must match the key schemas exactly | none |
517
- | `pf-dynamodb-global-table-gsi-count` | AWS::DynamoDB::GlobalTable | A global table can carry at most 20 global secondary indexes | none |
518
- | `pf-dynamodb-global-table-gsi-provisioned-write-settings` | AWS::DynamoDB::GlobalTable | Each GSI of a PROVISIONED GlobalTable needs WriteProvisionedThroughputSettings | none |
519
- | `pf-dynamodb-global-table-key-schema-shape` | AWS::DynamoDB::GlobalTable | GlobalTable KeySchema must be [HASH] or [HASH, RANGE] | none |
520
- | `pf-dynamodb-global-table-lsi-attribute-definitions` | AWS::DynamoDB::GlobalTable | GlobalTable LSI key attributes must be defined in AttributeDefinitions | none |
521
- | `pf-dynamodb-global-table-lsi-count` | AWS::DynamoDB::GlobalTable | A global table can carry at most 5 local secondary indexes | none |
522
- | `pf-dynamodb-global-table-lsi-shape` | AWS::DynamoDB::GlobalTable | A GlobalTable LSI needs a RANGE key and the table's leading hash key | none |
523
- | `pf-dynamodb-global-table-mrsc-lsi` | AWS::DynamoDB::GlobalTable | MRSC global tables do not support local secondary indexes | none |
524
- | `pf-dynamodb-global-table-mrsc-region-set` | AWS::DynamoDB::GlobalTable | An MRSC global table cannot span Region sets | none |
525
- | `pf-dynamodb-global-table-mrsc-replica-count` | AWS::DynamoDB::GlobalTable | An MRSC global table spans exactly three Regions | none |
526
- | `pf-dynamodb-global-table-mrsc-ttl` | AWS::DynamoDB::GlobalTable | MRSC global tables do not support TTL | none |
527
- | `pf-dynamodb-global-table-name-length` | AWS::DynamoDB::GlobalTable | GlobalTable TableName must be at least 3 characters | none |
528
- | `pf-dynamodb-global-table-ondemand-settings-billing` | AWS::DynamoDB::GlobalTable | On-demand throughput settings need BillingMode PAY_PER_REQUEST | none |
529
- | `pf-dynamodb-global-table-projection-nonkey` | AWS::DynamoDB::GlobalTable | GlobalTable NonKeyAttributes goes with INCLUDE, and only with INCLUDE | none |
530
- | `pf-dynamodb-global-table-provisioned-write-settings` | AWS::DynamoDB::GlobalTable | A PROVISIONED GlobalTable needs WriteProvisionedThroughputSettings | none |
531
- | `pf-dynamodb-global-table-read-capacity-exclusive` | AWS::DynamoDB::GlobalTable | A replica sets either ReadCapacityUnits or autoscaling, never both or neither | none |
532
- | `pf-dynamodb-global-table-read-settings-multi-account` | AWS::DynamoDB::GlobalTable | Table-level read throughput settings are for multi-account global tables only | none |
533
- | `pf-dynamodb-global-table-replica-gsi-name` | AWS::DynamoDB::GlobalTable | A replica can only override an index the global table declares | none |
534
- | `pf-dynamodb-global-table-replica-kinesis-region` | AWS::DynamoDB::GlobalTable | A replica's Kinesis destination must be in the replica's Region | none |
535
- | `pf-dynamodb-global-table-replica-region` | AWS::DynamoDB::GlobalTable | GlobalTable Replicas must include the deployment region | none |
536
- | `pf-dynamodb-global-table-replica-sse-key-coverage` | AWS::DynamoDB::GlobalTable | Either every replica names a KMS key, or none does | none |
537
- | `pf-dynamodb-global-table-replica-sse-key-region` | AWS::DynamoDB::GlobalTable | A replica's KMS key must live in the replica's Region | none |
538
- | `pf-dynamodb-global-table-stream-required` | AWS::DynamoDB::GlobalTable | An MREC global table with more than one replica needs a stream | none |
539
- | `pf-dynamodb-global-table-witness-region` | AWS::DynamoDB::GlobalTable | A witness lives in a Region that has no replica | none |
540
- | `pf-dynamodb-global-table-witness-requires-mrsc` | AWS::DynamoDB::GlobalTable | GlobalTableWitnesses only exists for MRSC global tables | none |
541
- | `pf-dynamodb-global-table-write-provisioned-with-ppr` | AWS::DynamoDB::GlobalTable | WriteProvisionedThroughputSettings cannot be used with PAY_PER_REQUEST | none |
542
- | `pf-dynamodb-gsi-billing-throughput` | AWS::DynamoDB::Table | GSI ProvisionedThroughput must match the table BillingMode | none |
543
- | `pf-dynamodb-gsi-count` | AWS::DynamoDB::Table | A table can carry at most 20 global secondary indexes | none |
544
- | `pf-dynamodb-gsi-projection-nonkey` | AWS::DynamoDB::Table | NonKeyAttributes goes with INCLUDE, and only with INCLUDE | none |
545
- | `pf-dynamodb-import-csv-delimiter` | AWS::DynamoDB::Table | A CSV import delimiter is a single character from , ; : | tab space | none |
546
- | `pf-dynamodb-import-format-options` | AWS::DynamoDB::Table | InputFormatOptions only applies to CSV imports | none |
547
- | `pf-dynamodb-key-schema-shape` | AWS::DynamoDB::Table | KeySchema must be [HASH] or [HASH, RANGE] | none |
548
- | `pf-dynamodb-kinesis-precision` | AWS::DynamoDB::Table | Kinesis record timestamp precision is MICROSECOND or MILLISECOND | pending-engine |
549
- | `pf-dynamodb-kinesis-stream-region` | AWS::DynamoDB::Table | A Kinesis streaming destination must be in the table's region | none |
550
- | `pf-dynamodb-lsi-attribute-definitions` | AWS::DynamoDB::Table | LSI key attributes must be defined in AttributeDefinitions | none |
551
- | `pf-dynamodb-lsi-count` | AWS::DynamoDB::Table | A table can carry at most 5 local secondary indexes | none |
552
- | `pf-dynamodb-lsi-shape` | AWS::DynamoDB::Table | An LSI needs a RANGE key and the table's leading hash key | none |
553
- | `pf-dynamodb-ondemand-throughput-billing` | AWS::DynamoDB::Table | OnDemandThroughput belongs to PAY_PER_REQUEST tables only | none |
554
- | `pf-dynamodb-pitr-recovery-period` | AWS::DynamoDB::Table | RecoveryPeriodInDays needs point-in-time recovery turned on | none |
555
- | `pf-dynamodb-projection-nonkey-limit` | AWS::DynamoDB::Table | One index can project at most 20 non-key attributes | none |
556
- | `pf-dynamodb-projection-nonkey-total` | AWS::DynamoDB::Table | Projected non-key attributes are capped at 100 across all indexes | none |
557
- | `pf-dynamodb-resource-policy-principal` | AWS::DynamoDB::Table | Every resource policy statement needs a Principal | none |
558
- | `pf-dynamodb-resource-policy-size` | AWS::DynamoDB::Table | A table resource policy must stay under 20480 bytes | none |
559
- | `pf-dynamodb-sse-type` | AWS::DynamoDB::Table | SSEType must be KMS, and only when SSE is enabled | none |
560
- | `pf-dynamodb-table-class` | AWS::DynamoDB::Table | TableClass must be STANDARD or STANDARD_INFREQUENT_ACCESS | pending-engine |
561
- | `pf-dynamodb-table-name-format` | AWS::DynamoDB::Table<br>AWS::DynamoDB::GlobalTable | Table names allow only letters, numbers, underscore, dot and hyphen (max 255) | none |
562
- | `pf-dynamodb-table-name-length` | AWS::DynamoDB::Table | TableName must be at least 3 characters | pending-engine |
563
- | `pf-dynamodb-ttl-attribute-required` | AWS::DynamoDB::Table | Enabling TTL requires an AttributeName | none |
564
- | `pf-dynamodb-warm-throughput-minimum` | AWS::DynamoDB::Table | WarmThroughput cannot go below the default 12000 read / 4000 write | none |
565
- | `pf-ec2-client-vpn-auth-type-config` | AWS::EC2::ClientVpnEndpoint | Client VPN AuthenticationOptions.Type must match the provided authentication sub-block | none |
566
- | `pf-ec2-client-vpn-authorization-rule-exclusive` | AWS::EC2::ClientVpnAuthorizationRule | Client VPN authorization rule cannot set both AccessGroupId and AuthorizeAllGroups | none |
567
- | `pf-ec2-client-vpn-cert-region` | AWS::EC2::ClientVpnEndpoint | The Client VPN server certificate must be in the deploy region | none |
568
- | `pf-ec2-client-vpn-cidr-size` | AWS::EC2::ClientVpnEndpoint | Client VPN ClientCidrBlock must be between /12 and /22 | none |
569
- | `pf-ec2-client-vpn-connection-log` | AWS::EC2::ClientVpnEndpoint | Client VPN ConnectionLogOptions.Enabled requires CloudwatchLogGroup | none |
570
- | `pf-ec2-client-vpn-port` | AWS::EC2::ClientVpnEndpoint | Client VPN VpnPort must be 443 or 1194 | none |
571
- | `pf-ec2-client-vpn-session-timeout` | AWS::EC2::ClientVpnEndpoint | Client VPN SessionTimeoutHours must be 8, 10, 12 or 24 | none |
572
- | `pf-ec2-cpu-options-combination` | AWS::EC2::Instance | CpuOptions ThreadsPerCore and CoreCount must be in range | none |
573
- | `pf-ec2-credit-specification-burstable` | AWS::EC2::Instance | CreditSpecification applies only to burstable instance types | none |
574
- | `pf-ec2-dhcp-ntp-servers-count` | AWS::EC2::DHCPOptions | DHCP server lists take at most four addresses | none |
575
- | `pf-ec2-dhcp-options-empty` | AWS::EC2::DHCPOptions | A DHCP options set must configure at least one option | none |
576
- | `pf-ec2-eip-association-exclusive` | AWS::EC2::EIPAssociation | An EIP association cannot set both AllocationId and EIP | none |
577
- | `pf-ec2-enclave-hibernation-exclusive` | AWS::EC2::Instance | Nitro Enclaves and hibernation cannot both be enabled | none |
578
- | `pf-ec2-eni-primary-single` | AWS::EC2::NetworkInterface | A network interface takes exactly one primary private IP | none |
579
- | `pf-ec2-eni-private-ip-in-subnet` | AWS::EC2::NetworkInterface | A network interface private IP must fall inside its subnet | none |
580
- | `pf-ec2-eni-public-ip-device-index` | AWS::EC2::Instance | AssociatePublicIpAddress is only valid on device index 0 | none |
581
- | `pf-ec2-flow-log-aggregation-interval` | AWS::EC2::FlowLog | Flow log MaxAggregationInterval accepts only 60 or 600 seconds | none |
582
- | `pf-ec2-flow-log-destination-config` | AWS::EC2::FlowLog | Flow log destination type requires its matching destination property | none |
583
- | `pf-ec2-flow-log-format-fields` | AWS::EC2::FlowLog | Flow log LogFormat accepts only documented field names | none |
584
- | `pf-ec2-flow-log-transit-gateway-traffic-type` | AWS::EC2::FlowLog | A Transit Gateway flow log cannot take TrafficType | none |
585
- | `pf-ec2-host-resource-group-tenancy` | AWS::EC2::Instance | HostResourceGroupArn requires Tenancy host | none |
586
- | `pf-ec2-instance-ami-arch` | AWS::EC2::Instance | Instance type architecture must match the SSM public-parameter AMI architecture | none |
587
- | `pf-ec2-instance-eni-exclusive` | AWS::EC2::Instance | An instance cannot mix NetworkInterfaces with instance-level security groups | none |
588
- | `pf-ec2-instance-ipv6-exclusive` | AWS::EC2::Instance | Ipv6AddressCount and Ipv6Addresses are mutually exclusive | none |
589
- | `pf-ec2-instance-requirements-exclusive` | AWS::EC2::LaunchTemplate | A launch template takes either InstanceType or InstanceRequirements | none |
590
- | `pf-ec2-key-pair-name-whitespace` | AWS::EC2::KeyPair | A key pair name cannot have leading or trailing whitespace | none |
591
- | `pf-ec2-launch-template-name` | AWS::EC2::LaunchTemplate | Launch template names are 3-128 chars of letters, numbers and -()./_ | none |
592
- | `pf-ec2-nacl-rule-number-unique` | AWS::EC2::NetworkAclEntry | Network ACL rule numbers must be unique per direction | none |
593
- | `pf-ec2-natgw-allocation` | AWS::EC2::NatGateway | NAT gateway AllocationId is required for public connectivity and forbidden for private | none |
594
- | `pf-ec2-natgw-secondary-ip-exclusive` | AWS::EC2::NatGateway | NAT gateway secondary IP count and list are mutually exclusive | none |
595
- | `pf-ec2-pg-cluster-burstable` | AWS::EC2::Instance<br>AWS::EC2::PlacementGroup | Burstable instance types are not supported in cluster placement groups | none |
596
- | `pf-ec2-placement-group-partition-count` | AWS::EC2::PlacementGroup | PartitionCount is only valid with the partition strategy | none |
597
- | `pf-ec2-placement-group-spread-level` | AWS::EC2::PlacementGroup | SpreadLevel is only valid with the spread or partition strategy | none |
598
- | `pf-ec2-prefix-list-address-family` | AWS::EC2::PrefixList | Prefix list entries must match the declared address family | none |
599
- | `pf-ec2-prefix-list-max-entries` | AWS::EC2::PrefixList | A managed prefix list cannot hold more entries than MaxEntries | none |
600
- | `pf-ec2-prefix-list-name-reserved` | AWS::EC2::PrefixList | A managed prefix list name cannot use an AWS-reserved prefix | none |
601
- | `pf-ec2-route-target-exactly-one` | AWS::EC2::Route | A route must name exactly one target | none |
602
- | `pf-ec2-sg-cidr-valid` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | Security group rule CidrIp must be a well-formed IPv4 CIDR | none |
603
- | `pf-ec2-sg-group-name` | AWS::EC2::SecurityGroup | Security group names may not start with sg- | none |
604
- | `pf-ec2-sg-group-name-default` | AWS::EC2::SecurityGroup | A security group cannot be named default | none |
605
- | `pf-ec2-sg-icmp-type-code` | AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | ICMP type and code must be within -1 to 255 | none |
606
- | `pf-ec2-sg-port-range` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | Security group TCP/UDP ports must be within 0-65535 and FromPort <= ToPort | none |
607
- | `pf-ec2-sg-rule-description` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | Security group rule descriptions are limited to 255 chars of a restricted ASCII set | none |
608
- | `pf-ec2-sg-source-exclusive` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | A security group rule takes exactly one source/destination field | none |
609
- | `pf-ec2-subnet-cidr-size` | AWS::EC2::Subnet | Subnet IPv4 CIDR netmask must be between /16 and /28 | none |
610
- | `pf-ec2-subnet-dns64-ipv6` | AWS::EC2::Subnet | EnableDns64 requires the subnet to have an IPv6 CIDR | none |
611
- | `pf-ec2-subnet-ipv6-native-cidr` | AWS::EC2::Subnet | An IPv6-only subnet cannot carry IPv4 addressing | none |
612
- | `pf-ec2-tgw-amazon-side-asn` | AWS::EC2::TransitGateway | TransitGateway AmazonSideAsn must be in 64512-65534 or 4200000000-4294967294 | none |
613
- | `pf-ec2-tgw-cidr-block-size` | AWS::EC2::TransitGateway | TransitGatewayCidrBlocks must be /24 or larger for IPv4 | none |
614
- | `pf-ec2-tgw-route-blackhole-exclusive` | AWS::EC2::TransitGatewayRoute | A blackhole transit gateway route cannot name an attachment | none |
615
- | `pf-ec2-traffic-mirror-target-exactly-one` | AWS::EC2::TrafficMirrorTarget | A traffic mirror target names exactly one destination | none |
616
- | `pf-ec2-userdata-size` | AWS::EC2::Instance<br>AWS::EC2::LaunchTemplate | EC2 user data is limited to 16384 bytes | none |
617
- | `pf-ec2-volume-iops` | AWS::EC2::Volume | EBS Iops/Throughput must match the volume type's supported ranges and ratios | none |
618
- | `pf-ec2-volume-iops-required` | AWS::EC2::Volume | io1 and io2 volumes require the Iops property | none |
619
- | `pf-ec2-volume-kms-encrypted` | AWS::EC2::Volume | KmsKeyId on a volume requires Encrypted to be true | none |
620
- | `pf-ec2-volume-multi-attach-type` | AWS::EC2::Volume | Multi-Attach is only available on io1 and io2 volumes | none |
621
- | `pf-ec2-volume-size-minimum` | AWS::EC2::Volume | EBS volume size must meet the volume type minimum (io1/io2 4 GiB, st1/sc1 125 GiB) | none |
622
- | `pf-ec2-volume-throughput-type` | AWS::EC2::Volume | EBS Throughput applies only to gp3 volumes | none |
623
- | `pf-ec2-vpc-cidr-block-overlap` | AWS::EC2::VPCCidrBlock | A secondary VPC CIDR cannot overlap the primary | none |
624
- | `pf-ec2-vpc-cidr-block-size` | AWS::EC2::VPC | VPC IPv4 CIDR block netmask must be between /16 and /28 | none |
625
- | `pf-ec2-vpc-cidr-reserved-range` | AWS::EC2::VPC | A VPC CIDR must not overlap a reserved IPv4 range | none |
626
- | `pf-ec2-vpc-single-igw` | AWS::EC2::VPCGatewayAttachment | A VPC accepts only one internet gateway attachment | none |
627
- | `pf-ec2-vpce-gateway-service` | AWS::EC2::VPCEndpoint | Gateway VPC endpoints only exist for S3 and DynamoDB | none |
628
- | `pf-ec2-vpce-service-region` | AWS::EC2::VPCEndpoint | VPC endpoint service names must use the deploy region unless ServiceRegion is set | none |
629
- | `pf-ec2-vpce-subnet-az-unique` | AWS::EC2::VPCEndpoint | An interface VPC endpoint takes at most one subnet per availability zone | none |
630
- | `pf-ec2-vpce-type-config` | AWS::EC2::VPCEndpoint | SubnetIds are not supported on Gateway endpoints (and RouteTableIds only on Gateway) | none |
631
- | `pf-ec2-vpn-gateway-exclusive` | AWS::EC2::VPNConnection | A VPN connection cannot name both a VPN gateway and a transit gateway | none |
632
- | `pf-ec2-vpn-phase-lifetime-order` | AWS::EC2::VPNConnection | VPN Phase2LifetimeSeconds must be less than Phase1LifetimeSeconds | none |
633
- | `pf-ec2-vpn-pre-shared-key` | AWS::EC2::VPNConnection | VPN tunnel PreSharedKey must be 8-64 characters of [A-Za-z0-9._] and must not start with 0 | none |
634
- | `pf-ec2-vpn-rekey-margin` | AWS::EC2::VPNConnection | VPN RekeyMarginTimeSeconds must be less than half of Phase2LifetimeSeconds | none |
635
- | `pf-ec2-vpn-tunnel-inside-cidr` | AWS::EC2::VPNConnection | VPN TunnelInsideCidr must be a /30 inside 169.254.0.0/16 and not one of the reserved ranges | none |
636
- | `pf-ecr-encryption-configuration` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | KmsKey is only valid with EncryptionType KMS/KMS_DSSE and must live in the deploy region | none |
637
- | `pf-ecr-image-tag-mutability-filters` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | ImageTagMutabilityExclusionFilters requires a *_WITH_EXCLUSION mutability setting, and vice versa | none |
638
- | `pf-ecr-lifecycle-action` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The action type is expire or transition, and transition requires targetStorageClass: archive | none |
639
- | `pf-ecr-lifecycle-count` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | countUnit belongs to the sinceImage* count types only, countNumber must be positive and storageClass follows countType | none |
640
- | `pf-ecr-lifecycle-policy-syntax` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The lifecycle policy must be a JSON document with 1-50 rules, each holding rulePriority, selection and action and no other keys | none |
641
- | `pf-ecr-lifecycle-rule-priority` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | rulePriority must be unique and >= 1, and the single tagStatus=any rule must carry the highest priority | none |
642
- | `pf-ecr-lifecycle-tag-status` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | tagStatus=tagged needs exactly one of tagPrefixList / tagPatternList, tagStatus=untagged or any takes neither | none |
643
- | `pf-ecr-pull-through-cache-credential` | AWS::ECR::PullThroughCacheRule | CredentialArn is required for the authenticated upstream registries, rejected for the open ones, and must name a secret in the deploy account and region | none |
644
- | `pf-ecr-pull-through-cache-registry-match` | AWS::ECR::PullThroughCacheRule | UpstreamRegistry must name the registry the URL belongs to | none |
645
- | `pf-ecr-pull-through-cache-url` | AWS::ECR::PullThroughCacheRule | UpstreamRegistryUrl must be one of the supported upstream endpoints and cannot be this registry itself | none |
646
- | `pf-ecr-registry-scanning-configuration` | AWS::ECR::RegistryScanningConfiguration | BASIC scanning supports SCAN_ON_PUSH only, and two rules cannot share a scan frequency | none |
647
- | `pf-ecr-replication-destination` | AWS::ECR::ReplicationConfiguration | A replication destination must be another registry: not the deploy account in the deploy region, and not another partition | none |
648
- | `pf-ecr-repository-creation-template-applied-for` | AWS::ECR::RepositoryCreationTemplate | AppliedFor accepts REPLICATION, PULL_THROUGH_CACHE and CREATE_ON_PUSH only | none |
649
- | `pf-ecr-signing-profile-region` | AWS::ECR::SigningConfiguration | A signing profile ARN must be in the same region as the registry | none |
650
- | `pf-ecs-awsfirelens-without-router` | AWS::ECS::TaskDefinition | The awsfirelens log driver requires a FireLens router container | none |
651
- | `pf-ecs-awslogs-fargate-missing-stream-prefix` | AWS::ECS::TaskDefinition | awslogs on Fargate requires the awslogs-stream-prefix option | none |
652
- | `pf-ecs-awslogs-missing-group` | AWS::ECS::TaskDefinition | The awslogs log driver requires the awslogs-group option | none |
653
- | `pf-ecs-awsvpc-extra-hosts` | AWS::ECS::TaskDefinition | ExtraHosts is not supported with NetworkMode awsvpc | none |
654
- | `pf-ecs-awsvpc-hostname` | AWS::ECS::TaskDefinition | Hostname is not supported with NetworkMode awsvpc | none |
655
- | `pf-ecs-cluster-default-strategy-multiple-base` | AWS::ECS::Cluster | Only one default capacity provider may set Base | none |
656
- | `pf-ecs-cluster-default-strategy-provider-not-listed` | AWS::ECS::Cluster | DefaultCapacityProviderStrategy may only use listed capacity providers | none |
657
- | `pf-ecs-cluster-execute-command-default-with-log-config` | AWS::ECS::Cluster | A LogConfiguration requires ExecuteCommand Logging OVERRIDE | none |
658
- | `pf-ecs-cluster-execute-command-override-without-log-config` | AWS::ECS::Cluster | ExecuteCommand Logging OVERRIDE requires a LogConfiguration | none |
659
- | `pf-ecs-cluster-name` | AWS::ECS::Cluster | ECS cluster names allow only letters, numbers, hyphen and underscore (max 255) | none |
660
- | `pf-ecs-container-definitions-empty` | AWS::ECS::TaskDefinition | ContainerDefinitions must contain at least one container | pending-engine |
661
- | `pf-ecs-container-memory-over-task` | AWS::ECS::TaskDefinition | A container Memory must not exceed the task-level Memory | none |
662
- | `pf-ecs-container-memory-required` | AWS::ECS::TaskDefinition | A container needs Memory or MemoryReservation when the task sets no Memory | none |
663
- | `pf-ecs-container-memory-reservation` | AWS::ECS::TaskDefinition | MemoryReservation must not exceed Memory | none |
664
- | `pf-ecs-cp-managed-termination-scale-in-protection` | AWS::ECS::CapacityProvider | ManagedTerminationProtection requires scale-in protection on the Auto Scaling group | none |
665
- | `pf-ecs-cp-name-reserved-prefix` | AWS::ECS::CapacityProvider | Capacity provider names cannot start with aws, ecs or fargate | none |
666
- | `pf-ecs-cp-scaling-step-order` | AWS::ECS::CapacityProvider | MinimumScalingStepSize must not exceed MaximumScalingStepSize | none |
667
- | `pf-ecs-dependson-complete-on-essential` | AWS::ECS::TaskDefinition | DependsOn COMPLETE / SUCCESS cannot target an essential container | none |
668
- | `pf-ecs-dependson-container-missing` | AWS::ECS::TaskDefinition | DependsOn.ContainerName must name a container in the same task | none |
669
- | `pf-ecs-dependson-healthy-without-healthcheck` | AWS::ECS::TaskDefinition | DependsOn Condition HEALTHY needs a HealthCheck on the target container | none |
670
- | `pf-ecs-duplicate-container-names` | AWS::ECS::TaskDefinition | Container names must be unique within a task definition | none |
671
- | `pf-ecs-efs-access-point-with-root-directory` | AWS::ECS::TaskDefinition | An EFS access point requires RootDirectory to be "/" or omitted | none |
672
- | `pf-ecs-efs-iam-without-transit-encryption` | AWS::ECS::TaskDefinition | EFS IAM authorization requires TransitEncryption ENABLED | none |
673
- | `pf-ecs-efs-transit-encryption-port-without-encryption` | AWS::ECS::TaskDefinition | TransitEncryptionPort requires TransitEncryption ENABLED | none |
674
- | `pf-ecs-environment-files-max` | AWS::ECS::TaskDefinition | A container can load at most 10 environment files | none |
675
- | `pf-ecs-environment-files-type` | AWS::ECS::TaskDefinition | EnvironmentFiles.Value must be an S3 object ARN | none |
676
- | `pf-ecs-ephemeral-storage-range` | AWS::ECS::TaskDefinition | EphemeralStorage SizeInGiB must be 21-200 | pending-engine |
677
- | `pf-ecs-essential-container` | AWS::ECS::TaskDefinition | At least one container must be essential | none |
678
- | `pf-ecs-fargate-capabilities-add` | AWS::ECS::TaskDefinition | Fargate only allows SYS_PTRACE in LinuxParameters.Capabilities.Add | none |
679
- | `pf-ecs-fargate-container-cpu-over-task` | AWS::ECS::TaskDefinition | Container Cpu values must not exceed the task-level Cpu | none |
680
- | `pf-ecs-fargate-devices` | AWS::ECS::TaskDefinition | LinuxParameters.Devices is not supported on Fargate | none |
681
- | `pf-ecs-fargate-disable-networking` | AWS::ECS::TaskDefinition | DisableNetworking is not supported with NetworkMode awsvpc | none |
682
- | `pf-ecs-fargate-dns-servers` | AWS::ECS::TaskDefinition | DnsServers is not supported with NetworkMode awsvpc | none |
683
- | `pf-ecs-fargate-docker-security-options` | AWS::ECS::TaskDefinition | DockerSecurityOptions is not supported on Fargate | none |
684
- | `pf-ecs-fargate-docker-volume` | AWS::ECS::TaskDefinition | DockerVolumeConfiguration is not supported on Fargate | none |
685
- | `pf-ecs-fargate-ephemeral-storage-ec2` | AWS::ECS::TaskDefinition | EphemeralStorage is only supported on Fargate | none |
686
- | `pf-ecs-fargate-execution-role-missing-awslogs` | AWS::ECS::TaskDefinition | awslogs on Fargate requires an ExecutionRoleArn | none |
687
- | `pf-ecs-fargate-gpu-resource` | AWS::ECS::TaskDefinition | GPU resource requirements are not supported on Fargate | none |
688
- | `pf-ecs-fargate-host-source-path` | AWS::ECS::TaskDefinition | Volumes[].Host.SourcePath is not supported on Fargate | none |
689
- | `pf-ecs-fargate-inference-accelerator` | AWS::ECS::TaskDefinition | InferenceAccelerators is retired and always rejected | none |
690
- | `pf-ecs-fargate-ipc-mode` | AWS::ECS::TaskDefinition | IpcMode is not supported on Fargate | none |
691
- | `pf-ecs-fargate-links` | AWS::ECS::TaskDefinition | Links is not supported with NetworkMode awsvpc | none |
692
- | `pf-ecs-fargate-log-driver-unsupported` | AWS::ECS::TaskDefinition | Fargate supports only a subset of log drivers | none |
693
- | `pf-ecs-fargate-max-swap` | AWS::ECS::TaskDefinition | LinuxParameters.MaxSwap is not supported on Fargate | none |
694
- | `pf-ecs-fargate-network-mode` | AWS::ECS::TaskDefinition | Fargate task definitions require NetworkMode 'awsvpc' | none |
695
- | `pf-ecs-fargate-pid-mode-host` | AWS::ECS::TaskDefinition | PidMode host is not supported on Fargate | none |
696
- | `pf-ecs-fargate-placement-constraints` | AWS::ECS::TaskDefinition | Task placement constraints are not supported on Fargate | none |
697
- | `pf-ecs-fargate-privileged` | AWS::ECS::TaskDefinition | Privileged is not supported on Fargate | none |
698
- | `pf-ecs-fargate-shared-memory-size` | AWS::ECS::TaskDefinition | LinuxParameters.SharedMemorySize is not supported on Fargate | none |
699
- | `pf-ecs-fargate-task-cpu-memory` | AWS::ECS::TaskDefinition | FARGATE compatibility requires task-level Cpu and Memory | none |
700
- | `pf-ecs-fargate-windows-cpu-under-1vcpu` | AWS::ECS::TaskDefinition | Windows tasks on Fargate need at least 1 vCPU | none |
701
- | `pf-ecs-healthcheck-interval-range` | AWS::ECS::TaskDefinition | HealthCheck.Interval must be 5-300 seconds | none |
702
- | `pf-ecs-healthcheck-retries-range` | AWS::ECS::TaskDefinition | HealthCheck.Retries must be 1-10 | none |
703
- | `pf-ecs-healthcheck-start-period-range` | AWS::ECS::TaskDefinition | HealthCheck.StartPeriod must be 0-300 seconds | none |
704
- | `pf-ecs-healthcheck-timeout-range` | AWS::ECS::TaskDefinition | HealthCheck.Timeout must be 2-60 seconds | none |
705
- | `pf-ecs-host-network-host-port-mismatch` | AWS::ECS::TaskDefinition | NetworkMode host requires HostPort to equal ContainerPort | none |
706
- | `pf-ecs-mountpoint-source-volume-missing` | AWS::ECS::TaskDefinition | MountPoints.SourceVolume must name a volume of the task definition | none |
707
- | `pf-ecs-port-mapping-duplicate-name` | AWS::ECS::TaskDefinition | PortMappings.Name must be unique within a task definition | none |
708
- | `pf-ecs-port-range-overlap` | AWS::ECS::TaskDefinition | ContainerPortRange values must not overlap | none |
709
- | `pf-ecs-port-range-reversed` | AWS::ECS::TaskDefinition | The first port of ContainerPortRange must be below the last | none |
710
- | `pf-ecs-port-range-with-host-port` | AWS::ECS::TaskDefinition | ContainerPortRange cannot be combined with a single port | none |
711
- | `pf-ecs-proxy-configuration-awsvpc-required` | AWS::ECS::TaskDefinition | ProxyConfiguration requires NetworkMode awsvpc | none |
712
- | `pf-ecs-proxy-configuration-container-missing` | AWS::ECS::TaskDefinition | ProxyConfiguration.ContainerName must name a container of the task definition | none |
713
- | `pf-ecs-proxy-configuration-missing-required-props` | AWS::ECS::TaskDefinition | An APPMESH ProxyConfiguration needs the four port properties | none |
714
- | `pf-ecs-restart-policy-attempt-period-range` | AWS::ECS::TaskDefinition | RestartPolicy.RestartAttemptPeriod must be 60-1800 seconds | none |
715
- | `pf-ecs-secrets-without-execution-role` | AWS::ECS::TaskDefinition | Container Secrets require an ExecutionRoleArn | none |
716
- | `pf-ecs-service-codedeploy-lb` | AWS::ECS::Service | CODE_DEPLOY deployment controller requires a load balancer | none |
717
- | `pf-ecs-service-daemon-desired-count` | AWS::ECS::Service | DAEMON scheduling strategy does not accept DesiredCount | none |
718
- | `pf-ecs-service-deployment-percent` | AWS::ECS::Service | DeploymentConfiguration percent bounds (min <= 100, max >= 100) | none |
719
- | `pf-ecs-service-fargate-placement` | AWS::ECS::Service | Placement constraints and strategies are not supported on FARGATE | none |
720
- | `pf-ecs-service-launch-type-capacity-provider` | AWS::ECS::Service | LaunchType and CapacityProviderStrategy are mutually exclusive | none |
721
- | `pf-ecs-service-lb-target-exclusive` | AWS::ECS::Service | A load balancer entry takes either TargetGroupArn or LoadBalancerName, not both | none |
722
- | `pf-ecs-service-name` | AWS::ECS::Service | ECS service names allow only letters, numbers, hyphen and underscore (max 255) | none |
723
- | `pf-ecs-service-network-config-mode` | AWS::ECS::Service<br>AWS::ECS::TaskDefinition | NetworkConfiguration requires an awsvpc task definition | none |
724
- | `pf-ecs-service-platform-version-ec2` | AWS::ECS::Service | PlatformVersion is not allowed with the EC2 launch type | none |
725
- | `pf-ecs-svc-az-rebalancing-with-daemon` | AWS::ECS::Service | AvailabilityZoneRebalancing is not supported for DAEMON services | none |
726
- | `pf-ecs-svc-binpack-field` | AWS::ECS::Service | A binpack placement strategy accepts only cpu or memory | none |
727
- | `pf-ecs-svc-capacity-provider-multiple-base` | AWS::ECS::Service | Only one capacity provider in a strategy may set Base | none |
728
- | `pf-ecs-svc-capacity-provider-zero-weight` | AWS::ECS::Service | A capacity provider strategy needs at least one non-zero Weight | none |
729
- | `pf-ecs-svc-circuit-breaker-with-code-deploy` | AWS::ECS::Service | DeploymentCircuitBreaker only works with the ECS deployment controller | none |
730
- | `pf-ecs-svc-classic-lb-with-fargate` | AWS::ECS::Service | Classic Load Balancers are not supported with Fargate | none |
731
- | `pf-ecs-svc-connect-client-alias-dns-name` | AWS::ECS::Service | A Service Connect ClientAlias.DnsName must be a valid DNS name | none |
732
- | `pf-ecs-svc-connect-client-aliases-max` | AWS::ECS::Service | A Service Connect service accepts at most one ClientAlias | none |
733
- | `pf-ecs-svc-connect-port-name-missing` | AWS::ECS::Service | Service Connect PortName must match a named port mapping | none |
734
- | `pf-ecs-svc-connect-without-namespace` | AWS::ECS::Service | Service Connect needs a Namespace on the service or the cluster | none |
735
- | `pf-ecs-svc-daemon-max-percent` | AWS::ECS::Service | A DAEMON service requires DeploymentConfiguration.MaximumPercent 100 | none |
736
- | `pf-ecs-svc-daemon-with-placement-strategies` | AWS::ECS::Service | A DAEMON service does not accept placement strategies | none |
737
- | `pf-ecs-svc-ebs-iops-unsupported-type` | AWS::ECS::Service | ManagedEBSVolume Iops is only valid for io1, io2 and gp3 | none |
738
- | `pf-ecs-svc-ebs-name-not-in-taskdef` | AWS::ECS::Service | VolumeConfigurations.Name must match a ConfiguredAtLaunch volume | none |
739
- | `pf-ecs-svc-ebs-throughput-non-gp3` | AWS::ECS::Service | ManagedEBSVolume Throughput is only valid for gp3 | none |
740
- | `pf-ecs-svc-ebs-volume-without-size-or-snapshot` | AWS::ECS::Service | A managed EBS volume needs SizeInGiB or SnapshotId | none |
741
- | `pf-ecs-svc-external-with-load-balancers` | AWS::ECS::Service | An EXTERNAL deployment controller does not accept LoadBalancers | none |
742
- | `pf-ecs-svc-external-with-taskdef` | AWS::ECS::Service | An EXTERNAL deployment controller does not accept TaskDefinition | none |
743
- | `pf-ecs-svc-lb-container-name-missing` | AWS::ECS::Service | LoadBalancers.ContainerName must name a container of the task definition | none |
744
- | `pf-ecs-svc-lb-container-port-missing` | AWS::ECS::Service | LoadBalancers.ContainerPort must match a port mapping of the container | none |
745
- | `pf-ecs-svc-min-healthy-over-max-percent` | AWS::ECS::Service | MinimumHealthyPercent must stay below MaximumPercent | none |
746
- | `pf-ecs-svc-placement-constraint-distinct-instance-expression` | AWS::ECS::Service | distinctInstance placement constraints take no Expression | none |
747
- | `pf-ecs-svc-placement-strategies-max6` | AWS::ECS::Service | A service accepts at most 5 placement strategies | none |
748
- | `pf-ecs-svc-random-with-field` | AWS::ECS::Service | A random placement strategy takes no Field | none |
749
- | `pf-ecs-svc-registries-multiple` | AWS::ECS::Service | A service accepts at most one service registry | none |
750
- | `pf-ecs-svc-registries-port-with-awsvpc` | AWS::ECS::Service | awsvpc services address a registry by Port, not ContainerName/ContainerPort | none |
751
- | `pf-ecs-svc-role-with-awsvpc` | AWS::ECS::Service | awsvpc services must use the service-linked role, not Role | none |
752
- | `pf-ecs-svc-role-without-load-balancers` | AWS::ECS::Service | Service Role is only valid together with LoadBalancers | none |
753
- | `pf-ecs-taskdef-family` | AWS::ECS::TaskDefinition | Task definition Family allows only letters, numbers, hyphen and underscore | none |
754
- | `pf-ecs-taskset-lb-container-missing` | AWS::ECS::TaskSet | TaskSet LoadBalancers.ContainerName must name a container of the task definition | none |
755
- | `pf-ecs-taskset-platform-version-ec2` | AWS::ECS::TaskSet | TaskSet PlatformVersion is not allowed with the EC2 launch type | none |
756
- | `pf-ecs-ulimit-soft-over-hard` | AWS::ECS::TaskDefinition | A Ulimit SoftLimit must not exceed its HardLimit | none |
757
- | `pf-ecs-volume-not-referenced` | AWS::ECS::TaskDefinition | Every task definition volume must be mounted by a container | none |
758
- | `pf-ecs-volumesfrom-source-container-missing` | AWS::ECS::TaskDefinition | VolumesFrom.SourceContainer must name a container of the task definition | none |
759
- | `pf-ecs-windows-arm64` | AWS::ECS::TaskDefinition | CpuArchitecture ARM64 is not available for Windows | none |
760
- | `pf-efs-availability-zone-region` | AWS::EFS::FileSystem | AvailabilityZoneName must name an Availability Zone of the deploy region | none |
761
- | `pf-efs-file-system-policy` | AWS::EFS::FileSystem | A file system policy may only name its own file system and must not lock out PutFileSystemPolicy | none |
762
- | `pf-efs-file-system-reference-region` | AWS::EFS::MountTarget<br>AWS::EFS::AccessPoint | A file system ARN passed as FileSystemId must be in the deploy region | none |
763
- | `pf-efs-kms-key` | AWS::EFS::FileSystem | KmsKeyId requires Encrypted: true and a key in the deploy region | none |
764
- | `pf-efs-lifecycle-policy` | AWS::EFS::FileSystem | Each LifecyclePolicy object carries exactly one transition, transitions cannot repeat, Archive must be later than IA and needs elastic or provisioned throughput | none |
765
- | `pf-efs-mount-target-availability-zone` | AWS::EFS::MountTarget | A file system takes one mount target per Availability Zone, and a One Zone file system only in its own zone | none |
766
- | `pf-efs-mount-target-ip-address` | AWS::EFS::MountTarget | IpAddress must fall inside the subnet CIDR and match IpAddressType, and IPv6 needs an IPv6 subnet | none |
767
- | `pf-efs-mount-target-network` | AWS::EFS::MountTarget | A mount target takes at most five security groups, all in the subnet VPC, and every mount target of a file system shares one VPC | none |
768
- | `pf-efs-performance-mode` | AWS::EFS::FileSystem | PerformanceMode maxIO works with neither One Zone storage nor elastic throughput | none |
769
- | `pf-efs-replication-destination` | AWS::EFS::FileSystem | A replication destination pairs Region with an Availability Zone and a KMS key of that same region | none |
770
- | `pf-efs-throughput-mode` | AWS::EFS::FileSystem | ProvisionedThroughputInMibps belongs to ThroughputMode: provisioned and nothing else | none |
771
- | `pf-elasticache-auth-token` | AWS::ElastiCache::ReplicationGroup | AuthToken needs in-transit encryption and must be 16-128 printable characters without slash, quotes or at-sign | none |
772
- | `pf-elasticache-cache-cluster-nodes` | AWS::ElastiCache::CacheCluster | A Redis cluster holds one node and cross-az needs at least two | none |
773
- | `pf-elasticache-cluster-mode-parameter-group` | AWS::ElastiCache::ReplicationGroup | More than one node group needs a parameter group with cluster-enabled set to yes | none |
774
- | `pf-elasticache-data-tiering-node-type` | AWS::ElastiCache::ReplicationGroup | DataTieringEnabled only works on r6gd node types | none |
775
- | `pf-elasticache-engine` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | Replication groups do not run Memcached and cache clusters do not run Valkey | none |
776
- | `pf-elasticache-identifier` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | A replication group or cluster name starts with a letter and holds no consecutive or trailing hyphens | none |
777
- | `pf-elasticache-kms-key` | AWS::ElastiCache::ReplicationGroup | KmsKeyId needs AtRestEncryptionEnabled and a key in the deploy region | none |
778
- | `pf-elasticache-maintenance-window` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | PreferredMaintenanceWindow must be ddd:hh24:mi-ddd:hh24:mi and span at least 60 minutes | none |
779
- | `pf-elasticache-port` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | Port must be in 1150-8004 or 8006-65535 | none |
780
- | `pf-elasticache-preferred-availability-zones` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | The preferred Availability Zone list must have exactly one entry per node | none |
781
- | `pf-elasticache-replication-group-clusters` | AWS::ElastiCache::ReplicationGroup | Automatic failover needs at least two cache clusters (CloudFormation turns it on by default), and NumCacheClusters cannot be combined with NumNodeGroups | none |
782
- | `pf-elasticache-snapshot-retention` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | SnapshotRetentionLimit is 0-35 days and Memcached does not support snapshots at all | none |
783
- | `pf-elasticache-snapshot-source-engine` | AWS::ElastiCache::CacheCluster | SnapshotArns and SnapshotName only restore Redis clusters | none |
784
- | `pf-elasticache-snapshot-window` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | SnapshotWindow must be hh24:mi-hh24:mi and must not overlap the maintenance window | none |
785
- | `pf-elasticache-snapshotting-cluster` | AWS::ElastiCache::ReplicationGroup | SnapshottingClusterId cannot be set on a cluster mode enabled replication group | none |
786
- | `pf-elasticache-user-access-string` | AWS::ElastiCache::User | The access string uses Redis ACL rules; password rules and reset are rejected and categories must exist | none |
787
- | `pf-elasticache-user-authentication` | AWS::ElastiCache::User | A user needs exactly one authentication mode, and passwords are 16-128 characters with at most two per user | none |
788
- | `pf-elasticache-user-group-default-user` | AWS::ElastiCache::UserGroup | A Redis user group must contain a user named default, and a Valkey group rejects password-less users | none |
789
- | `pf-elasticache-user-group-transit-encryption` | AWS::ElastiCache::ReplicationGroup | UserGroupIds requires in-transit encryption | none |
790
- | `pf-elbv2-action-cognito-userpool-region` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | The Cognito user pool sits in the load balancer region | none |
791
- | `pf-elbv2-action-fixed-response-content-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A fixed response uses one of the five supported content types | none |
792
- | `pf-elbv2-action-forward-same-ip-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target groups in one forward action share a IP address type | none |
793
- | `pf-elbv2-action-forward-same-protocol` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target groups in one forward action share a protocol | none |
794
- | `pf-elbv2-action-forward-stickiness-duration-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target group stickiness lasts between 1 and 604800 seconds | none |
795
- | `pf-elbv2-action-forward-stickiness-duration-required` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Enabled target group stickiness carries a duration | none |
796
- | `pf-elbv2-action-forward-stickiness-tls` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A TLS listener cannot turn on target group stickiness | none |
797
- | `pf-elbv2-action-forward-tg-count-max` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A forward action spreads over at most five target groups | none |
798
- | `pf-elbv2-action-forward-tgarn-conflict` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | TargetGroupArn and ForwardConfig name the same single target group | none |
799
- | `pf-elbv2-action-forward-weight-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A target group weight is between 0 and 999 | none |
800
- | `pf-elbv2-action-forward-weight-required-multi` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Every target group of a multi-target forward action has a weight | none |
801
- | `pf-elbv2-action-oidc-endpoint-https` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Every OIDC endpoint is a full HTTPS URL | none |
802
- | `pf-elbv2-action-oidc-extra-params-max` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An authentication action carries at most ten extra parameters | none |
803
- | `pf-elbv2-action-oidc-on-unauthenticated-values` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | OnUnauthenticatedRequest is deny, allow or authenticate | none |
804
- | `pf-elbv2-action-redirect-https-to-http` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An HTTPS listener does not redirect down to HTTP | none |
805
- | `pf-elbv2-action-redirect-no-change` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect changes at least one part of the URI | none |
806
- | `pf-elbv2-action-redirect-path-leading-slash` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect path is absolute | none |
807
- | `pf-elbv2-action-redirect-port-value` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect port is a port number or #{port} | none |
808
- | `pf-elbv2-action-redirect-status-code` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect answers with HTTP_301 or HTTP_302 | none |
809
- | `pf-elbv2-action-session-timeout-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An authentication session lasts between 1 and 604800 seconds | none |
810
- | `pf-elbv2-alb-subnet-count` | AWS::ElasticLoadBalancingV2::LoadBalancer | Application load balancers need at least two subnets | none |
811
- | `pf-elbv2-app-cookie-name` | AWS::ElasticLoadBalancingV2::TargetGroup | app_cookie stickiness requires a cookie name | none |
812
- | `pf-elbv2-hc-timeout-interval` | AWS::ElasticLoadBalancingV2::TargetGroup | Health check timeout must be strictly smaller than the interval | none |
813
- | `pf-elbv2-lambda-target-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | Lambda target groups cannot specify Protocol | none |
814
- | `pf-elbv2-lb-attr-access-logs-bucket-required` | AWS::ElasticLoadBalancingV2::LoadBalancer | Enabling access logs needs the destination bucket | none |
815
- | `pf-elbv2-lb-attr-alb-cross-zone-immutable` | AWS::ElasticLoadBalancingV2::LoadBalancer | Cross-zone load balancing cannot be turned off on an application load balancer | none |
816
- | `pf-elbv2-lb-attr-alb-only-on-gwlb` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer takes only the two common attributes | none |
817
- | `pf-elbv2-lb-attr-boolean-value` | AWS::ElasticLoadBalancingV2::LoadBalancer | A boolean load balancer attribute takes only true or false | none |
818
- | `pf-elbv2-lb-attr-client-keep-alive-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | The client keep-alive duration is 60-604800 seconds | none |
819
- | `pf-elbv2-lb-attr-connection-logs-bucket-required` | AWS::ElasticLoadBalancingV2::LoadBalancer | Enabling connection logs needs the destination bucket | none |
820
- | `pf-elbv2-lb-attr-count-max` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer carries at most 20 attributes | none |
821
- | `pf-elbv2-lb-attr-desync-mitigation-mode` | AWS::ElasticLoadBalancingV2::LoadBalancer | Desync mitigation mode is monitor, defensive or strictest | none |
822
- | `pf-elbv2-lb-attr-dns-record-client-routing-policy` | AWS::ElasticLoadBalancingV2::LoadBalancer | The DNS client routing policy is one of three zonal affinity values | none |
823
- | `pf-elbv2-lb-attr-duplicate-key` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key appears at most once | none |
824
- | `pf-elbv2-lb-attr-key-known` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key must be one the service recognises | none |
825
- | `pf-elbv2-lb-attr-key-lb-type` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key is bound to the load balancer type | none |
826
- | `pf-elbv2-lb-attr-secondary-ips-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | Auto-assigned secondary IPs per subnet are 0-7 | none |
827
- | `pf-elbv2-lb-attr-xff-header-processing-mode` | AWS::ElasticLoadBalancingV2::LoadBalancer | X-Forwarded-For processing is append, preserve or remove | none |
828
- | `pf-elbv2-lb-dualstack-no-public-ipv4-alb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | dualstack-without-public-ipv4 is an application load balancer address type | none |
829
- | `pf-elbv2-lb-eip-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | Only a network load balancer takes Elastic IPs | none |
830
- | `pf-elbv2-lb-eip-with-private-ipv4` | AWS::ElasticLoadBalancingV2::LoadBalancer | One subnet mapping cannot carry both an Elastic IP and a private IPv4 address | none |
831
- | `pf-elbv2-lb-enforce-sg-privatelink-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | PrivateLink inbound-rule enforcement is a network load balancer setting | none |
832
- | `pf-elbv2-lb-enforce-sg-privatelink-requires-sg` | AWS::ElasticLoadBalancingV2::LoadBalancer | PrivateLink inbound-rule enforcement needs security groups on the load balancer | none |
833
- | `pf-elbv2-lb-gwlb-no-scheme` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer cannot declare a Scheme | none |
834
- | `pf-elbv2-lb-gwlb-no-security-groups` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer cannot carry security groups | none |
835
- | `pf-elbv2-lb-idle-timeout-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | ALB idle_timeout.timeout_seconds must be between 1 and 4000 | none |
836
- | `pf-elbv2-lb-ipv6-address-internet-facing-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | A mapped IPv6 address needs an internet-facing load balancer | none |
837
- | `pf-elbv2-lb-mtls-verify-listener-max` | AWS::ElasticLoadBalancingV2::LoadBalancer<br>AWS::ElasticLoadBalancingV2::Listener | A load balancer runs at most two mTLS verify listeners | none |
838
- | `pf-elbv2-lb-name` | AWS::ElasticLoadBalancingV2::LoadBalancer | Load balancer names are at most 32 alphanumeric/hyphen chars and cannot begin with internal- or a hyphen | none |
839
- | `pf-elbv2-lb-one-subnet-per-az` | AWS::ElasticLoadBalancingV2::LoadBalancer<br>AWS::EC2::Subnet | A load balancer takes at most one subnet per availability zone | none |
840
- | `pf-elbv2-lb-private-ipv4-internal-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | A private IPv4 address needs an internal network load balancer | none |
841
- | `pf-elbv2-lb-sg-vpc-match` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer security group lives in the VPC of its subnets | none |
842
- | `pf-elbv2-lb-source-nat-prefix-netmask` | AWS::ElasticLoadBalancingV2::LoadBalancer | A source NAT IPv6 prefix is a /80 or auto_assigned | none |
843
- | `pf-elbv2-lb-source-nat-prefix-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | IPv6 source NAT prefixes are a network load balancer feature | none |
844
- | `pf-elbv2-lb-source-nat-prefix-requires-dualstack` | AWS::ElasticLoadBalancingV2::LoadBalancer | IPv6 source NAT prefixes need a dualstack load balancer | none |
845
- | `pf-elbv2-listener-action-config-type-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An action config must match the action type | none |
846
- | `pf-elbv2-listener-action-order-required` | AWS::ElasticLoadBalancingV2::Listener | Several actions on one listener need an explicit order | none |
847
- | `pf-elbv2-listener-alb-target-tg-listener-protocol` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A target group of Application Load Balancers hangs off a TCP listener | none |
848
- | `pf-elbv2-listener-alpn-single` | AWS::ElasticLoadBalancingV2::Listener | A listener carries a single ALPN policy | none |
849
- | `pf-elbv2-listener-alpn-tls-only` | AWS::ElasticLoadBalancingV2::Listener | ALPN is negotiated on a TLS listener only | none |
850
- | `pf-elbv2-listener-alpn-values` | AWS::ElasticLoadBalancingV2::Listener | An ALPN policy is one of five named values | none |
851
- | `pf-elbv2-listener-attr-header-name-format` | AWS::ElasticLoadBalancingV2::Listener | A renamed request header is a valid HTTP header name | none |
852
- | `pf-elbv2-listener-attr-key-known` | AWS::ElasticLoadBalancingV2::Listener | A listener attribute key is one the service knows | none |
853
- | `pf-elbv2-listener-attr-key-lb-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A listener attribute belongs to the load balancer type it is set on | none |
854
- | `pf-elbv2-listener-attr-server-enabled-value` | AWS::ElasticLoadBalancingV2::Listener | The response server header switch is true or false | none |
855
- | `pf-elbv2-listener-attr-tcp-idle-timeout-range` | AWS::ElasticLoadBalancingV2::Listener | The TCP idle timeout runs from 60 to 6000 seconds | none |
856
- | `pf-elbv2-listener-attr-x-content-type-options-value` | AWS::ElasticLoadBalancingV2::Listener | X-Content-Type-Options is nosniff | none |
857
- | `pf-elbv2-listener-attr-x-frame-options-value` | AWS::ElasticLoadBalancingV2::Listener | X-Frame-Options is DENY or SAMEORIGIN | none |
858
- | `pf-elbv2-listener-auth-action-https-only` | AWS::ElasticLoadBalancingV2::Listener | Authentication actions need an HTTPS listener | none |
859
- | `pf-elbv2-listener-cert-exactly-one` | AWS::ElasticLoadBalancingV2::Listener | A listener declares a single default certificate | none |
860
- | `pf-elbv2-listener-cert-insecure-protocol` | AWS::ElasticLoadBalancingV2::Listener | Only an HTTPS or TLS listener takes a certificate | none |
861
- | `pf-elbv2-listener-cert-not-acm-or-iam` | AWS::ElasticLoadBalancingV2::Listener | A listener certificate comes from ACM or IAM | none |
862
- | `pf-elbv2-listener-cert-region` | AWS::ElasticLoadBalancingV2::Listener | A listener certificate lives in the load balancer region | none |
863
- | `pf-elbv2-listener-certificate-region` | AWS::ElasticLoadBalancingV2::ListenerCertificate | An extra certificate lives in the load balancer region | none |
864
- | `pf-elbv2-listener-certificate-secure-listener` | AWS::ElasticLoadBalancingV2::ListenerCertificate<br>AWS::ElasticLoadBalancingV2::Listener | Extra certificates go on an HTTPS or TLS listener | none |
865
- | `pf-elbv2-listener-default-action-routing-last` | AWS::ElasticLoadBalancingV2::Listener | The last default action routes the request | none |
866
- | `pf-elbv2-listener-mtls-advertise-verify-only` | AWS::ElasticLoadBalancingV2::Listener | Advertising trust store CA names only applies to verify mode | none |
867
- | `pf-elbv2-listener-mtls-https-only` | AWS::ElasticLoadBalancingV2::Listener | Mutual authentication is an HTTPS listener feature | none |
868
- | `pf-elbv2-listener-mtls-ignore-expiry-verify-only` | AWS::ElasticLoadBalancingV2::Listener | Ignoring certificate expiry only applies to verify mode | none |
869
- | `pf-elbv2-listener-mtls-mode-values` | AWS::ElasticLoadBalancingV2::Listener | The mutual authentication mode is off, passthrough or verify | none |
870
- | `pf-elbv2-listener-mtls-truststore-region` | AWS::ElasticLoadBalancingV2::Listener | A trust store lives in the load balancer region | none |
871
- | `pf-elbv2-listener-mtls-truststore-required` | AWS::ElasticLoadBalancingV2::Listener | Verify mode needs a trust store | none |
872
- | `pf-elbv2-listener-mtls-truststore-verify-only` | AWS::ElasticLoadBalancingV2::Listener | A trust store only belongs to verify mode | none |
873
- | `pf-elbv2-listener-nlb-action-forward-only` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A network or gateway load balancer listener only forwards | none |
874
- | `pf-elbv2-listener-port-required` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A listener needs a port unless it is on a gateway load balancer | none |
875
- | `pf-elbv2-listener-protocol-lb-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | Listener protocols must match the load balancer type | none |
876
- | `pf-elbv2-listener-sslpolicy-known` | AWS::ElasticLoadBalancingV2::Listener | A security policy name must be one the service predefines | none |
877
- | `pf-elbv2-listener-sslpolicy-secure-only` | AWS::ElasticLoadBalancingV2::Listener | A security policy belongs to an HTTPS or TLS listener | none |
878
- | `pf-elbv2-listener-tg-protocol-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A listener forwards to a target group of a compatible protocol | none |
879
- | `pf-elbv2-listener-tg-vpc-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A target group lives in the VPC of the load balancer | none |
880
- | `pf-elbv2-listener-udp-dualstack` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A dualstack network load balancer takes no UDP listener | none |
881
- | `pf-elbv2-rule-actions-exactly-one-routing` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule ends on exactly one routing action | none |
882
- | `pf-elbv2-rule-condition-duplicate-field` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule uses each single-valued condition field once | none |
883
- | `pf-elbv2-rule-condition-empty-values` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition matches at least one value | none |
884
- | `pf-elbv2-rule-condition-field-config-match` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition carries the config that belongs to its field | none |
885
- | `pf-elbv2-rule-condition-field-values` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition uses one of the six condition fields | none |
886
- | `pf-elbv2-rule-condition-values-max` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule matches at most five condition values | none |
887
- | `pf-elbv2-rule-conditions-required` | AWS::ElasticLoadBalancingV2::ListenerRule | A listener rule has at least one condition | none |
888
- | `pf-elbv2-rule-host-header-format` | AWS::ElasticLoadBalancingV2::ListenerRule | A host-header value is a host name | none |
889
- | `pf-elbv2-rule-http-header-name-length` | AWS::ElasticLoadBalancingV2::ListenerRule | An http-header condition names a header of at most 40 characters | none |
890
- | `pf-elbv2-rule-http-header-not-host` | AWS::ElasticLoadBalancingV2::ListenerRule | The Host header is matched by a host-header condition | none |
891
- | `pf-elbv2-rule-http-method-charset` | AWS::ElasticLoadBalancingV2::ListenerRule | An HTTP method condition is written in upper case | none |
892
- | `pf-elbv2-rule-priority-unique` | AWS::ElasticLoadBalancingV2::ListenerRule | Listener rules on the same listener must have distinct priorities | none |
893
- | `pf-elbv2-rule-regex-and-values-exclusive` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition matches either literals or a regex | none |
894
- | `pf-elbv2-rule-regex-values-fields` | AWS::ElasticLoadBalancingV2::ListenerRule | Only three condition fields take a regular expression | none |
895
- | `pf-elbv2-rule-source-ip-cidr` | AWS::ElasticLoadBalancingV2::ListenerRule | A source-ip condition takes CIDR blocks | none |
896
- | `pf-elbv2-rule-value-length-128` | AWS::ElasticLoadBalancingV2::ListenerRule | A condition value is at most 128 characters | none |
897
- | `pf-elbv2-stickiness-type-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | Stickiness type lb_cookie needs an HTTP-protocol target group, source_ip a TCP one | none |
898
- | `pf-elbv2-tcp-health-check-path` | AWS::ElasticLoadBalancingV2::TargetGroup | TCP health checks cannot take a health check path | none |
899
- | `pf-elbv2-tg-alb-single-target` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group of type alb holds a single load balancer | none |
900
- | `pf-elbv2-tg-alb-target-type-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group of Application Load Balancers speaks TCP | none |
901
- | `pf-elbv2-tg-attr-algorithm-type` | AWS::ElasticLoadBalancingV2::TargetGroup | The load balancing algorithm is one of three named values | none |
902
- | `pf-elbv2-tg-attr-anomaly-mitigation-requires-weighted-random` | AWS::ElasticLoadBalancingV2::TargetGroup | Anomaly mitigation needs the weighted random algorithm | none |
903
- | `pf-elbv2-tg-attr-anomaly-mitigation-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Anomaly mitigation is on or off | none |
904
- | `pf-elbv2-tg-attr-app-cookie-duration-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Application cookie stickiness lasts 1-604800 seconds | none |
905
- | `pf-elbv2-tg-attr-boolean-value` | AWS::ElasticLoadBalancingV2::TargetGroup | A boolean target group attribute takes only true or false | none |
906
- | `pf-elbv2-tg-attr-cross-zone-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group cross-zone load balancing takes a third value | none |
907
- | `pf-elbv2-tg-attr-dereg-delay-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group has no deregistration delay | none |
908
- | `pf-elbv2-tg-attr-dns-failover-threshold-order` | AWS::ElasticLoadBalancingV2::TargetGroup | The DNS failover threshold is at least the unhealthy-state routing threshold | none |
909
- | `pf-elbv2-tg-attr-draining-interval-requires-termination-off` | AWS::ElasticLoadBalancingV2::TargetGroup | An unhealthy draining interval needs connection termination off | none |
910
- | `pf-elbv2-tg-attr-duplicate-key` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key appears at most once | none |
911
- | `pf-elbv2-tg-attr-health-count-value` | AWS::ElasticLoadBalancingV2::TargetGroup | A minimum healthy target count is off or a positive integer | none |
912
- | `pf-elbv2-tg-attr-health-percentage-range` | AWS::ElasticLoadBalancingV2::TargetGroup | A minimum healthy target percentage is off or 1-100 | none |
913
- | `pf-elbv2-tg-attr-key-known` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key must be one the service recognises | none |
914
- | `pf-elbv2-tg-attr-key-protocol-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key is bound to the target group protocol | none |
915
- | `pf-elbv2-tg-attr-lambda-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | Multi-value headers are a Lambda target group setting | none |
916
- | `pf-elbv2-tg-attr-lb-cookie-duration-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Load balancer cookie stickiness lasts 1-604800 seconds | none |
917
- | `pf-elbv2-tg-attr-preserve-client-ip-udp` | AWS::ElasticLoadBalancingV2::TargetGroup | Client IP preservation cannot be turned off for UDP target groups | none |
918
- | `pf-elbv2-tg-attr-send-tcp-reset-gwlb-only` | AWS::ElasticLoadBalancingV2::TargetGroup | TCP reset attributes belong to a GENEVE target group | none |
919
- | `pf-elbv2-tg-attr-slow-start-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | Slow start needs an HTTP target group of instances or IPs | none |
920
- | `pf-elbv2-tg-attr-stickiness-type-gwlb` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group sticks on the IP tuple | none |
921
- | `pf-elbv2-tg-attr-target-failover-pair-equal` | AWS::ElasticLoadBalancingV2::TargetGroup | The two target failover attributes must agree | none |
922
- | `pf-elbv2-tg-attr-target-failover-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Target failover is rebalance or no_rebalance | none |
923
- | `pf-elbv2-tg-attr-unhealthy-draining-interval-range` | AWS::ElasticLoadBalancingV2::TargetGroup | The unhealthy draining interval is 0-360000 seconds | none |
924
- | `pf-elbv2-tg-deregistration-delay-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group deregistration_delay.timeout_seconds must be between 0 and 3600 | none |
925
- | `pf-elbv2-tg-geneve-port` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group listens on port 6081 | none |
926
- | `pf-elbv2-tg-hc-enabled-required` | AWS::ElasticLoadBalancingV2::TargetGroup | Health checks can only be turned off for a Lambda target group | none |
927
- | `pf-elbv2-tg-hc-port-format` | AWS::ElasticLoadBalancingV2::TargetGroup | The health check port is traffic-port or a port number | none |
928
- | `pf-elbv2-tg-hc-protocol-unsupported` | AWS::ElasticLoadBalancingV2::TargetGroup | Health checks run over HTTP, HTTPS or TCP only | none |
929
- | `pf-elbv2-tg-hc-tcp-for-http-tg` | AWS::ElasticLoadBalancingV2::TargetGroup | An HTTP or HTTPS target group is health checked over HTTP or HTTPS | none |
930
- | `pf-elbv2-tg-ipv6-with-ipv4-lb` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | An IPv6 target group needs a dualstack load balancer | none |
931
- | `pf-elbv2-tg-ipv6-with-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group has no IPv6 address type | none |
932
- | `pf-elbv2-tg-ipv6-with-quic` | AWS::ElasticLoadBalancingV2::TargetGroup | QUIC target groups are IPv4 | none |
933
- | `pf-elbv2-tg-lambda-no-port` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group cannot declare a Port | none |
934
- | `pf-elbv2-tg-lambda-no-vpc` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group cannot declare a VpcId | none |
935
- | `pf-elbv2-tg-lambda-single-target` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group holds a single function | none |
936
- | `pf-elbv2-tg-matcher-grpc-range` | AWS::ElasticLoadBalancingV2::TargetGroup | gRPC status codes run from 0 to 99 | none |
937
- | `pf-elbv2-tg-matcher-grpc-requires-grpc` | AWS::ElasticLoadBalancingV2::TargetGroup | A gRPC matcher needs ProtocolVersion GRPC | none |
938
- | `pf-elbv2-tg-matcher-range-alb` | AWS::ElasticLoadBalancingV2::TargetGroup | HTTP success codes run from 200 to 499 | none |
939
- | `pf-elbv2-tg-matcher-range-geneve` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group accepts success codes 200 to 399 | none |
940
- | `pf-elbv2-tg-name` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group names are at most 32 alphanumeric/hyphen chars and cannot start or end with a hyphen | none |
941
- | `pf-elbv2-tg-protocol-required-non-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A non-Lambda target group needs Protocol and Port | none |
942
- | `pf-elbv2-tg-protocol-version-http-only` | AWS::ElasticLoadBalancingV2::TargetGroup | ProtocolVersion belongs to an HTTP or HTTPS target group | none |
943
- | `pf-elbv2-tg-protocol-version-values` | AWS::ElasticLoadBalancingV2::TargetGroup | ProtocolVersion is GRPC, HTTP1 or HTTP2 | none |
944
- | `pf-elbv2-tg-single-load-balancer` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group belongs to one load balancer | none |
945
- | `pf-elbv2-tg-slow-start-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group slow_start.duration_seconds must be 0 or between 30 and 900 | none |
946
- | `pf-elbv2-tg-target-control-port-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | TargetControlPort needs an HTTP target group of instances or IPs | none |
947
- | `pf-elbv2-tg-target-ip-not-public` | AWS::ElasticLoadBalancingV2::TargetGroup | IP targets are private addresses | none |
948
- | `pf-elbv2-tg-vpc-required-non-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A non-Lambda target group needs a VpcId | none |
949
- | `pf-elbv2-truststore-bundle-key-requires-bucket` | AWS::ElasticLoadBalancingV2::TrustStore | A CA bundle needs both its bucket and its key | none |
950
- | `pf-elbv2-truststore-revocation-content-required` | AWS::ElasticLoadBalancingV2::TrustStoreRevocation | A trust store revocation carries a revocation list | none |
951
- | `pf-events-apidestination-endpoint` | AWS::Events::ApiDestination | An API destination needs an HTTPS endpoint and a same-Region connection | none |
952
- | `pf-events-archive-source` | AWS::Events::Archive | An archive source must be an event bus in the archive's Region | none |
953
- | `pf-events-bus-dlq-arn-type` | AWS::Events::EventBus | An event bus dead-letter queue must be an SQS queue | none |
954
- | `pf-events-bus-name` | AWS::Events::EventBus | An event bus name may not be 'default' or contain '/', and a partner bus must match its source | none |
955
- | `pf-events-connection-auth-parameters` | AWS::Events::Connection | AuthParameters must carry the block that AuthorizationType names, and OAuth endpoints must be HTTPS | none |
956
- | `pf-events-endpoint-buses` | AWS::Events::Endpoint | A global endpoint needs two same-named buses in two Regions | none |
957
- | `pf-events-endpoint-replication-role` | AWS::Events::Endpoint | Endpoint replication needs a RoleArn | none |
958
- | `pf-events-input-path-jsonpath` | AWS::Events::Rule | Input paths must start at $ and avoid quoted bracket notation | none |
959
- | `pf-events-input-transformer-json-var` | AWS::Events::Rule | <aws.events.event.json> needs a JSON object InputTemplate | none |
960
- | `pf-events-input-transformer-limits` | AWS::Events::Rule | InputPathsMap is capped at 100 entries and may not use reserved variable names | none |
961
- | `pf-events-input-transformer-placeholders` | AWS::Events::Rule | InputTemplate placeholders must be declared in InputPathsMap | none |
962
- | `pf-events-pattern-empty` | AWS::Events::Rule | An empty EventPattern counts as no pattern at all | none |
963
- | `pf-events-pattern-empty-array` | AWS::Events::Rule<br>AWS::Events::Archive | An event pattern may not hold an empty array | none |
964
- | `pf-events-pattern-operator` | AWS::Events::Rule<br>AWS::Events::Archive | Event pattern matchers must name a real operator and give it the right shape | none |
965
- | `pf-events-pattern-or-exclusive` | AWS::Events::Rule<br>AWS::Events::Archive | $or cannot share an object with other keys | none |
966
- | `pf-events-pattern-scalar-value` | AWS::Events::Rule<br>AWS::Events::Archive | Event pattern values must be arrays or objects, not scalars | none |
967
- | `pf-events-rule-cron-fields` | AWS::Events::Rule | cron() fields must stay in range and keep | none |
968
- | `pf-events-rule-name-duplicate` | AWS::Events::Rule | Two rules in one template may not share a name | none |
969
- | `pf-events-rule-pattern-size` | AWS::Events::Rule | An event pattern may not exceed 2048 bytes | none |
970
- | `pf-events-rule-schedule-default-bus` | AWS::Events::Rule | A scheduled rule only works on the default event bus | none |
971
- | `pf-events-target-batch-parameters` | AWS::Events::Rule | Batch array size and retry attempts have service-stated bounds | none |
972
- | `pf-events-target-dlq` | AWS::Events::Rule | A target dead-letter queue must be a standard SQS queue in the rule's Region | none |
973
- | `pf-events-target-ecs-parameters` | AWS::Events::Rule | EcsParameters must match the launch type and stay inside its size caps | none |
974
- | `pf-events-target-ecs-task-definition-region` | AWS::Events::Rule | An ECS target's cluster and task definition must share a Region | none |
975
- | `pf-events-target-id-duplicate` | AWS::Events::Rule | Target ids must be unique within a rule | none |
976
- | `pf-events-target-input-exclusive` | AWS::Events::Rule | Input, InputPath and InputTransformer are mutually exclusive | none |
977
- | `pf-events-target-input-json` | AWS::Events::Rule | Target Input must be valid JSON | none |
978
- | `pf-events-target-parameters-mismatch` | AWS::Events::Rule | Target parameter blocks must match the target's resource type | none |
979
- | `pf-events-target-parameters-required` | AWS::Events::Rule | ECS, Batch and FIFO queue targets require their parameter block | none |
980
- | `pf-events-target-redshift-parameters` | AWS::Events::Rule | RedshiftDataParameters takes one statement form and one credential form | none |
981
- | `pf-events-target-role-required` | AWS::Events::Rule | Targets other than Lambda, SNS, SQS and CloudWatch Logs require RoleArn | none |
982
- | `pf-eventschemas-discoverer-source` | AWS::EventSchemas::Discoverer | A discoverer source must be an event bus in the discoverer's Region | none |
983
- | `pf-eventschemas-registry-name-reserved` | AWS::EventSchemas::Registry | A registry name may not use the reserved aws. prefix | none |
984
- | `pf-eventschemas-registry-policy` | AWS::EventSchemas::RegistryPolicy | A registry policy must declare a Version | none |
985
- | `pf-eventschemas-schema-content` | AWS::EventSchemas::Schema | Schema Content must be valid JSON, and valid OpenAPI 3.0 when Type is OpenApi3 | none |
986
- | `pf-firehose-dfcc-required-configs` | AWS::KinesisFirehose::DeliveryStream | Enabled format conversion needs input, output, and schema configs | none |
987
- | `pf-firehose-dynamic-partitioning-buffer` | AWS::KinesisFirehose::DeliveryStream | Dynamic partitioning needs a 64 MB buffer floor | none |
988
- | `pf-firehose-dynamic-partitioning-prefix` | AWS::KinesisFirehose::DeliveryStream | Dynamic partitioning needs partition namespaces in the prefix | none |
989
- | `pf-firehose-kinesis-source-config` | AWS::KinesisFirehose::DeliveryStream | KinesisStreamAsSource streams need KinesisStreamSourceConfiguration | none |
990
- | `pf-firehose-one-destination` | AWS::KinesisFirehose::DeliveryStream | A delivery stream takes exactly one destination configuration | none |
991
- | `pf-firehose-s3-backup-config` | AWS::KinesisFirehose::DeliveryStream | Enabling S3 backup needs S3BackupConfiguration | none |
992
- | `pf-iam-identity-policy-no-principal` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Identity policies cannot carry a Principal field | none |
993
- | `pf-iam-inline-policy-size` | AWS::IAM::Policy<br>AWS::IAM::RolePolicy<br>AWS::IAM::UserPolicy<br>AWS::IAM::GroupPolicy | Inline policy documents are limited per identity (role 10240 / group 5120 / user 2048 characters) | none |
994
- | `pf-iam-instance-profile-single-role` | AWS::IAM::InstanceProfile | An instance profile holds exactly one role | none |
995
- | `pf-iam-managed-policy-count` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group | Managed policies per identity are capped (hard maximums role 25 / user 20 / group 10) | none |
996
- | `pf-iam-managed-policy-size` | AWS::IAM::ManagedPolicy | Managed policy documents are limited to 6144 characters (whitespace excluded) | none |
997
- | `pf-iam-name-format` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group<br>AWS::IAM::ManagedPolicy | IAM entity names allow only alphanumerics and +=,.@-_ | none |
998
- | `pf-iam-oidc-provider-client-id-count` | AWS::IAM::OIDCProvider | An OIDC provider takes at most 100 client ids | none |
999
- | `pf-iam-oidc-provider-url-https` | AWS::IAM::OIDCProvider | An OIDC provider URL starts with https:// | none |
1000
- | `pf-iam-path-service-role-reserved` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group<br>AWS::IAM::InstanceProfile<br>AWS::IAM::ManagedPolicy | The /aws-service-role/ path is reserved | none |
1001
- | `pf-iam-permissions-boundary-policy-arn` | AWS::IAM::Role<br>AWS::IAM::User | A permissions boundary is a policy ARN | none |
1002
- | `pf-iam-policy-action-format` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Actions must carry a service prefix | none |
1003
- | `pf-iam-policy-action-required` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Every statement needs an Action or NotAction | none |
1004
- | `pf-iam-policy-action-single-colon` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | An action carries exactly one colon | none |
1005
- | `pf-iam-policy-action-vendor-wildcard` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | The service prefix of an action takes no wildcard | none |
1006
- | `pf-iam-policy-arn-partition` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group | Attached policy ARNs live in the deploy partition | none |
1007
- | `pf-iam-policy-condition-arn-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Arn condition operators need an ARN | none |
1008
- | `pf-iam-policy-condition-binary-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | BinaryEquals takes base64 text | none |
1009
- | `pf-iam-policy-condition-date-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Date condition operators need ISO 8601 or epoch seconds | none |
1010
- | `pf-iam-policy-condition-ip-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | IpAddress condition operators need an IP address or CIDR | none |
1011
- | `pf-iam-policy-condition-null-ifexists` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Null does not take the IfExists suffix | none |
1012
- | `pf-iam-policy-condition-numeric-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Numeric condition operators need a numeric value | none |
1013
- | `pf-iam-policy-condition-operator` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Condition operators come from a closed grammar | none |
1014
- | `pf-iam-policy-condition-value-type` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Condition values are strings, not nested objects | none |
1015
- | `pf-iam-policy-duplicate-sid` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Statement IDs must be unique within a policy | none |
1016
- | `pf-iam-policy-effect-case` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Effect is case-sensitive Allow or Deny | none |
1017
- | `pf-iam-policy-effect-required` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Every statement needs an Effect | none |
1018
- | `pf-iam-policy-exclusive-fields` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Action/NotAction and Resource/NotResource are exclusive pairs | none |
1019
- | `pf-iam-policy-resource-arn-segments` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | A resource ARN carries six colon-separated segments | none |
1020
- | `pf-iam-policy-resource-format` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Resources must be ARNs or * | none |
1021
- | `pf-iam-policy-resource-global-service-arn` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | S3, IAM and Route 53 ARNs carry no region | none |
1022
- | `pf-iam-policy-resource-partition` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Resource ARNs live in the deploy partition | none |
1023
- | `pf-iam-policy-resource-service-wildcard` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | The service segment of a resource ARN takes no wildcard | none |
1024
- | `pf-iam-policy-sid-format` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Policy statement Sid must be alphanumeric | none |
1025
- | `pf-iam-policy-statement-required` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | A policy document needs a non-empty Statement | none |
1026
- | `pf-iam-policy-statement-resource-required` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Identity policy statements need Resource or NotResource | none |
1027
- | `pf-iam-policy-statement-unknown-field` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | A statement holds only the documented policy elements | none |
1028
- | `pf-iam-policy-unknown-toplevel-field` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | A policy document holds only Version, Id and Statement | none |
1029
- | `pf-iam-policy-version` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Policy Version must be 2012-10-17 or 2008-10-17 | none |
1030
- | `pf-iam-slr-service-name-format` | AWS::IAM::ServiceLinkedRole | AWSServiceName is a service principal | none |
1031
- | `pf-iam-trust-policy-action-sts-only` | AWS::IAM::Role | A trust policy allows only the STS AssumeRole family | none |
1032
- | `pf-iam-trust-policy-aws-principal-format` | AWS::IAM::Role | An AWS principal is an account id or an IAM ARN | none |
1033
- | `pf-iam-trust-policy-cognito-condition` | AWS::IAM::Role | A Cognito federated principal needs a Condition block | none |
1034
- | `pf-iam-trust-policy-no-resource` | AWS::IAM::Role | Trust policies cannot carry a Resource field | none |
1035
- | `pf-iam-trust-policy-principal-star-string` | AWS::IAM::Role | A trust policy needs a typed principal, not a bare "*" | none |
1036
- | `pf-iam-trust-policy-service-principal` | AWS::IAM::Role | Service principals live under amazonaws.com | none |
1037
- | `pf-iam-trust-policy-service-wildcard` | AWS::IAM::Role | A service principal cannot be a wildcard | none |
1038
- | `pf-kinesis-consumer-duplicate-name` | AWS::Kinesis::StreamConsumer | Two consumers of one stream cannot share a ConsumerName | none |
1039
- | `pf-kinesis-consumer-stream-region` | AWS::Kinesis::StreamConsumer | A stream consumer must reference a stream in its own region | none |
1040
- | `pf-kinesis-encryption-key-region` | AWS::Kinesis::Stream | The stream encryption key must live in the stream region | none |
1041
- | `pf-kinesis-on-demand-shard-count` | AWS::Kinesis::Stream | An on-demand stream cannot set ShardCount | none |
1042
- | `pf-kinesis-provisioned-shard-count` | AWS::Kinesis::Stream | A provisioned stream must set ShardCount | none |
1043
- | `pf-kinesis-resource-policy-action` | AWS::Kinesis::ResourcePolicy | Resource policy actions must be plain kinesis: actions | none |
1044
- | `pf-kinesis-resource-policy-principal` | AWS::Kinesis::ResourcePolicy | Every policy statement needs a Principal (and no NotPrincipal) | none |
1045
- | `pf-kinesis-resource-policy-region` | AWS::Kinesis::ResourcePolicy | A resource policy must target a stream in its own region | none |
1046
- | `pf-kinesis-resource-policy-resource` | AWS::Kinesis::ResourcePolicy | Every policy statement Resource must equal the ResourceArn | none |
1047
- | `pf-kinesis-shard-level-metrics-all` | AWS::Kinesis::Stream | DesiredShardLevelMetrics cannot mix ALL with named metrics | none |
1048
- | `pf-kinesis-warm-throughput-shard-count` | AWS::Kinesis::Stream | WarmThroughputMiBps cannot be combined with ShardCount or provisioned mode | none |
1049
- | `pf-kinesisanalytics-application-mode-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationMode must match the runtime family | none |
1050
- | `pf-kinesisanalytics-checkpoint-configuration-type` | AWS::KinesisAnalyticsV2::Application | CheckpointConfiguration needs ConfigurationType CUSTOM to carry values | none |
1051
- | `pf-kinesisanalytics-code-content-member` | AWS::KinesisAnalyticsV2::Application | CodeContent must carry exactly the member its type names | none |
1052
- | `pf-kinesisanalytics-code-content-type` | AWS::KinesisAnalyticsV2::Application | CodeContentType must match the runtime family | none |
1053
- | `pf-kinesisanalytics-custom-artifact-source` | AWS::KinesisAnalyticsV2::Application | Every Studio custom artifact needs an S3 location or a Maven reference | none |
1054
- | `pf-kinesisanalytics-encryption-key-type` | AWS::KinesisAnalyticsV2::Application | KeyId presence must match the encryption KeyType | none |
1055
- | `pf-kinesisanalytics-glue-database-region` | AWS::KinesisAnalyticsV2::Application | The Studio Glue catalog database must be in the application region | none |
1056
- | `pf-kinesisanalytics-log-stream-arn` | AWS::KinesisAnalyticsV2::ApplicationCloudWatchLoggingOption | LogStreamARN must name a log stream, not a log group | none |
1057
- | `pf-kinesisanalytics-maven-artifact-type` | AWS::KinesisAnalyticsV2::Application | MavenReference is only valid for DEPENDENCY_JAR artifacts | none |
1058
- | `pf-kinesisanalytics-monitoring-configuration-type` | AWS::KinesisAnalyticsV2::Application | MonitoringConfiguration needs ConfigurationType CUSTOM to carry values | none |
1059
- | `pf-kinesisanalytics-parallelism-configuration-type` | AWS::KinesisAnalyticsV2::Application | ParallelismConfiguration needs ConfigurationType CUSTOM to carry values | none |
1060
- | `pf-kinesisanalytics-parallelism-per-kpu` | AWS::KinesisAnalyticsV2::Application | ParallelismPerKPU cannot exceed 8 | none |
1061
- | `pf-kinesisanalytics-property-group-duplicate` | AWS::KinesisAnalyticsV2::Application | PropertyGroupId must be unique within an application | none |
1062
- | `pf-kinesisanalytics-runtime-deprecated` | AWS::KinesisAnalyticsV2::Application | Deprecated runtime environments can no longer be created | none |
1063
- | `pf-kinesisanalytics-service-role-account` | AWS::KinesisAnalyticsV2::Application | ServiceExecutionRole must belong to the deploying account | none |
1064
- | `pf-kinesisanalytics-snapshot-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationSnapshotConfiguration is not applicable to Studio runtimes | none |
1065
- | `pf-kinesisanalytics-sql-configuration-runtime` | AWS::KinesisAnalyticsV2::Application | SqlApplicationConfiguration belongs to the SQL runtime only | none |
1066
- | `pf-kinesisanalytics-sql-only-resource` | AWS::KinesisAnalyticsV2::ApplicationOutput<br>AWS::KinesisAnalyticsV2::ApplicationReferenceDataSource | Outputs and reference data sources need a SQL application | none |
1067
- | `pf-kinesisanalytics-sql-runtime-unsupported` | AWS::KinesisAnalyticsV2::Application | SQL applications can no longer be created | none |
1068
- | `pf-kinesisanalytics-system-rollback-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationSystemRollbackConfiguration is not applicable to Studio runtimes | none |
1069
- | `pf-kinesisanalytics-zeppelin-configuration-runtime` | AWS::KinesisAnalyticsV2::Application | ZeppelinApplicationConfiguration belongs to Studio runtimes only | none |
1070
- | `pf-kinesisanalytics-zeppelin-note-json` | AWS::KinesisAnalyticsV2::Application | Studio TextContent must be a Zeppelin note JSON | none |
1071
- | `pf-kms-alias-name` | AWS::KMS::Alias | AliasName must not start with alias/aws/ (reserved for AWS managed keys) and may not contain a colon (the CloudFormation schema allows it, CreateAlias does not) | none |
1072
- | `pf-kms-alias-target` | AWS::KMS::Alias | TargetKeyId must be a key id or key ARN (not an alias) of a key in the same account and region | none |
1073
- | `pf-kms-key-origin` | AWS::KMS::Key | Origin AWS_CLOUDHSM and EXTERNAL_KEY_STORE cannot be created by CloudFormation, and Origin EXTERNAL does not support ML-DSA key specs | none |
1074
- | `pf-kms-key-policy-charset` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | A KeyPolicy may only contain tab, LF, CR and characters U+0020..U+00FF (no Japanese or other non-Latin-1 text, e.g. in a Sid) | none |
1075
- | `pf-kms-key-policy-lockout` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | A KeyPolicy must let a principal of the deploying account call kms:PutKeyPolicy, unless BypassPolicyLockoutSafetyCheck is true | none |
1076
- | `pf-kms-key-policy-statement` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | Every KeyPolicy statement needs Principal, Action and Resource, the Statement list must not be empty, and AWS principals must be *, an account id or an IAM/STS ARN | none |
1077
- | `pf-kms-key-rotation` | AWS::KMS::Key | EnableKeyRotation is only valid for SYMMETRIC_DEFAULT keys with AWS_KMS key material (not asymmetric, HMAC, or Origin EXTERNAL) | none |
1078
- | `pf-kms-key-spec-region` | AWS::KMS::Key | KeySpec SM2 exists only in China regions | none |
1079
- | `pf-kms-key-spec-usage` | AWS::KMS::Key | KeyUsage must match KeySpec (symmetric: ENCRYPT_DECRYPT, HMAC: GENERATE_VERIFY_MAC, RSA: ENCRYPT_DECRYPT|SIGN_VERIFY, NIST ECC: SIGN_VERIFY|KEY_AGREEMENT, ed25519/secp256k1/ML-DSA: SIGN_VERIFY) and is required for every non-symmetric key | none |
1080
- | `pf-kms-replica-primary-arn` | AWS::KMS::ReplicaKey | ReplicaKey.PrimaryKeyArn must be the ARN of a multi-Region primary key (key/mrk-...) in a different region of the same partition, so a primary key in the same stack can never be replicated by it | none |
1081
- | `pf-lambda-alias-additional-version-distinct` | AWS::Lambda::Alias | A weighted alias must route to a different version | none |
1082
- | `pf-lambda-alias-additional-version-not-latest` | AWS::Lambda::Alias | A routing entry cannot name $LATEST | none |
1083
- | `pf-lambda-alias-additional-versions-max-one` | AWS::Lambda::Alias | An alias can carry only one additional version | none |
1084
- | `pf-lambda-alias-routing-not-latest` | AWS::Lambda::Alias | A weighted alias cannot sit on $LATEST | none |
1085
- | `pf-lambda-alias-version-not-alias` | AWS::Lambda::Alias | An alias cannot point at another alias | none |
1086
- | `pf-lambda-alias-version-weight-range` | AWS::Lambda::Alias | A routing weight is a fraction between 0 and 1 | none |
1087
- | `pf-lambda-capacity-provider-arn-region` | AWS::Lambda::Function | A capacity provider lives in the deploy region | none |
1088
- | `pf-lambda-capacity-provider-json-log-only` | AWS::Lambda::Function | Managed-instance functions log in JSON | none |
1089
- | `pf-lambda-capacity-provider-runtime` | AWS::Lambda::Function | Managed instances support only the newer runtimes | none |
1090
- | `pf-lambda-code-s3-pair` | AWS::Lambda::Function | S3-based Code needs both S3Bucket and S3Key | none |
1091
- | `pf-lambda-code-signing-arn-region` | AWS::Lambda::Function | A code signing config lives in the deploy region | none |
1092
- | `pf-lambda-code-signing-zip-only` | AWS::Lambda::Function | Code signing applies to .zip functions only | none |
1093
- | `pf-lambda-code-zipfile-exclusive` | AWS::Lambda::Function | Inline ZipFile excludes every other Code parameter | none |
1094
- | `pf-lambda-csc-untrusted-artifact-enum` | AWS::Lambda::CodeSigningConfig | UntrustedArtifactOnDeployment is Warn or Enforce | pending-engine |
1095
- | `pf-lambda-dlq-no-fifo` | AWS::Lambda::Function | A dead-letter target cannot be a FIFO queue or topic | none |
1096
- | `pf-lambda-dlq-region` | AWS::Lambda::Function | The dead letter target must sit in the deploy region | none |
1097
- | `pf-lambda-dlq-service` | AWS::Lambda::Function | The dead letter target must be an SQS queue or SNS topic | none |
1098
- | `pf-lambda-durable-kms-key-region` | AWS::Lambda::Function | A durable-function KMS key lives in the deploy region | none |
1099
- | `pf-lambda-efs-mount-target-dependson` | AWS::Lambda::Function | A function that mounts EFS waits for the mount target | none |
1100
- | `pf-lambda-efs-mount-target-every-az` | AWS::Lambda::Function | Every subnet of an EFS function needs a mount target in its AZ | none |
1101
- | `pf-lambda-efs-requires-vpc` | AWS::Lambda::Function | Mounting EFS requires VpcConfig | none |
1102
- | `pf-lambda-eic-destination-no-sns-fifo` | AWS::Lambda::EventInvokeConfig | An invoke destination cannot be a FIFO topic | none |
1103
- | `pf-lambda-eic-destination-no-sqs-fifo` | AWS::Lambda::EventInvokeConfig | An invoke destination cannot be a FIFO queue | none |
1104
- | `pf-lambda-eic-destination-region` | AWS::Lambda::EventInvokeConfig | An invoke destination lives in the deploy region | none |
1105
- | `pf-lambda-eic-destination-service` | AWS::Lambda::EventInvokeConfig | An invoke destination is a queue, topic, bucket, function or event bus | none |
1106
- | `pf-lambda-eic-onsuccess-no-s3` | AWS::Lambda::EventInvokeConfig | An S3 bucket is an on-failure destination only | none |
1107
- | `pf-lambda-env-key-start-letter` | AWS::Lambda::Function | An environment variable name starts with a letter | none |
1108
- | `pf-lambda-env-size` | AWS::Lambda::Function | Lambda environment variables are limited to 4096 bytes in total | none |
1109
- | `pf-lambda-esm-batchsize-window` | AWS::Lambda::EventSourceMapping | SQS batch sizes over 10 need a batching window | none |
1110
- | `pf-lambda-esm-bisect-batch-stream-only` | AWS::Lambda::EventSourceMapping | BisectBatchOnFunctionError only applies to Kinesis and DynamoDB streams | none |
1111
- | `pf-lambda-esm-client-certificate-kafka-only` | AWS::Lambda::EventSourceMapping | CLIENT_CERTIFICATE_TLS_AUTH is not accepted on Amazon MQ | none |
1112
- | `pf-lambda-esm-ddb-at-timestamp-unsupported` | AWS::Lambda::EventSourceMapping | DynamoDB Streams rejects AT_TIMESTAMP | none |
1113
- | `pf-lambda-esm-ddb-cross-region` | AWS::Lambda::EventSourceMapping | A DynamoDB stream source must sit in the deploy region | none |
1114
- | `pf-lambda-esm-ddb-destination-standard-only` | AWS::Lambda::EventSourceMapping | An on-failure destination cannot be a FIFO queue or topic | none |
1115
- | `pf-lambda-esm-destination-config-stream-only` | AWS::Lambda::EventSourceMapping | DestinationConfig only applies to stream sources | none |
1116
- | `pf-lambda-esm-docdb-basic-auth-required` | AWS::Lambda::EventSourceMapping | A DocumentDB event source needs BASIC_AUTH credentials | none |
1117
- | `pf-lambda-esm-docdb-cluster-type` | AWS::Lambda::EventSourceMapping | Elastic DocumentDB clusters cannot be event sources | none |
1118
- | `pf-lambda-esm-docdb-database-name-required` | AWS::Lambda::EventSourceMapping | CollectionName needs DatabaseName | none |
1119
- | `pf-lambda-esm-docdb-full-document-values` | AWS::Lambda::EventSourceMapping | FullDocument accepts only UpdateLookup and Default | pending-engine |
1120
- | `pf-lambda-esm-documentdb-arn-rds-service` | AWS::Lambda::EventSourceMapping | A DocumentDB event source is named by its rds cluster ARN | none |
1121
- | `pf-lambda-esm-event-source-arn-service` | AWS::Lambda::EventSourceMapping | EventSourceArn must name a supported event source service | none |
1122
- | `pf-lambda-esm-fifo-batch-size-max` | AWS::Lambda::EventSourceMapping | A FIFO queue source caps BatchSize at 10 | none |
1123
- | `pf-lambda-esm-fifo-batching-window` | AWS::Lambda::EventSourceMapping | FIFO queues reject a batching window | none |
1124
- | `pf-lambda-esm-filter-criteria-docdb-unsupported` | AWS::Lambda::EventSourceMapping | DocumentDB event sources do not support FilterCriteria | none |
1125
- | `pf-lambda-esm-filter-pattern-eventbridge-syntax` | AWS::Lambda::EventSourceMapping | A filter Pattern must be an EventBridge pattern JSON object | none |
1126
- | `pf-lambda-esm-filter-pattern-leaf-array` | AWS::Lambda::EventSourceMapping | Every leaf value in a filter Pattern must be an array | none |
1127
- | `pf-lambda-esm-filters-hard-limit-ten` | AWS::Lambda::EventSourceMapping | An event source mapping takes at most ten filters | none |
1128
- | `pf-lambda-esm-function-name-bare-max-length` | AWS::Lambda::EventSourceMapping | A bare function name in FunctionName is limited to 64 characters | none |
1129
- | `pf-lambda-esm-function-name-format` | AWS::Lambda::EventSourceMapping | FunctionName must be a name, ARN, partial ARN or version/alias ARN | none |
1130
- | `pf-lambda-esm-function-response-types-allowed-value` | AWS::Lambda::EventSourceMapping | FunctionResponseTypes only accepts ReportBatchItemFailures | pending-engine |
1131
- | `pf-lambda-esm-function-response-types-mq-docdb` | AWS::Lambda::EventSourceMapping | Partial batch failure reporting is not available on Amazon MQ or DocumentDB | none |
1132
- | `pf-lambda-esm-kms-key-policy-lambda-principal` | AWS::Lambda::EventSourceMapping<br>AWS::KMS::Key | The filter-criteria key policy must let Lambda decrypt | none |
1133
- | `pf-lambda-esm-logging-config-kafka-only` | AWS::Lambda::EventSourceMapping | LoggingConfig only applies to Kafka sources | none |
1134
- | `pf-lambda-esm-max-concurrency-vs-reserved` | AWS::Lambda::EventSourceMapping<br>AWS::Lambda::Function | MaximumConcurrency cannot exceed the reserved concurrency of the function | none |
1135
- | `pf-lambda-esm-maximum-record-age-stream-only` | AWS::Lambda::EventSourceMapping | MaximumRecordAgeInSeconds only applies to stream sources | none |
1136
- | `pf-lambda-esm-maximum-retry-attempts-stream-only` | AWS::Lambda::EventSourceMapping | MaximumRetryAttempts only applies to stream sources | none |
1137
- | `pf-lambda-esm-metrics-allowed-values` | AWS::Lambda::EventSourceMapping | MetricsConfig.Metrics only accepts EventCount, ErrorCount and KafkaMetrics | pending-engine |
1138
- | `pf-lambda-esm-metrics-error-count-kafka-only` | AWS::Lambda::EventSourceMapping | The ErrorCount metric is Kafka-only | none |
1139
- | `pf-lambda-esm-metrics-kafka-metrics-kafka-only` | AWS::Lambda::EventSourceMapping | The KafkaMetrics metric is Kafka-only | none |
1140
- | `pf-lambda-esm-mq-auth-secret-required` | AWS::Lambda::EventSourceMapping | An Amazon MQ event source needs BASIC_AUTH credentials | none |
1141
- | `pf-lambda-esm-mq-cross-account` | AWS::Lambda::EventSourceMapping | The Amazon MQ broker must live in the deploy account | none |
1142
- | `pf-lambda-esm-mq-starting-position-unsupported` | AWS::Lambda::EventSourceMapping | Amazon MQ event sources reject StartingPosition | none |
1143
- | `pf-lambda-esm-msk-topics-required` | AWS::Lambda::EventSourceMapping | A Kafka event source needs Topics | none |
1144
- | `pf-lambda-esm-on-failure-destination-api-max-length` | AWS::Lambda::EventSourceMapping | An on-failure destination ARN is limited to 350 characters | none |
1145
- | `pf-lambda-esm-on-failure-destination-service` | AWS::Lambda::EventSourceMapping | An on-failure destination must be SNS, SQS, S3 or a Kafka topic | none |
1146
- | `pf-lambda-esm-parallelization-factor-stream-only` | AWS::Lambda::EventSourceMapping | ParallelizationFactor only applies to Kinesis and DynamoDB streams | none |
1147
- | `pf-lambda-esm-poller-group-esm-count` | AWS::Lambda::EventSourceMapping | A poller group holds at most 100 event source mappings | none |
1148
- | `pf-lambda-esm-poller-group-name-kafka-only` | AWS::Lambda::EventSourceMapping | PollerGroupName only applies to Kafka sources | none |
1149
- | `pf-lambda-esm-pollers-max-ge-min` | AWS::Lambda::EventSourceMapping | MaximumPollers must be at least MinimumPollers | none |
1150
- | `pf-lambda-esm-provisioned-poller-source-support` | AWS::Lambda::EventSourceMapping | ProvisionedPollerConfig only applies to SQS and Kafka sources | none |
1151
- | `pf-lambda-esm-record-age-effective-min` | AWS::Lambda::EventSourceMapping | MaximumRecordAgeInSeconds starts at 60 seconds | none |
1152
- | `pf-lambda-esm-sasl-scram-512-kafka-only` | AWS::Lambda::EventSourceMapping | SASL_SCRAM_512_AUTH is not accepted on Amazon MQ | none |
1153
- | `pf-lambda-esm-scaling-config-sqs-only` | AWS::Lambda::EventSourceMapping | ScalingConfig only applies to SQS event sources | none |
1154
- | `pf-lambda-esm-scaling-provisioned-mutually-exclusive` | AWS::Lambda::EventSourceMapping | ScalingConfig and ProvisionedPollerConfig are mutually exclusive | none |
1155
- | `pf-lambda-esm-sqs-maximum-pollers-min` | AWS::Lambda::EventSourceMapping | ProvisionedPollerConfig MaximumPollers starts at 2 | none |
1156
- | `pf-lambda-esm-sqs-minimum-pollers-min` | AWS::Lambda::EventSourceMapping | ProvisionedPollerConfig MinimumPollers starts at 2 | none |
1157
- | `pf-lambda-esm-sqs-same-region` | AWS::Lambda::EventSourceMapping | The SQS source queue must sit in the deploy region | none |
1158
- | `pf-lambda-esm-sqs-starting-position` | AWS::Lambda::EventSourceMapping | SQS event sources reject StartingPosition | none |
1159
- | `pf-lambda-esm-starting-position-timestamp-mq-unsupported` | AWS::Lambda::EventSourceMapping | Amazon MQ event sources reject StartingPositionTimestamp | none |
1160
- | `pf-lambda-esm-starting-position-timestamp-requires-at-timestamp` | AWS::Lambda::EventSourceMapping | StartingPositionTimestamp needs StartingPosition AT_TIMESTAMP | none |
1161
- | `pf-lambda-esm-starting-position-timestamp-sqs-unsupported` | AWS::Lambda::EventSourceMapping | SQS event sources reject StartingPositionTimestamp | none |
1162
- | `pf-lambda-esm-tumbling-window-stream-only` | AWS::Lambda::EventSourceMapping | TumblingWindowInSeconds only applies to Kinesis and DynamoDB streams | none |
1163
- | `pf-lambda-image-requires-imageuri` | AWS::Lambda::Function | A container-image function needs Code.ImageUri | none |
1164
- | `pf-lambda-image-uri-no-fips` | AWS::Lambda::Function | A container image cannot come from an ECR FIPS endpoint | none |
1165
- | `pf-lambda-image-uri-private-ecr` | AWS::Lambda::Function | A container image lives in a private ECR repository | none |
1166
- | `pf-lambda-image-uri-region` | AWS::Lambda::Function | A container image lives in the deploy region | none |
1167
- | `pf-lambda-imageconfig-requires-image` | AWS::Lambda::Function | ImageConfig belongs to container-image functions | none |
1168
- | `pf-lambda-layer-arn-region` | AWS::Lambda::Function | A layer lives in the deploy region | none |
1169
- | `pf-lambda-layer-compatible-architectures-enum` | AWS::Lambda::LayerVersion | CompatibleArchitectures are x86_64 or arm64 | pending-engine |
1170
- | `pf-lambda-layer-compatible-runtimes-enum` | AWS::Lambda::LayerVersion | CompatibleRuntimes are known runtime identifiers | pending-engine |
1171
- | `pf-lambda-layer-content-storage-mode-enum` | AWS::Lambda::LayerVersion | S3ObjectStorageMode is COPY or REFERENCE | pending-engine |
1172
- | `pf-lambda-layer-cross-account-needs-permission` | AWS::Lambda::Function | A cross-account layer needs a share | none |
1173
- | `pf-lambda-layer-name-pattern` | AWS::Lambda::LayerVersion | A layer name is letters, digits, dashes and underscores | none |
1174
- | `pf-lambda-layer-reference-glacier-storage-class` | AWS::Lambda::LayerVersion | REFERENCE content cannot be archived | none |
1175
- | `pf-lambda-layer-reference-needs-bucket-policy` | AWS::Lambda::LayerVersion | REFERENCE content needs a bucket policy for Lambda | none |
1176
- | `pf-lambda-layer-reference-needs-object-version` | AWS::Lambda::LayerVersion | REFERENCE content needs an object version | none |
1177
- | `pf-lambda-layer-reference-needs-versioning` | AWS::Lambda::LayerVersion | REFERENCE content needs a versioned bucket | none |
1178
- | `pf-lambda-layerperm-arn-length` | AWS::Lambda::LayerVersionPermission | A layer version ARN is at most 140 characters | none |
1179
- | `pf-lambda-layerperm-arn-version-suffix` | AWS::Lambda::LayerVersionPermission | A layer permission names a layer version | none |
1180
- | `pf-lambda-layerperm-organization-id-needs-wildcard-principal` | AWS::Lambda::LayerVersionPermission | OrganizationId narrows a wildcard principal | none |
1181
- | `pf-lambda-layerperm-policy-size` | AWS::Lambda::LayerVersionPermission | A layer version policy has a size limit | pending-engine |
1182
- | `pf-lambda-loggroup-no-aws-prefix` | AWS::Lambda::Function | A custom log group cannot start with aws/ | none |
1183
- | `pf-lambda-loggroup-pattern` | AWS::Lambda::Function | A log group name follows the CloudWatch Logs naming rules | none |
1184
- | `pf-lambda-loglevel-requires-json` | AWS::Lambda::Function | Log-level filters need JSON log format | none |
1185
- | `pf-lambda-memory-max` | AWS::Lambda::Function | MemorySize tops out at 10240 | pending-engine |
1186
- | `pf-lambda-perm-cross-region-function` | AWS::Lambda::Permission | A permission stays in the function region | none |
1187
- | `pf-lambda-perm-function-name-latest` | AWS::Lambda::Permission | A permission cannot name $LATEST | none |
1188
- | `pf-lambda-perm-function-url-auth-type-enum` | AWS::Lambda::Permission | FunctionUrlAuthType is AWS_IAM or NONE | pending-engine |
1189
- | `pf-lambda-perm-policy-size` | AWS::Lambda::Permission | A function resource policy has a size limit | pending-engine |
1190
- | `pf-lambda-perm-principal-service-domain` | AWS::Lambda::Permission | A service principal is a domain-style identifier | none |
1191
- | `pf-lambda-perm-principal-whitespace` | AWS::Lambda::Permission | A principal has no whitespace | none |
1192
- | `pf-lambda-perm-source-arn-with-account-principal` | AWS::Lambda::Permission | SourceArn narrows service principals, not account principals | pending-engine |
1193
- | `pf-lambda-perm-url-auth-action` | AWS::Lambda::Permission | FunctionUrlAuthType goes with the function URL action | none |
1194
- | `pf-lambda-provisioned-concurrency-not-latest` | AWS::Lambda::Alias | Provisioned concurrency cannot sit on $LATEST | none |
1195
- | `pf-lambda-provisioned-sum-not-exceed-reserved` | AWS::Lambda::Function | Provisioned concurrency fits inside the reserved concurrency | none |
1196
- | `pf-lambda-recursive-loop-enum` | AWS::Lambda::Function | RecursiveLoop takes Allow or Terminate | pending-engine |
1197
- | `pf-lambda-runtime-arn-manual-only` | AWS::Lambda::Function | A pinned runtime version needs UpdateRuntimeOn: Manual | none |
1198
- | `pf-lambda-runtime-manual-requires-arn` | AWS::Lambda::Function | Manual runtime updates need a runtime version ARN | none |
1199
- | `pf-lambda-runtime-version-arn-region` | AWS::Lambda::Function | A runtime version ARN names the deploy region | none |
1200
- | `pf-lambda-s3-storage-mode-zip-only` | AWS::Lambda::Function | S3ObjectStorageMode belongs to .zip functions | none |
1201
- | `pf-lambda-scaling-min-max-pair` | AWS::Lambda::Function | FunctionScalingConfig takes both bounds | none |
1202
- | `pf-lambda-scaling-min-zero-requires-max-zero` | AWS::Lambda::Function | Scaling to zero means both bounds are zero | none |
1203
- | `pf-lambda-system-log-level-enum` | AWS::Lambda::Function | SystemLogLevel takes DEBUG, INFO or WARN | pending-engine |
1204
- | `pf-lambda-tenancy-no-function-url` | AWS::Lambda::Function | A tenant-isolated function cannot have a function URL | none |
1205
- | `pf-lambda-tenancy-no-provisioned-concurrency` | AWS::Lambda::Function | A tenant-isolated function cannot use provisioned concurrency | none |
1206
- | `pf-lambda-tenancy-no-snapstart` | AWS::Lambda::Function | A tenant-isolated function cannot use SnapStart | pending-engine |
1207
- | `pf-lambda-timeout-max` | AWS::Lambda::Function | Timeout tops out at 900 seconds | pending-engine |
1208
- | `pf-lambda-tracing-mode-enum` | AWS::Lambda::Function | TracingConfig.Mode takes Active or PassThrough | pending-engine |
1209
- | `pf-lambda-url-auth-type-enum` | AWS::Lambda::Url | AuthType is AWS_IAM or NONE | pending-engine |
1210
- | `pf-lambda-url-cors-allow-methods-wildcard-mix` | AWS::Lambda::Url | CORS methods are a wildcard or a list, not both | none |
1211
- | `pf-lambda-url-cors-allow-origins-wildcard-mix` | AWS::Lambda::Url | CORS origins are a wildcard or a list, not both | none |
1212
- | `pf-lambda-url-invoke-mode-enum` | AWS::Lambda::Url | InvokeMode is BUFFERED or RESPONSE_STREAM | pending-engine |
1213
- | `pf-lambda-url-qualifier-latest-literal` | AWS::Lambda::Url | A URL qualifier cannot be $LATEST | none |
1214
- | `pf-lambda-url-qualifier-permission-match` | AWS::Lambda::Url | A qualified URL needs a qualified permission | none |
1215
- | `pf-lambda-url-target-arn-and-qualifier` | AWS::Lambda::Url | The qualifier goes in TargetFunctionArn or Qualifier, not both | none |
1216
- | `pf-lambda-url-target-name-length` | AWS::Lambda::Url | A bare target function name is at most 64 characters | none |
1217
- | `pf-lambda-version-runtime-policy-manual-requires-arn` | AWS::Lambda::Version | A version pinned to Manual needs a runtime version ARN | none |
1218
- | `pf-lambda-vpc-no-dedicated-tenancy` | AWS::Lambda::Function | A VPC function cannot sit in a dedicated-tenancy VPC | none |
1219
- | `pf-lambda-vpc-non-empty` | AWS::Lambda::Function | VpcConfig needs at least one subnet and one security group | none |
1220
- | `pf-lambda-vpc-same-vpc` | AWS::Lambda::Function | Subnets and security groups belong to one VPC | none |
1221
- | `pf-lambda-zip-no-imageuri` | AWS::Lambda::Function | A .zip function cannot carry Code.ImageUri | none |
1222
- | `pf-logs-account-policy-document-json` | AWS::Logs::AccountPolicy | An account policy document must be valid JSON | none |
1223
- | `pf-logs-account-policy-selection-criteria-prefix` | AWS::Logs::AccountPolicy | Field index and transformer account policies select with LogGroupNamePrefix | none |
1224
- | `pf-logs-account-policy-selection-criteria-subscription` | AWS::Logs::AccountPolicy | A subscription account policy selects with LogGroupName NOT IN | none |
1225
- | `pf-logs-account-policy-selection-criteria-unsupported` | AWS::Logs::AccountPolicy | A data protection account policy takes no SelectionCriteria | none |
1226
- | `pf-logs-account-policy-subscription-document` | AWS::Logs::AccountPolicy | A subscription account policy document needs DestinationArn | none |
1227
- | `pf-logs-account-policy-transformer-document` | AWS::Logs::AccountPolicy | A transformer account policy document is an array of processors | none |
1228
- | `pf-logs-anomaly-detector-single-log-group` | AWS::Logs::LogAnomalyDetector | A log anomaly detector watches exactly one log group | none |
1229
- | `pf-logs-data-protection-identifier-arn` | AWS::Logs::LogGroup | A data identifier must be a managed data-identifier ARN | none |
1230
- | `pf-logs-data-protection-identifiers-match` | AWS::Logs::LogGroup | Both data protection statements must list the same data identifiers | none |
1231
- | `pf-logs-data-protection-mask-config-empty` | AWS::Logs::LogGroup | Deidentify MaskConfig takes no fields | none |
1232
- | `pf-logs-data-protection-policy-statements` | AWS::Logs::LogGroup | A data protection policy needs exactly two statements | none |
1233
- | `pf-logs-data-protection-policy-version` | AWS::Logs::LogGroup | A data protection policy version must be 2021-06-01 | none |
1234
- | `pf-logs-delivery-destination-output-format-enum` | AWS::Logs::DeliveryDestination | OutputFormat must be json, plain, w3c, raw or parquet | none |
1235
- | `pf-logs-delivery-destination-output-format-target` | AWS::Logs::DeliveryDestination | A CloudWatch Logs delivery destination cannot use parquet | none |
1236
- | `pf-logs-delivery-destination-region` | AWS::Logs::DeliveryDestination | A delivery destination must be in the stack's own region | none |
1237
- | `pf-logs-destination-policy-json` | AWS::Logs::Destination | DestinationPolicy must be an IAM policy document | none |
1238
- | `pf-logs-field-index-fields-max` | AWS::Logs::LogGroup | A field index policy indexes at most 20 fields | none |
1239
- | `pf-logs-field-selection-criteria-syntax` | AWS::Logs::MetricFilter | FieldSelectionCriteria must reference an @aws system field | none |
1240
- | `pf-logs-filter-name-charset` | AWS::Logs::MetricFilter | A filter name cannot contain a colon or an asterisk | none |
1241
- | `pf-logs-filter-pattern-bracket` | AWS::Logs::MetricFilter<br>AWS::Logs::SubscriptionFilter | A filter pattern starting with '[' must end with ']' | none |
1242
- | `pf-logs-infrequent-access-anomaly-detector` | AWS::Logs::LogGroup<br>AWS::Logs::LogAnomalyDetector | A log anomaly detector needs Standard-class log groups | none |
1243
- | `pf-logs-infrequent-access-metric-filter` | AWS::Logs::LogGroup<br>AWS::Logs::MetricFilter | A metric filter needs a Standard-class log group | none |
1244
- | `pf-logs-infrequent-access-subscription-filter` | AWS::Logs::LogGroup<br>AWS::Logs::SubscriptionFilter | A subscription filter needs a Standard-class log group | none |
1245
- | `pf-logs-infrequent-access-transformer` | AWS::Logs::LogGroup<br>AWS::Logs::Transformer | A transformer needs a Standard-class log group | none |
1246
- | `pf-logs-metric-dimension-selector` | AWS::Logs::MetricFilter | A metric filter dimension value must be a field selector | none |
1247
- | `pf-logs-metric-dimensions-default-exclusive` | AWS::Logs::MetricFilter | Dimensions and DefaultValue are mutually exclusive | none |
1248
- | `pf-logs-metric-namespace-reserved` | AWS::Logs::MetricFilter | A metric filter cannot publish into the AWS/ namespace | none |
1249
- | `pf-logs-query-definition-log-groups-max` | AWS::Logs::QueryDefinition | A saved query names at most 50 log groups | none |
1250
- | `pf-logs-resource-policy-json` | AWS::Logs::ResourcePolicy | PolicyDocument must be an IAM policy document | none |
1251
- | `pf-logs-subscription-destination-vendor` | AWS::Logs::SubscriptionFilter | A subscription destination must be Lambda, Kinesis, Firehose or a Logs destination | none |
1252
- | `pf-logs-subscription-firehose-role` | AWS::Logs::SubscriptionFilter | A Firehose destination needs RoleArn | none |
1253
- | `pf-logs-subscription-kinesis-role` | AWS::Logs::SubscriptionFilter | A Kinesis destination needs RoleArn | none |
1254
- | `pf-logs-subscription-lambda-no-role` | AWS::Logs::SubscriptionFilter | A Lambda destination must not carry RoleArn | none |
1255
- | `pf-logs-transformer-grok-pattern` | AWS::Logs::Transformer | A grok match may only use supported pattern names | none |
1256
- | `pf-logs-transformer-parser-first` | AWS::Logs::Transformer | A transformer config must begin with a parser | none |
1257
- | `pf-memorydb-data-tiering-node-type` | AWS::MemoryDB::Cluster | DataTiering only works on r6gd node types | none |
1258
- | `pf-memorydb-engine` | AWS::MemoryDB::Cluster | MemoryDB runs Valkey or Redis, not Memcached | none |
1259
- | `pf-memorydb-kms-key-region` | AWS::MemoryDB::Cluster | KmsKeyId must name a key in the deploy region | none |
1260
- | `pf-memorydb-maintenance-window` | AWS::MemoryDB::Cluster | MaintenanceWindow must be ddd:hh24:mi-ddd:hh24:mi and span at least 60 minutes | none |
1261
- | `pf-memorydb-port` | AWS::MemoryDB::Cluster | Port must be in 1150-8004 or 8006-65535 | none |
1262
- | `pf-memorydb-replicas-per-shard` | AWS::MemoryDB::Cluster | NumReplicasPerShard is 0-5 | none |
1263
- | `pf-memorydb-snapshot-retention` | AWS::MemoryDB::Cluster | SnapshotRetentionLimit is 0-35 days | none |
1264
- | `pf-memorydb-snapshot-window` | AWS::MemoryDB::Cluster | SnapshotWindow must be hh24:mi-hh24:mi and must not overlap the maintenance window | none |
1265
- | `pf-memorydb-user-password` | AWS::MemoryDB::User | A password user needs passwords of 16-128 characters | none |
1266
- | `pf-pipes-batch-size-target-limit` | AWS::Pipes::Pipe | Source BatchSize is capped by what the target accepts per call | none |
1267
- | `pf-pipes-cross-region` | AWS::Pipes::Pipe | A pipe's source and target must be in the pipe's Region | none |
1268
- | `pf-pipes-enrichment-type` | AWS::Pipes::Pipe | Pipe enrichment must be Lambda, Step Functions, API Gateway or an API destination | none |
1269
- | `pf-pipes-filter-pattern` | AWS::Pipes::Pipe | A pipe filter Pattern must be a valid, non-empty event pattern | none |
1270
- | `pf-pipes-input-template-variables` | AWS::Pipes::Pipe | InputTemplate may only use the aws.pipes.* reserved variables | none |
1271
- | `pf-pipes-log-configuration` | AWS::Pipes::Pipe | A log level other than OFF needs a destination, and S3 logs must be JSON | none |
1272
- | `pf-pipes-source-parameters` | AWS::Pipes::Pipe | Source parameters must match the source, and stream sources require theirs | none |
1273
- | `pf-pipes-target-parameters` | AWS::Pipes::Pipe | Target parameters must match the target's resource type | none |
1274
- | `pf-pipes-target-sns-fifo` | AWS::Pipes::Pipe | A FIFO SNS topic cannot be a pipe target | none |
1275
- | `pf-rds-backtrack` | AWS::RDS::DBCluster | Backtrack only works on aurora-mysql, with a window of at most 259200 seconds | none |
1276
- | `pf-rds-backup-retention-range` | AWS::RDS::DBInstance | BackupRetentionPeriod must be at most 35 days | none |
1277
- | `pf-rds-backup-window-duration` | AWS::RDS::DBInstance | The backup window must be at least 30 minutes | none |
1278
- | `pf-rds-backup-window-format` | AWS::RDS::DBInstance | PreferredBackupWindow must be hh24:mi-hh24:mi | none |
1279
- | `pf-rds-character-set-engine` | AWS::RDS::DBInstance | CharacterSetName is only accepted by Oracle engines | none |
1280
- | `pf-rds-cluster-allocated-storage-aurora` | AWS::RDS::DBCluster | AllocatedStorage is only for Multi-AZ DB clusters, not Aurora | none |
1281
- | `pf-rds-cluster-az-count` | AWS::RDS::DBCluster | AvailabilityZones accepts at most 3 zones | none |
1282
- | `pf-rds-cluster-instance-class-aurora` | AWS::RDS::DBCluster | DBClusterInstanceClass is only for Multi-AZ DB clusters, not Aurora | none |
1283
- | `pf-rds-cluster-logs-exports-engine` | AWS::RDS::DBCluster | Cluster EnableCloudwatchLogsExports values depend on the Aurora engine | none |
1284
- | `pf-rds-cluster-port-range` | AWS::RDS::DBCluster | DBCluster Port must be between 1150 and 65535 | none |
1285
- | `pf-rds-cluster-publicly-accessible-aurora` | AWS::RDS::DBCluster | PubliclyAccessible is only for Multi-AZ DB clusters, not Aurora | none |
1286
- | `pf-rds-cluster-storage-type` | AWS::RDS::DBCluster | Aurora clusters only accept the aurora storage types | none |
1287
- | `pf-rds-database-insights-advanced` | AWS::RDS::DBCluster | DatabaseInsightsMode: advanced requires Performance Insights with at least 31 days retention | none |
1288
- | `pf-rds-dbname-format` | AWS::RDS::DBInstance | postgres DBName must begin with a letter | none |
1289
- | `pf-rds-description-printable` | AWS::RDS::DBSubnetGroup<br>AWS::RDS::DBParameterGroup | RDS group descriptions must be printable ASCII | none |
1290
- | `pf-rds-engine-mode-serverless-retired` | AWS::RDS::DBCluster | EngineMode: serverless (Aurora Serverless v1) can no longer be created | none |
1291
- | `pf-rds-event-subscription-categories` | AWS::RDS::EventSubscription | EventCategories must exist for the SourceType | none |
1292
- | `pf-rds-event-subscription-source-ids-require-type` | AWS::RDS::EventSubscription | SourceIds requires SourceType | none |
1293
- | `pf-rds-event-subscription-source-type-values` | AWS::RDS::EventSubscription | SourceType must be one of the RDS event source types | none |
1294
- | `pf-rds-global-write-forwarding-requires-global` | AWS::RDS::DBCluster | EnableGlobalWriteForwarding requires GlobalClusterIdentifier | none |
1295
- | `pf-rds-gp3-iops-storage-threshold` | AWS::RDS::DBInstance | gp3 below 400 GiB cannot take custom Iops or StorageThroughput (postgres/mysql) | none |
1296
- | `pf-rds-iam-auth-engine` | AWS::RDS::DBInstance | IAM database authentication is only supported by MySQL, MariaDB and PostgreSQL | none |
1297
- | `pf-rds-io1-iops-ratio` | AWS::RDS::DBInstance | postgres io1 Iops may not exceed 50 per GiB of storage | none |
1298
- | `pf-rds-iops-required` | AWS::RDS::DBInstance | io1 and io2 storage require the Iops property | none |
1299
- | `pf-rds-license-model-engine` | AWS::RDS::DBInstance | LicenseModel must match the engine | none |
1300
- | `pf-rds-limitless-delete-automated-backups` | AWS::RDS::DBCluster | Limitless clusters cannot set DeleteAutomatedBackups: false | none |
1301
- | `pf-rds-logs-exports-engine` | AWS::RDS::DBInstance | EnableCloudwatchLogsExports values depend on the engine | none |
1302
- | `pf-rds-magnetic-storage-deprecated` | AWS::RDS::DBInstance | Magnetic (standard) storage cannot be created any more | none |
1303
- | `pf-rds-manage-master-password-exclusive` | AWS::RDS::DBInstance | ManageMasterUserPassword and MasterUserPassword are mutually exclusive | none |
1304
- | `pf-rds-master-username-length` | AWS::RDS::DBInstance | MasterUsername length limit depends on the engine | none |
1305
- | `pf-rds-master-username-reserved` | AWS::RDS::DBInstance | MasterUsername must not be an engine reserved word | none |
1306
- | `pf-rds-max-allocated-storage` | AWS::RDS::DBInstance | MaxAllocatedStorage must be greater than AllocatedStorage | none |
1307
- | `pf-rds-monitoring-interval-values` | AWS::RDS::DBInstance<br>AWS::RDS::DBCluster | MonitoringInterval must be one of 0, 1, 5, 10, 15, 30, 60 | none |
1308
- | `pf-rds-monitoring-role-required` | AWS::RDS::DBInstance<br>AWS::RDS::DBCluster | MonitoringRoleArn is required when MonitoringInterval is not 0 | none |
1309
- | `pf-rds-multiaz-availability-zone` | AWS::RDS::DBInstance | MultiAZ and AvailabilityZone are mutually exclusive | none |
1310
- | `pf-rds-option-group-engine` | AWS::RDS::DBInstance<br>AWS::RDS::OptionGroup | OptionGroup EngineName must match the engine of the instance that uses it | none |
1311
- | `pf-rds-parameter-group-family-engine` | AWS::RDS::DBInstance<br>AWS::RDS::DBParameterGroup | DBParameterGroup Family must match the engine of the instance that uses it | none |
1312
- | `pf-rds-password-valid` | AWS::RDS::DBInstance<br>AWS::RDS::DBCluster | MasterUserPassword must be at least 8 characters without '/', '@', '\"' or spaces | none |
1313
- | `pf-rds-pi-retention-period` | AWS::RDS::DBInstance | PerformanceInsightsRetentionPeriod must be 7, 731, or a multiple of 31 up to 713 | none |
1314
- | `pf-rds-pi-retention-requires-enable` | AWS::RDS::DBInstance | PerformanceInsightsRetentionPeriod requires EnablePerformanceInsights: true | none |
1315
- | `pf-rds-port-range` | AWS::RDS::DBInstance | The database port must be within 1150-65535 | none |
1316
- | `pf-rds-processor-features-engine` | AWS::RDS::DBInstance | ProcessorFeatures is only supported by Oracle and SQL Server | none |
1317
- | `pf-rds-promotion-tier-cluster-only` | AWS::RDS::DBInstance | PromotionTier is only valid on a cluster member instance | none |
1318
- | `pf-rds-proxy-client-password-auth-engine` | AWS::RDS::DBProxy | ClientPasswordAuthType must match the proxy EngineFamily | none |
1319
- | `pf-rds-proxy-iam-auth-enabled` | AWS::RDS::DBProxy | IAMAuth: ENABLED is only valid for SQL Server proxies | none |
1320
- | `pf-rds-proxy-iam-auth-requires-tls` | AWS::RDS::DBProxy | IAMAuth: REQUIRED needs RequireTLS: true | none |
1321
- | `pf-rds-proxy-idle-client-timeout` | AWS::RDS::DBProxy | IdleClientTimeout must be between 1 and 28800 seconds | none |
1322
- | `pf-rds-proxy-pool-percent` | AWS::RDS::DBProxyTargetGroup | Connection pool percentages and borrow timeout have fixed ranges | none |
1323
- | `pf-rds-proxy-target-group-name` | AWS::RDS::DBProxyTargetGroup | DBProxyTargetGroup TargetGroupName must be "default" | none |
1324
- | `pf-rds-scaling-configuration-serverless-v1-only` | AWS::RDS::DBCluster | ScalingConfiguration only applies to Aurora Serverless v1 clusters | none |
1325
- | `pf-rds-serverless-v2-auto-pause` | AWS::RDS::DBCluster | SecondsUntilAutoPause requires MinCapacity 0 | none |
1326
- | `pf-rds-serverless-v2-capacity` | AWS::RDS::DBCluster | Serverless v2 MinCapacity must not exceed MaxCapacity, and MaxCapacity is at most 256 | none |
1327
- | `pf-rds-serverless-v2-capacity-step` | AWS::RDS::DBCluster | Serverless v2 capacity must be a multiple of 0.5 ACU | none |
1328
- | `pf-rds-shard-group-acu` | AWS::RDS::DBShardGroup | DBShardGroup MaxACU must be at least MinACU | none |
1329
- | `pf-rds-sqlserver-dbname-null` | AWS::RDS::DBInstance | DBName is not accepted by SQL Server engines | none |
1330
- | `pf-rds-sqlserver-reserved-port` | AWS::RDS::DBInstance | SQL Server reserves several ports | none |
1331
- | `pf-rds-storage-throughput-gp3-only` | AWS::RDS::DBInstance | StorageThroughput is only valid with StorageType gp3 | none |
1332
- | `pf-rds-storage-throughput-max` | AWS::RDS::DBInstance | gp3 StorageThroughput is capped at 4000 MiBps | none |
1333
- | `pf-rds-subnet-group-name` | AWS::RDS::DBSubnetGroup | DB subnet group names allow only letters, numbers, spaces, dot, underscore and hyphen | none |
1334
- | `pf-rds-subnet-group-name-reserved` | AWS::RDS::DBSubnetGroup | DBSubnetGroupName: default is reserved | none |
1335
- | `pf-rds-timezone-engine` | AWS::RDS::DBInstance | Timezone is only accepted by Db2 and SQL Server engines | none |
1336
- | `pf-rds-window-overlap` | AWS::RDS::DBInstance | The backup window and the maintenance window must not overlap | none |
1337
- | `pf-route53-alias-cloudfront-zone-id` | AWS::Route53::RecordSet | A CloudFront alias target must use hosted zone Z2FDTNDATAQYW2 | none |
1338
- | `pf-route53-apex-cname` | AWS::Route53::RecordSet<br>AWS::Route53::HostedZone | A CNAME record is not permitted at the zone apex | none |
1339
- | `pf-route53-geolocation-exclusive` | AWS::Route53::RecordSet | GeoLocation cannot specify both ContinentCode and CountryCode | pending-engine |
1340
- | `pf-route53-multivalue-alias` | AWS::Route53::RecordSet | MultiValueAnswer cannot be combined with AliasTarget | none |
1341
- | `pf-route53-record-type-routing-policy` | AWS::Route53::RecordSet | NS records take no routing policy; CNAME cannot be multivalue | none |
1342
- | `pf-route53-record-value-source` | AWS::Route53::RecordSet | A record set needs AliasTarget or the full TTL+ResourceRecords pair | none |
1343
- | `pf-route53-routing-policy-exclusive` | AWS::Route53::RecordSet | A record set can use only one routing policy | none |
1344
- | `pf-route53-set-identifier-pairing` | AWS::Route53::RecordSet | SetIdentifier and a routing policy must appear together | none |
1345
- | `pf-route53-ttl-range` | AWS::Route53::RecordSet | TTL must fit in 32 bits (0..2147483647 seconds) | pending-engine |
1346
- | `pf-route53-weight-range` | AWS::Route53::RecordSet | Weight must be between 0 and 255 | pending-engine |
1347
- | `pf-route53-zonename-trailing-dot` | AWS::Route53::RecordSet | HostedZoneName must end with a trailing dot | none |
1348
- | `pf-s3-accelerate-dotted-name` | AWS::S3::Bucket | Transfer Acceleration rejects bucket names with periods | none |
1349
- | `pf-s3-acl-public-blocked` | AWS::S3::Bucket | A public canned ACL cannot be applied while Block Public Access is on | none |
1350
- | `pf-s3-ap-name-alias-suffix` | AWS::S3::AccessPoint | An access point name must not end with an alias suffix | none |
1351
- | `pf-s3-bucket-name-double-dot` | AWS::S3::Bucket | A bucket name must not contain two adjacent periods | none |
1352
- | `pf-s3-bucket-name-ip-address` | AWS::S3::Bucket | A bucket name must not look like an IP address | none |
1353
- | `pf-s3-bucket-name-reserved-prefix` | AWS::S3::Bucket | A bucket name must not start with a reserved prefix | none |
1354
- | `pf-s3-bucket-name-reserved-suffix` | AWS::S3::Bucket | A bucket name must not end with a reserved suffix | none |
1355
- | `pf-s3-bucket-namespace-account-regional-name` | AWS::S3::Bucket | An account-regional bucket takes a BucketNamePrefix, not a BucketName | none |
1356
- | `pf-s3-bucket-policy-action-resource` | AWS::S3::BucketPolicy | Object-level actions need an object-level Resource | none |
1357
- | `pf-s3-bucket-policy-principal` | AWS::S3::BucketPolicy | Bucket policy statements need a Principal | none |
1358
- | `pf-s3-bucket-policy-version` | AWS::S3::BucketPolicy | A policy document Version must be a known IAM policy language version | none |
1359
- | `pf-s3-encryption-kms-key-with-aes256` | AWS::S3::Bucket | KMSMasterKeyID is only valid with a KMS server-side encryption algorithm | none |
1360
- | `pf-s3-intelligent-tiering-archive-before-deep` | AWS::S3::Bucket | ARCHIVE_ACCESS must come before DEEP_ARCHIVE_ACCESS | none |
1361
- | `pf-s3-intelligent-tiering-duplicate-tier` | AWS::S3::Bucket | An Intelligent-Tiering configuration must not repeat an access tier | none |
1362
- | `pf-s3-lifecycle-abort-mpu-with-tag-filter` | AWS::S3::Bucket | AbortIncompleteMultipartUpload cannot be used in a tag-filtered rule | none |
1363
- | `pf-s3-lifecycle-date-days-mix` | AWS::S3::Bucket | A lifecycle rule must not mix day-based and date-based schedules | none |
1364
- | `pf-s3-lifecycle-date-midnight-utc` | AWS::S3::Bucket | Lifecycle dates must be UTC midnight | none |
1365
- | `pf-s3-lifecycle-days-order` | AWS::S3::Bucket | Lifecycle archive transitions must come 30+ days after IA, and expiration after every transition | none |
1366
- | `pf-s3-lifecycle-delete-marker-exclusive` | AWS::S3::Bucket | ExpiredObjectDeleteMarker cannot be combined with an expiration or a tag filter | none |
1367
- | `pf-s3-lifecycle-expiration-positive` | AWS::S3::Bucket | ExpirationInDays must be a positive integer | pending-engine |
1368
- | `pf-s3-lifecycle-min-storage-duration-chain` | AWS::S3::Bucket | A transition must wait out the minimum storage duration of the class it leaves | none |
1369
- | `pf-s3-lifecycle-object-size-order` | AWS::S3::Bucket | ObjectSizeGreaterThan must be smaller than ObjectSizeLessThan | none |
1370
- | `pf-s3-lifecycle-rule-id-duplicate` | AWS::S3::Bucket | Lifecycle rule ids must be unique within a bucket | none |
1371
- | `pf-s3-lifecycle-rule-no-action` | AWS::S3::Bucket | A lifecycle rule needs at least one action | none |
1372
- | `pf-s3-lifecycle-tag-key-duplicate` | AWS::S3::Bucket | Lifecycle tag filter keys must be unique within a rule | none |
1373
- | `pf-s3-lifecycle-transition-singular-plural-exclusive` | AWS::S3::Bucket | A lifecycle rule must not use both the singular and the plural transition property | none |
1374
- | `pf-s3-lifecycle-transition-storage-class-duplicate` | AWS::S3::Bucket | A lifecycle rule must not transition to the same storage class twice | none |
1375
- | `pf-s3-lifecycle-transition-waterfall-order` | AWS::S3::Bucket | Lifecycle transitions may only move down the storage-class waterfall | none |
1376
- | `pf-s3-metadata-kms-requires-key` | AWS::S3::Bucket | A KMS-encrypted metadata table needs a KmsKeyArn | none |
1377
- | `pf-s3-metadata-record-expiration-days` | AWS::S3::Bucket | Metadata journal record expiration must be at least 7 days | none |
1378
- | `pf-s3-metadata-v1-v2-exclusive` | AWS::S3::Bucket | MetadataConfiguration and MetadataTableConfiguration cannot both be set | none |
1379
- | `pf-s3-notification-destination-region` | AWS::S3::Bucket | A notification destination must live in the bucket region | none |
1380
- | `pf-s3-notification-duplicate-filter-type` | AWS::S3::Bucket | A notification filter may hold one prefix rule and one suffix rule | none |
1381
- | `pf-s3-notification-event-name` | AWS::S3::Bucket | The notification Event must be an S3 event type | none |
1382
- | `pf-s3-notification-fifo-queue` | AWS::S3::Bucket | S3 event notifications cannot target a FIFO SQS queue | none |
1383
- | `pf-s3-notification-fifo-topic` | AWS::S3::Bucket | S3 event notifications cannot target a FIFO SNS topic | none |
1384
- | `pf-s3-notification-overlapping-filters` | AWS::S3::Bucket | Notification entries must not overlap for the same event type | none |
1385
- | `pf-s3-objectlock-requires-versioning` | AWS::S3::Bucket | ObjectLockConfiguration needs versioning enabled | none |
1386
- | `pf-s3-objectlock-retention-days-years-exclusive` | AWS::S3::Bucket | DefaultRetention takes exactly one of Days or Years | none |
1387
- | `pf-s3-objectlock-versioning-suspended` | AWS::S3::Bucket | Object Lock forbids suspending versioning | none |
1388
- | `pf-s3-policy-public-with-block-public-policy` | AWS::S3::BucketPolicy<br>AWS::S3::Bucket | A public bucket policy cannot be put on a bucket that blocks public policies | none |
1389
- | `pf-s3-replication-acl-translation-needs-account` | AWS::S3::Bucket | AccessControlTranslation requires the destination Account | none |
1390
- | `pf-s3-replication-dest-versioning` | AWS::S3::Bucket | The replication destination bucket needs versioning enabled | none |
1391
- | `pf-s3-replication-destination-bucket-arn` | AWS::S3::Bucket | The replication destination must be a bucket ARN, not a bucket name | none |
1392
- | `pf-s3-replication-filter-requires-delete-marker` | AWS::S3::Bucket | A V2 replication rule with a Filter must also set Priority and DeleteMarkerReplication | none |
1393
- | `pf-s3-replication-priority-duplicate` | AWS::S3::Bucket | Replication rule priorities must be unique | none |
1394
- | `pf-s3-replication-requires-versioning` | AWS::S3::Bucket | ReplicationConfiguration requires versioning to be enabled on the source bucket | none |
1395
- | `pf-s3-replication-rtc-minutes-15` | AWS::S3::Bucket | Replication Time Control accepts only 15 minutes | none |
1396
- | `pf-s3-replication-rtc-needs-metrics` | AWS::S3::Bucket | Replication Time Control needs Metrics, and Metrics needs ReplicationTime | none |
1397
- | `pf-s3-replication-sse-kms-needs-replica-key` | AWS::S3::Bucket | Replicating SSE-KMS objects requires a replica KMS key | none |
1398
- | `pf-s3-replication-tag-filter-delete-marker` | AWS::S3::Bucket | A tag-filtered replication rule must disable delete marker replication | none |
1399
- | `pf-s3-replication-v1-v2-mixed` | AWS::S3::Bucket | A replication rule must not mix the V1 Prefix with the V2 Filter | none |
1400
- | `pf-s3-storagelens-bucket-level-needs-account-level` | AWS::S3::StorageLens | A bucket-level advanced metric must also be enabled at the account level | none |
1401
- | `pf-s3-storagelens-buckets-arn` | AWS::S3::StorageLens | Storage Lens scope buckets are given as ARNs | none |
1402
- | `pf-s3-storagelens-include-empty` | AWS::S3::StorageLens | A Storage Lens Include or Exclude must list at least one bucket or region | none |
1403
- | `pf-s3-storagelens-include-exclude-exclusive` | AWS::S3::StorageLens | A Storage Lens configuration takes either Include or Exclude | none |
1404
- | `pf-s3-storagelens-prefix-delimiter-length` | AWS::S3::StorageLens | PrefixDelimiter is a single character | none |
1405
- | `pf-s3-storagelensgroup-match-any-max` | AWS::S3::StorageLensGroup | A Storage Lens group match list holds at most 10 entries | none |
1406
- | `pf-s3-storagelensgroup-object-age-order` | AWS::S3::StorageLensGroup | MatchObjectAge DaysGreaterThan must be smaller than DaysLessThan | none |
1407
- | `pf-s3-storagelensgroup-object-size-order` | AWS::S3::StorageLensGroup | MatchObjectSize BytesGreaterThan must be smaller than BytesLessThan | none |
1408
- | `pf-s3-versioning-suspended-with-replication` | AWS::S3::Bucket | A replicating bucket must keep versioning enabled | none |
1409
- | `pf-s3-website-empty-condition` | AWS::S3::Bucket | A RoutingRuleCondition needs a key prefix or an HTTP error code | none |
1410
- | `pf-s3-website-empty-redirect-rule` | AWS::S3::Bucket | A RedirectRule must carry at least one element | none |
1411
- | `pf-s3-website-redirect-exclusive` | AWS::S3::Bucket | RedirectAllRequestsTo excludes every other website setting | none |
1412
- | `pf-s3-website-replace-key-exclusive` | AWS::S3::Bucket | ReplaceKeyWith and ReplaceKeyPrefixWith are mutually exclusive | none |
1413
- | `pf-s3-website-routing-rules-need-index` | AWS::S3::Bucket | RoutingRules require an IndexDocument | none |
1414
- | `pf-s3express-ap-name-suffix` | AWS::S3Express::AccessPoint | An S3 Express access point name must end with --<availability-zone-id>--xa-s3 | none |
1415
- | `pf-s3express-ap-scope-permissions` | AWS::S3Express::AccessPoint | Access point scope permissions are bare API names, not s3: actions | none |
1416
- | `pf-s3express-ap-zone-mismatch` | AWS::S3Express::AccessPoint | An S3 Express access point must carry the same zone id as its bucket | none |
1417
- | `pf-s3express-bucket-key-enabled-false` | AWS::S3Express::DirectoryBucket | A directory bucket must keep BucketKeyEnabled true | none |
1418
- | `pf-s3express-bucket-location-region` | AWS::S3Express::DirectoryBucket | LocationName must name a zone in the region the stack deploys to | none |
1419
- | `pf-s3express-bucket-name-dot` | AWS::S3Express::DirectoryBucket | A directory bucket name must not contain a period | none |
1420
- | `pf-s3express-bucket-name-reserved-prefix` | AWS::S3Express::DirectoryBucket | A directory bucket name must not start with a reserved prefix | none |
1421
- | `pf-s3express-bucket-name-suffix` | AWS::S3Express::DirectoryBucket | A directory bucket name must end with --<availability-zone-id>--x-s3 | none |
1422
- | `pf-s3express-bucket-redundancy-location` | AWS::S3Express::DirectoryBucket | DataRedundancy must match the kind of zone LocationName names | none |
1423
- | `pf-s3express-bucket-zone-mismatch` | AWS::S3Express::DirectoryBucket | The zone id in a directory bucket name must equal LocationName | none |
1424
- | `pf-s3express-kms-key-alias` | AWS::S3Express::DirectoryBucket | A directory bucket KMS key must be given as a key id or ARN, not an alias | none |
1425
- | `pf-s3express-kms-key-with-aes256` | AWS::S3Express::DirectoryBucket | KMSMasterKeyID is only valid when SSEAlgorithm is aws:kms | none |
1426
- | `pf-s3express-lifecycle-object-size-order` | AWS::S3Express::DirectoryBucket | ObjectSizeGreaterThan must be smaller than ObjectSizeLessThan | none |
1427
- | `pf-s3express-lifecycle-rule-no-action` | AWS::S3Express::DirectoryBucket | A directory bucket lifecycle rule must declare an expiration or an abort action | none |
1428
- | `pf-scheduler-date-format` | AWS::Scheduler::Schedule | StartDate and EndDate need millisecond precision | none |
1429
- | `pf-scheduler-flexible-time-window` | AWS::Scheduler::Schedule | MaximumWindowInMinutes is only valid when the flexible time window is on | none |
1430
- | `pf-scheduler-flexible-window` | AWS::Scheduler::Schedule | FLEXIBLE mode needs MaximumWindowInMinutes, OFF forbids it | none |
1431
- | `pf-scheduler-group-name-default` | AWS::Scheduler::ScheduleGroup | A schedule group may not be named 'default' | none |
1432
- | `pf-scheduler-rate-positive` | AWS::Scheduler::Schedule | A Scheduler rate() value must be positive | none |
1433
- | `pf-scheduler-schedule-expression` | AWS::Scheduler::Schedule | Schedule expression must parse as a valid rate(), cron() or at() | none |
1434
- | `pf-scheduler-start-end-order` | AWS::Scheduler::Schedule | StartDate must come before EndDate | none |
1435
- | `pf-scheduler-target-input-json` | AWS::Scheduler::Schedule | Target Input must be valid JSON | none |
1436
- | `pf-scheduler-target-parameters` | AWS::Scheduler::Schedule | Target parameters must match the target, and FIFO queues and Fargate tasks need theirs | none |
1437
- | `pf-scheduler-target-region` | AWS::Scheduler::Schedule | A schedule can only invoke a target in its own Region | none |
1438
- | `pf-scheduler-universal-target` | AWS::Scheduler::Schedule | Universal targets need the bare ARN shape, an Input, and an API that changes state | none |
1439
- | `pf-secretsmanager-generate-secret-string` | AWS::SecretsManager::Secret | GenerateSecretString must leave at least one character type, a PasswordLength (1..4096) that fits every required type, ExcludeCharacters under 4096 chars that does not wipe out a required type, and SecretStringTemplate (a JSON object) together with GenerateStringKey | none |
1440
- | `pf-secretsmanager-hosted-rotation` | AWS::SecretsManager::RotationSchedule | HostedRotationLambda needs the AWS::SecretsManager transform, a known RotationType, MasterSecretArn/SuperuserSecretArn only for *MultiUser types (never both), and no Runtime with the 2024-09-16 transform | none |
1441
- | `pf-secretsmanager-kms-key` | AWS::SecretsManager::Secret | KmsKeyId must be a key in the deploy region, and AWS managed keys of other services (alias/aws/<service>) cannot encrypt a secret | none |
1442
- | `pf-secretsmanager-replica-regions` | AWS::SecretsManager::Secret | ReplicaRegions must name other regions than the one the secret deploys to | none |
1443
- | `pf-secretsmanager-rotation-lambda` | AWS::SecretsManager::RotationSchedule | A RotationSchedule needs exactly one of RotationLambdaARN (a Lambda ARN in the deploy region) or HostedRotationLambda | none |
1444
- | `pf-secretsmanager-rotation-rules` | AWS::SecretsManager::RotationSchedule | RotationRules: AutomaticallyAfterDays (1..1000) or ScheduleExpression, not both; rate() every 4..23 hours or 1..1000 days; cron() with 6 fields, minute 0, year *, one of day-of-month/day-of-week ?, and hours at least 4 apart; Duration Nh in 1..24 that fits the rotation interval and the UTC day | none |
1445
- | `pf-secretsmanager-rotation-schedule-unique` | AWS::SecretsManager::RotationSchedule | A secret can have only one RotationSchedule | none |
1446
- | `pf-secretsmanager-secret-name` | AWS::SecretsManager::Secret | A secret Name may only contain ASCII letters, digits and -/_+=.@! (no spaces, colons, hashes or non-ASCII text) | none |
1447
- | `pf-secretsmanager-secret-string-exclusive` | AWS::SecretsManager::Secret | SecretString and GenerateSecretString cannot both be set on a secret | none |
1448
- | `pf-secretsmanager-target-attachment` | AWS::SecretsManager::SecretTargetAttachment | SecretTargetAttachment needs a TargetType from the documented list and a secret whose value is a JSON object (SecretString JSON or GenerateSecretString with SecretStringTemplate) | none |
1449
- | `pf-sns-delivery-policy` | AWS::SNS::Subscription<br>AWS::SNS::Topic | HTTP/S DeliveryPolicy retry values: minDelayTarget >= 1, maxDelayTarget <= 3600 and >= minDelayTarget, numRetries 0..100 and at least the sum of the phase retries, phase counts >= 0, backoffFunction one of arithmetic|exponential|geometric|linear, maxReceivesPerSecond >= 1 (subscription DeliveryPolicy and topic DeliveryPolicy.http) | none |
1450
- | `pf-sns-fifo-only-attributes` | AWS::SNS::Topic | ContentBasedDeduplication, ArchivePolicy and FifoThroughputScope are FIFO-only topic attributes, and ArchivePolicy.MessageRetentionPeriod is 1..365 days | none |
1451
- | `pf-sns-fifo-queue-on-standard-topic` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A FIFO SQS queue cannot subscribe to a standard topic (a FIFO topic may fan out to standard queues, not the reverse) | none |
1452
- | `pf-sns-fifo-topic-name` | AWS::SNS::Topic | FIFO topic names must end with '.fifo' (and '.fifo' names require FifoTopic) | none |
1453
- | `pf-sns-fifo-topic-protocol` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A FIFO topic only accepts sqs subscriptions (lambda, http/https, email, email-json, sms, firehose are rejected) | none |
1454
- | `pf-sns-filter-policy` | AWS::SNS::Subscription<br>AWS::SNS::Topic | FilterPolicy shape: at most 5 keys, every value an array or object, no empty arrays, no arrays inside arrays, nesting only with FilterPolicyScope MessageBody, and FilterPolicyScope is MessageAttributes or MessageBody | none |
1455
- | `pf-sns-firehose-subscription-role` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A firehose subscription requires SubscriptionRoleArn | none |
1456
- | `pf-sns-raw-message-delivery` | AWS::SNS::Subscription<br>AWS::SNS::Topic | RawMessageDelivery is only supported for sqs, http, https and firehose subscriptions | none |
1457
- | `pf-sns-subscription-endpoint` | AWS::SNS::Subscription<br>AWS::SNS::Topic | Subscription Protocol is one of the nine SNS protocols and the Endpoint matches it: an ARN of the right service for sqs/lambda/firehose/application, an email address, a URL with the same scheme for http/https, a phone number for sms | none |
1458
- | `pf-sns-subscription-redrive` | AWS::SNS::Subscription<br>AWS::SNS::Topic | Subscription RedrivePolicy needs deadLetterTargetArn, which must be an SQS queue ARN in the deploy region | none |
1459
- | `pf-sns-subscription-region` | AWS::SNS::Subscription | Subscription.Region must be the topic's region (the region in a literal TopicArn, or the deploy region for a topic in this template) | none |
1460
- | `pf-sns-topic-attribute-values` | AWS::SNS::Topic | Topic DisplayName is at most 100 characters, SignatureVersion is 1 or 2, and TracingConfig is PassThrough or Active | none |
1461
- | `pf-sns-topic-name-format` | AWS::SNS::Topic | Topic names allow only letters, numbers, hyphen and underscore (plus a .fifo suffix) | none |
1462
- | `pf-sns-topic-policy-topics` | AWS::SNS::TopicPolicy | TopicPolicy.Topics takes topic ARNs (Ref Topic), not topic names | none |
1463
- | `pf-sqs-dlq-same-type` | AWS::SQS::Queue | A dead-letter queue named by a literal ARN must be the same type as its source (FIFO for FIFO, standard for standard); Fn::GetAtt wiring is covered by engine rule E3502 | none |
1464
- | `pf-sqs-fifo-name-suffix` | AWS::SQS::Queue | A QueueName ending in .fifo requires FifoQueue: true (a FIFO queue without the suffix is engine rule E2504) | none |
1465
- | `pf-sqs-fifo-only-attributes` | AWS::SQS::Queue | ContentBasedDeduplication, DeduplicationScope and FifoThroughputLimit are FIFO-only queue attributes (and the two enums are messageGroup|queue and perQueue|perMessageGroupId) | none |
1466
- | `pf-sqs-high-throughput-pairing` | AWS::SQS::Queue | FifoThroughputLimit perMessageGroupId requires DeduplicationScope messageGroup | none |
1467
- | `pf-sqs-queue-name-format` | AWS::SQS::Queue | Queue names allow only letters, numbers, hyphen and underscore (max 80, plus a .fifo suffix) | none |
1468
- | `pf-sqs-queue-policy-queues` | AWS::SQS::QueuePolicy | QueuePolicy.Queues takes queue URLs (Ref Queue), never ARNs (Fn::GetAtt Queue.Arn), and must not be empty | none |
1469
- | `pf-sqs-redrive-allow-policy` | AWS::SQS::Queue | RedriveAllowPolicy: redrivePermission is required (allowAll|denyAll|byQueue); byQueue needs 1..10 sourceQueueArns and the other two forbid them | none |
1470
- | `pf-sqs-redrive-arn-region` | AWS::SQS::Queue | The dead-letter target and every RedriveAllowPolicy source queue must sit in the deploy region | none |
1471
- | `pf-sqs-redrive-policy` | AWS::SQS::Queue | RedrivePolicy needs deadLetterTargetArn (an SQS queue ARN) and maxReceiveCount in 1..1000 | none |
1472
- | `pf-sqs-sse-exclusive` | AWS::SQS::Queue | SqsManagedSseEnabled: true and KmsMasterKeyId are mutually exclusive (one SSE type per queue) | none |
1473
- | `pf-ssm-association-document` | AWS::SSM::Association | Association document checks: no DocumentVersion on Amazon-owned documents (a new document in this stack only has version 1), the document must be in the deploy region, Session documents cannot be associated, SyncCompliance MANUAL needs an AssociationId parameter, Automation documents with Targets need AutomationTargetParameterName, and Parameters must match the document declaration | none |
1474
- | `pf-ssm-association-schedule` | AWS::SSM::Association | Association schedules: rate() of at least 30 minutes with matching singular/plural unit; cron() only in the accepted forms (every 30 minutes, every 1/2/4/8/12 hours, a time every day or on one weekday, nth or last weekday of the month); at() only with ApplyOnlyAtCronInterval; ApplyOnlyAtCronInterval not with rate(); ScheduleOffset only with ApplyOnlyAtCronInterval and a #n/L weekday cron | none |
1475
- | `pf-ssm-association-targets` | AWS::SSM::Association | An association needs InstanceId or Targets; target keys are InstanceIds, aws:NoOpAutomationTag, resource-groups:Name, tag-key or tag:<key>, with non-empty values and well-formed instance ids | none |
1476
- | `pf-ssm-document-content` | AWS::SSM::Document | Document Content must be JSON for DocumentFormat JSON, have mainSteps (2.x/0.3) or runtimeConfig (1.2), name every step uniquely with a known plugin/action, declare typed parameters that every {{ ref }} resolves to, and keep Automation step links (nextStep, onFailure, isEnd, outputs) consistent | none |
1477
- | `pf-ssm-document-name` | AWS::SSM::Document | Document Name must not start with aws-, amazon or amzn (case-insensitive) | none |
1478
- | `pf-ssm-document-schema` | AWS::SSM::Document | schemaVersion must match DocumentType (Command 1.0/1.2/2.0/2.2, Automation 0.3, Session 1.0, Policy 2.0/2.2), 2.2 needs an explicit DocumentType, ChangeCalendar needs DocumentFormat TEXT (and TEXT only ChangeCalendar), and ApplicationConfiguration needs Requires | none |
1479
- | `pf-ssm-maintenance-window-cutoff` | AWS::SSM::MaintenanceWindow | Cutoff must be smaller than Duration | none |
1480
- | `pf-ssm-maintenance-window-schedule` | AWS::SSM::MaintenanceWindow | Schedule must be rate(N minutes|hours|days), a 6/7-field cron() with in-range fields and one of day-of-month/day-of-week as ?, or at(yyyy-MM-ddTHH:mm:ss); ScheduleOffset only with an nth-/last-weekday cron; StartDate/EndDate need a UTC offset with Start before End; ScheduleTimezone is an IANA name or ±HH:MM | none |
1481
- | `pf-ssm-maintenance-window-target` | AWS::SSM::MaintenanceWindowTarget | MaintenanceWindowTarget with ResourceType INSTANCE takes either a single InstanceIds target or up to five tag:/tag-key targets; RESOURCE_GROUP takes a resource-groups:Name target | none |
1482
- | `pf-ssm-maintenance-window-task` | AWS::SSM::MaintenanceWindowTask | RUN_COMMAND tasks need Targets; tasks with Targets need MaxConcurrency and MaxErrors (and targetless tasks must not set them); TaskInvocationParameters may only hold the block for the TaskType; target keys are InstanceIds or WindowTargetIds; a NotificationConfig needs ServiceRoleArn | none |
1483
- | `pf-ssm-parameter-allowed-pattern` | AWS::SSM::Parameter | Value (each item of a StringList) must match AllowedPattern | none |
1484
- | `pf-ssm-parameter-name` | AWS::SSM::Parameter | Parameter Name must not start with aws or ssm (case-insensitive), must not end with / or contain empty segments, uses only [A-Za-z0-9_.-] per segment, and with the ARN prefix must stay within 1011 characters | none |
1485
- | `pf-ssm-parameter-policies` | AWS::SSM::Parameter | Policies is a JSON array of at most 10 {Type, Version "1.0", Attributes} entries: one Expiration with an ISO-8601 Timestamp, ExpirationNotification (Before + Unit) only alongside it, NoChangeNotification (After + Unit), Unit Days or Hours | none |
1486
- | `pf-ssm-parameter-tier` | AWS::SSM::Parameter | Standard-tier parameters (Tier omitted uses the account default, normally Standard) hold at most 4096 characters and no Policies; Advanced and Intelligent-Tiering hold at most 8192 | none |
1487
- | `pf-ssm-parameter-value` | AWS::SSM::Parameter | Value must be non-empty and must not contain {{ }}; DataType is text, aws:ec2:image or aws:ssm:integration (lowercase), and aws:ec2:image needs Type String with an ami-... value | none |
1488
- | `pf-sfn-asl-branch-shape` | AWS::StepFunctions::StateMachine | Parallel Branches is a non-empty array and every branch / Map ItemProcessor / Iterator carries both StartAt and States | none |
1489
- | `pf-sfn-asl-choice-rules` | AWS::StepFunctions::StateMachine | Choice rules: Choices is non-empty, each top-level rule has Next and exactly one selector (Variable / And / Or / Not / Condition), a Variable rule has exactly one comparator, and Next never sits inside And/Or/Not | none |
1490
- | `pf-sfn-asl-credentials` | AWS::StepFunctions::StateMachine | A Task Credentials object needs RoleArn, and Credentials is not accepted on an Activity resource | none |
1491
- | `pf-sfn-asl-duplicate-state-name` | AWS::StepFunctions::StateMachine | ASL state names must be unique across the whole state machine, including Parallel branches and Map item processors | none |
1492
- | `pf-sfn-asl-integration-parameters` | AWS::StepFunctions::StateMachine | An arn:<partition>:states::: integration Task needs Parameters (JSONPath) or Arguments (JSONata), and the common integrations need their required fields (lambda:invoke FunctionName, sqs:sendMessage QueueUrl+MessageBody, sns:publish Message, dynamodb:putItem TableName+Item, dynamodb:getItem TableName+Key, states:startExecution StateMachineArn, events:putEvents Entries, ecs:runTask TaskDefinition, glue:startJobRun JobName) | none |
1493
- | `pf-sfn-asl-jsonpath-syntax` | AWS::StepFunctions::StateMachine | JSONPath fields start with $ (InputPath, OutputPath, *Path, Choice Variable), ResultPath/ItemsPath are Reference Paths (no *, .., ?, @), values of ".$" keys are a path or a States.* intrinsic, and Assign variable names are alphanumeric and not the reserved "states" | none |
1494
- | `pf-sfn-asl-map-distributed` | AWS::StepFunctions::StateMachine | Map ProcessorConfig and ItemReader shape: DISTRIBUTED requires ExecutionType (STANDARD|EXPRESS) and INLINE forbids it; ItemReader.Resource is s3:getObject or s3:listObjectsV2; CSV input needs CSVHeaderLocation (GIVEN needs CSVHeaders) and JSON input forbids it | none |
1495
- | `pf-sfn-asl-missing-state` | AWS::StepFunctions::StateMachine | ASL Next/Default/Choices[].Next/Catch[].Next must reference a state defined in the same States block, at every nesting level (a dangling StartAt is covered by engine rule E3601) | none |
1496
- | `pf-sfn-asl-name-limits` | AWS::StepFunctions::StateMachine | ASL state names are at most 80 characters; a Distributed Map Label is at most 40 characters and unique within the state machine | none |
1497
- | `pf-sfn-asl-next-end` | AWS::StepFunctions::StateMachine | A Task/Pass/Wait/Parallel/Map state carries exactly one of Next or End: true | none |
1498
- | `pf-sfn-asl-numeric-ranges` | AWS::StepFunctions::StateMachine | ASL numeric fields have service-side ranges the schema does not carry: TimeoutSeconds/HeartbeatSeconds 1..99999999, Wait Seconds 0..99999999, MaxConcurrency >= 0, ToleratedFailurePercentage <= 100, Retry MaxAttempts 0..99999999, BackoffRate >= 1.0, MaxDelaySeconds 1..31622400, and integers must be numbers | none |
1499
- | `pf-sfn-asl-path-exclusive` | AWS::StepFunctions::StateMachine | A static ASL field and its Path variant are mutually exclusive (TimeoutSeconds/TimeoutSecondsPath, HeartbeatSeconds/HeartbeatSecondsPath, MaxConcurrency/MaxConcurrencyPath, ToleratedFailurePercentage/-Path, Error/ErrorPath, Cause/CausePath), and a Map state has exactly one of ItemProcessor / Iterator | none |
1500
- | `pf-sfn-asl-query-language` | AWS::StepFunctions::StateMachine | JSONPath-only fields (InputPath, OutputPath, ResultPath, Parameters, ResultSelector, Result, *Path, Variable rules) and JSONata-only fields (Arguments, Output, Items, Condition) must match the effective QueryLanguage; a JSONata state machine cannot contain JSONPath states; {% must close with %} | none |
1501
- | `pf-sfn-asl-resource-arn` | AWS::StepFunctions::StateMachine | Task Resource is an ARN, and an integration pattern the service does not offer fails creation: .sync on Lambda/SNS/SQS/DynamoDB/EventBridge/API Gateway/aws-sdk, .waitForTaskToken on Athena/Batch/CodeBuild/EMR/Glue/DataBrew/MediaConvert/SageMaker/DynamoDB, and .sync:2 anywhere but states:startExecution | none |
1502
- | `pf-sfn-asl-retry-catch` | AWS::StepFunctions::StateMachine | Retry/Catch entries: ErrorEquals is present and non-empty, States.ALL appears alone and only in the last entry, every Catch has Next, and JitterStrategy is NONE or FULL | none |
1503
- | `pf-sfn-asl-state-fields` | AWS::StepFunctions::StateMachine | ASL fields are per state type: a known field placed on a type that does not accept it (Retry on Pass, End on Choice, Next on Fail, ...) fails creation | none |
1504
- | `pf-sfn-asl-terminal-state` | AWS::StepFunctions::StateMachine | An ASL state machine needs at least one terminal state (End: true, Succeed or Fail) at the top level | none |
1505
- | `pf-sfn-asl-unreachable-state` | AWS::StepFunctions::StateMachine | Every ASL state must be reachable: a state that is not StartAt and that no other state transitions to fails creation | none |
1506
- | `pf-sfn-asl-wait-timing` | AWS::StepFunctions::StateMachine | A Wait state carries exactly one of Seconds / Timestamp / SecondsPath / TimestampPath, and a literal Timestamp is RFC3339 with T and Z (all four absent is covered by engine rule E3601) | none |
1507
- | `pf-sfn-definition-exactly-one` | AWS::StepFunctions::StateMachine | A state machine carries exactly one of Definition, DefinitionString or DefinitionS3Location | none |
1508
- | `pf-sfn-encryption-config` | AWS::StepFunctions::StateMachine<br>AWS::StepFunctions::Activity | EncryptionConfiguration: CUSTOMER_MANAGED_KMS_KEY requires KmsKeyId, and AWS_OWNED_KEY rejects KmsKeyId and KmsDataKeyReusePeriodSeconds (state machines and activities) | none |
1509
- | `pf-sfn-express-unsupported` | AWS::StepFunctions::StateMachine | An EXPRESS state machine cannot use .sync / .waitForTaskToken integrations, Activity resources, or Distributed Map (at any nesting level) | none |
1510
- | `pf-sfn-kms-key-region` | AWS::StepFunctions::StateMachine<br>AWS::StepFunctions::Activity | EncryptionConfiguration.KmsKeyId must be a key in the deploy region (state machines and activities) | none |
1511
- | `pf-sfn-logging-destination` | AWS::StepFunctions::StateMachine | LoggingConfiguration with Level other than OFF needs exactly one Destinations entry carrying CloudWatchLogsLogGroup.LogGroupArn, and a literal ARN must be a CloudWatch Logs log-group ARN ending in :* | none |
1512
- | `pf-sfn-logging-name-ascii` | AWS::StepFunctions::StateMachine | With CloudWatch Logs logging enabled (Level other than OFF) the StateMachineName may only contain 0-9, A-Z, a-z, . - and _ (non-ASCII names are accepted only without logging) | none |
1513
- | `pf-sfn-name-charset` | AWS::StepFunctions::StateMachine<br>AWS::StepFunctions::Activity | StateMachineName and Activity Name may not contain whitespace, brackets (< > { } [ ]), wildcards (? *), the special characters " # % \ ^ | ~ ` $ & , ; : / or control characters (non-ASCII letters are accepted) | none |
1514
- | `pf-tags-aws-prefix` | * | Tag keys may not use the reserved aws: prefix | none |
1515
- | `pf-tags-count-max` | * | A resource may carry at most 50 tags | none |
1516
- | `pf-wafv2-association-config-scope` | AWS::WAFv2::WebACL | AssociationConfig.RequestBody keys must match the web ACL Scope | none |
1517
- | `pf-wafv2-association-resource-arn` | AWS::WAFv2::WebACLAssociation | ResourceArn must be a supported protected-resource ARN in the deploy account and region | none |
1518
- | `pf-wafv2-association-webacl-arn` | AWS::WAFv2::WebACLAssociation | WebACLArn must be the ARN of a web ACL in the deploy region | none |
1519
- | `pf-wafv2-byte-match` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | ByteMatchStatement: exactly one of SearchString / SearchStringBase64, at most 200 bytes, non-blank, and CONTAINS_WORD only with [A-Za-z0-9_] | none |
1520
- | `pf-wafv2-capacity` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule group Capacity must be 1..5000 and cover the WCUs of its rules; a web ACL is limited to 5000 WCUs | none |
1521
- | `pf-wafv2-challenge-immunity-time` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Challenge immunity time must be at least 300 seconds | none |
1522
- | `pf-wafv2-cloudfront-only-features` | AWS::WAFv2::WebACL | ResponseInspection and the Monetize action only work in CLOUDFRONT-scoped web ACLs (Monetize also needs MonetizationConfig) | none |
1523
- | `pf-wafv2-custom-request-handling` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Inserted request headers: unique names, at most 10 per action and 100 per web ACL / rule group | none |
1524
- | `pf-wafv2-custom-response` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Custom responses: no content-type or duplicate headers, at most 10 headers, body keys must exist, bodies within 4 KB / 50 entries / 50 KB total | none |
1525
- | `pf-wafv2-data-protection` | AWS::WAFv2::WebACL | Data protection fields: FieldKeys required for single-key types, forbidden for QUERY_STRING / BODY, one entry per field type | none |
1526
- | `pf-wafv2-ipset-addresses` | AWS::WAFv2::IPSet | IP set addresses must be CIDR blocks of the declared version with a 1..32 / 1..128 prefix and no host bits set | none |
1527
- | `pf-wafv2-label-syntax` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule labels and label match keys must follow the label syntax (no reserved words, no empty components, at most 8 components of 128 chars, no labels on rule group references) | none |
1528
- | `pf-wafv2-logging-destination` | AWS::WAFv2::LoggingConfiguration | Exactly one log destination whose name starts with aws-waf-logs-, in the web ACL account and region | none |
1529
- | `pf-wafv2-logging-filter-condition` | AWS::WAFv2::LoggingConfiguration | Each logging filter condition is exactly one of ActionCondition / LabelNameCondition | none |
1530
- | `pf-wafv2-logging-unique` | AWS::WAFv2::LoggingConfiguration | One LoggingConfiguration per web ACL in a template | none |
1531
- | `pf-wafv2-managed-rule-group` | AWS::WAFv2::WebACL | Managed rule group statements: known AWS group names, matching and complete ManagedRuleGroupConfigs, consistent overrides and response inspection | none |
1532
- | `pf-wafv2-metric-name-reserved` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | MetricName Default_Action is reserved | none |
1533
- | `pf-wafv2-name-unique` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::IPSet<br>AWS::WAFv2::RegexPatternSet | Two WAFv2 entities of the same type, Scope and Name in one template | none |
1534
- | `pf-wafv2-rate-based-statement` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rate-based statement aggregation settings must be consistent (keys, forwarded IP config, scope-down, counts) | none |
1535
- | `pf-wafv2-reference-arn` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | IP set / regex pattern set / rule group references must match the web ACL scope, region and account | none |
1536
- | `pf-wafv2-regex-syntax` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::RegexPatternSet | Regular expressions must stay within the supported PCRE subset (no backreferences, lookaround, possessive / atomic groups, conditionals, recursion, \K, \R, control verbs), at most 10 per pattern set | none |
1537
- | `pf-wafv2-rule-action` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule group references take OverrideAction, every other rule takes Action; each action object names exactly one action | none |
1538
- | `pf-wafv2-rule-unique` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule priorities and names must be unique within a web ACL / rule group | none |
1539
- | `pf-wafv2-scope-region` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::IPSet<br>AWS::WAFv2::RegexPatternSet | Scope CLOUDFRONT is only accepted in us-east-1 | none |
1540
- | `pf-wafv2-statement-exactly-one` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Statement, FieldToMatch, MatchPattern and custom-key objects name exactly one alternative | none |
1541
- | `pf-wafv2-statement-limits` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Statement limits: 50 country codes, 30-character query argument names, 50 reference statements per web ACL / rule group, unique header and cookie filters | none |
1542
- | `pf-wafv2-statement-nesting` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | And/Or need two nested statements; managed rule group, rule group reference and rate-based statements cannot be nested | none |
1543
- | `pf-wafv2-text-transformations` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Text transformations: unique priorities, at most 10, and pre-parse transformations only on query-argument components with pre-parse types | none |
1544
- | `pf-wafv2-token-domains` | AWS::WAFv2::WebACL | Token domains must be registrable domains (no bare labels, TLDs or public suffixes), at most 10 | none |
5
+ | Rule | Resource types | Constraint | Severity | Upstream status |
6
+ |---|---|---|---|---|
7
+ | `pf-apigw-access-log-format-request-id` | AWS::ApiGateway::Stage | Access log format must include a request id variable | ERROR | none |
8
+ | `pf-apigw-api-key-value-length` | AWS::ApiGateway::ApiKey | An API key value is at least 20 characters | ERROR | none |
9
+ | `pf-apigw-authorizer-ttl-range` | AWS::ApiGateway::Authorizer | AuthorizerResultTtlInSeconds tops out at 3600 | ERROR | none |
10
+ | `pf-apigw-authorizer-uri-format` | AWS::ApiGateway::Authorizer | An authorizer URI is an API Gateway invocation ARN | ERROR | none |
11
+ | `pf-apigw-cognito-authorizer-provider-arns` | AWS::ApiGateway::Authorizer | COGNITO_USER_POOLS authorizers need ProviderARNs | ERROR | none |
12
+ | `pf-apigw-deployment-no-methods` | AWS::ApiGateway::Deployment | A Deployment needs at least one Method on its REST API | ERROR | none |
13
+ | `pf-apigw-documentation-part-location` | AWS::ApiGateway::DocumentationPart | An API-level documentation part takes no path, method, status or name | ERROR | none |
14
+ | `pf-apigw-edge-certificate-property` | AWS::ApiGateway::DomainName | EDGE domain names read CertificateArn, not RegionalCertificateArn | ERROR | none |
15
+ | `pf-apigw-endpoint-configuration-single-type` | AWS::ApiGateway::RestApi | An API has exactly one endpoint type | ERROR | none |
16
+ | `pf-apigw-gateway-response-status-code` | AWS::ApiGateway::GatewayResponse | A gateway response status code is three digits | ERROR | none |
17
+ | `pf-apigw-integration-aws-uri` | AWS::ApiGateway::Method | An AWS integration URI is an API Gateway ARN, not the target's ARN | ERROR | none |
18
+ | `pf-apigw-integration-cache-key-parameters` | AWS::ApiGateway::Method | Cache key parameters must be declared method request parameters | ERROR | none |
19
+ | `pf-apigw-integration-credentials-arn` | AWS::ApiGateway::Method | Integration credentials must be an ARN | ERROR | none |
20
+ | `pf-apigw-integration-http-method` | AWS::ApiGateway::Method | Non-MOCK integrations need IntegrationHttpMethod | ERROR | none |
21
+ | `pf-apigw-integration-http-uri` | AWS::ApiGateway::Method | An HTTP integration URI is an http(s) URL | ERROR | none |
22
+ | `pf-apigw-integration-request-parameter-value` | AWS::ApiGateway::Method | Static integration request parameters must be single-quoted | ERROR | none |
23
+ | `pf-apigw-integration-response-selection-pattern` | AWS::ApiGateway::Method | SelectionPattern must be a valid regular expression | ERROR | none |
24
+ | `pf-apigw-integration-timeout-range` | AWS::ApiGateway::Method | REST integration timeouts are 50-29000 ms | ERROR | none |
25
+ | `pf-apigw-integration-vpc-link-connection-id` | AWS::ApiGateway::Method | A VPC_LINK integration needs a ConnectionId | ERROR | none |
26
+ | `pf-apigw-method-authorization-scopes-cognito` | AWS::ApiGateway::Method | AuthorizationScopes needs COGNITO_USER_POOLS authorization | ERROR | none |
27
+ | `pf-apigw-method-authorizer-id` | AWS::ApiGateway::Method | CUSTOM and COGNITO_USER_POOLS authorization need AuthorizerId | ERROR | none |
28
+ | `pf-apigw-method-http-verb` | AWS::ApiGateway::Method | HttpMethod is one of the eight API Gateway verbs | ERROR | none |
29
+ | `pf-apigw-method-request-parameter-key` | AWS::ApiGateway::Method | Method request parameter keys are mapping expressions | ERROR | none |
30
+ | `pf-apigw-minimum-compression-size-range` | AWS::ApiGateway::RestApi | MinimumCompressionSize is 0-10485760 | ERROR | none |
31
+ | `pf-apigw-model-content-type` | AWS::ApiGateway::Model | A model content type is a media type | ERROR | none |
32
+ | `pf-apigw-model-name-alphanumeric` | AWS::ApiGateway::Model | Model names are alphanumeric | ERROR | none |
33
+ | `pf-apigw-model-schema-type` | AWS::ApiGateway::Model | Model schema 'type' must be a JSON Schema draft-4 type | ERROR | none |
34
+ | `pf-apigw-mutual-tls-security-policy` | AWS::ApiGateway::DomainName | Mutual TLS requires SecurityPolicy TLS_1_2 | ERROR | none |
35
+ | `pf-apigw-regional-certificate-property` | AWS::ApiGateway::DomainName | REGIONAL domain names read RegionalCertificateArn, not CertificateArn | ERROR | none |
36
+ | `pf-apigw-regional-certificate-region` | AWS::ApiGateway::DomainName | A REGIONAL domain name needs a certificate from the deployment region | ERROR | none |
37
+ | `pf-apigw-request-authorizer-identity-source` | AWS::ApiGateway::Authorizer | REQUEST authorizer identity sources are mapping expressions | ERROR | none |
38
+ | `pf-apigw-resource-path-part` | AWS::ApiGateway::Resource | PathPart allows a-zA-Z0-9._-: or one curly-brace variable | ERROR | none |
39
+ | `pf-apigw-rest-api-policy-document` | AWS::ApiGateway::RestApi | A REST API policy must be a policy document | ERROR | none |
40
+ | `pf-apigw-stage-access-log-destination-arn` | AWS::ApiGateway::Stage | Access logs go to CloudWatch Logs or Firehose only | ERROR | none |
41
+ | `pf-apigw-stage-access-log-firehose-prefix` | AWS::ApiGateway::Stage | An access log delivery stream is named amazon-apigateway-* | ERROR | none |
42
+ | `pf-apigw-stage-cache-ttl-range` | AWS::ApiGateway::Stage | Method setting cache TTL tops out at 3600 seconds | ERROR | none |
43
+ | `pf-apigw-stage-method-setting-http-method` | AWS::ApiGateway::Stage | Method setting HttpMethod is a verb or * | ERROR | none |
44
+ | `pf-apigw-stage-method-setting-resource-path` | AWS::ApiGateway::Stage | Method setting paths start with / and encode slashes as ~1 | ERROR | none |
45
+ | `pf-apigw-stage-name-charset` | AWS::ApiGateway::Stage | Stage names allow only a-zA-Z0-9_ | ERROR | none |
46
+ | `pf-apigw-stage-variable-name` | AWS::ApiGateway::Stage | Stage variable names allow only word characters | ERROR | none |
47
+ | `pf-apigw-stage-variable-value` | AWS::ApiGateway::Stage | Stage variable values have a restricted character set | ERROR | none |
48
+ | `pf-apigw-token-authorizer-identity-source` | AWS::ApiGateway::Authorizer | TOKEN authorizers need IdentitySource | ERROR | none |
49
+ | `pf-apigw-usage-plan-api-stage-exists` | AWS::ApiGateway::UsagePlan | A usage plan references a stage the template creates | ERROR | none |
50
+ | `pf-apigw-usage-plan-quota-limit` | AWS::ApiGateway::UsagePlan | A usage plan quota limit is 1 or more | ERROR | none |
51
+ | `pf-apigw-usage-plan-quota-offset-range` | AWS::ApiGateway::UsagePlan | The quota offset ceiling depends on the quota period | ERROR | none |
52
+ | `pf-apigw-usage-plan-quota-period-required` | AWS::ApiGateway::UsagePlan | A usage plan quota needs a period | ERROR | none |
53
+ | `pf-apigw-usage-plan-throttle-key` | AWS::ApiGateway::UsagePlan | Per-method throttle keys are {resourcePath}/{httpMethod} | ERROR | none |
54
+ | `pf-apigw-vpc-endpoint-ids-private-only` | AWS::ApiGateway::RestApi | VpcEndpointIds belongs to PRIVATE APIs only | ERROR | none |
55
+ | `pf-apigw-vpc-link-single-target` | AWS::ApiGateway::VpcLink | A VPC link takes exactly one target load balancer | ERROR | none |
56
+ | `pf-apigwv2-access-log-destination-log-group` | AWS::ApiGatewayV2::Stage | HTTP/WebSocket access logs go to CloudWatch Logs only | ERROR | none |
57
+ | `pf-apigwv2-access-log-format-request-id` | AWS::ApiGatewayV2::Stage | An access log format must carry a request id | ERROR | none |
58
+ | `pf-apigwv2-api-name-required` | AWS::ApiGatewayV2::Api | An Api needs a Name unless an OpenAPI body provides one | ERROR | none |
59
+ | `pf-apigwv2-authorizer-ttl-identity-source` | AWS::ApiGatewayV2::Authorizer | Authorizer caching needs an identity source | ERROR | none |
60
+ | `pf-apigwv2-authorizer-ttl-range` | AWS::ApiGatewayV2::Authorizer | Authorizer result TTL tops out at 3600 seconds | ERROR | none |
61
+ | `pf-apigwv2-aws-proxy-payload-version` | AWS::ApiGatewayV2::Integration | AWS_PROXY integrations take PayloadFormatVersion 1.0 or 2.0 | ERROR | none |
62
+ | `pf-apigwv2-cors-credentials-wildcard` | AWS::ApiGatewayV2::Api | CORS AllowCredentials cannot pair with a wildcard origin | ERROR | none |
63
+ | `pf-apigwv2-domain-certificate-region` | AWS::ApiGatewayV2::DomainName | A custom domain needs a certificate from the deployment region | ERROR | none |
64
+ | `pf-apigwv2-domain-endpoint-type-regional` | AWS::ApiGatewayV2::DomainName | HTTP/WebSocket custom domains are REGIONAL only | ERROR | none |
65
+ | `pf-apigwv2-domain-name-charset` | AWS::ApiGatewayV2::DomainName | Custom domain names are lower case | ERROR | none |
66
+ | `pf-apigwv2-http-identity-source-expression` | AWS::ApiGatewayV2::Authorizer | HTTP API identity sources are $-prefixed selection expressions | ERROR | none |
67
+ | `pf-apigwv2-http-proxy-integration-method` | AWS::ApiGatewayV2::Integration | An HTTP_PROXY integration needs an IntegrationMethod | ERROR | none |
68
+ | `pf-apigwv2-http-proxy-payload-version` | AWS::ApiGatewayV2::Integration | HTTP_PROXY integrations only take PayloadFormatVersion 1.0 | ERROR | none |
69
+ | `pf-apigwv2-http-route-key` | AWS::ApiGatewayV2::Route | HTTP API route keys are "METHOD /path" or $default | ERROR | none |
70
+ | `pf-apigwv2-http-route-no-api-key` | AWS::ApiGatewayV2::Route | ApiKeyRequired is not supported on HTTP APIs | ERROR | none |
71
+ | `pf-apigwv2-http-route-selection` | AWS::ApiGatewayV2::Api | HTTP APIs accept only the method-path route selection expression | ERROR | none |
72
+ | `pf-apigwv2-integration-response-websocket-only` | AWS::ApiGatewayV2::IntegrationResponse | Integration responses exist on WebSocket APIs only | ERROR | none |
73
+ | `pf-apigwv2-integration-subtype-credentials` | AWS::ApiGatewayV2::Integration | A subtype integration needs a CredentialsArn | ERROR | none |
74
+ | `pf-apigwv2-integration-subtype-known` | AWS::ApiGatewayV2::Integration | IntegrationSubtype is one of the ten AWS service subtypes | ERROR | none |
75
+ | `pf-apigwv2-integration-subtype-payload-version` | AWS::ApiGatewayV2::Integration | Subtype integrations are payload format 1.0 only | ERROR | none |
76
+ | `pf-apigwv2-integration-subtype-required-parameters` | AWS::ApiGatewayV2::Integration | Each integration subtype has mandatory request parameters | ERROR | none |
77
+ | `pf-apigwv2-integration-timeout-range` | AWS::ApiGatewayV2::Integration | HTTP API integration timeouts are 50-30000 ms | ERROR | none |
78
+ | `pf-apigwv2-integration-vpc-link-connection-id` | AWS::ApiGatewayV2::Integration | A VPC_LINK integration needs a ConnectionId | ERROR | none |
79
+ | `pf-apigwv2-jwt-audience-required` | AWS::ApiGatewayV2::Authorizer | A JWT authorizer needs at least one audience | ERROR | none |
80
+ | `pf-apigwv2-jwt-authorizer-config` | AWS::ApiGatewayV2::Authorizer | JWT authorizers need JwtConfiguration | ERROR | none |
81
+ | `pf-apigwv2-jwt-issuer-https` | AWS::ApiGatewayV2::Authorizer | A JWT issuer is an https URL | ERROR | none |
82
+ | `pf-apigwv2-model-name-alphanumeric` | AWS::ApiGatewayV2::Model | Model names are alphanumeric | ERROR | none |
83
+ | `pf-apigwv2-model-websocket-only` | AWS::ApiGatewayV2::Model | Models exist on WebSocket APIs only | ERROR | none |
84
+ | `pf-apigwv2-request-authorizer-payload-version` | AWS::ApiGatewayV2::Authorizer | REQUEST authorizers on HTTP APIs need AuthorizerPayloadFormatVersion | ERROR | none |
85
+ | `pf-apigwv2-request-authorizer-uri-required` | AWS::ApiGatewayV2::Authorizer | A REQUEST authorizer needs an AuthorizerUri | ERROR | none |
86
+ | `pf-apigwv2-request-parameter-action` | AWS::ApiGatewayV2::Integration | Request parameter keys are <action>:<header|querystring|path>.<name> | ERROR | none |
87
+ | `pf-apigwv2-response-parameter-action` | AWS::ApiGatewayV2::Integration | Response parameter keys are <action>:<header.name|statuscode> | ERROR | none |
88
+ | `pf-apigwv2-response-parameter-status-code` | AWS::ApiGatewayV2::Integration | Response parameter mappings are keyed by a 200-599 status | ERROR | none |
89
+ | `pf-apigwv2-route-authorization-scopes-jwt` | AWS::ApiGatewayV2::Route | AuthorizationScopes needs JWT authorization | ERROR | none |
90
+ | `pf-apigwv2-route-jwt-authorizer-id` | AWS::ApiGatewayV2::Route | JWT authorization needs an AuthorizerId | ERROR | none |
91
+ | `pf-apigwv2-route-response-key-default` | AWS::ApiGatewayV2::RouteResponse | RouteResponseKey is $default | ERROR | none |
92
+ | `pf-apigwv2-route-response-websocket-only` | AWS::ApiGatewayV2::RouteResponse | Route responses exist on WebSocket APIs only | ERROR | none |
93
+ | `pf-apigwv2-route-target-format` | AWS::ApiGatewayV2::Route | A route target is integrations/<integration id> | ERROR | none |
94
+ | `pf-apigwv2-simple-responses-payload-version` | AWS::ApiGatewayV2::Authorizer | EnableSimpleResponses needs payload format 2.0 | ERROR | none |
95
+ | `pf-apigwv2-stage-name-charset` | AWS::ApiGatewayV2::Stage | Stage names allow only a-zA-Z0-9_ (or $default) | ERROR | none |
96
+ | `pf-apigwv2-stage-route-settings-key` | AWS::ApiGatewayV2::Stage | RouteSettings is keyed by an existing route key | ERROR | none |
97
+ | `pf-apigwv2-vpc-link-integration-uri` | AWS::ApiGatewayV2::Integration | A VPC link integration points at a listener, not a load balancer | ERROR | none |
98
+ | `pf-apigwv2-vpc-link-subnets-required` | AWS::ApiGatewayV2::VpcLink | A VPC link needs at least one subnet | ERROR | none |
99
+ | `pf-apigwv2-websocket-authorization-connect-only` | AWS::ApiGatewayV2::Route | WebSocket authorization is restricted to $connect | ERROR | none |
100
+ | `pf-apigwv2-websocket-authorizer-type` | AWS::ApiGatewayV2::Authorizer | WebSocket APIs only take REQUEST authorizers | ERROR | none |
101
+ | `pf-apigwv2-websocket-identity-source-expression` | AWS::ApiGatewayV2::Authorizer | WebSocket identity sources use route.request.* | ERROR | none |
102
+ | `pf-apigwv2-websocket-integration-timeout-range` | AWS::ApiGatewayV2::Integration | WebSocket integration timeouts are 50-29000 ms | ERROR | none |
103
+ | `pf-apigwv2-websocket-no-cors` | AWS::ApiGatewayV2::Api | WebSocket APIs take no CORS configuration | ERROR | none |
104
+ | `pf-apigwv2-websocket-payload-version` | AWS::ApiGatewayV2::Integration | WebSocket AWS_PROXY integrations reject payload format 2.0 | ERROR | none |
105
+ | `pf-apigwv2-websocket-route-selection` | AWS::ApiGatewayV2::Api | WebSocket APIs need RouteSelectionExpression | ERROR | none |
106
+ | `pf-asg-az-xor-azid` | AWS::AutoScaling::AutoScalingGroup | A group names zones by name or by id, not both | ERROR | none |
107
+ | `pf-asg-capacity-reservation-none-target-exclusive` | AWS::AutoScaling::AutoScalingGroup | A capacity reservation target needs the capacity-reservations-only preference | ERROR | none |
108
+ | `pf-asg-cooldown-non-negative` | AWS::AutoScaling::AutoScalingGroup | Cooldown cannot be negative | ERROR | none |
109
+ | `pf-asg-desired-capacity-range` | AWS::AutoScaling::AutoScalingGroup | DesiredCapacity must sit between MinSize and MaxSize | ERROR | none |
110
+ | `pf-asg-exactcapacity-nonnegative` | AWS::AutoScaling::ScalingPolicy | ExactCapacity takes no negative ScalingAdjustment | ERROR | none |
111
+ | `pf-asg-health-check-grace-period` | AWS::AutoScaling::AutoScalingGroup | HealthCheckGracePeriod cannot be negative | ERROR | none |
112
+ | `pf-asg-healthchecktype-ec2-exclusive-with-others` | AWS::AutoScaling::AutoScalingGroup | EC2 health checks do not combine with the others | ERROR | none |
113
+ | `pf-asg-instance-maintenance-policy-range-diff` | AWS::AutoScaling::AutoScalingGroup | An instance maintenance policy spans at most 100 points | ERROR | none |
114
+ | `pf-asg-instance-requirements-allowed-xor-excluded` | AWS::AutoScaling::AutoScalingGroup | Instance requirements allow types or exclude them, not both | ERROR | none |
115
+ | `pf-asg-instance-requirements-spot-price-protection-xor` | AWS::AutoScaling::AutoScalingGroup | Spot price protection takes one baseline, not two | ERROR | none |
116
+ | `pf-asg-instance-requirements-vcpu-min-max` | AWS::AutoScaling::AutoScalingGroup | Instance requirement ranges run from Min up to Max | ERROR | none |
117
+ | `pf-asg-lh-default-result-enum` | AWS::AutoScaling::LifecycleHook | A lifecycle hook DefaultResult is CONTINUE or ABANDON | ERROR | pending-engine |
118
+ | `pf-asg-lh-fifo-queue-unsupported` | AWS::AutoScaling::LifecycleHook | A FIFO SQS queue cannot be a lifecycle hook target | ERROR | none |
119
+ | `pf-asg-lh-heartbeat-timeout-range` | AWS::AutoScaling::LifecycleHook | A lifecycle hook HeartbeatTimeout runs from 30 to 7200 seconds | ERROR | none |
120
+ | `pf-asg-lh-role-forbidden-for-lambda-target` | AWS::AutoScaling::LifecycleHook | A Lambda notification target takes no RoleARN | ERROR | none |
121
+ | `pf-asg-lh-target-arn-format` | AWS::AutoScaling::LifecycleHook | NotificationTargetARN is an ARN | ERROR | none |
122
+ | `pf-asg-lh-target-region-match` | AWS::AutoScaling::LifecycleHook | A lifecycle hook target lives in the deploy region | ERROR | none |
123
+ | `pf-asg-lh-target-role-mutual-required` | AWS::AutoScaling::LifecycleHook | NotificationTargetARN and RoleARN come as a pair | ERROR | none |
124
+ | `pf-asg-lh-transition-enum` | AWS::AutoScaling::LifecycleHook | LifecycleTransition names one of the two lifecycle transitions | ERROR | pending-engine |
125
+ | `pf-asg-lifecycle-hook-heartbeat-timeout-range` | AWS::AutoScaling::AutoScalingGroup | An inline lifecycle hook HeartbeatTimeout runs from 30 to 7200 seconds | ERROR | none |
126
+ | `pf-asg-lifecyclehook-defaultresult-enum` | AWS::AutoScaling::AutoScalingGroup | An inline lifecycle hook DefaultResult is CONTINUE or ABANDON | ERROR | none |
127
+ | `pf-asg-lifecyclehook-name-duplicate-rejected` | AWS::AutoScaling::AutoScalingGroup | Inline lifecycle hook names are unique within a group | ERROR | none |
128
+ | `pf-asg-lifecyclehook-rolearn-requires-target` | AWS::AutoScaling::AutoScalingGroup | An inline hook RoleARN needs a notification target | ERROR | none |
129
+ | `pf-asg-lifecyclehook-transition-enum` | AWS::AutoScaling::AutoScalingGroup | An inline lifecycle hook names one of the two transitions | ERROR | none |
130
+ | `pf-asg-lifecyclehookspec-max-5` | AWS::AutoScaling::AutoScalingGroup | A group creates at most five lifecycle hooks inline | ERROR | none |
131
+ | `pf-asg-max-instance-lifetime-range` | AWS::AutoScaling::AutoScalingGroup | MaxInstanceLifetime is zero or a day to a year | ERROR | none |
132
+ | `pf-asg-metrics-granularity-enum` | AWS::AutoScaling::AutoScalingGroup | Group metrics come at one-minute granularity | ERROR | none |
133
+ | `pf-asg-metrics-name-enum` | AWS::AutoScaling::AutoScalingGroup | Collected group metrics come from the published list | ERROR | none |
134
+ | `pf-asg-minadjustmagnitude-positive` | AWS::AutoScaling::ScalingPolicy | MinAdjustmentMagnitude is greater than zero | ERROR | none |
135
+ | `pf-asg-minadjustmagnitude-requires-percent` | AWS::AutoScaling::ScalingPolicy | MinAdjustmentMagnitude only goes with PercentChangeInCapacity | ERROR | none |
136
+ | `pf-asg-notification-sns-topics-max-10` | AWS::AutoScaling::AutoScalingGroup | A group notifies at most ten topics | ERROR | none |
137
+ | `pf-asg-notification-topic-cross-region-rejected` | AWS::AutoScaling::AutoScalingGroup | A notification topic lives in the deploy region | ERROR | none |
138
+ | `pf-asg-notification-type-enum` | AWS::AutoScaling::AutoScalingGroup | A notification type comes from the published five | ERROR | none |
139
+ | `pf-asg-ondemand-allocation-prioritized-invalid-with-instance-requirements` | AWS::AutoScaling::AutoScalingGroup | Prioritized On-Demand allocation does not go with instance requirements | ERROR | none |
140
+ | `pf-asg-ondemand-percentage-max` | AWS::AutoScaling::AutoScalingGroup | OnDemandPercentageAboveBaseCapacity tops out at 100 | ERROR | none |
141
+ | `pf-asg-overrides-instance-requirements-max-4` | AWS::AutoScaling::AutoScalingGroup | At most four overrides pick instances by requirements | ERROR | none |
142
+ | `pf-asg-overrides-instance-requirements-xor-type` | AWS::AutoScaling::AutoScalingGroup | An override names an instance type or its requirements, not both | ERROR | none |
143
+ | `pf-asg-overrides-instancetype-duplicate-rejected` | AWS::AutoScaling::AutoScalingGroup | An instance type appears once across the overrides | ERROR | none |
144
+ | `pf-asg-overrides-instancetype-max-40` | AWS::AutoScaling::AutoScalingGroup | A mixed instances policy lists at most 40 overrides | ERROR | none |
145
+ | `pf-asg-overrides-weighted-capacity-uniform` | AWS::AutoScaling::AutoScalingGroup | Instance weights go on every override or none | ERROR | none |
146
+ | `pf-asg-predictive-alb-requires-resourcelabel` | AWS::AutoScaling::ScalingPolicy | A predictive ALB metric needs a ResourceLabel | ERROR | none |
147
+ | `pf-asg-predictive-buffer-forbidden-with-honormax` | AWS::AutoScaling::ScalingPolicy | MaxCapacityBuffer only goes with IncreaseMaxCapacity | ERROR | none |
148
+ | `pf-asg-predictive-buffer-requires-increasemode` | AWS::AutoScaling::ScalingPolicy | IncreaseMaxCapacity needs a MaxCapacityBuffer | ERROR | none |
149
+ | `pf-asg-predictive-capacity-metric-requires-load-and-scaling` | AWS::AutoScaling::ScalingPolicy | A customized capacity metric is an add-on to a load and a scaling metric | ERROR | none |
150
+ | `pf-asg-predictive-forbids-other-policy-props` | AWS::AutoScaling::ScalingPolicy | A predictive policy carries no other policy settings | ERROR | none |
151
+ | `pf-asg-predictive-metric-pair-xor-individual` | AWS::AutoScaling::ScalingPolicy | A metric pair does not mix with individual load and scaling metrics | ERROR | none |
152
+ | `pf-asg-predictive-metricspecs-single-element` | AWS::AutoScaling::ScalingPolicy | Predictive scaling takes exactly one metric specification | ERROR | none |
153
+ | `pf-asg-predictive-mq-dup-id-per-array` | AWS::AutoScaling::ScalingPolicy | Metric data query ids are unique within one array | ERROR | none |
154
+ | `pf-asg-predictive-mq-exactly-one-returndata` | AWS::AutoScaling::ScalingPolicy | Exactly one metric data query returns each predictive metric | ERROR | none |
155
+ | `pf-asg-predictive-requires-config` | AWS::AutoScaling::ScalingPolicy | A PredictiveScaling policy carries its configuration | ERROR | none |
156
+ | `pf-asg-sched-capacity-fields-ordering` | AWS::AutoScaling::ScheduledAction | A scheduled action keeps MinSize <= DesiredCapacity <= MaxSize | ERROR | none |
157
+ | `pf-asg-sched-desiredcapacity-nonnegative` | AWS::AutoScaling::ScheduledAction | A scheduled action DesiredCapacity is not negative | ERROR | none |
158
+ | `pf-asg-sched-endtime-alone-requires-starttime-or-recurrence` | AWS::AutoScaling::ScheduledAction | EndTime alone does not describe a scheduled action | ERROR | none |
159
+ | `pf-asg-sched-endtime-not-before-starttime` | AWS::AutoScaling::ScheduledAction | A scheduled action EndTime is not before its StartTime | ERROR | none |
160
+ | `pf-asg-sched-endtime-not-past` | AWS::AutoScaling::ScheduledAction | A scheduled action EndTime is not a date already gone by | ERROR | none |
161
+ | `pf-asg-sched-minsize-nonnegative` | AWS::AutoScaling::ScheduledAction | A scheduled action MinSize is not negative | ERROR | none |
162
+ | `pf-asg-sched-recurrence-field-range` | AWS::AutoScaling::ScheduledAction | Every Recurrence cron field stays in its own range | ERROR | none |
163
+ | `pf-asg-sched-recurrence-five-fields-no-cron-wrapper` | AWS::AutoScaling::ScheduledAction | Recurrence is a bare five-field cron string | ERROR | none |
164
+ | `pf-asg-sched-recurrence-rejects-question-mark` | AWS::AutoScaling::ScheduledAction | Recurrence takes no ? wildcard | ERROR | none |
165
+ | `pf-asg-sched-requires-a-capacity-field` | AWS::AutoScaling::ScheduledAction | A scheduled action sets at least one capacity field | ERROR | none |
166
+ | `pf-asg-sched-starttime-not-past` | AWS::AutoScaling::ScheduledAction | A scheduled action StartTime is not a date already gone by | ERROR | none |
167
+ | `pf-asg-sched-starttime-unique-per-group` | AWS::AutoScaling::ScheduledAction | Two scheduled actions on one group need different start times | ERROR | none |
168
+ | `pf-asg-sched-timezone-iana-only` | AWS::AutoScaling::ScheduledAction | TimeZone is a canonical IANA zone name | ERROR | none |
169
+ | `pf-asg-simple-forbids-other-policy-props` | AWS::AutoScaling::ScalingPolicy | A SimpleScaling policy carries no step or target-tracking settings | ERROR | none |
170
+ | `pf-asg-simple-requires-adjustmenttype` | AWS::AutoScaling::ScalingPolicy | A SimpleScaling policy names an AdjustmentType | ERROR | none |
171
+ | `pf-asg-simple-requires-scalingadjustment` | AWS::AutoScaling::ScalingPolicy | A SimpleScaling policy names a ScalingAdjustment | ERROR | none |
172
+ | `pf-asg-spot-allocation-capacity-optimized-prioritized-invalid-with-instance-requirements` | AWS::AutoScaling::AutoScalingGroup | Capacity-optimized-prioritized Spot allocation does not go with instance requirements | ERROR | none |
173
+ | `pf-asg-spot-instance-pools-requires-lowest-price` | AWS::AutoScaling::AutoScalingGroup | SpotInstancePools only counts under lowest-price allocation | ERROR | none |
174
+ | `pf-asg-step-adjustments-max-20` | AWS::AutoScaling::ScalingPolicy | A step policy holds at most 20 steps | ERROR | none |
175
+ | `pf-asg-step-both-bounds-null-forbidden` | AWS::AutoScaling::ScalingPolicy | A step names at least one of its two bounds | ERROR | none |
176
+ | `pf-asg-step-exactcapacity-nonnegative` | AWS::AutoScaling::ScalingPolicy | ExactCapacity takes no negative step adjustment | ERROR | none |
177
+ | `pf-asg-step-forbids-other-policy-props` | AWS::AutoScaling::ScalingPolicy | A StepScaling policy carries no simple or target-tracking settings | ERROR | none |
178
+ | `pf-asg-step-interval-gap` | AWS::AutoScaling::ScalingPolicy | Step intervals leave no gap between them | ERROR | none |
179
+ | `pf-asg-step-interval-overlap` | AWS::AutoScaling::ScalingPolicy | Step intervals do not overlap | ERROR | none |
180
+ | `pf-asg-step-multiple-null-lower` | AWS::AutoScaling::ScalingPolicy | At most one step leaves out its lower bound | ERROR | none |
181
+ | `pf-asg-step-multiple-null-upper` | AWS::AutoScaling::ScalingPolicy | At most one step leaves out its upper bound | ERROR | none |
182
+ | `pf-asg-step-negative-lower-needs-null-lower` | AWS::AutoScaling::ScalingPolicy | A negative lower bound needs a step that runs to minus infinity | ERROR | none |
183
+ | `pf-asg-step-positive-upper-needs-null-upper` | AWS::AutoScaling::ScalingPolicy | A positive upper bound needs a step that runs to plus infinity | ERROR | none |
184
+ | `pf-asg-step-requires-adjustmenttype` | AWS::AutoScaling::ScalingPolicy | A StepScaling policy names an AdjustmentType | ERROR | none |
185
+ | `pf-asg-step-requires-stepadjustments` | AWS::AutoScaling::ScalingPolicy | A StepScaling policy carries at least one step | ERROR | none |
186
+ | `pf-asg-step-upper-must-exceed-lower` | AWS::AutoScaling::ScalingPolicy | A step upper bound sits above its lower bound | ERROR | none |
187
+ | `pf-asg-tags-aws-prefix-rejected` | AWS::AutoScaling::AutoScalingGroup | A group tag key does not start with the reserved aws: prefix | ERROR | none |
188
+ | `pf-asg-tags-max-50` | AWS::AutoScaling::AutoScalingGroup | A group carries at most 50 tags | ERROR | none |
189
+ | `pf-asg-target-value-positive` | AWS::AutoScaling::ScalingPolicy | Target tracking needs a positive TargetValue | ERROR | none |
190
+ | `pf-asg-termination-policy-lambda-arn-format` | AWS::AutoScaling::AutoScalingGroup | A termination policy is a published name or a Lambda ARN | ERROR | none |
191
+ | `pf-asg-tt-alb-requires-resourcelabel` | AWS::AutoScaling::ScalingPolicy | The ALB request-count metric needs a ResourceLabel | ERROR | none |
192
+ | `pf-asg-tt-custom-metrics-array-exclusive` | AWS::AutoScaling::ScalingPolicy | A metric-math specification takes none of the single-metric fields | ERROR | none |
193
+ | `pf-asg-tt-custom-simple-requires-namespace-and-statistic` | AWS::AutoScaling::ScalingPolicy | A single-metric specification names its Namespace and Statistic | ERROR | none |
194
+ | `pf-asg-tt-forbids-step-and-simple-props` | AWS::AutoScaling::ScalingPolicy | A target-tracking policy carries no step or simple settings | ERROR | none |
195
+ | `pf-asg-tt-metric-spec-exclusive` | AWS::AutoScaling::ScalingPolicy | Target tracking takes exactly one metric specification | ERROR | none |
196
+ | `pf-asg-tt-mq-exactly-one-returndata` | AWS::AutoScaling::ScalingPolicy | Exactly one metric data query returns the value to track | ERROR | none |
197
+ | `pf-asg-tt-mq-expression-xor-metricstat` | AWS::AutoScaling::ScalingPolicy | A metric data query holds an Expression or a MetricStat, not both | ERROR | none |
198
+ | `pf-asg-tt-mq-same-period-required` | AWS::AutoScaling::ScalingPolicy | Every metric in one specification shares a period | ERROR | none |
199
+ | `pf-asg-tt-non-alb-forbids-resourcelabel` | AWS::AutoScaling::ScalingPolicy | Only the ALB metric takes a ResourceLabel | ERROR | none |
200
+ | `pf-asg-tt-period-max-60` | AWS::AutoScaling::ScalingPolicy | A customized target-tracking metric uses a period of 60 seconds or less | ERROR | none |
201
+ | `pf-asg-tt-requires-config` | AWS::AutoScaling::ScalingPolicy | A TargetTrackingScaling policy carries its configuration | ERROR | none |
202
+ | `pf-asg-vpczone-az-mismatch` | AWS::AutoScaling::AutoScalingGroup | The listed zones cover the subnets the group launches into | ERROR | none |
203
+ | `pf-asg-wp-hibernated-requires-encrypted-root` | AWS::AutoScaling::WarmPool<br>AWS::EC2::LaunchTemplate | A hibernating warm pool needs an encrypted root volume | ERROR | none |
204
+ | `pf-asg-wp-poolstate-enum` | AWS::AutoScaling::WarmPool | A warm pool PoolState is Stopped, Running or Hibernated | ERROR | pending-engine |
205
+ | `pf-asg-wp-spot-incompatible` | AWS::AutoScaling::WarmPool<br>AWS::EC2::LaunchTemplate | A group asking for Spot instances takes no warm pool | ERROR | none |
206
+ | `pf-asg-wp-weighted-mixed-instances-incompatible` | AWS::AutoScaling::WarmPool<br>AWS::AutoScaling::AutoScalingGroup | A weighted mixed instances policy takes no warm pool | ERROR | none |
207
+ | `pf-asg-zonalshift-cross-zone-disabled-requires-skip-validation` | AWS::AutoScaling::AutoScalingGroup | Zonal shift needs cross-zone load balancing on its target groups | ERROR | none |
208
+ | `pf-asg-zone-or-subnet-required` | AWS::AutoScaling::AutoScalingGroup | A group needs AvailabilityZones, AvailabilityZoneIds, or subnets | ERROR | none |
209
+ | `pf-batch-ce-name` | AWS::Batch::ComputeEnvironment | Compute environment names allow only letters, numbers, hyphen and underscore | ERROR | none |
210
+ | `pf-batch-ce-vcpus-order` | AWS::Batch::ComputeEnvironment | MaxvCpus must be at least MinvCpus | ERROR | none |
211
+ | `pf-batch-fargate-ce-fields` | AWS::Batch::ComputeEnvironment | Fargate compute environments cannot take AllocationStrategy or InstanceTypes | ERROR | none |
212
+ | `pf-batch-fargate-cpu-memory` | AWS::Batch::JobDefinition | Fargate job definitions must use a supported vCPU/memory combination | ERROR | none |
213
+ | `pf-batch-fargate-execution-role` | AWS::Batch::JobDefinition | Fargate job definitions require ExecutionRoleArn | ERROR | none |
214
+ | `pf-batch-fargate-multinode` | AWS::Batch::JobDefinition | Multi-node parallel jobs are not supported on Fargate | ERROR | none |
215
+ | `pf-batch-jd-name` | AWS::Batch::JobDefinition | Job definition names allow only letters, numbers, hyphen and underscore | ERROR | none |
216
+ | `pf-batch-managed-compute-resources` | AWS::Batch::ComputeEnvironment | MANAGED compute environments require ComputeResources | ERROR | none |
217
+ | `pf-batch-queue-order-required` | AWS::Batch::JobQueue | ComputeEnvironmentOrder may not be empty | ERROR | none |
218
+ | `pf-batch-retry-attempts` | AWS::Batch::JobDefinition | RetryStrategy.Attempts may not exceed 10 | ERROR | none |
219
+ | `pf-batch-timeout-minimum` | AWS::Batch::JobDefinition | Timeout.AttemptDurationSeconds must be at least 60 | ERROR | none |
220
+ | `pf-batch-unmanaged-fargate` | AWS::Batch::ComputeEnvironment | UNMANAGED compute environments cannot be Fargate | ERROR | none |
221
+ | `pf-bedrock-automated-reasoning-policy-names-unique` | AWS::Bedrock::AutomatedReasoningPolicy | Names and ids inside a policy definition must be unique | ERROR | none |
222
+ | `pf-bedrock-automated-reasoning-policy-variable-type` | AWS::Bedrock::AutomatedReasoningPolicy | Policy variables must use a type declared in PolicyDefinition.Types | ERROR | none |
223
+ | `pf-bedrock-automated-reasoning-policy-version` | AWS::Bedrock::AutomatedReasoningPolicy | PolicyDefinition.Version must be 1.0 | ERROR | none |
224
+ | `pf-bedrock-bda-blueprint-schema` | AWS::Bedrock::Blueprint | A blueprint schema needs class, description and properties | ERROR | none |
225
+ | `pf-bedrock-bda-project-blueprint-region` | AWS::Bedrock::DataAutomationProject | Blueprints must live in the project's Region | ERROR | none |
226
+ | `pf-bedrock-bda-project-blueprint-stage` | AWS::Bedrock::DataAutomationProject<br>AWS::Bedrock::Blueprint | Blueprint references must name a stage or version the blueprint has | ERROR | none |
227
+ | `pf-bedrock-bda-project-blueprints-unique` | AWS::Bedrock::DataAutomationProject<br>AWS::Bedrock::Blueprint | A project must not attach the same blueprint twice | ERROR | none |
228
+ | `pf-bedrock-bda-project-modality-routing` | AWS::Bedrock::DataAutomationProject | Modality routing overrides must fit the file type | ERROR | none |
229
+ | `pf-bedrock-bda-project-output-types` | AWS::Bedrock::DataAutomationProject | Document granularity and text-format type lists must not be empty | ERROR | none |
230
+ | `pf-bedrock-bda-project-standard-output-required` | AWS::Bedrock::DataAutomationProject | A Data Automation project needs StandardOutputConfiguration | ERROR | none |
231
+ | `pf-bedrock-bda-project-sync-modalities` | AWS::Bedrock::DataAutomationProject | A SYNC project cannot configure audio or video standard output | ERROR | none |
232
+ | `pf-bedrock-bda-project-transcript-configuration` | AWS::Bedrock::DataAutomationProject | Audio transcript settings need TRANSCRIPT among the extraction types | ERROR | none |
233
+ | `pf-bedrock-datasource-chunk-max-tokens` | AWS::Bedrock::DataSource | Fixed-size and semantic chunks are limited to 8192 tokens | ERROR | none |
234
+ | `pf-bedrock-datasource-chunk-tokens-embedding-limit` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Chunk size must not exceed the embedding model's token limit | ERROR | none |
235
+ | `pf-bedrock-datasource-chunking-configuration` | AWS::Bedrock::DataSource | ChunkingStrategy needs its matching configuration block | ERROR | none |
236
+ | `pf-bedrock-datasource-context-enrichment-neptune` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Context enrichment is only available on Neptune Analytics knowledge bases | ERROR | none |
237
+ | `pf-bedrock-datasource-hierarchical-levels` | AWS::Bedrock::DataSource | Hierarchical chunking levels must descend and OverlapTokens must stay below the child size | ERROR | none |
238
+ | `pf-bedrock-datasource-multimodal-supplemental-storage` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | Multimodal parsing needs supplemental data storage on the knowledge base | ERROR | none |
239
+ | `pf-bedrock-datasource-parsing-configuration` | AWS::Bedrock::DataSource | BEDROCK_FOUNDATION_MODEL parsing needs BedrockFoundationModelConfiguration | ERROR | none |
240
+ | `pf-bedrock-datasource-parsing-model-region` | AWS::Bedrock::DataSource | The parsing model must be reachable from the data source's Region | ERROR | none |
241
+ | `pf-bedrock-datasource-supplemental-bucket-overlap` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | A data source must not share its bucket with the knowledge base's supplemental storage unless it has an inclusion prefix | ERROR | none |
242
+ | `pf-bedrock-datasource-transformation-bucket` | AWS::Bedrock::DataSource | Custom transformation intermediate storage must not use the data source bucket | ERROR | none |
243
+ | `pf-bedrock-datasource-type-configuration` | AWS::Bedrock::DataSource | DataSourceConfiguration.Type needs its matching configuration block | ERROR | none |
244
+ | `pf-bedrock-datasource-web-vector-store` | AWS::Bedrock::DataSource<br>AWS::Bedrock::KnowledgeBase | A web crawler data source needs an OpenSearch Serverless knowledge base | ERROR | none |
245
+ | `pf-bedrock-flow-condition-default` | AWS::Bedrock::Flow | A Condition node needs a default condition | ERROR | none |
246
+ | `pf-bedrock-flow-condition-unique` | AWS::Bedrock::Flow | Conditions within a Condition node need unique names and expressions | ERROR | none |
247
+ | `pf-bedrock-flow-connection-condition` | AWS::Bedrock::Flow | A Conditional connection must leave a Condition node through one of its conditions | ERROR | none |
248
+ | `pf-bedrock-flow-connection-name-unique` | AWS::Bedrock::Flow | Flow connection names must be unique | ERROR | none |
249
+ | `pf-bedrock-flow-connection-nodes` | AWS::Bedrock::Flow | Flow connections must reference nodes that exist | ERROR | none |
250
+ | `pf-bedrock-flow-connection-ports` | AWS::Bedrock::Flow | Data connections must use outputs and inputs the nodes declare | ERROR | none |
251
+ | `pf-bedrock-flow-definition-source` | AWS::Bedrock::Flow | A flow takes exactly one of Definition, DefinitionString or DefinitionS3Location | ERROR | none |
252
+ | `pf-bedrock-flow-definition-string-json` | AWS::Bedrock::Flow | DefinitionString must be JSON | ERROR | none |
253
+ | `pf-bedrock-flow-input-expression` | AWS::Bedrock::Flow | A node input Expression must start with $.data | ERROR | none |
254
+ | `pf-bedrock-flow-input-node` | AWS::Bedrock::Flow | A flow has exactly one Input node | ERROR | none |
255
+ | `pf-bedrock-flow-input-node-output` | AWS::Bedrock::Flow | The Input node exposes a single output named document | ERROR | none |
256
+ | `pf-bedrock-flow-input-single-connection` | AWS::Bedrock::Flow | A node input accepts a single incoming connection | ERROR | none |
257
+ | `pf-bedrock-flow-node-configuration` | AWS::Bedrock::Flow | A flow node needs the Configuration member named after its Type | ERROR | none |
258
+ | `pf-bedrock-flow-node-name-unique` | AWS::Bedrock::Flow | Flow node names must be unique | ERROR | none |
259
+ | `pf-bedrock-guardrail-automated-reasoning-cross-region` | AWS::Bedrock::Guardrail | Automated Reasoning checks need CrossRegionConfig | ERROR | none |
260
+ | `pf-bedrock-guardrail-automated-reasoning-policy-region` | AWS::Bedrock::Guardrail | An Automated Reasoning policy must live in the guardrail's Region | ERROR | none |
261
+ | `pf-bedrock-guardrail-content-filter-unique` | AWS::Bedrock::Guardrail | A guardrail content policy must not list the same filter type twice | ERROR | none |
262
+ | `pf-bedrock-guardrail-grounding-filter-unique` | AWS::Bedrock::Guardrail | A contextual grounding policy must not list the same filter type twice | ERROR | none |
263
+ | `pf-bedrock-guardrail-grounding-threshold` | AWS::Bedrock::Guardrail | A contextual grounding threshold must be below 1 | ERROR | none |
264
+ | `pf-bedrock-guardrail-managed-word-list-unique` | AWS::Bedrock::Guardrail | A guardrail must not list the same managed word list twice | ERROR | none |
265
+ | `pf-bedrock-guardrail-pii-entity-unique` | AWS::Bedrock::Guardrail | A guardrail must not configure the same PII entity type twice | ERROR | none |
266
+ | `pf-bedrock-guardrail-policy-required` | AWS::Bedrock::Guardrail | A guardrail needs at least one policy | ERROR | none |
267
+ | `pf-bedrock-guardrail-profile-account` | AWS::Bedrock::Guardrail | A guardrail profile ARN must carry the deploying account | ERROR | none |
268
+ | `pf-bedrock-guardrail-profile-geo` | AWS::Bedrock::Guardrail | A guardrail profile must belong to the deploy Region's geography | ERROR | none |
269
+ | `pf-bedrock-guardrail-profile-region` | AWS::Bedrock::Guardrail | A guardrail profile ARN must carry the guardrail's own Region | ERROR | none |
270
+ | `pf-bedrock-guardrail-prompt-attack-output-strength` | AWS::Bedrock::Guardrail | The PROMPT_ATTACK content filter must use OutputStrength NONE | ERROR | none |
271
+ | `pf-bedrock-guardrail-regex-pattern-length` | AWS::Bedrock::Guardrail | A guardrail regex pattern is limited to 500 characters | ERROR | none |
272
+ | `pf-bedrock-guardrail-regex-unique` | AWS::Bedrock::Guardrail | Guardrail regex filters must have unique names and unique patterns | ERROR | none |
273
+ | `pf-bedrock-guardrail-standard-tier-cross-region` | AWS::Bedrock::Guardrail | The STANDARD safeguard tier needs CrossRegionConfig | ERROR | none |
274
+ | `pf-bedrock-guardrail-topic-definition-length` | AWS::Bedrock::Guardrail | A denied topic definition is limited to 200 characters on the CLASSIC tier | ERROR | none |
275
+ | `pf-bedrock-guardrail-topic-name-unique` | AWS::Bedrock::Guardrail | Denied topic names within a guardrail must be unique | ERROR | none |
276
+ | `pf-bedrock-guardrail-word-length` | AWS::Bedrock::Guardrail | A guardrail custom word is limited to 100 characters | ERROR | none |
277
+ | `pf-bedrock-guardrail-word-unique` | AWS::Bedrock::Guardrail | Guardrail custom words must be unique (case-insensitively) | ERROR | none |
278
+ | `pf-bedrock-inference-profile-model-source-required` | AWS::Bedrock::ApplicationInferenceProfile | An application inference profile needs ModelSource | ERROR | none |
279
+ | `pf-bedrock-inference-profile-source-region` | AWS::Bedrock::ApplicationInferenceProfile | An application inference profile copies from a model or profile of its own Region | ERROR | none |
280
+ | `pf-bedrock-kb-embedding-binary` | AWS::Bedrock::KnowledgeBase | BINARY embeddings need a model and a vector store that support them | ERROR | none |
281
+ | `pf-bedrock-kb-embedding-dimensions` | AWS::Bedrock::KnowledgeBase | Embedding Dimensions must be a size the embedding model supports | ERROR | none |
282
+ | `pf-bedrock-kb-embedding-model-region` | AWS::Bedrock::KnowledgeBase | The embedding model ARN must carry the knowledge base's Region | ERROR | none |
283
+ | `pf-bedrock-kb-s3-vectors-index-dimension` | AWS::Bedrock::KnowledgeBase | The embedding size must equal the S3 Vectors index Dimension | ERROR | none |
284
+ | `pf-bedrock-kb-sql-auth-configuration` | AWS::Bedrock::KnowledgeBase | Redshift AuthConfiguration must carry exactly the fields its Type needs | ERROR | none |
285
+ | `pf-bedrock-kb-sql-query-engine-configuration` | AWS::Bedrock::KnowledgeBase | A Redshift query engine needs the block matching its Type | ERROR | none |
286
+ | `pf-bedrock-kb-sql-storage-configuration` | AWS::Bedrock::KnowledgeBase | A Redshift storage configuration needs the block matching its Type | ERROR | none |
287
+ | `pf-bedrock-kb-storage-not-allowed` | AWS::Bedrock::KnowledgeBase | KENDRA and SQL knowledge bases must not carry StorageConfiguration | ERROR | none |
288
+ | `pf-bedrock-kb-storage-type-configuration` | AWS::Bedrock::KnowledgeBase | StorageConfiguration.Type needs its matching configuration block | ERROR | none |
289
+ | `pf-bedrock-kb-supplemental-storage-uri` | AWS::Bedrock::KnowledgeBase | Supplemental data storage must point at an S3 bucket root | ERROR | none |
290
+ | `pf-bedrock-kb-type-configuration` | AWS::Bedrock::KnowledgeBase | KnowledgeBaseConfiguration.Type needs its matching configuration block | ERROR | none |
291
+ | `pf-bedrock-kb-vector-storage-required` | AWS::Bedrock::KnowledgeBase | A VECTOR knowledge base needs StorageConfiguration | ERROR | none |
292
+ | `pf-bedrock-kb-vector-store-region` | AWS::Bedrock::KnowledgeBase | An S3 Vectors index must live in the knowledge base's Region | ERROR | none |
293
+ | `pf-bedrock-prompt-default-variant` | AWS::Bedrock::Prompt | DefaultVariant must name one of the prompt's variants | ERROR | none |
294
+ | `pf-bedrock-prompt-router-fallback-model` | AWS::Bedrock::IntelligentPromptRouter | The prompt router's fallback model must be one of its routed models | ERROR | none |
295
+ | `pf-bedrock-prompt-router-model-provider` | AWS::Bedrock::IntelligentPromptRouter | A prompt router's models must come from the same provider | ERROR | none |
296
+ | `pf-bedrock-prompt-router-model-region` | AWS::Bedrock::IntelligentPromptRouter | Prompt router models must be reachable from the deploy Region | ERROR | none |
297
+ | `pf-bedrock-prompt-router-models-count` | AWS::Bedrock::IntelligentPromptRouter | A prompt router routes between exactly two models | ERROR | none |
298
+ | `pf-bedrock-prompt-router-models-unique` | AWS::Bedrock::IntelligentPromptRouter | A prompt router must not list the same model twice | ERROR | none |
299
+ | `pf-bedrock-prompt-variant-model-or-agent` | AWS::Bedrock::Prompt | A prompt variant takes either ModelId or GenAiResource, not both | ERROR | none |
300
+ | `pf-bedrock-prompt-variant-name-unique` | AWS::Bedrock::Prompt | Prompt variant names must be unique | ERROR | none |
301
+ | `pf-bedrock-prompt-variant-template-type` | AWS::Bedrock::Prompt | A prompt variant's TemplateConfiguration must match its TemplateType | ERROR | none |
302
+ | `pf-agentcore-apikey-provider-secret-source` | AWS::BedrockAgentCore::ApiKeyCredentialProvider | An API key credential provider takes ApiKey when the secret is MANAGED and ApiKeySecretConfig when it is EXTERNAL, never both | ERROR | none |
303
+ | `pf-agentcore-config-bundle-components-empty` | AWS::BedrockAgentCore::ConfigurationBundle | A configuration bundle needs at least one component | ERROR | none |
304
+ | `pf-agentcore-dataset-source-exactly-one` | AWS::BedrockAgentCore::Dataset | Dataset Source must hold exactly one of InlineExamples or S3Source | ERROR | none |
305
+ | `pf-agentcore-evaluator-rating-scale-empty` | AWS::BedrockAgentCore::Evaluator | An LLM-as-a-judge evaluator RatingScale must list at least one scale entry | ERROR | none |
306
+ | `pf-agentcore-gateway-authorizer-config-unexpected` | AWS::BedrockAgentCore::Gateway | Gateways with AuthorizerType AWS_IAM or NONE must not set AuthorizerConfiguration | ERROR | none |
307
+ | `pf-agentcore-gateway-interceptor-point-unique` | AWS::BedrockAgentCore::Gateway | Gateway interceptors may bind each interception point (REQUEST / RESPONSE) only once | ERROR | none |
308
+ | `pf-agentcore-gateway-jwt-authorizer` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::PaymentManager | Gateways and payment managers with AuthorizerType CUSTOM_JWT require AuthorizerConfiguration | ERROR | none |
309
+ | `pf-agentcore-gateway-mcp-supported-versions` | AWS::BedrockAgentCore::Gateway | Gateway MCP SupportedVersions must be MCP protocol versions the service supports | ERROR | none |
310
+ | `pf-agentcore-gateway-target-credential-provider-required` | AWS::BedrockAgentCore::GatewayTarget | Gateway target credential types OAUTH and API_KEY require the matching CredentialProvider block | ERROR | none |
311
+ | `pf-agentcore-gateway-target-iam-credential-provider` | AWS::BedrockAgentCore::GatewayTarget | OpenAPI and MCP server gateway targets using GATEWAY_IAM_ROLE must set IamCredentialProvider (the SigV4 service) | ERROR | none |
312
+ | `pf-agentcore-gateway-target-lambda-credential-type` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets accept only the GATEWAY_IAM_ROLE credential provider | ERROR | none |
313
+ | `pf-agentcore-gateway-target-lambda-region` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets must be in the gateway's own region | ERROR | none |
314
+ | `pf-agentcore-gateway-target-lambda-tool-name-unique` | AWS::BedrockAgentCore::GatewayTarget | Tool names in a Lambda gateway target's inline ToolSchema must be unique | ERROR | none |
315
+ | `pf-agentcore-gateway-target-lambda-tool-schema-empty` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets need at least one tool in ToolSchema.InlinePayload | ERROR | none |
316
+ | `pf-agentcore-gateway-target-openapi-schema` | AWS::BedrockAgentCore::GatewayTarget | Inline OpenAPI schemas for gateway targets must be OpenAPI 3 with a servers list and an operationId on every operation | ERROR | none |
317
+ | `pf-agentcore-jwt-authorizer-claims` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::Harness | A CustomJWTAuthorizer needs at least one of AllowedAudience, AllowedClients, AllowedScopes, or CustomClaims | ERROR | none |
318
+ | `pf-agentcore-memory-custom-strategy-execution-role` | AWS::BedrockAgentCore::Memory | Memories with a custom strategy require MemoryExecutionRoleArn | ERROR | none |
319
+ | `pf-agentcore-memory-strategy-exactly-one` | AWS::BedrockAgentCore::Memory | Each MemoryStrategies entry must hold exactly one strategy type, and a CustomMemoryStrategy exactly one Configuration override | ERROR | pending-engine |
320
+ | `pf-agentcore-memory-strategy-name-unique` | AWS::BedrockAgentCore::Memory | Memory strategy names must be unique within a memory | ERROR | none |
321
+ | `pf-agentcore-memory-strategy-namespaces-count` | AWS::BedrockAgentCore::Memory | A memory strategy accepts exactly one namespace | ERROR | none |
322
+ | `pf-agentcore-memory-strategy-type-unique` | AWS::BedrockAgentCore::Memory | A memory may carry at most one strategy of each built-in type | ERROR | none |
323
+ | `pf-agentcore-oauth2-provider-client-secret` | AWS::BedrockAgentCore::OAuth2CredentialProvider | A custom OAuth2 provider takes ClientSecret when the secret is MANAGED and ClientSecretConfig when it is EXTERNAL, never both | ERROR | none |
324
+ | `pf-agentcore-oauth2-provider-private-key-jwt` | AWS::BedrockAgentCore::OAuth2CredentialProvider | ClientAuthenticationMethod PRIVATE_KEY_JWT cannot be satisfied through CloudFormation (PrivateKeyJwtConfig is not in the resource schema) | ERROR | none |
325
+ | `pf-agentcore-oauth2-provider-vendor-config` | AWS::BedrockAgentCore::OAuth2CredentialProvider | Oauth2ProviderConfigInput must contain the config block that matches CredentialProviderVendor | ERROR | none |
326
+ | `pf-agentcore-online-eval-evaluator-unique` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config must not list the same evaluator twice | ERROR | none |
327
+ | `pf-agentcore-online-eval-evaluators-or-insights` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config needs a non-empty Evaluators list (or Insights) | ERROR | none |
328
+ | `pf-agentcore-payment-credential-provider-vendor-config` | AWS::BedrockAgentCore::PaymentCredentialProvider | ProviderConfigurationInput must contain the block matching CredentialProviderVendor (CoinbaseCDP / StripePrivy) | ERROR | none |
329
+ | `pf-agentcore-policy-cedar-statement` | AWS::BedrockAgentCore::Policy | A Cedar policy statement must be a permit/forbid clause that constrains the resource and, for permit, carries a condition | ERROR | none |
330
+ | `pf-agentcore-required-union-empty` | AWS::BedrockAgentCore::Evaluator<br>AWS::BedrockAgentCore::GatewayTarget<br>AWS::BedrockAgentCore::Policy | Required union blocks (EvaluatorConfig, TargetConfiguration, Definition) must not be empty objects | ERROR | pending-engine |
331
+ | `pf-agentcore-resource-policy-document` | AWS::BedrockAgentCore::ResourcePolicy | A resource policy must be a JSON policy whose statements carry Principal, bedrock-agentcore actions, and exactly one Resource ARN | ERROR | none |
332
+ | `pf-agentcore-runtime-artifact-exactly-one` | AWS::BedrockAgentCore::Runtime | AgentRuntimeArtifact must hold exactly one of ContainerConfiguration or CodeConfiguration | ERROR | none |
333
+ | `pf-agentcore-runtime-code-entrypoint-extension` | AWS::BedrockAgentCore::Runtime | A CodeConfiguration EntryPoint file must match the selected Runtime (.py for PYTHON_*) | ERROR | none |
334
+ | `pf-agentcore-runtime-endpoint-name-default` | AWS::BedrockAgentCore::RuntimeEndpoint | A RuntimeEndpoint cannot be named DEFAULT (the runtime already owns that endpoint) | ERROR | none |
335
+ | `pf-agentcore-runtime-env-var-count` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime EnvironmentVariables holds at most 50 entries | ERROR | pending-engine |
336
+ | `pf-agentcore-runtime-lifecycle-timeout-order` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime IdleRuntimeSessionTimeout must not exceed MaxLifetime | ERROR | none |
337
+ | `pf-agentcore-runtime-name` | AWS::BedrockAgentCore::Runtime | AgentCore Runtime names must match [a-zA-Z][a-zA-Z0-9_]{0,47} (no hyphens) | ERROR | pending-engine |
338
+ | `pf-agentcore-runtime-session-storage-single` | AWS::BedrockAgentCore::Runtime | An AgentCore Runtime allows at most one SessionStorage filesystem configuration | ERROR | none |
339
+ | `pf-agentcore-vpc-network-mode-config` | AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::BrowserCustom<br>AWS::BedrockAgentCore::CodeInterpreterCustom<br>AWS::BedrockAgentCore::Harness | NetworkMode VPC requires the VPC config block, and PUBLIC forbids it (Runtime, Browser, Code Interpreter, Harness) | ERROR | none |
340
+ | `pf-cloudfront-acm-cert-region` | AWS::CloudFront::Distribution | CloudFront viewer certificates must live in us-east-1 | WARN | none |
341
+ | `pf-cloudfront-alias-unique` | AWS::CloudFront::Distribution | Aliases must not contain duplicates | ERROR | none |
342
+ | `pf-cloudfront-aliases-require-custom-certificate` | AWS::CloudFront::Distribution | A distribution with Aliases cannot use the CloudFront default certificate | ERROR | none |
343
+ | `pf-cloudfront-allowed-methods-set` | AWS::CloudFront::Distribution | AllowedMethods must be one of the three sets CloudFront supports | ERROR | none |
344
+ | `pf-cloudfront-anycast-ip-list-count` | AWS::CloudFront::AnycastIpList | AnycastIpList IpCount must be 21 | ERROR | none |
345
+ | `pf-cloudfront-cache-behavior-path-pattern-unique` | AWS::CloudFront::Distribution | Cache behavior PathPattern values must be unique | ERROR | none |
346
+ | `pf-cloudfront-cache-behavior-target-origin-exists` | AWS::CloudFront::Distribution | Cache behavior TargetOriginId must match an origin or origin group Id | ERROR | none |
347
+ | `pf-cloudfront-cache-policy-accept-encoding-conflict` | AWS::CloudFront::CachePolicy | Accept-Encoding cannot be whitelisted while EnableAcceptEncodingGzip/Brotli is true | ERROR | none |
348
+ | `pf-cloudfront-cache-policy-cookie-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy CookieBehavior whitelist / allExcept requires Cookies | ERROR | none |
349
+ | `pf-cloudfront-cache-policy-header-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy HeaderBehavior whitelist requires Headers | ERROR | none |
350
+ | `pf-cloudfront-cache-policy-header-behavior-none-items` | AWS::CloudFront::CachePolicy | Cache policy HeaderBehavior none cannot carry Headers | ERROR | none |
351
+ | `pf-cloudfront-cache-policy-name` | AWS::CloudFront::CachePolicy | Cache policy names allow only alphanumerics, dash and underscore | ERROR | none |
352
+ | `pf-cloudfront-cache-policy-or-forwarded-values-required` | AWS::CloudFront::Distribution | A cache behavior must set either CachePolicyId or ForwardedValues | ERROR | none |
353
+ | `pf-cloudfront-cache-policy-query-string-behavior-items` | AWS::CloudFront::CachePolicy | Cache policy QueryStringBehavior whitelist / allExcept requires QueryStrings | ERROR | none |
354
+ | `pf-cloudfront-cache-policy-ttl-default-in-range` | AWS::CloudFront::CachePolicy | Cache policy DefaultTTL must be between MinTTL and MaxTTL | ERROR | none |
355
+ | `pf-cloudfront-cached-methods-subset` | AWS::CloudFront::Distribution | CachedMethods must be a subset of AllowedMethods | ERROR | none |
356
+ | `pf-cloudfront-continuous-deployment-header-prefix` | AWS::CloudFront::ContinuousDeploymentPolicy | SingleHeaderConfig Header must start with aws-cf-cd- | ERROR | none |
357
+ | `pf-cloudfront-continuous-deployment-policy-excludes-staging` | AWS::CloudFront::Distribution | ContinuousDeploymentPolicyId cannot be set on a staging distribution | ERROR | none |
358
+ | `pf-cloudfront-continuous-deployment-session-ttl-order` | AWS::CloudFront::ContinuousDeploymentPolicy | SessionStickinessConfig IdleTTL cannot exceed MaximumTTL | ERROR | none |
359
+ | `pf-cloudfront-continuous-deployment-staging-dns-count` | AWS::CloudFront::ContinuousDeploymentPolicy | A continuous deployment policy takes exactly one staging distribution DNS name | ERROR | none |
360
+ | `pf-cloudfront-continuous-deployment-traffic-config-match` | AWS::CloudFront::ContinuousDeploymentPolicy | TrafficConfig Type must match the config block that is present | ERROR | none |
361
+ | `pf-cloudfront-continuous-deployment-weight-range` | AWS::CloudFront::ContinuousDeploymentPolicy | SingleWeightConfig Weight must be between 0 and 0.15 | ERROR | none |
362
+ | `pf-cloudfront-custom-error-response-code` | AWS::CloudFront::Distribution | CustomErrorResponses ErrorCode must be one of the codes CloudFront caches | ERROR | pending-engine |
363
+ | `pf-cloudfront-custom-error-response-page-path-format` | AWS::CloudFront::Distribution | ResponsePagePath must start with / | ERROR | none |
364
+ | `pf-cloudfront-custom-error-response-page-path-pair` | AWS::CloudFront::Distribution | ResponsePagePath and ResponseCode must be specified together | ERROR | none |
365
+ | `pf-cloudfront-edge-lambda-region` | AWS::CloudFront::Distribution | Lambda@Edge functions associated with a distribution must be in us-east-1 | ERROR | none |
366
+ | `pf-cloudfront-edge-lambda-version` | AWS::CloudFront::Distribution | Lambda@Edge associations must reference a version ARN, not an alias or $LATEST | ERROR | none |
367
+ | `pf-cloudfront-field-level-encryption-requires-post` | AWS::CloudFront::Distribution | FieldLevelEncryptionId requires POST or PUT in AllowedMethods | ERROR | none |
368
+ | `pf-cloudfront-function-association-event-type` | AWS::CloudFront::Distribution | CloudFront Functions only support viewer-request and viewer-response | ERROR | none |
369
+ | `pf-cloudfront-function-association-event-type-unique` | AWS::CloudFront::Distribution | Each CloudFront Function EventType can appear only once per cache behavior | ERROR | none |
370
+ | `pf-cloudfront-function-code-size` | AWS::CloudFront::Function | CloudFront Function code is limited to 10 KB | ERROR | none |
371
+ | `pf-cloudfront-function-kvs-association-count` | AWS::CloudFront::Function | A CloudFront Function can associate at most one key value store | ERROR | none |
372
+ | `pf-cloudfront-function-kvs-requires-runtime-2` | AWS::CloudFront::Function | KeyValueStoreAssociations require the cloudfront-js-2.0 runtime | ERROR | none |
373
+ | `pf-cloudfront-function-runtime-enum` | AWS::CloudFront::Function | CloudFront Function Runtime must be cloudfront-js-1.0 or cloudfront-js-2.0 | ERROR | pending-engine |
374
+ | `pf-cloudfront-geo-restriction-country-code` | AWS::CloudFront::Distribution | GeoRestriction locations must be two-letter uppercase country codes | ERROR | pending-engine |
375
+ | `pf-cloudfront-geo-restriction-locations-exclusive` | AWS::CloudFront::Distribution | RestrictionType none cannot carry Locations | ERROR | none |
376
+ | `pf-cloudfront-grpc-requires-http2` | AWS::CloudFront::Distribution | GrpcConfig requires an HTTP/2 capable HttpVersion | ERROR | none |
377
+ | `pf-cloudfront-grpc-requires-post-method` | AWS::CloudFront::Distribution | GrpcConfig requires POST in AllowedMethods | ERROR | none |
378
+ | `pf-cloudfront-http-version-enum` | AWS::CloudFront::Distribution | HttpVersion must be http1.1, http2, http2and3 or http3 | ERROR | pending-engine |
379
+ | `pf-cloudfront-key-group-item-count` | AWS::CloudFront::KeyGroup | A key group holds at most 5 public keys | ERROR | none |
380
+ | `pf-cloudfront-key-group-item-unique` | AWS::CloudFront::KeyGroup | A key group must not list the same public key twice | ERROR | none |
381
+ | `pf-cloudfront-key-value-store-import-source-arn` | AWS::CloudFront::KeyValueStore | KeyValueStore ImportSource SourceArn must be an S3 object ARN | ERROR | none |
382
+ | `pf-cloudfront-key-value-store-import-source-type` | AWS::CloudFront::KeyValueStore | KeyValueStore ImportSource SourceType must be S3 | ERROR | pending-engine |
383
+ | `pf-cloudfront-lambda-association-event-type-unique` | AWS::CloudFront::Distribution | Each Lambda@Edge EventType can appear only once per cache behavior | ERROR | none |
384
+ | `pf-cloudfront-lambda-association-include-body-event-type` | AWS::CloudFront::Distribution | IncludeBody is only valid for viewer-request and origin-request | ERROR | none |
385
+ | `pf-cloudfront-logging-bucket-format` | AWS::CloudFront::Distribution | Logging.Bucket must be the S3 bucket DNS name, not the bare bucket name | ERROR | none |
386
+ | `pf-cloudfront-oac-excludes-origin-access-identity` | AWS::CloudFront::Distribution | OriginAccessControlId and S3OriginConfig.OriginAccessIdentity are mutually exclusive | ERROR | none |
387
+ | `pf-cloudfront-origin-config-required` | AWS::CloudFront::Distribution | Every origin must declare exactly one origin type configuration | ERROR | none |
388
+ | `pf-cloudfront-origin-connection-attempts-range` | AWS::CloudFront::Distribution | ConnectionAttempts must be between 1 and 3 | ERROR | none |
389
+ | `pf-cloudfront-origin-connection-timeout-range` | AWS::CloudFront::Distribution | ConnectionTimeout must be between 1 and 10 | ERROR | none |
390
+ | `pf-cloudfront-origin-custom-header-blocklist` | AWS::CloudFront::Distribution | OriginCustomHeaders cannot carry headers CloudFront reserves | ERROR | none |
391
+ | `pf-cloudfront-origin-custom-header-name-unique` | AWS::CloudFront::Distribution | OriginCustomHeaders header names must be unique per origin | ERROR | none |
392
+ | `pf-cloudfront-origin-group-failover-status-codes` | AWS::CloudFront::Distribution | Origin group failover status codes are limited to a fixed set | ERROR | none |
393
+ | `pf-cloudfront-origin-group-id-collides-with-origin` | AWS::CloudFront::Distribution | An origin group Id cannot reuse an origin Id | ERROR | none |
394
+ | `pf-cloudfront-origin-group-member-origin` | AWS::CloudFront::Distribution | Origin group members must reference an origin declared in the distribution | ERROR | none |
395
+ | `pf-cloudfront-origin-http-port-range` | AWS::CloudFront::Distribution | HTTPPort must be 80, 443 or in 1024-65535 | ERROR | none |
396
+ | `pf-cloudfront-origin-https-port-range` | AWS::CloudFront::Distribution | HTTPSPort must be 80, 443 or in 1024-65535 | ERROR | none |
397
+ | `pf-cloudfront-origin-id-unique` | AWS::CloudFront::Distribution | Origin Id values must be unique within a distribution | ERROR | none |
398
+ | `pf-cloudfront-origin-keepalive-timeout-range` | AWS::CloudFront::Distribution | OriginKeepaliveTimeout must be between 1 and 300 | ERROR | none |
399
+ | `pf-cloudfront-origin-path-format` | AWS::CloudFront::Distribution | OriginPath must start with / and must not end with / | ERROR | none |
400
+ | `pf-cloudfront-origin-protocol-policy-enum` | AWS::CloudFront::Distribution | OriginProtocolPolicy must be http-only, https-only or match-viewer | ERROR | none |
401
+ | `pf-cloudfront-origin-read-timeout-range` | AWS::CloudFront::Distribution | OriginReadTimeout must be between 1 and 120 | ERROR | none |
402
+ | `pf-cloudfront-origin-request-policy-cloudfront-headers` | AWS::CloudFront::OriginRequestPolicy | allViewerAndWhitelistCloudFront only accepts CloudFront-* headers | ERROR | none |
403
+ | `pf-cloudfront-origin-request-policy-cookie-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy CookieBehavior whitelist / allExcept requires Cookies | ERROR | none |
404
+ | `pf-cloudfront-origin-request-policy-excludes-forwarded-values` | AWS::CloudFront::Distribution | A cache behavior cannot set both OriginRequestPolicyId and ForwardedValues | ERROR | none |
405
+ | `pf-cloudfront-origin-request-policy-header-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy HeaderBehavior whitelist / allExcept requires Headers | ERROR | none |
406
+ | `pf-cloudfront-origin-request-policy-name-charset` | AWS::CloudFront::OriginRequestPolicy | Origin request policy names allow only alphanumerics, dash and underscore | ERROR | none |
407
+ | `pf-cloudfront-origin-request-policy-query-string-behavior-items` | AWS::CloudFront::OriginRequestPolicy | Origin request policy QueryStringBehavior whitelist / allExcept requires QueryStrings | ERROR | none |
408
+ | `pf-cloudfront-origin-shield-region-required` | AWS::CloudFront::Distribution | Enabling Origin Shield requires OriginShieldRegion | ERROR | none |
409
+ | `pf-cloudfront-origin-shield-region-supported` | AWS::CloudFront::Distribution | OriginShieldRegion must be a region where CloudFront offers Origin Shield | ERROR | none |
410
+ | `pf-cloudfront-price-class-enum` | AWS::CloudFront::Distribution | PriceClass must be PriceClass_100, PriceClass_200 or PriceClass_All | ERROR | pending-engine |
411
+ | `pf-cloudfront-public-key-pem-format` | AWS::CloudFront::PublicKey | PublicKey EncodedKey must be a PEM-encoded public key | ERROR | none |
412
+ | `pf-cloudfront-realtime-log-endpoint-count` | AWS::CloudFront::RealtimeLogConfig | A real-time log configuration takes exactly one endpoint | ERROR | none |
413
+ | `pf-cloudfront-realtime-log-endpoint-stream-type` | AWS::CloudFront::RealtimeLogConfig | Real-time log endpoints must have StreamType Kinesis | ERROR | none |
414
+ | `pf-cloudfront-realtime-log-field-names` | AWS::CloudFront::RealtimeLogConfig | Real-time log Fields must name fields CloudFront defines | ERROR | none |
415
+ | `pf-cloudfront-response-headers-policy-name-charset` | AWS::CloudFront::ResponseHeadersPolicy | Response headers policy names allow only alphanumerics, dash and underscore | ERROR | none |
416
+ | `pf-cloudfront-rhp-content-security-policy-length` | AWS::CloudFront::ResponseHeadersPolicy | ContentSecurityPolicy is limited to 1783 characters | ERROR | none |
417
+ | `pf-cloudfront-rhp-cors-allow-methods-enum` | AWS::CloudFront::ResponseHeadersPolicy | AccessControlAllowMethods accepts only the eight documented values | ERROR | pending-engine |
418
+ | `pf-cloudfront-rhp-custom-header-blocklist` | AWS::CloudFront::ResponseHeadersPolicy | CustomHeadersConfig cannot carry headers CloudFront reserves | ERROR | none |
419
+ | `pf-cloudfront-rhp-custom-header-unique` | AWS::CloudFront::ResponseHeadersPolicy | CustomHeadersConfig must not repeat a header name | ERROR | none |
420
+ | `pf-cloudfront-rhp-remove-header-blocklist` | AWS::CloudFront::ResponseHeadersPolicy | RemoveHeadersConfig cannot remove headers CloudFront controls | ERROR | none |
421
+ | `pf-cloudfront-rhp-server-timing-sampling-rate-required` | AWS::CloudFront::ResponseHeadersPolicy | ServerTimingHeadersConfig requires SamplingRate when enabled | ERROR | none |
422
+ | `pf-cloudfront-rhp-xss-protection-report-uri-mode-block` | AWS::CloudFront::ResponseHeadersPolicy | XSSProtection cannot set both ReportUri and ModeBlock | ERROR | none |
423
+ | `pf-cloudfront-rhp-xss-protection-report-uri-requires-protection` | AWS::CloudFront::ResponseHeadersPolicy | XSSProtection ReportUri requires Protection true | ERROR | none |
424
+ | `pf-cloudfront-s3-website-endpoint-custom-origin` | AWS::CloudFront::Distribution | An S3 website endpoint origin must use CustomOriginConfig, not S3OriginConfig | ERROR | none |
425
+ | `pf-cloudfront-staging-requires-no-aliases` | AWS::CloudFront::Distribution | A staging distribution cannot have Aliases | ERROR | none |
426
+ | `pf-cloudfront-trusted-key-groups-excludes-trusted-signers` | AWS::CloudFront::Distribution | TrustedKeyGroups and TrustedSigners cannot both be used on a cache behavior | ERROR | none |
427
+ | `pf-cloudfront-trusted-signers-account-format` | AWS::CloudFront::Distribution | TrustedSigners entries must be self or a 12-digit account id | ERROR | none |
428
+ | `pf-cloudfront-ttl-order` | AWS::CloudFront::Distribution | Cache behavior TTLs must satisfy MinTTL <= DefaultTTL <= MaxTTL | ERROR | none |
429
+ | `pf-cloudfront-viewer-certificate-exactly-one` | AWS::CloudFront::Distribution | ViewerCertificate must name exactly one certificate source | ERROR | none |
430
+ | `pf-cloudfront-viewer-certificate-sni-min-protocol` | AWS::CloudFront::Distribution | sni-only requires MinimumProtocolVersion of TLSv1 or higher | ERROR | none |
431
+ | `pf-cloudfront-viewer-certificate-vip-deprecated` | AWS::CloudFront::Distribution | SslSupportMethod vip cannot be used for new distributions | ERROR | none |
432
+ | `pf-cloudfront-viewer-protocol-policy-enum` | AWS::CloudFront::Distribution | ViewerProtocolPolicy must be allow-all, https-only or redirect-to-https | ERROR | pending-engine |
433
+ | `pf-cloudfront-vpc-origin-arn-type` | AWS::CloudFront::VpcOrigin | A VPC origin ARN must point at an ALB, NLB or EC2 instance | ERROR | none |
434
+ | `pf-cloudfront-vpc-origin-port-range` | AWS::CloudFront::VpcOrigin | VPC origin HTTPPort and HTTPSPort must be between 1 and 65535 | ERROR | none |
435
+ | `pf-cloudfront-vpc-origin-ssl-protocols-required` | AWS::CloudFront::VpcOrigin | An HTTPS-capable VPC origin must list OriginSSLProtocols | ERROR | none |
436
+ | `pf-cloudfront-wafv2-webacl-scope` | AWS::CloudFront::Distribution | A WAFv2 web ACL attached to CloudFront must be globally scoped | ERROR | none |
437
+ | `pf-cloudwatch-alarm-action-vendor` | AWS::CloudWatch::Alarm | Alarm actions accept only the CloudWatch action vendors | ERROR | none |
438
+ | `pf-cloudwatch-alarm-actions-max` | AWS::CloudWatch::Alarm | Each alarm action list holds at most 5 ARNs | ERROR | none |
439
+ | `pf-cloudwatch-alarm-anomaly-autoscaling-action` | AWS::CloudWatch::Alarm | An anomaly-detection alarm cannot carry an Auto Scaling action | ERROR | none |
440
+ | `pf-cloudwatch-alarm-ec2-action-region` | AWS::CloudWatch::Alarm | An EC2 automate action must name the stack's own region | ERROR | none |
441
+ | `pf-cloudwatch-alarm-evaluation-window` | AWS::CloudWatch::Alarm | The evaluation window caps at 7 days (Period >= 3600) or 1 day (Period < 3600) | ERROR | none |
442
+ | `pf-cloudwatch-alarm-expressions-max` | AWS::CloudWatch::Alarm | An alarm takes at most 10 math expressions | ERROR | none |
443
+ | `pf-cloudwatch-alarm-low-sample-percentile` | AWS::CloudWatch::Alarm | EvaluateLowSampleCountPercentile only applies to percentile statistics | ERROR | none |
444
+ | `pf-cloudwatch-alarm-metrics-max` | AWS::CloudWatch::Alarm | An alarm takes at most 10 MetricStat queries | ERROR | none |
445
+ | `pf-cloudwatch-alarm-period` | AWS::CloudWatch::Alarm | Period must be 10, 20, 30 or a multiple of 60 | ERROR | none |
446
+ | `pf-cloudwatch-alarm-search-expression` | AWS::CloudWatch::Alarm | SEARCH() cannot be used in a metric alarm | ERROR | none |
447
+ | `pf-cloudwatch-alarm-threshold` | AWS::CloudWatch::Alarm | Standard operators need Threshold, range operators need ThresholdMetricId | ERROR | none |
448
+ | `pf-cloudwatch-anomaly-detector-excluded-range-order` | AWS::CloudWatch::AnomalyDetector | An excluded time range must start before it ends | ERROR | none |
449
+ | `pf-cloudwatch-anomaly-detector-exclusive` | AWS::CloudWatch::AnomalyDetector | SingleMetricAnomalyDetector and MetricMathAnomalyDetector are mutually exclusive | ERROR | none |
450
+ | `pf-cloudwatch-anomaly-detector-math-single-query` | AWS::CloudWatch::AnomalyDetector | A math detector needs more than one metric data query | ERROR | none |
451
+ | `pf-cloudwatch-anomaly-detector-math-toplevel` | AWS::CloudWatch::AnomalyDetector | MetricMathAnomalyDetector cannot be combined with the top-level metric properties | ERROR | none |
452
+ | `pf-cloudwatch-anomaly-detector-namespace-colon` | AWS::CloudWatch::AnomalyDetector | A metric namespace must not start with a colon | ERROR | none |
453
+ | `pf-cloudwatch-anomaly-detector-stat-syntax` | AWS::CloudWatch::AnomalyDetector | The anomaly detector Stat must be a CloudWatch statistic | ERROR | none |
454
+ | `pf-cloudwatch-composite-alarm-rule-syntax` | AWS::CloudWatch::CompositeAlarm | An AlarmRule must start with a valid expression token | ERROR | none |
455
+ | `pf-cloudwatch-composite-self-reference` | AWS::CloudWatch::CompositeAlarm | A composite alarm cannot reference itself in its AlarmRule | ERROR | none |
456
+ | `pf-cloudwatch-composite-suppressor-extension-period` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor requires ActionsSuppressorExtensionPeriod | ERROR | none |
457
+ | `pf-cloudwatch-composite-suppressor-format` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor must be an alarm name or a CloudWatch alarm ARN | ERROR | none |
458
+ | `pf-cloudwatch-composite-suppressor-required` | AWS::CloudWatch::CompositeAlarm | The suppressor periods require an ActionsSuppressor | ERROR | none |
459
+ | `pf-cloudwatch-composite-suppressor-wait-period` | AWS::CloudWatch::CompositeAlarm | ActionsSuppressor requires ActionsSuppressorWaitPeriod | ERROR | none |
460
+ | `pf-cloudwatch-dashboard-alarm-widget-alarms` | AWS::CloudWatch::Dashboard | An alarm widget requires properties.alarms | ERROR | none |
461
+ | `pf-cloudwatch-dashboard-body-json` | AWS::CloudWatch::Dashboard | DashboardBody must be valid JSON | ERROR | none |
462
+ | `pf-cloudwatch-dashboard-metric-widget-source` | AWS::CloudWatch::Dashboard | A metric widget needs a region and a data source | ERROR | none |
463
+ | `pf-cloudwatch-dashboard-name` | AWS::CloudWatch::Dashboard | Dashboard names allow only alphanumerics, dash and underscore | ERROR | none |
464
+ | `pf-cloudwatch-dashboard-text-widget-markdown` | AWS::CloudWatch::Dashboard | A text widget requires properties.markdown | ERROR | none |
465
+ | `pf-cloudwatch-dashboard-widget-fields` | AWS::CloudWatch::Dashboard | Every dashboard widget requires type and properties | ERROR | none |
466
+ | `pf-cloudwatch-dashboard-widget-height-max` | AWS::CloudWatch::Dashboard | Widget height tops out at 1000 | ERROR | none |
467
+ | `pf-cloudwatch-dashboard-widget-period` | AWS::CloudWatch::Dashboard | A widget period must be 1, 5, 10, 20, 30 or a multiple of 60 | ERROR | none |
468
+ | `pf-cloudwatch-dashboard-widget-position` | AWS::CloudWatch::Dashboard | Dashboard widget x tops out at 23 and width at 24 | ERROR | none |
469
+ | `pf-cloudwatch-dashboard-widget-position-min` | AWS::CloudWatch::Dashboard | Widget x and y must not be negative | ERROR | none |
470
+ | `pf-cloudwatch-dashboard-widget-stat-syntax` | AWS::CloudWatch::Dashboard | A widget stat must be a CloudWatch statistic | ERROR | none |
471
+ | `pf-cloudwatch-dashboard-widgets` | AWS::CloudWatch::Dashboard | DashboardBody requires a widgets array | ERROR | none |
472
+ | `pf-cloudwatch-dashboard-widgets-array` | AWS::CloudWatch::Dashboard | The widgets key must hold an array | ERROR | none |
473
+ | `pf-cloudwatch-dashboard-yaxis-range` | AWS::CloudWatch::Dashboard | A widget yAxis min must be below its max | ERROR | none |
474
+ | `pf-cloudwatch-datapoints-evaluation` | AWS::CloudWatch::Alarm | DatapointsToAlarm must not exceed EvaluationPeriods | ERROR | none |
475
+ | `pf-cloudwatch-extended-statistic` | AWS::CloudWatch::Alarm | A percentile statistic cannot exceed p100 | ERROR | none |
476
+ | `pf-cloudwatch-insight-rule-body-json` | AWS::CloudWatch::InsightRule | RuleBody must be valid JSON | ERROR | none |
477
+ | `pf-cloudwatch-insight-rule-body-unknown-key` | AWS::CloudWatch::InsightRule | The rule body top level takes only the documented keys | ERROR | none |
478
+ | `pf-cloudwatch-insight-rule-contribution-filters` | AWS::CloudWatch::InsightRule | Contribution requires a Filters key | ERROR | none |
479
+ | `pf-cloudwatch-insight-rule-keys-max` | AWS::CloudWatch::InsightRule | Contribution.Keys holds at most 4 keys | ERROR | none |
480
+ | `pf-cloudwatch-insight-rule-log-format` | AWS::CloudWatch::InsightRule | LogFormat must be JSON or CLF | ERROR | none |
481
+ | `pf-cloudwatch-insight-rule-log-groups` | AWS::CloudWatch::InsightRule | The rule body needs at least one log group | ERROR | none |
482
+ | `pf-cloudwatch-insight-rule-schema` | AWS::CloudWatch::InsightRule | The rule body Schema must be CloudWatchLogRule version 1 | ERROR | none |
483
+ | `pf-cloudwatch-metric-namespace-ascii` | AWS::CloudWatch::Alarm | Metric namespaces must not contain non-ASCII characters | ERROR | none |
484
+ | `pf-cloudwatch-metric-query-exclusive` | AWS::CloudWatch::Alarm | Expression and MetricStat are mutually exclusive per query | ERROR | none |
485
+ | `pf-cloudwatch-metric-query-returndata` | AWS::CloudWatch::Alarm | One metric query must return data, or two for an anomaly alarm | ERROR | none |
486
+ | `pf-cloudwatch-metric-stream-additional-statistic` | AWS::CloudWatch::MetricStream | AdditionalStatistics must be CloudWatch statistics | ERROR | none |
487
+ | `pf-cloudwatch-metric-stream-filters-exclusive` | AWS::CloudWatch::MetricStream | IncludeFilters and ExcludeFilters are mutually exclusive | ERROR | none |
488
+ | `pf-cloudwatch-metric-stream-firehose-account` | AWS::CloudWatch::MetricStream | FirehoseArn must be in the stack's own account | ERROR | none |
489
+ | `pf-cloudwatch-metric-stream-firehose-region` | AWS::CloudWatch::MetricStream | FirehoseArn must be in the stack's own region and partition | ERROR | none |
490
+ | `pf-cloudwatch-metric-stream-include-metrics` | AWS::CloudWatch::MetricStream | A statistics configuration needs at least one IncludeMetrics entry | ERROR | none |
491
+ | `pf-cloudwatch-metric-stream-role-account` | AWS::CloudWatch::MetricStream | RoleArn must be in the stack's own account | ERROR | none |
492
+ | `pf-cloudwatch-metricstat-stat-syntax` | AWS::CloudWatch::Alarm | MetricStat.Stat must be a CloudWatch statistic | ERROR | none |
493
+ | `pf-cloudwatch-threshold-metric-id` | AWS::CloudWatch::Alarm | ThresholdMetricId must match a metric query that returns data | ERROR | none |
494
+ | `pf-cognito-alias-username-exclusive` | AWS::Cognito::UserPool | AliasAttributes and UsernameAttributes are mutually exclusive | ERROR | none |
495
+ | `pf-cognito-analytics-application-requires-role` | AWS::Cognito::UserPoolClient | Pinpoint ApplicationId needs a RoleArn | ERROR | none |
496
+ | `pf-cognito-analytics-arn-region` | AWS::Cognito::UserPoolClient | The Pinpoint analytics app must be in the pool region | ERROR | none |
497
+ | `pf-cognito-analytics-config-exclusive` | AWS::Cognito::UserPoolClient | Pinpoint ApplicationArn excludes the id/role form | ERROR | none |
498
+ | `pf-cognito-auto-verified-attributes-enum` | AWS::Cognito::UserPool | Only email and phone_number can be auto-verified | ERROR | none |
499
+ | `pf-cognito-auto-verified-username-consistency` | AWS::Cognito::UserPool | Auto-verifying phone_number requires an SmsConfiguration | ERROR | none |
500
+ | `pf-cognito-callback-url-fragment` | AWS::Cognito::UserPoolClient | Callback URLs cannot carry a fragment | ERROR | none |
501
+ | `pf-cognito-callback-url-https` | AWS::Cognito::UserPoolClient | Callback URLs must use https (except localhost) | ERROR | none |
502
+ | `pf-cognito-callback-urls-max` | AWS::Cognito::UserPoolClient | At most 100 callback URLs per client | ERROR | none |
503
+ | `pf-cognito-client-credentials-exclusive` | AWS::Cognito::UserPoolClient | client_credentials cannot combine with code or implicit | ERROR | none |
504
+ | `pf-cognito-client-credentials-secret` | AWS::Cognito::UserPoolClient | client_credentials needs a client secret | ERROR | none |
505
+ | `pf-cognito-client-name` | AWS::Cognito::UserPoolClient | User pool client names allow only word characters, spaces and +=,.@- | ERROR | none |
506
+ | `pf-cognito-custom-domain-cert-region` | AWS::Cognito::UserPoolDomain | A custom domain certificate must be in us-east-1 | ERROR | none |
507
+ | `pf-cognito-custom-domain-fqdn` | AWS::Cognito::UserPoolDomain | A custom domain must be a fully qualified domain name | ERROR | none |
508
+ | `pf-cognito-custom-email-sender-kms` | AWS::Cognito::UserPool | A custom email sender trigger requires LambdaConfig.KMSKeyID | ERROR | none |
509
+ | `pf-cognito-custom-sender-kms-region` | AWS::Cognito::UserPool | The custom sender KMS key must be in the pool region | ERROR | none |
510
+ | `pf-cognito-custom-sms-sender-kms` | AWS::Cognito::UserPool | A custom SMS sender trigger requires LambdaConfig.KMSKeyID | ERROR | none |
511
+ | `pf-cognito-default-redirect-uri-member` | AWS::Cognito::UserPoolClient | DefaultRedirectURI must be one of the callback URLs | ERROR | none |
512
+ | `pf-cognito-developer-provider-name-format` | AWS::Cognito::IdentityPool | DeveloperProviderName takes no spaces | ERROR | none |
513
+ | `pf-cognito-domain-prefix-format` | AWS::Cognito::UserPoolDomain | A hosted UI domain prefix takes lower-case letters, digits and hyphens | ERROR | none |
514
+ | `pf-cognito-domain-prefix-length` | AWS::Cognito::UserPoolDomain | A hosted UI domain prefix is capped at 63 characters | ERROR | none |
515
+ | `pf-cognito-domain-reserved-word` | AWS::Cognito::UserPoolDomain | Domain prefixes cannot contain reserved words | ERROR | none |
516
+ | `pf-cognito-email-cognito-default-with-sourcearn` | AWS::Cognito::UserPool | COGNITO_DEFAULT email sending takes no SourceArn | ERROR | none |
517
+ | `pf-cognito-email-developer-requires-sourcearn` | AWS::Cognito::UserPool | DEVELOPER email sending needs a SES SourceArn | ERROR | none |
518
+ | `pf-cognito-email-from-format` | AWS::Cognito::UserPool | EmailConfiguration.From must be an email address | ERROR | none |
519
+ | `pf-cognito-email-reply-to-format` | AWS::Cognito::UserPool | ReplyToEmailAddress must be an email address | ERROR | none |
520
+ | `pf-cognito-email-sourcearn-region` | AWS::Cognito::UserPool | The SES SourceArn must be in a Cognito-supported SES region | ERROR | none |
521
+ | `pf-cognito-email-verification-message-placeholder` | AWS::Cognito::UserPool | EmailVerificationMessage needs the {####} code placeholder | ERROR | none |
522
+ | `pf-cognito-explicit-auth-flows-legacy-mix` | AWS::Cognito::UserPoolClient | Legacy and ALLOW_ auth flow names cannot be mixed | ERROR | none |
523
+ | `pf-cognito-group-role-arn-account` | AWS::Cognito::UserPoolGroup | A group role must be in the deploying account | ERROR | none |
524
+ | `pf-cognito-identity-pool-provider-name-format` | AWS::Cognito::IdentityPool | A user pool provider name is the full cognito-idp endpoint | ERROR | none |
525
+ | `pf-cognito-identity-pool-saml-arn-account` | AWS::Cognito::IdentityPool | SAML provider ARNs must be in the deploying account | ERROR | none |
526
+ | `pf-cognito-idp-apple-required-keys` | AWS::Cognito::UserPoolIdentityProvider | Sign in with Apple needs team_id, key_id and private_key | ERROR | none |
527
+ | `pf-cognito-idp-identifiers-max` | AWS::Cognito::UserPoolIdentityProvider | At most 50 IdP identifiers | ERROR | none |
528
+ | `pf-cognito-idp-oidc-attributes-request-method` | AWS::Cognito::UserPoolIdentityProvider | attributes_request_method is GET or POST | ERROR | none |
529
+ | `pf-cognito-idp-oidc-issuer-https` | AWS::Cognito::UserPoolIdentityProvider | The OIDC issuer must be an https URL | ERROR | none |
530
+ | `pf-cognito-idp-oidc-required-keys` | AWS::Cognito::UserPoolIdentityProvider | An OIDC provider needs four ProviderDetails keys | ERROR | none |
531
+ | `pf-cognito-idp-provider-name-length` | AWS::Cognito::UserPoolIdentityProvider | A provider name is capped at 32 characters | ERROR | none |
532
+ | `pf-cognito-idp-saml-metadata-exclusive` | AWS::Cognito::UserPoolIdentityProvider | MetadataURL and MetadataFile are exclusive | ERROR | none |
533
+ | `pf-cognito-idp-saml-metadata-required` | AWS::Cognito::UserPoolIdentityProvider | A SAML provider needs MetadataURL or MetadataFile | ERROR | none |
534
+ | `pf-cognito-idp-social-provider-name-fixed` | AWS::Cognito::UserPoolIdentityProvider | A social provider name is fixed to its type | ERROR | none |
535
+ | `pf-cognito-idp-social-required-keys` | AWS::Cognito::UserPoolIdentityProvider | A social provider needs client_id, client_secret and authorize_scopes | ERROR | none |
536
+ | `pf-cognito-invite-message-username-placeholder` | AWS::Cognito::UserPool | The invite email needs {username} and {####} | ERROR | none |
537
+ | `pf-cognito-invite-sms-message-placeholder` | AWS::Cognito::UserPool | The invite SMS needs {username} and {####} | ERROR | none |
538
+ | `pf-cognito-lambda-config-region` | AWS::Cognito::UserPool | User pool triggers must be Lambda functions in the same region | ERROR | none |
539
+ | `pf-cognito-log-delivery-event-source-duplicate` | AWS::Cognito::LogDeliveryConfiguration | One log configuration per event source | ERROR | none |
540
+ | `pf-cognito-log-delivery-log-group-region` | AWS::Cognito::LogDeliveryConfiguration | The log group must be in the pool region | ERROR | none |
541
+ | `pf-cognito-log-delivery-user-auth-events-tier` | AWS::Cognito::LogDeliveryConfiguration<br>AWS::Cognito::UserPool | userAuthEvents logging needs the PLUS tier | ERROR | none |
542
+ | `pf-cognito-logout-url-https` | AWS::Cognito::UserPoolClient | Logout URLs must use https (except localhost) | ERROR | none |
543
+ | `pf-cognito-managed-login-branding-asset-extension` | AWS::Cognito::ManagedLoginBranding | Only a favicon asset takes the ICO extension | ERROR | none |
544
+ | `pf-cognito-managed-login-branding-values-exclusive` | AWS::Cognito::ManagedLoginBranding | UseCognitoProvidedValues excludes Settings | ERROR | none |
545
+ | `pf-cognito-managed-login-version-tier` | AWS::Cognito::UserPoolDomain<br>AWS::Cognito::UserPool | Managed login version 2 needs ESSENTIALS or PLUS | ERROR | none |
546
+ | `pf-cognito-mfa-email-otp-requires-developer` | AWS::Cognito::UserPool | EMAIL_OTP needs the DEVELOPER email sending account | ERROR | none |
547
+ | `pf-cognito-mfa-off-with-enabled-mfas` | AWS::Cognito::UserPool | MfaConfiguration OFF takes no EnabledMfas | ERROR | none |
548
+ | `pf-cognito-mfa-sms-config` | AWS::Cognito::UserPool | MFA without any factor configuration cannot deploy | ERROR | none |
549
+ | `pf-cognito-oauth-callback-required` | AWS::Cognito::UserPoolClient | code and implicit OAuth flows need CallbackURLs | ERROR | none |
550
+ | `pf-cognito-oauth-flows-scopes-required` | AWS::Cognito::UserPoolClient | Enabling OAuth requires both AllowedOAuthFlows and AllowedOAuthScopes | ERROR | none |
551
+ | `pf-cognito-oauth-scopes-unknown` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPoolResourceServer | OAuth scopes must be standard or come from a resource server | ERROR | none |
552
+ | `pf-cognito-password-history-size-range` | AWS::Cognito::UserPool | PasswordHistorySize must be between 0 and 24 | ERROR | none |
553
+ | `pf-cognito-password-min-length` | AWS::Cognito::UserPool | PasswordPolicy MinimumLength runs 6 to 99 | ERROR | none |
554
+ | `pf-cognito-pre-token-generation-config-tier` | AWS::Cognito::UserPool | Pre token generation V2_0 and later need ESSENTIALS or PLUS | ERROR | none |
555
+ | `pf-cognito-pre-token-generation-legacy-mix` | AWS::Cognito::UserPool | PreTokenGeneration and PreTokenGenerationConfig must name the same function | ERROR | none |
556
+ | `pf-cognito-propagate-context-requires-secret` | AWS::Cognito::UserPoolClient | Propagating user context data requires a client secret | ERROR | none |
557
+ | `pf-cognito-read-attributes-exists` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPool | ReadAttributes must name attributes the pool has | ERROR | none |
558
+ | `pf-cognito-recovery-admin-only-alone` | AWS::Cognito::UserPool | admin_only cannot be combined with other recovery mechanisms | ERROR | none |
559
+ | `pf-cognito-recovery-duplicate` | AWS::Cognito::UserPool | Recovery mechanisms cannot repeat priorities or names | ERROR | none |
560
+ | `pf-cognito-recovery-mechanisms-max` | AWS::Cognito::UserPool | At most two account recovery mechanisms | ERROR | none |
561
+ | `pf-cognito-resource-server-identifier-charset` | AWS::Cognito::UserPoolResourceServer | A resource server identifier takes no spaces | ERROR | none |
562
+ | `pf-cognito-resource-server-scope-name-charset` | AWS::Cognito::UserPoolResourceServer | Scope names take no spaces or quotes | ERROR | none |
563
+ | `pf-cognito-resource-server-scopes-max` | AWS::Cognito::UserPoolResourceServer | At most 100 scopes per resource server | ERROR | none |
564
+ | `pf-cognito-risk-account-takeover-event-action-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Account takeover actions take four values | ERROR | none |
565
+ | `pf-cognito-risk-compromised-event-action-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Compromised credentials action is BLOCK or NO_ACTION | ERROR | none |
566
+ | `pf-cognito-risk-compromised-event-filter-enum` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Compromised credentials event filter takes three values | ERROR | none |
567
+ | `pf-cognito-risk-ip-range-cidr` | AWS::Cognito::UserPoolRiskConfigurationAttachment | Blocked and skipped IP ranges are CIDR blocks | ERROR | none |
568
+ | `pf-cognito-risk-ip-range-max` | AWS::Cognito::UserPoolRiskConfigurationAttachment | At most 200 blocked IP ranges | ERROR | none |
569
+ | `pf-cognito-risk-notify-source-arn-region` | AWS::Cognito::UserPoolRiskConfigurationAttachment | The notification SourceArn must be in a Cognito-supported SES region | ERROR | none |
570
+ | `pf-cognito-role-attachment-roles-keys` | AWS::Cognito::IdentityPoolRoleAttachment | Roles keys are authenticated and unauthenticated | ERROR | none |
571
+ | `pf-cognito-role-mapping-rule-match-type` | AWS::Cognito::IdentityPoolRoleAttachment | MatchType is Equals, Contains, StartsWith or NotEqual | ERROR | none |
572
+ | `pf-cognito-role-mapping-rules-max` | AWS::Cognito::IdentityPoolRoleAttachment | At most 25 rules per role mapping | ERROR | none |
573
+ | `pf-cognito-role-mappings-ambiguous-required` | AWS::Cognito::IdentityPoolRoleAttachment | A role mapping needs AmbiguousRoleResolution | ERROR | none |
574
+ | `pf-cognito-role-mappings-key-format` | AWS::Cognito::IdentityPoolRoleAttachment | A role mapping key is a provider name | ERROR | none |
575
+ | `pf-cognito-role-mappings-rules-required` | AWS::Cognito::IdentityPoolRoleAttachment | A Rules role mapping needs RulesConfiguration | ERROR | none |
576
+ | `pf-cognito-role-mappings-token-no-rules` | AWS::Cognito::IdentityPoolRoleAttachment | A Token role mapping takes no RulesConfiguration | ERROR | none |
577
+ | `pf-cognito-schema-attr-length-order` | AWS::Cognito::UserPool | Schema attribute MaxLength cannot undercut MinLength | ERROR | none |
578
+ | `pf-cognito-schema-attr-max` | AWS::Cognito::UserPool | A user pool takes at most 50 custom attributes | ERROR | none |
579
+ | `pf-cognito-schema-custom-name-length` | AWS::Cognito::UserPool | A schema attribute name is capped at 20 characters | ERROR | none |
580
+ | `pf-cognito-schema-custom-required` | AWS::Cognito::UserPool | Custom attributes cannot be required | ERROR | none |
581
+ | `pf-cognito-schema-name-duplicate` | AWS::Cognito::UserPool | Schema attribute names must be unique | ERROR | none |
582
+ | `pf-cognito-schema-number-min-max-order` | AWS::Cognito::UserPool | Number attribute MinValue must not exceed MaxValue | ERROR | none |
583
+ | `pf-cognito-schema-standard-attr-datatype` | AWS::Cognito::UserPool | Standard attributes keep their fixed data type | ERROR | none |
584
+ | `pf-cognito-signin-policy-password-required` | AWS::Cognito::UserPool | AllowedFirstAuthFactors must include PASSWORD | ERROR | none |
585
+ | `pf-cognito-signin-policy-webauthn-tier` | AWS::Cognito::UserPool | Passwordless sign-in factors need ESSENTIALS or PLUS | ERROR | none |
586
+ | `pf-cognito-sms-authentication-message-placeholder` | AWS::Cognito::UserPool | SmsAuthenticationMessage needs the {####} code placeholder | ERROR | none |
587
+ | `pf-cognito-sms-caller-arn-account` | AWS::Cognito::UserPool | The SMS caller role must be in the deploying account | ERROR | none |
588
+ | `pf-cognito-sms-configuration-sns-region` | AWS::Cognito::UserPool | SnsRegion must be the region the pool deploys to | ERROR | none |
589
+ | `pf-cognito-sms-verification-message-placeholder` | AWS::Cognito::UserPool | SmsVerificationMessage needs the {####} code placeholder | ERROR | none |
590
+ | `pf-cognito-supported-identity-providers-exists` | AWS::Cognito::UserPoolClient<br>AWS::Cognito::UserPoolIdentityProvider | Supported identity providers must exist on the pool | ERROR | none |
591
+ | `pf-cognito-temporary-password-validity-range` | AWS::Cognito::UserPool | TemporaryPasswordValidityDays must be between 0 and 365 | ERROR | none |
592
+ | `pf-cognito-token-expiration-order` | AWS::Cognito::UserPoolClient | Access and id tokens cannot outlive the refresh token | ERROR | none |
593
+ | `pf-cognito-token-validity-range` | AWS::Cognito::UserPoolClient | Token validity ranges depend on token type and unit | ERROR | none |
594
+ | `pf-cognito-ui-customization-css-properties` | AWS::Cognito::UserPoolUICustomizationAttachment | Hosted UI CSS only styles the -customizable classes | ERROR | none |
595
+ | `pf-cognito-ui-customization-requires-domain` | AWS::Cognito::UserPoolUICustomizationAttachment<br>AWS::Cognito::UserPoolDomain | Hosted UI customization requires a domain on the pool | ERROR | none |
596
+ | `pf-cognito-unused-account-validity-exclusive` | AWS::Cognito::UserPool | UnusedAccountValidityDays and TemporaryPasswordValidityDays are exclusive | ERROR | none |
597
+ | `pf-cognito-unused-account-validity-range` | AWS::Cognito::UserPool | UnusedAccountValidityDays must be between 0 and 365 | ERROR | none |
598
+ | `pf-cognito-user-attribute-update-requires-auto-verified` | AWS::Cognito::UserPool | Attributes requiring verification before update must be auto-verified | ERROR | none |
599
+ | `pf-cognito-user-attribute-update-settings-enum` | AWS::Cognito::UserPool | Only email and phone_number can require verification before update | ERROR | none |
600
+ | `pf-cognito-user-pool-name` | AWS::Cognito::UserPool | User pool names allow only word characters, spaces and +=,.@- | ERROR | none |
601
+ | `pf-cognito-verification-code-placeholder` | AWS::Cognito::UserPool | The verification email needs the {####} code placeholder | ERROR | none |
602
+ | `pf-cognito-verification-email-subject-length` | AWS::Cognito::UserPool | The verification email subject is capped at 140 characters | ERROR | none |
603
+ | `pf-cognito-verification-link-placeholder` | AWS::Cognito::UserPool | A link verification message needs the {##...##} placeholder | ERROR | none |
604
+ | `pf-cognito-verification-sms-placeholder` | AWS::Cognito::UserPool | The verification SMS needs the {####} code placeholder | ERROR | none |
605
+ | `pf-cognito-web-authn-relying-party-format` | AWS::Cognito::UserPool | WebAuthnRelyingPartyID is a bare domain name | ERROR | none |
606
+ | `pf-cognito-write-attributes-immutable` | AWS::Cognito::UserPoolClient | Verified-status attributes cannot be written by a client | ERROR | none |
607
+ | `pf-dynamodb-attribute-definitions-usage` | AWS::DynamoDB::Table | Every AttributeDefinitions entry must be used by a key schema | ERROR | none |
608
+ | `pf-dynamodb-attribute-type` | AWS::DynamoDB::Table | AttributeType must be S, N or B | ERROR | pending-engine |
609
+ | `pf-dynamodb-billing-throughput` | AWS::DynamoDB::Table | ProvisionedThroughput must match BillingMode (required for PROVISIONED, forbidden for PAY_PER_REQUEST) | ERROR | none |
610
+ | `pf-dynamodb-contributor-insights-mode` | AWS::DynamoDB::Table | Contributor Insights Mode must be ACCESSED_AND_THROTTLED_KEYS or THROTTLED_KEYS | ERROR | pending-engine |
611
+ | `pf-dynamodb-duplicate-attribute-definitions` | AWS::DynamoDB::Table | AttributeDefinitions must not define the same attribute twice | ERROR | none |
612
+ | `pf-dynamodb-duplicate-index-name` | AWS::DynamoDB::Table | Secondary index names must be unique | ERROR | none |
613
+ | `pf-dynamodb-global-table-attribute-definitions` | AWS::DynamoDB::GlobalTable | GlobalTable AttributeDefinitions must match the key schemas exactly | ERROR | none |
614
+ | `pf-dynamodb-global-table-gsi-count` | AWS::DynamoDB::GlobalTable | A global table can carry at most 20 global secondary indexes | ERROR | none |
615
+ | `pf-dynamodb-global-table-gsi-provisioned-write-settings` | AWS::DynamoDB::GlobalTable | Each GSI of a PROVISIONED GlobalTable needs WriteProvisionedThroughputSettings | ERROR | none |
616
+ | `pf-dynamodb-global-table-key-schema-shape` | AWS::DynamoDB::GlobalTable | GlobalTable KeySchema must be [HASH] or [HASH, RANGE] | ERROR | none |
617
+ | `pf-dynamodb-global-table-lsi-attribute-definitions` | AWS::DynamoDB::GlobalTable | GlobalTable LSI key attributes must be defined in AttributeDefinitions | ERROR | none |
618
+ | `pf-dynamodb-global-table-lsi-count` | AWS::DynamoDB::GlobalTable | A global table can carry at most 5 local secondary indexes | ERROR | none |
619
+ | `pf-dynamodb-global-table-lsi-shape` | AWS::DynamoDB::GlobalTable | A GlobalTable LSI needs a RANGE key and the table's leading hash key | ERROR | none |
620
+ | `pf-dynamodb-global-table-mrsc-lsi` | AWS::DynamoDB::GlobalTable | MRSC global tables do not support local secondary indexes | ERROR | none |
621
+ | `pf-dynamodb-global-table-mrsc-region-set` | AWS::DynamoDB::GlobalTable | An MRSC global table cannot span Region sets | ERROR | none |
622
+ | `pf-dynamodb-global-table-mrsc-replica-count` | AWS::DynamoDB::GlobalTable | An MRSC global table spans exactly three Regions | ERROR | none |
623
+ | `pf-dynamodb-global-table-mrsc-ttl` | AWS::DynamoDB::GlobalTable | MRSC global tables do not support TTL | ERROR | none |
624
+ | `pf-dynamodb-global-table-name-length` | AWS::DynamoDB::GlobalTable | GlobalTable TableName must be at least 3 characters | ERROR | none |
625
+ | `pf-dynamodb-global-table-ondemand-settings-billing` | AWS::DynamoDB::GlobalTable | On-demand throughput settings need BillingMode PAY_PER_REQUEST | ERROR | none |
626
+ | `pf-dynamodb-global-table-projection-nonkey` | AWS::DynamoDB::GlobalTable | GlobalTable NonKeyAttributes goes with INCLUDE, and only with INCLUDE | ERROR | none |
627
+ | `pf-dynamodb-global-table-provisioned-write-settings` | AWS::DynamoDB::GlobalTable | A PROVISIONED GlobalTable needs WriteProvisionedThroughputSettings | ERROR | none |
628
+ | `pf-dynamodb-global-table-read-capacity-exclusive` | AWS::DynamoDB::GlobalTable | A replica sets either ReadCapacityUnits or autoscaling, never both or neither | ERROR | none |
629
+ | `pf-dynamodb-global-table-read-settings-multi-account` | AWS::DynamoDB::GlobalTable | Table-level read throughput settings are for multi-account global tables only | ERROR | none |
630
+ | `pf-dynamodb-global-table-replica-gsi-name` | AWS::DynamoDB::GlobalTable | A replica can only override an index the global table declares | ERROR | none |
631
+ | `pf-dynamodb-global-table-replica-kinesis-region` | AWS::DynamoDB::GlobalTable | A replica's Kinesis destination must be in the replica's Region | ERROR | none |
632
+ | `pf-dynamodb-global-table-replica-region` | AWS::DynamoDB::GlobalTable | GlobalTable Replicas must include the deployment region | ERROR | none |
633
+ | `pf-dynamodb-global-table-replica-sse-key-coverage` | AWS::DynamoDB::GlobalTable | Either every replica names a KMS key, or none does | ERROR | none |
634
+ | `pf-dynamodb-global-table-replica-sse-key-region` | AWS::DynamoDB::GlobalTable | A replica's KMS key must live in the replica's Region | ERROR | none |
635
+ | `pf-dynamodb-global-table-stream-required` | AWS::DynamoDB::GlobalTable | An MREC global table with more than one replica needs a stream | ERROR | none |
636
+ | `pf-dynamodb-global-table-witness-region` | AWS::DynamoDB::GlobalTable | A witness lives in a Region that has no replica | ERROR | none |
637
+ | `pf-dynamodb-global-table-witness-requires-mrsc` | AWS::DynamoDB::GlobalTable | GlobalTableWitnesses only exists for MRSC global tables | ERROR | none |
638
+ | `pf-dynamodb-global-table-write-provisioned-with-ppr` | AWS::DynamoDB::GlobalTable | WriteProvisionedThroughputSettings cannot be used with PAY_PER_REQUEST | ERROR | none |
639
+ | `pf-dynamodb-gsi-billing-throughput` | AWS::DynamoDB::Table | GSI ProvisionedThroughput must match the table BillingMode | ERROR | none |
640
+ | `pf-dynamodb-gsi-count` | AWS::DynamoDB::Table | A table can carry at most 20 global secondary indexes | ERROR | none |
641
+ | `pf-dynamodb-gsi-projection-nonkey` | AWS::DynamoDB::Table | NonKeyAttributes goes with INCLUDE, and only with INCLUDE | ERROR | none |
642
+ | `pf-dynamodb-import-csv-delimiter` | AWS::DynamoDB::Table | A CSV import delimiter is a single character from , ; : | tab space | ERROR | none |
643
+ | `pf-dynamodb-import-format-options` | AWS::DynamoDB::Table | InputFormatOptions only applies to CSV imports | ERROR | none |
644
+ | `pf-dynamodb-key-schema-shape` | AWS::DynamoDB::Table | KeySchema must be [HASH] or [HASH, RANGE] | ERROR | none |
645
+ | `pf-dynamodb-kinesis-precision` | AWS::DynamoDB::Table | Kinesis record timestamp precision is MICROSECOND or MILLISECOND | ERROR | pending-engine |
646
+ | `pf-dynamodb-kinesis-stream-region` | AWS::DynamoDB::Table | A Kinesis streaming destination must be in the table's region | ERROR | none |
647
+ | `pf-dynamodb-lsi-attribute-definitions` | AWS::DynamoDB::Table | LSI key attributes must be defined in AttributeDefinitions | ERROR | none |
648
+ | `pf-dynamodb-lsi-count` | AWS::DynamoDB::Table | A table can carry at most 5 local secondary indexes | ERROR | none |
649
+ | `pf-dynamodb-lsi-shape` | AWS::DynamoDB::Table | An LSI needs a RANGE key and the table's leading hash key | ERROR | none |
650
+ | `pf-dynamodb-ondemand-throughput-billing` | AWS::DynamoDB::Table | OnDemandThroughput belongs to PAY_PER_REQUEST tables only | ERROR | none |
651
+ | `pf-dynamodb-pitr-recovery-period` | AWS::DynamoDB::Table | RecoveryPeriodInDays needs point-in-time recovery turned on | ERROR | none |
652
+ | `pf-dynamodb-projection-nonkey-limit` | AWS::DynamoDB::Table | One index can project at most 20 non-key attributes | ERROR | none |
653
+ | `pf-dynamodb-projection-nonkey-total` | AWS::DynamoDB::Table | Projected non-key attributes are capped at 100 across all indexes | ERROR | none |
654
+ | `pf-dynamodb-resource-policy-principal` | AWS::DynamoDB::Table | Every resource policy statement needs a Principal | ERROR | none |
655
+ | `pf-dynamodb-resource-policy-size` | AWS::DynamoDB::Table | A table resource policy must stay under 20480 bytes | ERROR | none |
656
+ | `pf-dynamodb-sse-type` | AWS::DynamoDB::Table | SSEType must be KMS, and only when SSE is enabled | ERROR | none |
657
+ | `pf-dynamodb-table-class` | AWS::DynamoDB::Table | TableClass must be STANDARD or STANDARD_INFREQUENT_ACCESS | ERROR | pending-engine |
658
+ | `pf-dynamodb-table-name-format` | AWS::DynamoDB::Table<br>AWS::DynamoDB::GlobalTable | Table names allow only letters, numbers, underscore, dot and hyphen (max 255) | ERROR | none |
659
+ | `pf-dynamodb-table-name-length` | AWS::DynamoDB::Table | TableName must be at least 3 characters | ERROR | pending-engine |
660
+ | `pf-dynamodb-ttl-attribute-required` | AWS::DynamoDB::Table | Enabling TTL requires an AttributeName | ERROR | none |
661
+ | `pf-dynamodb-warm-throughput-minimum` | AWS::DynamoDB::Table | WarmThroughput cannot go below the default 12000 read / 4000 write | ERROR | none |
662
+ | `pf-ec2-client-vpn-auth-type-config` | AWS::EC2::ClientVpnEndpoint | Client VPN AuthenticationOptions.Type must match the provided authentication sub-block | ERROR | none |
663
+ | `pf-ec2-client-vpn-authorization-rule-exclusive` | AWS::EC2::ClientVpnAuthorizationRule | Client VPN authorization rule cannot set both AccessGroupId and AuthorizeAllGroups | ERROR | none |
664
+ | `pf-ec2-client-vpn-cert-region` | AWS::EC2::ClientVpnEndpoint | The Client VPN server certificate must be in the deploy region | ERROR | none |
665
+ | `pf-ec2-client-vpn-cidr-size` | AWS::EC2::ClientVpnEndpoint | Client VPN ClientCidrBlock must be between /12 and /22 | ERROR | none |
666
+ | `pf-ec2-client-vpn-connection-log` | AWS::EC2::ClientVpnEndpoint | Client VPN ConnectionLogOptions.Enabled requires CloudwatchLogGroup | ERROR | none |
667
+ | `pf-ec2-client-vpn-port` | AWS::EC2::ClientVpnEndpoint | Client VPN VpnPort must be 443 or 1194 | ERROR | none |
668
+ | `pf-ec2-client-vpn-session-timeout` | AWS::EC2::ClientVpnEndpoint | Client VPN SessionTimeoutHours must be 8, 10, 12 or 24 | ERROR | none |
669
+ | `pf-ec2-cpu-options-combination` | AWS::EC2::Instance | CpuOptions ThreadsPerCore and CoreCount must be in range | ERROR | none |
670
+ | `pf-ec2-credit-specification-burstable` | AWS::EC2::Instance | CreditSpecification applies only to burstable instance types | ERROR | none |
671
+ | `pf-ec2-dhcp-ntp-servers-count` | AWS::EC2::DHCPOptions | DHCP server lists take at most four addresses | ERROR | none |
672
+ | `pf-ec2-dhcp-options-empty` | AWS::EC2::DHCPOptions | A DHCP options set must configure at least one option | ERROR | none |
673
+ | `pf-ec2-eip-association-exclusive` | AWS::EC2::EIPAssociation | An EIP association cannot set both AllocationId and EIP | ERROR | none |
674
+ | `pf-ec2-enclave-hibernation-exclusive` | AWS::EC2::Instance | Nitro Enclaves and hibernation cannot both be enabled | ERROR | none |
675
+ | `pf-ec2-eni-primary-single` | AWS::EC2::NetworkInterface | A network interface takes exactly one primary private IP | ERROR | none |
676
+ | `pf-ec2-eni-private-ip-in-subnet` | AWS::EC2::NetworkInterface | A network interface private IP must fall inside its subnet | ERROR | none |
677
+ | `pf-ec2-eni-public-ip-device-index` | AWS::EC2::Instance | AssociatePublicIpAddress is only valid on device index 0 | ERROR | none |
678
+ | `pf-ec2-flow-log-aggregation-interval` | AWS::EC2::FlowLog | Flow log MaxAggregationInterval accepts only 60 or 600 seconds | ERROR | none |
679
+ | `pf-ec2-flow-log-destination-config` | AWS::EC2::FlowLog | Flow log destination type requires its matching destination property | ERROR | none |
680
+ | `pf-ec2-flow-log-format-fields` | AWS::EC2::FlowLog | Flow log LogFormat accepts only documented field names | ERROR | none |
681
+ | `pf-ec2-flow-log-transit-gateway-traffic-type` | AWS::EC2::FlowLog | A Transit Gateway flow log cannot take TrafficType | ERROR | none |
682
+ | `pf-ec2-host-resource-group-tenancy` | AWS::EC2::Instance | HostResourceGroupArn requires Tenancy host | ERROR | none |
683
+ | `pf-ec2-instance-ami-arch` | AWS::EC2::Instance | Instance type architecture must match the SSM public-parameter AMI architecture | ERROR | none |
684
+ | `pf-ec2-instance-eni-exclusive` | AWS::EC2::Instance | An instance cannot mix NetworkInterfaces with instance-level security groups | ERROR | none |
685
+ | `pf-ec2-instance-ipv6-exclusive` | AWS::EC2::Instance | Ipv6AddressCount and Ipv6Addresses are mutually exclusive | ERROR | none |
686
+ | `pf-ec2-instance-requirements-exclusive` | AWS::EC2::LaunchTemplate | A launch template takes either InstanceType or InstanceRequirements | ERROR | none |
687
+ | `pf-ec2-key-pair-name-whitespace` | AWS::EC2::KeyPair | A key pair name cannot have leading or trailing whitespace | ERROR | none |
688
+ | `pf-ec2-launch-template-name` | AWS::EC2::LaunchTemplate | Launch template names are 3-128 chars of letters, numbers and -()./_ | ERROR | none |
689
+ | `pf-ec2-nacl-rule-number-unique` | AWS::EC2::NetworkAclEntry | Network ACL rule numbers must be unique per direction | ERROR | none |
690
+ | `pf-ec2-natgw-allocation` | AWS::EC2::NatGateway | NAT gateway AllocationId is required for public connectivity and forbidden for private | ERROR | none |
691
+ | `pf-ec2-natgw-secondary-ip-exclusive` | AWS::EC2::NatGateway | NAT gateway secondary IP count and list are mutually exclusive | ERROR | none |
692
+ | `pf-ec2-pg-cluster-burstable` | AWS::EC2::Instance<br>AWS::EC2::PlacementGroup | Burstable instance types are not supported in cluster placement groups | ERROR | none |
693
+ | `pf-ec2-placement-group-partition-count` | AWS::EC2::PlacementGroup | PartitionCount is only valid with the partition strategy | ERROR | none |
694
+ | `pf-ec2-placement-group-spread-level` | AWS::EC2::PlacementGroup | SpreadLevel is only valid with the spread or partition strategy | ERROR | none |
695
+ | `pf-ec2-prefix-list-address-family` | AWS::EC2::PrefixList | Prefix list entries must match the declared address family | ERROR | none |
696
+ | `pf-ec2-prefix-list-max-entries` | AWS::EC2::PrefixList | A managed prefix list cannot hold more entries than MaxEntries | ERROR | none |
697
+ | `pf-ec2-prefix-list-name-reserved` | AWS::EC2::PrefixList | A managed prefix list name cannot use an AWS-reserved prefix | ERROR | none |
698
+ | `pf-ec2-route-target-exactly-one` | AWS::EC2::Route | A route must name exactly one target | ERROR | none |
699
+ | `pf-ec2-sg-cidr-valid` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | Security group rule CidrIp must be a well-formed IPv4 CIDR | ERROR | none |
700
+ | `pf-ec2-sg-group-name` | AWS::EC2::SecurityGroup | Security group names may not start with sg- | ERROR | none |
701
+ | `pf-ec2-sg-group-name-default` | AWS::EC2::SecurityGroup | A security group cannot be named default | ERROR | none |
702
+ | `pf-ec2-sg-icmp-type-code` | AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | ICMP type and code must be within -1 to 255 | ERROR | none |
703
+ | `pf-ec2-sg-port-range` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | Security group TCP/UDP ports must be within 0-65535 and FromPort <= ToPort | ERROR | none |
704
+ | `pf-ec2-sg-rule-description` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | Security group rule descriptions are limited to 255 chars of a restricted ASCII set | ERROR | none |
705
+ | `pf-ec2-sg-source-exclusive` | AWS::EC2::SecurityGroup<br>AWS::EC2::SecurityGroupIngress<br>AWS::EC2::SecurityGroupEgress | A security group rule takes exactly one source/destination field | ERROR | none |
706
+ | `pf-ec2-subnet-cidr-size` | AWS::EC2::Subnet | Subnet IPv4 CIDR netmask must be between /16 and /28 | ERROR | none |
707
+ | `pf-ec2-subnet-dns64-ipv6` | AWS::EC2::Subnet | EnableDns64 requires the subnet to have an IPv6 CIDR | ERROR | none |
708
+ | `pf-ec2-subnet-ipv6-native-cidr` | AWS::EC2::Subnet | An IPv6-only subnet cannot carry IPv4 addressing | ERROR | none |
709
+ | `pf-ec2-tgw-amazon-side-asn` | AWS::EC2::TransitGateway | TransitGateway AmazonSideAsn must be in 64512-65534 or 4200000000-4294967294 | ERROR | none |
710
+ | `pf-ec2-tgw-cidr-block-size` | AWS::EC2::TransitGateway | TransitGatewayCidrBlocks must be /24 or larger for IPv4 | ERROR | none |
711
+ | `pf-ec2-tgw-route-blackhole-exclusive` | AWS::EC2::TransitGatewayRoute | A blackhole transit gateway route cannot name an attachment | ERROR | none |
712
+ | `pf-ec2-traffic-mirror-target-exactly-one` | AWS::EC2::TrafficMirrorTarget | A traffic mirror target names exactly one destination | ERROR | none |
713
+ | `pf-ec2-userdata-size` | AWS::EC2::Instance<br>AWS::EC2::LaunchTemplate | EC2 user data is limited to 16384 bytes | ERROR | none |
714
+ | `pf-ec2-volume-iops` | AWS::EC2::Volume | EBS Iops/Throughput must match the volume type's supported ranges and ratios | ERROR | none |
715
+ | `pf-ec2-volume-iops-required` | AWS::EC2::Volume | io1 and io2 volumes require the Iops property | ERROR | none |
716
+ | `pf-ec2-volume-kms-encrypted` | AWS::EC2::Volume | KmsKeyId on a volume requires Encrypted to be true | ERROR | none |
717
+ | `pf-ec2-volume-multi-attach-type` | AWS::EC2::Volume | Multi-Attach is only available on io1 and io2 volumes | ERROR | none |
718
+ | `pf-ec2-volume-size-minimum` | AWS::EC2::Volume | EBS volume size must meet the volume type minimum (io1/io2 4 GiB, st1/sc1 125 GiB) | ERROR | none |
719
+ | `pf-ec2-volume-throughput-type` | AWS::EC2::Volume | EBS Throughput applies only to gp3 volumes | ERROR | none |
720
+ | `pf-ec2-vpc-cidr-block-overlap` | AWS::EC2::VPCCidrBlock | A secondary VPC CIDR cannot overlap the primary | ERROR | none |
721
+ | `pf-ec2-vpc-cidr-block-size` | AWS::EC2::VPC | VPC IPv4 CIDR block netmask must be between /16 and /28 | ERROR | none |
722
+ | `pf-ec2-vpc-cidr-reserved-range` | AWS::EC2::VPC | A VPC CIDR must not overlap a reserved IPv4 range | ERROR | none |
723
+ | `pf-ec2-vpc-single-igw` | AWS::EC2::VPCGatewayAttachment | A VPC accepts only one internet gateway attachment | ERROR | none |
724
+ | `pf-ec2-vpce-gateway-service` | AWS::EC2::VPCEndpoint | Gateway VPC endpoints only exist for S3 and DynamoDB | ERROR | none |
725
+ | `pf-ec2-vpce-service-region` | AWS::EC2::VPCEndpoint | VPC endpoint service names must use the deploy region unless ServiceRegion is set | ERROR | none |
726
+ | `pf-ec2-vpce-subnet-az-unique` | AWS::EC2::VPCEndpoint | An interface VPC endpoint takes at most one subnet per availability zone | ERROR | none |
727
+ | `pf-ec2-vpce-type-config` | AWS::EC2::VPCEndpoint | SubnetIds are not supported on Gateway endpoints (and RouteTableIds only on Gateway) | ERROR | none |
728
+ | `pf-ec2-vpn-gateway-exclusive` | AWS::EC2::VPNConnection | A VPN connection cannot name both a VPN gateway and a transit gateway | ERROR | none |
729
+ | `pf-ec2-vpn-phase-lifetime-order` | AWS::EC2::VPNConnection | VPN Phase2LifetimeSeconds must be less than Phase1LifetimeSeconds | ERROR | none |
730
+ | `pf-ec2-vpn-pre-shared-key` | AWS::EC2::VPNConnection | VPN tunnel PreSharedKey must be 8-64 characters of [A-Za-z0-9._] and must not start with 0 | ERROR | none |
731
+ | `pf-ec2-vpn-rekey-margin` | AWS::EC2::VPNConnection | VPN RekeyMarginTimeSeconds must be less than half of Phase2LifetimeSeconds | ERROR | none |
732
+ | `pf-ec2-vpn-tunnel-inside-cidr` | AWS::EC2::VPNConnection | VPN TunnelInsideCidr must be a /30 inside 169.254.0.0/16 and not one of the reserved ranges | ERROR | none |
733
+ | `pf-ecr-encryption-configuration` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | KmsKey is only valid with EncryptionType KMS/KMS_DSSE and must live in the deploy region | ERROR | none |
734
+ | `pf-ecr-image-tag-mutability-filters` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | ImageTagMutabilityExclusionFilters requires a *_WITH_EXCLUSION mutability setting, and vice versa | ERROR | none |
735
+ | `pf-ecr-lifecycle-action` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The action type is expire or transition, and transition requires targetStorageClass: archive | ERROR | none |
736
+ | `pf-ecr-lifecycle-count` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | countUnit belongs to the sinceImage* count types only, countNumber must be positive and storageClass follows countType | ERROR | none |
737
+ | `pf-ecr-lifecycle-policy-syntax` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | The lifecycle policy must be a JSON document with 1-50 rules, each holding rulePriority, selection and action and no other keys | ERROR | none |
738
+ | `pf-ecr-lifecycle-rule-priority` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | rulePriority must be unique and >= 1, and the single tagStatus=any rule must carry the highest priority | ERROR | none |
739
+ | `pf-ecr-lifecycle-tag-status` | AWS::ECR::Repository<br>AWS::ECR::RepositoryCreationTemplate | tagStatus=tagged needs exactly one of tagPrefixList / tagPatternList, tagStatus=untagged or any takes neither | ERROR | none |
740
+ | `pf-ecr-pull-through-cache-credential` | AWS::ECR::PullThroughCacheRule | CredentialArn is required for the authenticated upstream registries, rejected for the open ones, and must name a secret in the deploy account and region | ERROR | none |
741
+ | `pf-ecr-pull-through-cache-registry-match` | AWS::ECR::PullThroughCacheRule | UpstreamRegistry must name the registry the URL belongs to | ERROR | none |
742
+ | `pf-ecr-pull-through-cache-url` | AWS::ECR::PullThroughCacheRule | UpstreamRegistryUrl must be one of the supported upstream endpoints and cannot be this registry itself | ERROR | none |
743
+ | `pf-ecr-registry-scanning-configuration` | AWS::ECR::RegistryScanningConfiguration | BASIC scanning supports SCAN_ON_PUSH only, and two rules cannot share a scan frequency | ERROR | none |
744
+ | `pf-ecr-replication-destination` | AWS::ECR::ReplicationConfiguration | A replication destination must be another registry: not the deploy account in the deploy region, and not another partition | ERROR | none |
745
+ | `pf-ecr-repository-creation-template-applied-for` | AWS::ECR::RepositoryCreationTemplate | AppliedFor accepts REPLICATION, PULL_THROUGH_CACHE and CREATE_ON_PUSH only | ERROR | none |
746
+ | `pf-ecr-signing-profile-region` | AWS::ECR::SigningConfiguration | A signing profile ARN must be in the same region as the registry | ERROR | none |
747
+ | `pf-ecs-awsfirelens-without-router` | AWS::ECS::TaskDefinition | The awsfirelens log driver requires a FireLens router container | ERROR | none |
748
+ | `pf-ecs-awslogs-fargate-missing-stream-prefix` | AWS::ECS::TaskDefinition | awslogs on Fargate requires the awslogs-stream-prefix option | ERROR | none |
749
+ | `pf-ecs-awslogs-missing-group` | AWS::ECS::TaskDefinition | The awslogs log driver requires the awslogs-group option | ERROR | none |
750
+ | `pf-ecs-awsvpc-extra-hosts` | AWS::ECS::TaskDefinition | ExtraHosts is not supported with NetworkMode awsvpc | ERROR | none |
751
+ | `pf-ecs-awsvpc-hostname` | AWS::ECS::TaskDefinition | Hostname is not supported with NetworkMode awsvpc | ERROR | none |
752
+ | `pf-ecs-cluster-default-strategy-multiple-base` | AWS::ECS::Cluster | Only one default capacity provider may set Base | ERROR | none |
753
+ | `pf-ecs-cluster-default-strategy-provider-not-listed` | AWS::ECS::Cluster | DefaultCapacityProviderStrategy may only use listed capacity providers | ERROR | none |
754
+ | `pf-ecs-cluster-execute-command-default-with-log-config` | AWS::ECS::Cluster | A LogConfiguration requires ExecuteCommand Logging OVERRIDE | ERROR | none |
755
+ | `pf-ecs-cluster-execute-command-override-without-log-config` | AWS::ECS::Cluster | ExecuteCommand Logging OVERRIDE requires a LogConfiguration | ERROR | none |
756
+ | `pf-ecs-cluster-name` | AWS::ECS::Cluster | ECS cluster names allow only letters, numbers, hyphen and underscore (max 255) | ERROR | none |
757
+ | `pf-ecs-container-definitions-empty` | AWS::ECS::TaskDefinition | ContainerDefinitions must contain at least one container | ERROR | pending-engine |
758
+ | `pf-ecs-container-memory-over-task` | AWS::ECS::TaskDefinition | A container Memory must not exceed the task-level Memory | ERROR | none |
759
+ | `pf-ecs-container-memory-required` | AWS::ECS::TaskDefinition | A container needs Memory or MemoryReservation when the task sets no Memory | ERROR | none |
760
+ | `pf-ecs-container-memory-reservation` | AWS::ECS::TaskDefinition | MemoryReservation must not exceed Memory | ERROR | none |
761
+ | `pf-ecs-cp-managed-termination-scale-in-protection` | AWS::ECS::CapacityProvider | ManagedTerminationProtection requires scale-in protection on the Auto Scaling group | ERROR | none |
762
+ | `pf-ecs-cp-name-reserved-prefix` | AWS::ECS::CapacityProvider | Capacity provider names cannot start with aws, ecs or fargate | ERROR | none |
763
+ | `pf-ecs-cp-scaling-step-order` | AWS::ECS::CapacityProvider | MinimumScalingStepSize must not exceed MaximumScalingStepSize | ERROR | none |
764
+ | `pf-ecs-dependson-complete-on-essential` | AWS::ECS::TaskDefinition | DependsOn COMPLETE / SUCCESS cannot target an essential container | ERROR | none |
765
+ | `pf-ecs-dependson-container-missing` | AWS::ECS::TaskDefinition | DependsOn.ContainerName must name a container in the same task | ERROR | none |
766
+ | `pf-ecs-dependson-healthy-without-healthcheck` | AWS::ECS::TaskDefinition | DependsOn Condition HEALTHY needs a HealthCheck on the target container | ERROR | none |
767
+ | `pf-ecs-duplicate-container-names` | AWS::ECS::TaskDefinition | Container names must be unique within a task definition | ERROR | none |
768
+ | `pf-ecs-efs-access-point-with-root-directory` | AWS::ECS::TaskDefinition | An EFS access point requires RootDirectory to be "/" or omitted | ERROR | none |
769
+ | `pf-ecs-efs-iam-without-transit-encryption` | AWS::ECS::TaskDefinition | EFS IAM authorization requires TransitEncryption ENABLED | ERROR | none |
770
+ | `pf-ecs-efs-transit-encryption-port-without-encryption` | AWS::ECS::TaskDefinition | TransitEncryptionPort requires TransitEncryption ENABLED | ERROR | none |
771
+ | `pf-ecs-environment-files-max` | AWS::ECS::TaskDefinition | A container can load at most 10 environment files | ERROR | none |
772
+ | `pf-ecs-environment-files-type` | AWS::ECS::TaskDefinition | EnvironmentFiles.Value must be an S3 object ARN | ERROR | none |
773
+ | `pf-ecs-ephemeral-storage-range` | AWS::ECS::TaskDefinition | EphemeralStorage SizeInGiB must be 21-200 | ERROR | pending-engine |
774
+ | `pf-ecs-essential-container` | AWS::ECS::TaskDefinition | At least one container must be essential | ERROR | none |
775
+ | `pf-ecs-fargate-capabilities-add` | AWS::ECS::TaskDefinition | Fargate only allows SYS_PTRACE in LinuxParameters.Capabilities.Add | ERROR | none |
776
+ | `pf-ecs-fargate-container-cpu-over-task` | AWS::ECS::TaskDefinition | Container Cpu values must not exceed the task-level Cpu | ERROR | none |
777
+ | `pf-ecs-fargate-devices` | AWS::ECS::TaskDefinition | LinuxParameters.Devices is not supported on Fargate | ERROR | none |
778
+ | `pf-ecs-fargate-disable-networking` | AWS::ECS::TaskDefinition | DisableNetworking is not supported with NetworkMode awsvpc | ERROR | none |
779
+ | `pf-ecs-fargate-dns-servers` | AWS::ECS::TaskDefinition | DnsServers is not supported with NetworkMode awsvpc | ERROR | none |
780
+ | `pf-ecs-fargate-docker-security-options` | AWS::ECS::TaskDefinition | DockerSecurityOptions is not supported on Fargate | ERROR | none |
781
+ | `pf-ecs-fargate-docker-volume` | AWS::ECS::TaskDefinition | DockerVolumeConfiguration is not supported on Fargate | ERROR | none |
782
+ | `pf-ecs-fargate-ephemeral-storage-ec2` | AWS::ECS::TaskDefinition | EphemeralStorage is only supported on Fargate | ERROR | none |
783
+ | `pf-ecs-fargate-execution-role-missing-awslogs` | AWS::ECS::TaskDefinition | awslogs on Fargate requires an ExecutionRoleArn | ERROR | none |
784
+ | `pf-ecs-fargate-gpu-resource` | AWS::ECS::TaskDefinition | GPU resource requirements are not supported on Fargate | ERROR | none |
785
+ | `pf-ecs-fargate-host-source-path` | AWS::ECS::TaskDefinition | Volumes[].Host.SourcePath is not supported on Fargate | ERROR | none |
786
+ | `pf-ecs-fargate-inference-accelerator` | AWS::ECS::TaskDefinition | InferenceAccelerators is retired and always rejected | ERROR | none |
787
+ | `pf-ecs-fargate-ipc-mode` | AWS::ECS::TaskDefinition | IpcMode is not supported on Fargate | ERROR | none |
788
+ | `pf-ecs-fargate-links` | AWS::ECS::TaskDefinition | Links is not supported with NetworkMode awsvpc | ERROR | none |
789
+ | `pf-ecs-fargate-log-driver-unsupported` | AWS::ECS::TaskDefinition | Fargate supports only a subset of log drivers | ERROR | none |
790
+ | `pf-ecs-fargate-max-swap` | AWS::ECS::TaskDefinition | LinuxParameters.MaxSwap is not supported on Fargate | ERROR | none |
791
+ | `pf-ecs-fargate-network-mode` | AWS::ECS::TaskDefinition | Fargate task definitions require NetworkMode 'awsvpc' | ERROR | none |
792
+ | `pf-ecs-fargate-pid-mode-host` | AWS::ECS::TaskDefinition | PidMode host is not supported on Fargate | ERROR | none |
793
+ | `pf-ecs-fargate-placement-constraints` | AWS::ECS::TaskDefinition | Task placement constraints are not supported on Fargate | ERROR | none |
794
+ | `pf-ecs-fargate-privileged` | AWS::ECS::TaskDefinition | Privileged is not supported on Fargate | ERROR | none |
795
+ | `pf-ecs-fargate-shared-memory-size` | AWS::ECS::TaskDefinition | LinuxParameters.SharedMemorySize is not supported on Fargate | ERROR | none |
796
+ | `pf-ecs-fargate-task-cpu-memory` | AWS::ECS::TaskDefinition | FARGATE compatibility requires task-level Cpu and Memory | ERROR | none |
797
+ | `pf-ecs-fargate-windows-cpu-under-1vcpu` | AWS::ECS::TaskDefinition | Windows tasks on Fargate need at least 1 vCPU | ERROR | none |
798
+ | `pf-ecs-healthcheck-interval-range` | AWS::ECS::TaskDefinition | HealthCheck.Interval must be 5-300 seconds | ERROR | none |
799
+ | `pf-ecs-healthcheck-retries-range` | AWS::ECS::TaskDefinition | HealthCheck.Retries must be 1-10 | ERROR | none |
800
+ | `pf-ecs-healthcheck-start-period-range` | AWS::ECS::TaskDefinition | HealthCheck.StartPeriod must be 0-300 seconds | ERROR | none |
801
+ | `pf-ecs-healthcheck-timeout-range` | AWS::ECS::TaskDefinition | HealthCheck.Timeout must be 2-60 seconds | ERROR | none |
802
+ | `pf-ecs-host-network-host-port-mismatch` | AWS::ECS::TaskDefinition | NetworkMode host requires HostPort to equal ContainerPort | ERROR | none |
803
+ | `pf-ecs-mountpoint-source-volume-missing` | AWS::ECS::TaskDefinition | MountPoints.SourceVolume must name a volume of the task definition | ERROR | none |
804
+ | `pf-ecs-port-mapping-duplicate-name` | AWS::ECS::TaskDefinition | PortMappings.Name must be unique within a task definition | ERROR | none |
805
+ | `pf-ecs-port-range-overlap` | AWS::ECS::TaskDefinition | ContainerPortRange values must not overlap | ERROR | none |
806
+ | `pf-ecs-port-range-reversed` | AWS::ECS::TaskDefinition | The first port of ContainerPortRange must be below the last | ERROR | none |
807
+ | `pf-ecs-port-range-with-host-port` | AWS::ECS::TaskDefinition | ContainerPortRange cannot be combined with a single port | ERROR | none |
808
+ | `pf-ecs-proxy-configuration-awsvpc-required` | AWS::ECS::TaskDefinition | ProxyConfiguration requires NetworkMode awsvpc | ERROR | none |
809
+ | `pf-ecs-proxy-configuration-container-missing` | AWS::ECS::TaskDefinition | ProxyConfiguration.ContainerName must name a container of the task definition | ERROR | none |
810
+ | `pf-ecs-proxy-configuration-missing-required-props` | AWS::ECS::TaskDefinition | An APPMESH ProxyConfiguration needs the four port properties | ERROR | none |
811
+ | `pf-ecs-restart-policy-attempt-period-range` | AWS::ECS::TaskDefinition | RestartPolicy.RestartAttemptPeriod must be 60-1800 seconds | ERROR | none |
812
+ | `pf-ecs-secrets-without-execution-role` | AWS::ECS::TaskDefinition | Container Secrets require an ExecutionRoleArn | ERROR | none |
813
+ | `pf-ecs-service-codedeploy-lb` | AWS::ECS::Service | CODE_DEPLOY deployment controller requires a load balancer | ERROR | none |
814
+ | `pf-ecs-service-daemon-desired-count` | AWS::ECS::Service | DAEMON scheduling strategy does not accept DesiredCount | ERROR | none |
815
+ | `pf-ecs-service-deployment-percent` | AWS::ECS::Service | DeploymentConfiguration percent bounds (min <= 100, max >= 100) | ERROR | none |
816
+ | `pf-ecs-service-fargate-placement` | AWS::ECS::Service | Placement constraints and strategies are not supported on FARGATE | ERROR | none |
817
+ | `pf-ecs-service-launch-type-capacity-provider` | AWS::ECS::Service | LaunchType and CapacityProviderStrategy are mutually exclusive | ERROR | none |
818
+ | `pf-ecs-service-lb-target-exclusive` | AWS::ECS::Service | A load balancer entry takes either TargetGroupArn or LoadBalancerName, not both | ERROR | none |
819
+ | `pf-ecs-service-name` | AWS::ECS::Service | ECS service names allow only letters, numbers, hyphen and underscore (max 255) | ERROR | none |
820
+ | `pf-ecs-service-network-config-mode` | AWS::ECS::Service<br>AWS::ECS::TaskDefinition | NetworkConfiguration requires an awsvpc task definition | ERROR | none |
821
+ | `pf-ecs-service-platform-version-ec2` | AWS::ECS::Service | PlatformVersion is not allowed with the EC2 launch type | ERROR | none |
822
+ | `pf-ecs-svc-az-rebalancing-with-daemon` | AWS::ECS::Service | AvailabilityZoneRebalancing is not supported for DAEMON services | ERROR | none |
823
+ | `pf-ecs-svc-binpack-field` | AWS::ECS::Service | A binpack placement strategy accepts only cpu or memory | ERROR | none |
824
+ | `pf-ecs-svc-capacity-provider-multiple-base` | AWS::ECS::Service | Only one capacity provider in a strategy may set Base | ERROR | none |
825
+ | `pf-ecs-svc-capacity-provider-zero-weight` | AWS::ECS::Service | A capacity provider strategy needs at least one non-zero Weight | ERROR | none |
826
+ | `pf-ecs-svc-circuit-breaker-with-code-deploy` | AWS::ECS::Service | DeploymentCircuitBreaker only works with the ECS deployment controller | ERROR | none |
827
+ | `pf-ecs-svc-classic-lb-with-fargate` | AWS::ECS::Service | Classic Load Balancers are not supported with Fargate | ERROR | none |
828
+ | `pf-ecs-svc-connect-client-alias-dns-name` | AWS::ECS::Service | A Service Connect ClientAlias.DnsName must be a valid DNS name | ERROR | none |
829
+ | `pf-ecs-svc-connect-client-aliases-max` | AWS::ECS::Service | A Service Connect service accepts at most one ClientAlias | ERROR | none |
830
+ | `pf-ecs-svc-connect-port-name-missing` | AWS::ECS::Service | Service Connect PortName must match a named port mapping | ERROR | none |
831
+ | `pf-ecs-svc-connect-without-namespace` | AWS::ECS::Service | Service Connect needs a Namespace on the service or the cluster | ERROR | none |
832
+ | `pf-ecs-svc-daemon-max-percent` | AWS::ECS::Service | A DAEMON service requires DeploymentConfiguration.MaximumPercent 100 | ERROR | none |
833
+ | `pf-ecs-svc-daemon-with-placement-strategies` | AWS::ECS::Service | A DAEMON service does not accept placement strategies | ERROR | none |
834
+ | `pf-ecs-svc-ebs-iops-unsupported-type` | AWS::ECS::Service | ManagedEBSVolume Iops is only valid for io1, io2 and gp3 | ERROR | none |
835
+ | `pf-ecs-svc-ebs-name-not-in-taskdef` | AWS::ECS::Service | VolumeConfigurations.Name must match a ConfiguredAtLaunch volume | ERROR | none |
836
+ | `pf-ecs-svc-ebs-throughput-non-gp3` | AWS::ECS::Service | ManagedEBSVolume Throughput is only valid for gp3 | ERROR | none |
837
+ | `pf-ecs-svc-ebs-volume-without-size-or-snapshot` | AWS::ECS::Service | A managed EBS volume needs SizeInGiB or SnapshotId | ERROR | none |
838
+ | `pf-ecs-svc-external-with-load-balancers` | AWS::ECS::Service | An EXTERNAL deployment controller does not accept LoadBalancers | ERROR | none |
839
+ | `pf-ecs-svc-external-with-taskdef` | AWS::ECS::Service | An EXTERNAL deployment controller does not accept TaskDefinition | ERROR | none |
840
+ | `pf-ecs-svc-lb-container-name-missing` | AWS::ECS::Service | LoadBalancers.ContainerName must name a container of the task definition | ERROR | none |
841
+ | `pf-ecs-svc-lb-container-port-missing` | AWS::ECS::Service | LoadBalancers.ContainerPort must match a port mapping of the container | ERROR | none |
842
+ | `pf-ecs-svc-min-healthy-over-max-percent` | AWS::ECS::Service | MinimumHealthyPercent must stay below MaximumPercent | ERROR | none |
843
+ | `pf-ecs-svc-placement-constraint-distinct-instance-expression` | AWS::ECS::Service | distinctInstance placement constraints take no Expression | ERROR | none |
844
+ | `pf-ecs-svc-placement-strategies-max6` | AWS::ECS::Service | A service accepts at most 5 placement strategies | ERROR | none |
845
+ | `pf-ecs-svc-random-with-field` | AWS::ECS::Service | A random placement strategy takes no Field | ERROR | none |
846
+ | `pf-ecs-svc-registries-multiple` | AWS::ECS::Service | A service accepts at most one service registry | ERROR | none |
847
+ | `pf-ecs-svc-registries-port-with-awsvpc` | AWS::ECS::Service | awsvpc services address a registry by Port, not ContainerName/ContainerPort | ERROR | none |
848
+ | `pf-ecs-svc-role-with-awsvpc` | AWS::ECS::Service | awsvpc services must use the service-linked role, not Role | ERROR | none |
849
+ | `pf-ecs-svc-role-without-load-balancers` | AWS::ECS::Service | Service Role is only valid together with LoadBalancers | ERROR | none |
850
+ | `pf-ecs-taskdef-family` | AWS::ECS::TaskDefinition | Task definition Family allows only letters, numbers, hyphen and underscore | ERROR | none |
851
+ | `pf-ecs-taskset-lb-container-missing` | AWS::ECS::TaskSet | TaskSet LoadBalancers.ContainerName must name a container of the task definition | ERROR | none |
852
+ | `pf-ecs-taskset-platform-version-ec2` | AWS::ECS::TaskSet | TaskSet PlatformVersion is not allowed with the EC2 launch type | ERROR | none |
853
+ | `pf-ecs-ulimit-soft-over-hard` | AWS::ECS::TaskDefinition | A Ulimit SoftLimit must not exceed its HardLimit | ERROR | none |
854
+ | `pf-ecs-volume-not-referenced` | AWS::ECS::TaskDefinition | Every task definition volume must be mounted by a container | ERROR | none |
855
+ | `pf-ecs-volumesfrom-source-container-missing` | AWS::ECS::TaskDefinition | VolumesFrom.SourceContainer must name a container of the task definition | ERROR | none |
856
+ | `pf-ecs-windows-arm64` | AWS::ECS::TaskDefinition | CpuArchitecture ARM64 is not available for Windows | ERROR | none |
857
+ | `pf-efs-availability-zone-region` | AWS::EFS::FileSystem | AvailabilityZoneName must name an Availability Zone of the deploy region | ERROR | none |
858
+ | `pf-efs-file-system-policy` | AWS::EFS::FileSystem | A file system policy may only name its own file system and must not lock out PutFileSystemPolicy | ERROR | none |
859
+ | `pf-efs-file-system-reference-region` | AWS::EFS::MountTarget<br>AWS::EFS::AccessPoint | A file system ARN passed as FileSystemId must be in the deploy region | ERROR | none |
860
+ | `pf-efs-kms-key` | AWS::EFS::FileSystem | KmsKeyId requires Encrypted: true and a key in the deploy region | ERROR | none |
861
+ | `pf-efs-lifecycle-policy` | AWS::EFS::FileSystem | Each LifecyclePolicy object carries exactly one transition, transitions cannot repeat, Archive must be later than IA and needs elastic or provisioned throughput | ERROR | none |
862
+ | `pf-efs-mount-target-availability-zone` | AWS::EFS::MountTarget | A file system takes one mount target per Availability Zone, and a One Zone file system only in its own zone | ERROR | none |
863
+ | `pf-efs-mount-target-ip-address` | AWS::EFS::MountTarget | IpAddress must fall inside the subnet CIDR and match IpAddressType, and IPv6 needs an IPv6 subnet | ERROR | none |
864
+ | `pf-efs-mount-target-network` | AWS::EFS::MountTarget | A mount target takes at most five security groups, all in the subnet VPC, and every mount target of a file system shares one VPC | ERROR | none |
865
+ | `pf-efs-performance-mode` | AWS::EFS::FileSystem | PerformanceMode maxIO works with neither One Zone storage nor elastic throughput | ERROR | none |
866
+ | `pf-efs-replication-destination` | AWS::EFS::FileSystem | A replication destination pairs Region with an Availability Zone and a KMS key of that same region | ERROR | none |
867
+ | `pf-efs-throughput-mode` | AWS::EFS::FileSystem | ProvisionedThroughputInMibps belongs to ThroughputMode: provisioned and nothing else | ERROR | none |
868
+ | `pf-elasticache-auth-token` | AWS::ElastiCache::ReplicationGroup | AuthToken needs in-transit encryption and must be 16-128 printable characters without slash, quotes or at-sign | ERROR | none |
869
+ | `pf-elasticache-cache-cluster-nodes` | AWS::ElastiCache::CacheCluster | A Redis cluster holds one node and cross-az needs at least two | ERROR | none |
870
+ | `pf-elasticache-cluster-mode-parameter-group` | AWS::ElastiCache::ReplicationGroup | More than one node group needs a parameter group with cluster-enabled set to yes | ERROR | none |
871
+ | `pf-elasticache-data-tiering-node-type` | AWS::ElastiCache::ReplicationGroup | DataTieringEnabled only works on r6gd node types | ERROR | none |
872
+ | `pf-elasticache-engine` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | Replication groups do not run Memcached and cache clusters do not run Valkey | ERROR | none |
873
+ | `pf-elasticache-identifier` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | A replication group or cluster name starts with a letter and holds no consecutive or trailing hyphens | ERROR | none |
874
+ | `pf-elasticache-kms-key` | AWS::ElastiCache::ReplicationGroup | KmsKeyId needs AtRestEncryptionEnabled and a key in the deploy region | ERROR | none |
875
+ | `pf-elasticache-maintenance-window` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | PreferredMaintenanceWindow must be ddd:hh24:mi-ddd:hh24:mi and span at least 60 minutes | ERROR | none |
876
+ | `pf-elasticache-port` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | Port must be in 1150-8004 or 8006-65535 | ERROR | none |
877
+ | `pf-elasticache-preferred-availability-zones` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | The preferred Availability Zone list must have exactly one entry per node | ERROR | none |
878
+ | `pf-elasticache-replication-group-clusters` | AWS::ElastiCache::ReplicationGroup | Automatic failover needs at least two cache clusters (CloudFormation turns it on by default), and NumCacheClusters cannot be combined with NumNodeGroups | ERROR | none |
879
+ | `pf-elasticache-snapshot-retention` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | SnapshotRetentionLimit is 0-35 days and Memcached does not support snapshots at all | ERROR | none |
880
+ | `pf-elasticache-snapshot-source-engine` | AWS::ElastiCache::CacheCluster | SnapshotArns and SnapshotName only restore Redis clusters | ERROR | none |
881
+ | `pf-elasticache-snapshot-window` | AWS::ElastiCache::ReplicationGroup<br>AWS::ElastiCache::CacheCluster | SnapshotWindow must be hh24:mi-hh24:mi and must not overlap the maintenance window | ERROR | none |
882
+ | `pf-elasticache-snapshotting-cluster` | AWS::ElastiCache::ReplicationGroup | SnapshottingClusterId cannot be set on a cluster mode enabled replication group | ERROR | none |
883
+ | `pf-elasticache-user-access-string` | AWS::ElastiCache::User | The access string uses Redis ACL rules; password rules and reset are rejected and categories must exist | ERROR | none |
884
+ | `pf-elasticache-user-authentication` | AWS::ElastiCache::User | A user needs exactly one authentication mode, and passwords are 16-128 characters with at most two per user | ERROR | none |
885
+ | `pf-elasticache-user-group-default-user` | AWS::ElastiCache::UserGroup | A Redis user group must contain a user named default, and a Valkey group rejects password-less users | ERROR | none |
886
+ | `pf-elasticache-user-group-transit-encryption` | AWS::ElastiCache::ReplicationGroup | UserGroupIds requires in-transit encryption | ERROR | none |
887
+ | `pf-elbv2-action-cognito-userpool-region` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | The Cognito user pool sits in the load balancer region | ERROR | none |
888
+ | `pf-elbv2-action-fixed-response-content-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A fixed response uses one of the five supported content types | ERROR | none |
889
+ | `pf-elbv2-action-forward-same-ip-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target groups in one forward action share a IP address type | ERROR | none |
890
+ | `pf-elbv2-action-forward-same-protocol` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target groups in one forward action share a protocol | ERROR | none |
891
+ | `pf-elbv2-action-forward-stickiness-duration-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Target group stickiness lasts between 1 and 604800 seconds | ERROR | none |
892
+ | `pf-elbv2-action-forward-stickiness-duration-required` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Enabled target group stickiness carries a duration | ERROR | none |
893
+ | `pf-elbv2-action-forward-stickiness-tls` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A TLS listener cannot turn on target group stickiness | ERROR | none |
894
+ | `pf-elbv2-action-forward-tg-count-max` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A forward action spreads over at most five target groups | ERROR | none |
895
+ | `pf-elbv2-action-forward-tgarn-conflict` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | TargetGroupArn and ForwardConfig name the same single target group | ERROR | none |
896
+ | `pf-elbv2-action-forward-weight-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A target group weight is between 0 and 999 | ERROR | none |
897
+ | `pf-elbv2-action-forward-weight-required-multi` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Every target group of a multi-target forward action has a weight | ERROR | none |
898
+ | `pf-elbv2-action-oidc-endpoint-https` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | Every OIDC endpoint is a full HTTPS URL | ERROR | none |
899
+ | `pf-elbv2-action-oidc-extra-params-max` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An authentication action carries at most ten extra parameters | ERROR | none |
900
+ | `pf-elbv2-action-oidc-on-unauthenticated-values` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | OnUnauthenticatedRequest is deny, allow or authenticate | ERROR | none |
901
+ | `pf-elbv2-action-redirect-https-to-http` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An HTTPS listener does not redirect down to HTTP | ERROR | none |
902
+ | `pf-elbv2-action-redirect-no-change` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect changes at least one part of the URI | ERROR | none |
903
+ | `pf-elbv2-action-redirect-path-leading-slash` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect path is absolute | ERROR | none |
904
+ | `pf-elbv2-action-redirect-port-value` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect port is a port number or #{port} | ERROR | none |
905
+ | `pf-elbv2-action-redirect-status-code` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | A redirect answers with HTTP_301 or HTTP_302 | ERROR | none |
906
+ | `pf-elbv2-action-session-timeout-range` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An authentication session lasts between 1 and 604800 seconds | ERROR | none |
907
+ | `pf-elbv2-alb-subnet-count` | AWS::ElasticLoadBalancingV2::LoadBalancer | Application load balancers need at least two subnets | ERROR | none |
908
+ | `pf-elbv2-app-cookie-name` | AWS::ElasticLoadBalancingV2::TargetGroup | app_cookie stickiness requires a cookie name | ERROR | none |
909
+ | `pf-elbv2-hc-timeout-interval` | AWS::ElasticLoadBalancingV2::TargetGroup | Health check timeout must be strictly smaller than the interval | ERROR | none |
910
+ | `pf-elbv2-lambda-target-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | Lambda target groups cannot specify Protocol | ERROR | none |
911
+ | `pf-elbv2-lb-attr-access-logs-bucket-required` | AWS::ElasticLoadBalancingV2::LoadBalancer | Enabling access logs needs the destination bucket | ERROR | none |
912
+ | `pf-elbv2-lb-attr-alb-cross-zone-immutable` | AWS::ElasticLoadBalancingV2::LoadBalancer | Cross-zone load balancing cannot be turned off on an application load balancer | ERROR | none |
913
+ | `pf-elbv2-lb-attr-alb-only-on-gwlb` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer takes only the two common attributes | ERROR | none |
914
+ | `pf-elbv2-lb-attr-boolean-value` | AWS::ElasticLoadBalancingV2::LoadBalancer | A boolean load balancer attribute takes only true or false | ERROR | none |
915
+ | `pf-elbv2-lb-attr-client-keep-alive-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | The client keep-alive duration is 60-604800 seconds | ERROR | none |
916
+ | `pf-elbv2-lb-attr-connection-logs-bucket-required` | AWS::ElasticLoadBalancingV2::LoadBalancer | Enabling connection logs needs the destination bucket | ERROR | none |
917
+ | `pf-elbv2-lb-attr-count-max` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer carries at most 20 attributes | ERROR | none |
918
+ | `pf-elbv2-lb-attr-desync-mitigation-mode` | AWS::ElasticLoadBalancingV2::LoadBalancer | Desync mitigation mode is monitor, defensive or strictest | ERROR | none |
919
+ | `pf-elbv2-lb-attr-dns-record-client-routing-policy` | AWS::ElasticLoadBalancingV2::LoadBalancer | The DNS client routing policy is one of three zonal affinity values | ERROR | none |
920
+ | `pf-elbv2-lb-attr-duplicate-key` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key appears at most once | ERROR | none |
921
+ | `pf-elbv2-lb-attr-key-known` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key must be one the service recognises | ERROR | none |
922
+ | `pf-elbv2-lb-attr-key-lb-type` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer attribute key is bound to the load balancer type | ERROR | none |
923
+ | `pf-elbv2-lb-attr-secondary-ips-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | Auto-assigned secondary IPs per subnet are 0-7 | ERROR | none |
924
+ | `pf-elbv2-lb-attr-xff-header-processing-mode` | AWS::ElasticLoadBalancingV2::LoadBalancer | X-Forwarded-For processing is append, preserve or remove | ERROR | none |
925
+ | `pf-elbv2-lb-dualstack-no-public-ipv4-alb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | dualstack-without-public-ipv4 is an application load balancer address type | ERROR | none |
926
+ | `pf-elbv2-lb-eip-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | Only a network load balancer takes Elastic IPs | ERROR | none |
927
+ | `pf-elbv2-lb-eip-with-private-ipv4` | AWS::ElasticLoadBalancingV2::LoadBalancer | One subnet mapping cannot carry both an Elastic IP and a private IPv4 address | ERROR | none |
928
+ | `pf-elbv2-lb-enforce-sg-privatelink-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | PrivateLink inbound-rule enforcement is a network load balancer setting | ERROR | none |
929
+ | `pf-elbv2-lb-enforce-sg-privatelink-requires-sg` | AWS::ElasticLoadBalancingV2::LoadBalancer | PrivateLink inbound-rule enforcement needs security groups on the load balancer | ERROR | none |
930
+ | `pf-elbv2-lb-gwlb-no-scheme` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer cannot declare a Scheme | ERROR | none |
931
+ | `pf-elbv2-lb-gwlb-no-security-groups` | AWS::ElasticLoadBalancingV2::LoadBalancer | A gateway load balancer cannot carry security groups | ERROR | none |
932
+ | `pf-elbv2-lb-idle-timeout-range` | AWS::ElasticLoadBalancingV2::LoadBalancer | ALB idle_timeout.timeout_seconds must be between 1 and 4000 | ERROR | none |
933
+ | `pf-elbv2-lb-ipv6-address-internet-facing-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | A mapped IPv6 address needs an internet-facing load balancer | ERROR | none |
934
+ | `pf-elbv2-lb-mtls-verify-listener-max` | AWS::ElasticLoadBalancingV2::LoadBalancer<br>AWS::ElasticLoadBalancingV2::Listener | A load balancer runs at most two mTLS verify listeners | ERROR | none |
935
+ | `pf-elbv2-lb-name` | AWS::ElasticLoadBalancingV2::LoadBalancer | Load balancer names are at most 32 alphanumeric/hyphen chars and cannot begin with internal- or a hyphen | ERROR | none |
936
+ | `pf-elbv2-lb-one-subnet-per-az` | AWS::ElasticLoadBalancingV2::LoadBalancer<br>AWS::EC2::Subnet | A load balancer takes at most one subnet per availability zone | ERROR | none |
937
+ | `pf-elbv2-lb-private-ipv4-internal-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | A private IPv4 address needs an internal network load balancer | ERROR | none |
938
+ | `pf-elbv2-lb-sg-vpc-match` | AWS::ElasticLoadBalancingV2::LoadBalancer | A load balancer security group lives in the VPC of its subnets | ERROR | none |
939
+ | `pf-elbv2-lb-source-nat-prefix-netmask` | AWS::ElasticLoadBalancingV2::LoadBalancer | A source NAT IPv6 prefix is a /80 or auto_assigned | ERROR | none |
940
+ | `pf-elbv2-lb-source-nat-prefix-nlb-only` | AWS::ElasticLoadBalancingV2::LoadBalancer | IPv6 source NAT prefixes are a network load balancer feature | ERROR | none |
941
+ | `pf-elbv2-lb-source-nat-prefix-requires-dualstack` | AWS::ElasticLoadBalancingV2::LoadBalancer | IPv6 source NAT prefixes need a dualstack load balancer | ERROR | none |
942
+ | `pf-elbv2-listener-action-config-type-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::ListenerRule | An action config must match the action type | ERROR | none |
943
+ | `pf-elbv2-listener-action-order-required` | AWS::ElasticLoadBalancingV2::Listener | Several actions on one listener need an explicit order | ERROR | none |
944
+ | `pf-elbv2-listener-alb-target-tg-listener-protocol` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A target group of Application Load Balancers hangs off a TCP listener | ERROR | none |
945
+ | `pf-elbv2-listener-alpn-single` | AWS::ElasticLoadBalancingV2::Listener | A listener carries a single ALPN policy | ERROR | none |
946
+ | `pf-elbv2-listener-alpn-tls-only` | AWS::ElasticLoadBalancingV2::Listener | ALPN is negotiated on a TLS listener only | ERROR | none |
947
+ | `pf-elbv2-listener-alpn-values` | AWS::ElasticLoadBalancingV2::Listener | An ALPN policy is one of five named values | ERROR | none |
948
+ | `pf-elbv2-listener-attr-header-name-format` | AWS::ElasticLoadBalancingV2::Listener | A renamed request header is a valid HTTP header name | ERROR | none |
949
+ | `pf-elbv2-listener-attr-key-known` | AWS::ElasticLoadBalancingV2::Listener | A listener attribute key is one the service knows | ERROR | none |
950
+ | `pf-elbv2-listener-attr-key-lb-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A listener attribute belongs to the load balancer type it is set on | ERROR | none |
951
+ | `pf-elbv2-listener-attr-server-enabled-value` | AWS::ElasticLoadBalancingV2::Listener | The response server header switch is true or false | ERROR | none |
952
+ | `pf-elbv2-listener-attr-tcp-idle-timeout-range` | AWS::ElasticLoadBalancingV2::Listener | The TCP idle timeout runs from 60 to 6000 seconds | ERROR | none |
953
+ | `pf-elbv2-listener-attr-x-content-type-options-value` | AWS::ElasticLoadBalancingV2::Listener | X-Content-Type-Options is nosniff | ERROR | none |
954
+ | `pf-elbv2-listener-attr-x-frame-options-value` | AWS::ElasticLoadBalancingV2::Listener | X-Frame-Options is DENY or SAMEORIGIN | ERROR | none |
955
+ | `pf-elbv2-listener-auth-action-https-only` | AWS::ElasticLoadBalancingV2::Listener | Authentication actions need an HTTPS listener | ERROR | none |
956
+ | `pf-elbv2-listener-cert-exactly-one` | AWS::ElasticLoadBalancingV2::Listener | A listener declares a single default certificate | ERROR | none |
957
+ | `pf-elbv2-listener-cert-insecure-protocol` | AWS::ElasticLoadBalancingV2::Listener | Only an HTTPS or TLS listener takes a certificate | ERROR | none |
958
+ | `pf-elbv2-listener-cert-not-acm-or-iam` | AWS::ElasticLoadBalancingV2::Listener | A listener certificate comes from ACM or IAM | ERROR | none |
959
+ | `pf-elbv2-listener-cert-region` | AWS::ElasticLoadBalancingV2::Listener | A listener certificate lives in the load balancer region | ERROR | none |
960
+ | `pf-elbv2-listener-certificate-region` | AWS::ElasticLoadBalancingV2::ListenerCertificate | An extra certificate lives in the load balancer region | ERROR | none |
961
+ | `pf-elbv2-listener-certificate-secure-listener` | AWS::ElasticLoadBalancingV2::ListenerCertificate<br>AWS::ElasticLoadBalancingV2::Listener | Extra certificates go on an HTTPS or TLS listener | ERROR | none |
962
+ | `pf-elbv2-listener-default-action-routing-last` | AWS::ElasticLoadBalancingV2::Listener | The last default action routes the request | ERROR | none |
963
+ | `pf-elbv2-listener-mtls-advertise-verify-only` | AWS::ElasticLoadBalancingV2::Listener | Advertising trust store CA names only applies to verify mode | ERROR | none |
964
+ | `pf-elbv2-listener-mtls-https-only` | AWS::ElasticLoadBalancingV2::Listener | Mutual authentication is an HTTPS listener feature | ERROR | none |
965
+ | `pf-elbv2-listener-mtls-ignore-expiry-verify-only` | AWS::ElasticLoadBalancingV2::Listener | Ignoring certificate expiry only applies to verify mode | ERROR | none |
966
+ | `pf-elbv2-listener-mtls-mode-values` | AWS::ElasticLoadBalancingV2::Listener | The mutual authentication mode is off, passthrough or verify | ERROR | none |
967
+ | `pf-elbv2-listener-mtls-truststore-region` | AWS::ElasticLoadBalancingV2::Listener | A trust store lives in the load balancer region | ERROR | none |
968
+ | `pf-elbv2-listener-mtls-truststore-required` | AWS::ElasticLoadBalancingV2::Listener | Verify mode needs a trust store | ERROR | none |
969
+ | `pf-elbv2-listener-mtls-truststore-verify-only` | AWS::ElasticLoadBalancingV2::Listener | A trust store only belongs to verify mode | ERROR | none |
970
+ | `pf-elbv2-listener-nlb-action-forward-only` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A network or gateway load balancer listener only forwards | ERROR | none |
971
+ | `pf-elbv2-listener-port-required` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A listener needs a port unless it is on a gateway load balancer | ERROR | none |
972
+ | `pf-elbv2-listener-protocol-lb-type` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | Listener protocols must match the load balancer type | ERROR | none |
973
+ | `pf-elbv2-listener-sslpolicy-known` | AWS::ElasticLoadBalancingV2::Listener | A security policy name must be one the service predefines | ERROR | none |
974
+ | `pf-elbv2-listener-sslpolicy-secure-only` | AWS::ElasticLoadBalancingV2::Listener | A security policy belongs to an HTTPS or TLS listener | ERROR | none |
975
+ | `pf-elbv2-listener-tg-protocol-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A listener forwards to a target group of a compatible protocol | ERROR | none |
976
+ | `pf-elbv2-listener-tg-vpc-match` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | A target group lives in the VPC of the load balancer | ERROR | none |
977
+ | `pf-elbv2-listener-udp-dualstack` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::LoadBalancer | A dualstack network load balancer takes no UDP listener | ERROR | none |
978
+ | `pf-elbv2-rule-actions-exactly-one-routing` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule ends on exactly one routing action | ERROR | none |
979
+ | `pf-elbv2-rule-condition-duplicate-field` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule uses each single-valued condition field once | ERROR | none |
980
+ | `pf-elbv2-rule-condition-empty-values` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition matches at least one value | ERROR | none |
981
+ | `pf-elbv2-rule-condition-field-config-match` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition carries the config that belongs to its field | ERROR | none |
982
+ | `pf-elbv2-rule-condition-field-values` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition uses one of the six condition fields | ERROR | none |
983
+ | `pf-elbv2-rule-condition-values-max` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule matches at most five condition values | ERROR | none |
984
+ | `pf-elbv2-rule-conditions-required` | AWS::ElasticLoadBalancingV2::ListenerRule | A listener rule has at least one condition | ERROR | none |
985
+ | `pf-elbv2-rule-host-header-format` | AWS::ElasticLoadBalancingV2::ListenerRule | A host-header value is a host name | ERROR | none |
986
+ | `pf-elbv2-rule-http-header-name-length` | AWS::ElasticLoadBalancingV2::ListenerRule | An http-header condition names a header of at most 40 characters | ERROR | none |
987
+ | `pf-elbv2-rule-http-header-not-host` | AWS::ElasticLoadBalancingV2::ListenerRule | The Host header is matched by a host-header condition | ERROR | none |
988
+ | `pf-elbv2-rule-http-method-charset` | AWS::ElasticLoadBalancingV2::ListenerRule | An HTTP method condition is written in upper case | ERROR | none |
989
+ | `pf-elbv2-rule-priority-unique` | AWS::ElasticLoadBalancingV2::ListenerRule | Listener rules on the same listener must have distinct priorities | ERROR | none |
990
+ | `pf-elbv2-rule-regex-and-values-exclusive` | AWS::ElasticLoadBalancingV2::ListenerRule | A rule condition matches either literals or a regex | ERROR | none |
991
+ | `pf-elbv2-rule-regex-values-fields` | AWS::ElasticLoadBalancingV2::ListenerRule | Only three condition fields take a regular expression | ERROR | none |
992
+ | `pf-elbv2-rule-source-ip-cidr` | AWS::ElasticLoadBalancingV2::ListenerRule | A source-ip condition takes CIDR blocks | ERROR | none |
993
+ | `pf-elbv2-rule-value-length-128` | AWS::ElasticLoadBalancingV2::ListenerRule | A condition value is at most 128 characters | ERROR | none |
994
+ | `pf-elbv2-stickiness-type-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | Stickiness type lb_cookie needs an HTTP-protocol target group, source_ip a TCP one | ERROR | none |
995
+ | `pf-elbv2-tcp-health-check-path` | AWS::ElasticLoadBalancingV2::TargetGroup | TCP health checks cannot take a health check path | ERROR | none |
996
+ | `pf-elbv2-tg-alb-single-target` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group of type alb holds a single load balancer | ERROR | none |
997
+ | `pf-elbv2-tg-alb-target-type-protocol` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group of Application Load Balancers speaks TCP | ERROR | none |
998
+ | `pf-elbv2-tg-attr-algorithm-type` | AWS::ElasticLoadBalancingV2::TargetGroup | The load balancing algorithm is one of three named values | ERROR | none |
999
+ | `pf-elbv2-tg-attr-anomaly-mitigation-requires-weighted-random` | AWS::ElasticLoadBalancingV2::TargetGroup | Anomaly mitigation needs the weighted random algorithm | ERROR | none |
1000
+ | `pf-elbv2-tg-attr-anomaly-mitigation-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Anomaly mitigation is on or off | ERROR | none |
1001
+ | `pf-elbv2-tg-attr-app-cookie-duration-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Application cookie stickiness lasts 1-604800 seconds | ERROR | none |
1002
+ | `pf-elbv2-tg-attr-boolean-value` | AWS::ElasticLoadBalancingV2::TargetGroup | A boolean target group attribute takes only true or false | ERROR | none |
1003
+ | `pf-elbv2-tg-attr-cross-zone-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group cross-zone load balancing takes a third value | ERROR | none |
1004
+ | `pf-elbv2-tg-attr-dereg-delay-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group has no deregistration delay | ERROR | none |
1005
+ | `pf-elbv2-tg-attr-dns-failover-threshold-order` | AWS::ElasticLoadBalancingV2::TargetGroup | The DNS failover threshold is at least the unhealthy-state routing threshold | ERROR | none |
1006
+ | `pf-elbv2-tg-attr-draining-interval-requires-termination-off` | AWS::ElasticLoadBalancingV2::TargetGroup | An unhealthy draining interval needs connection termination off | ERROR | none |
1007
+ | `pf-elbv2-tg-attr-duplicate-key` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key appears at most once | ERROR | none |
1008
+ | `pf-elbv2-tg-attr-health-count-value` | AWS::ElasticLoadBalancingV2::TargetGroup | A minimum healthy target count is off or a positive integer | ERROR | none |
1009
+ | `pf-elbv2-tg-attr-health-percentage-range` | AWS::ElasticLoadBalancingV2::TargetGroup | A minimum healthy target percentage is off or 1-100 | ERROR | none |
1010
+ | `pf-elbv2-tg-attr-key-known` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key must be one the service recognises | ERROR | none |
1011
+ | `pf-elbv2-tg-attr-key-protocol-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group attribute key is bound to the target group protocol | ERROR | none |
1012
+ | `pf-elbv2-tg-attr-lambda-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | Multi-value headers are a Lambda target group setting | ERROR | none |
1013
+ | `pf-elbv2-tg-attr-lb-cookie-duration-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Load balancer cookie stickiness lasts 1-604800 seconds | ERROR | none |
1014
+ | `pf-elbv2-tg-attr-preserve-client-ip-udp` | AWS::ElasticLoadBalancingV2::TargetGroup | Client IP preservation cannot be turned off for UDP target groups | ERROR | none |
1015
+ | `pf-elbv2-tg-attr-send-tcp-reset-gwlb-only` | AWS::ElasticLoadBalancingV2::TargetGroup | TCP reset attributes belong to a GENEVE target group | ERROR | none |
1016
+ | `pf-elbv2-tg-attr-slow-start-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | Slow start needs an HTTP target group of instances or IPs | ERROR | none |
1017
+ | `pf-elbv2-tg-attr-stickiness-type-gwlb` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group sticks on the IP tuple | ERROR | none |
1018
+ | `pf-elbv2-tg-attr-target-failover-pair-equal` | AWS::ElasticLoadBalancingV2::TargetGroup | The two target failover attributes must agree | ERROR | none |
1019
+ | `pf-elbv2-tg-attr-target-failover-value` | AWS::ElasticLoadBalancingV2::TargetGroup | Target failover is rebalance or no_rebalance | ERROR | none |
1020
+ | `pf-elbv2-tg-attr-unhealthy-draining-interval-range` | AWS::ElasticLoadBalancingV2::TargetGroup | The unhealthy draining interval is 0-360000 seconds | ERROR | none |
1021
+ | `pf-elbv2-tg-deregistration-delay-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group deregistration_delay.timeout_seconds must be between 0 and 3600 | ERROR | none |
1022
+ | `pf-elbv2-tg-geneve-port` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group listens on port 6081 | ERROR | none |
1023
+ | `pf-elbv2-tg-hc-enabled-required` | AWS::ElasticLoadBalancingV2::TargetGroup | Health checks can only be turned off for a Lambda target group | ERROR | none |
1024
+ | `pf-elbv2-tg-hc-port-format` | AWS::ElasticLoadBalancingV2::TargetGroup | The health check port is traffic-port or a port number | ERROR | none |
1025
+ | `pf-elbv2-tg-hc-protocol-unsupported` | AWS::ElasticLoadBalancingV2::TargetGroup | Health checks run over HTTP, HTTPS or TCP only | ERROR | none |
1026
+ | `pf-elbv2-tg-hc-tcp-for-http-tg` | AWS::ElasticLoadBalancingV2::TargetGroup | An HTTP or HTTPS target group is health checked over HTTP or HTTPS | ERROR | none |
1027
+ | `pf-elbv2-tg-ipv6-with-ipv4-lb` | AWS::ElasticLoadBalancingV2::Listener<br>AWS::ElasticLoadBalancingV2::TargetGroup | An IPv6 target group needs a dualstack load balancer | ERROR | none |
1028
+ | `pf-elbv2-tg-ipv6-with-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group has no IPv6 address type | ERROR | none |
1029
+ | `pf-elbv2-tg-ipv6-with-quic` | AWS::ElasticLoadBalancingV2::TargetGroup | QUIC target groups are IPv4 | ERROR | none |
1030
+ | `pf-elbv2-tg-lambda-no-port` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group cannot declare a Port | ERROR | none |
1031
+ | `pf-elbv2-tg-lambda-no-vpc` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group cannot declare a VpcId | ERROR | none |
1032
+ | `pf-elbv2-tg-lambda-single-target` | AWS::ElasticLoadBalancingV2::TargetGroup | A Lambda target group holds a single function | ERROR | none |
1033
+ | `pf-elbv2-tg-matcher-grpc-range` | AWS::ElasticLoadBalancingV2::TargetGroup | gRPC status codes run from 0 to 99 | ERROR | none |
1034
+ | `pf-elbv2-tg-matcher-grpc-requires-grpc` | AWS::ElasticLoadBalancingV2::TargetGroup | A gRPC matcher needs ProtocolVersion GRPC | ERROR | none |
1035
+ | `pf-elbv2-tg-matcher-range-alb` | AWS::ElasticLoadBalancingV2::TargetGroup | HTTP success codes run from 200 to 499 | ERROR | none |
1036
+ | `pf-elbv2-tg-matcher-range-geneve` | AWS::ElasticLoadBalancingV2::TargetGroup | A GENEVE target group accepts success codes 200 to 399 | ERROR | none |
1037
+ | `pf-elbv2-tg-name` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group names are at most 32 alphanumeric/hyphen chars and cannot start or end with a hyphen | ERROR | none |
1038
+ | `pf-elbv2-tg-protocol-required-non-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A non-Lambda target group needs Protocol and Port | ERROR | none |
1039
+ | `pf-elbv2-tg-protocol-version-http-only` | AWS::ElasticLoadBalancingV2::TargetGroup | ProtocolVersion belongs to an HTTP or HTTPS target group | ERROR | none |
1040
+ | `pf-elbv2-tg-protocol-version-values` | AWS::ElasticLoadBalancingV2::TargetGroup | ProtocolVersion is GRPC, HTTP1 or HTTP2 | ERROR | none |
1041
+ | `pf-elbv2-tg-single-load-balancer` | AWS::ElasticLoadBalancingV2::TargetGroup | A target group belongs to one load balancer | ERROR | none |
1042
+ | `pf-elbv2-tg-slow-start-range` | AWS::ElasticLoadBalancingV2::TargetGroup | Target group slow_start.duration_seconds must be 0 or between 30 and 900 | ERROR | none |
1043
+ | `pf-elbv2-tg-target-control-port-scope` | AWS::ElasticLoadBalancingV2::TargetGroup | TargetControlPort needs an HTTP target group of instances or IPs | ERROR | none |
1044
+ | `pf-elbv2-tg-target-ip-not-public` | AWS::ElasticLoadBalancingV2::TargetGroup | IP targets are private addresses | ERROR | none |
1045
+ | `pf-elbv2-tg-vpc-required-non-lambda` | AWS::ElasticLoadBalancingV2::TargetGroup | A non-Lambda target group needs a VpcId | ERROR | none |
1046
+ | `pf-elbv2-truststore-bundle-key-requires-bucket` | AWS::ElasticLoadBalancingV2::TrustStore | A CA bundle needs both its bucket and its key | ERROR | none |
1047
+ | `pf-elbv2-truststore-revocation-content-required` | AWS::ElasticLoadBalancingV2::TrustStoreRevocation | A trust store revocation carries a revocation list | ERROR | none |
1048
+ | `pf-events-apidestination-endpoint` | AWS::Events::ApiDestination | An API destination needs an HTTPS endpoint and a same-Region connection | ERROR | none |
1049
+ | `pf-events-archive-source` | AWS::Events::Archive | An archive source must be an event bus in the archive's Region | ERROR | none |
1050
+ | `pf-events-bus-dlq-arn-type` | AWS::Events::EventBus | An event bus dead-letter queue must be an SQS queue | ERROR | none |
1051
+ | `pf-events-bus-name` | AWS::Events::EventBus | An event bus name may not be 'default' or contain '/', and a partner bus must match its source | ERROR | none |
1052
+ | `pf-events-connection-auth-parameters` | AWS::Events::Connection | AuthParameters must carry the block that AuthorizationType names, and OAuth endpoints must be HTTPS | ERROR | none |
1053
+ | `pf-events-endpoint-buses` | AWS::Events::Endpoint | A global endpoint needs two same-named buses in two Regions | ERROR | none |
1054
+ | `pf-events-endpoint-replication-role` | AWS::Events::Endpoint | Endpoint replication needs a RoleArn | ERROR | none |
1055
+ | `pf-events-input-path-jsonpath` | AWS::Events::Rule | Input paths must start at $ and avoid quoted bracket notation | ERROR | none |
1056
+ | `pf-events-input-transformer-json-var` | AWS::Events::Rule | <aws.events.event.json> needs a JSON object InputTemplate | ERROR | none |
1057
+ | `pf-events-input-transformer-limits` | AWS::Events::Rule | InputPathsMap is capped at 100 entries and may not use reserved variable names | ERROR | none |
1058
+ | `pf-events-input-transformer-placeholders` | AWS::Events::Rule | InputTemplate placeholders must be declared in InputPathsMap | ERROR | none |
1059
+ | `pf-events-pattern-empty` | AWS::Events::Rule | An empty EventPattern counts as no pattern at all | ERROR | none |
1060
+ | `pf-events-pattern-empty-array` | AWS::Events::Rule<br>AWS::Events::Archive | An event pattern may not hold an empty array | ERROR | none |
1061
+ | `pf-events-pattern-operator` | AWS::Events::Rule<br>AWS::Events::Archive | Event pattern matchers must name a real operator and give it the right shape | ERROR | none |
1062
+ | `pf-events-pattern-or-exclusive` | AWS::Events::Rule<br>AWS::Events::Archive | $or cannot share an object with other keys | ERROR | none |
1063
+ | `pf-events-pattern-scalar-value` | AWS::Events::Rule<br>AWS::Events::Archive | Event pattern values must be arrays or objects, not scalars | ERROR | none |
1064
+ | `pf-events-rule-cron-fields` | AWS::Events::Rule | cron() fields must stay in range and keep | ERROR | none |
1065
+ | `pf-events-rule-name-duplicate` | AWS::Events::Rule | Two rules in one template may not share a name | ERROR | none |
1066
+ | `pf-events-rule-pattern-size` | AWS::Events::Rule | An event pattern may not exceed 2048 bytes | ERROR | none |
1067
+ | `pf-events-rule-schedule-default-bus` | AWS::Events::Rule | A scheduled rule only works on the default event bus | ERROR | none |
1068
+ | `pf-events-target-batch-parameters` | AWS::Events::Rule | Batch array size and retry attempts have service-stated bounds | ERROR | none |
1069
+ | `pf-events-target-dlq` | AWS::Events::Rule | A target dead-letter queue must be a standard SQS queue in the rule's Region | ERROR | none |
1070
+ | `pf-events-target-ecs-parameters` | AWS::Events::Rule | EcsParameters must match the launch type and stay inside its size caps | ERROR | none |
1071
+ | `pf-events-target-ecs-task-definition-region` | AWS::Events::Rule | An ECS target's cluster and task definition must share a Region | ERROR | none |
1072
+ | `pf-events-target-id-duplicate` | AWS::Events::Rule | Target ids must be unique within a rule | ERROR | none |
1073
+ | `pf-events-target-input-exclusive` | AWS::Events::Rule | Input, InputPath and InputTransformer are mutually exclusive | ERROR | none |
1074
+ | `pf-events-target-input-json` | AWS::Events::Rule | Target Input must be valid JSON | ERROR | none |
1075
+ | `pf-events-target-parameters-mismatch` | AWS::Events::Rule | Target parameter blocks must match the target's resource type | ERROR | none |
1076
+ | `pf-events-target-parameters-required` | AWS::Events::Rule | ECS, Batch and FIFO queue targets require their parameter block | ERROR | none |
1077
+ | `pf-events-target-redshift-parameters` | AWS::Events::Rule | RedshiftDataParameters takes one statement form and one credential form | ERROR | none |
1078
+ | `pf-events-target-role-required` | AWS::Events::Rule | Targets other than Lambda, SNS, SQS and CloudWatch Logs require RoleArn | ERROR | none |
1079
+ | `pf-eventschemas-discoverer-source` | AWS::EventSchemas::Discoverer | A discoverer source must be an event bus in the discoverer's Region | ERROR | none |
1080
+ | `pf-eventschemas-registry-name-reserved` | AWS::EventSchemas::Registry | A registry name may not use the reserved aws. prefix | ERROR | none |
1081
+ | `pf-eventschemas-registry-policy` | AWS::EventSchemas::RegistryPolicy | A registry policy must declare a Version | ERROR | none |
1082
+ | `pf-eventschemas-schema-content` | AWS::EventSchemas::Schema | Schema Content must be valid JSON, and valid OpenAPI 3.0 when Type is OpenApi3 | ERROR | none |
1083
+ | `pf-firehose-dfcc-required-configs` | AWS::KinesisFirehose::DeliveryStream | Enabled format conversion needs input, output, and schema configs | ERROR | none |
1084
+ | `pf-firehose-dynamic-partitioning-buffer` | AWS::KinesisFirehose::DeliveryStream | Dynamic partitioning needs a 64 MB buffer floor | ERROR | none |
1085
+ | `pf-firehose-dynamic-partitioning-prefix` | AWS::KinesisFirehose::DeliveryStream | Dynamic partitioning needs partition namespaces in the prefix | ERROR | none |
1086
+ | `pf-firehose-kinesis-source-config` | AWS::KinesisFirehose::DeliveryStream | KinesisStreamAsSource streams need KinesisStreamSourceConfiguration | ERROR | none |
1087
+ | `pf-firehose-one-destination` | AWS::KinesisFirehose::DeliveryStream | A delivery stream takes exactly one destination configuration | ERROR | none |
1088
+ | `pf-firehose-s3-backup-config` | AWS::KinesisFirehose::DeliveryStream | Enabling S3 backup needs S3BackupConfiguration | ERROR | none |
1089
+ | `pf-iam-identity-policy-no-principal` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Identity policies cannot carry a Principal field | ERROR | none |
1090
+ | `pf-iam-inline-policy-size` | AWS::IAM::Policy<br>AWS::IAM::RolePolicy<br>AWS::IAM::UserPolicy<br>AWS::IAM::GroupPolicy | Inline policy documents are limited per identity (role 10240 / group 5120 / user 2048 characters) | ERROR | none |
1091
+ | `pf-iam-instance-profile-single-role` | AWS::IAM::InstanceProfile | An instance profile holds exactly one role | ERROR | none |
1092
+ | `pf-iam-managed-policy-count` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group | Managed policies per identity are capped (hard maximums role 25 / user 20 / group 10) | ERROR | none |
1093
+ | `pf-iam-managed-policy-size` | AWS::IAM::ManagedPolicy | Managed policy documents are limited to 6144 characters (whitespace excluded) | ERROR | none |
1094
+ | `pf-iam-name-format` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group<br>AWS::IAM::ManagedPolicy | IAM entity names allow only alphanumerics and +=,.@-_ | ERROR | none |
1095
+ | `pf-iam-oidc-provider-client-id-count` | AWS::IAM::OIDCProvider | An OIDC provider takes at most 100 client ids | ERROR | none |
1096
+ | `pf-iam-oidc-provider-url-https` | AWS::IAM::OIDCProvider | An OIDC provider URL starts with https:// | ERROR | none |
1097
+ | `pf-iam-path-service-role-reserved` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group<br>AWS::IAM::InstanceProfile<br>AWS::IAM::ManagedPolicy | The /aws-service-role/ path is reserved | ERROR | none |
1098
+ | `pf-iam-permissions-boundary-policy-arn` | AWS::IAM::Role<br>AWS::IAM::User | A permissions boundary is a policy ARN | ERROR | none |
1099
+ | `pf-iam-policy-action-format` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Actions must carry a service prefix | ERROR | none |
1100
+ | `pf-iam-policy-action-required` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Every statement needs an Action or NotAction | ERROR | none |
1101
+ | `pf-iam-policy-action-single-colon` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | An action carries exactly one colon | ERROR | none |
1102
+ | `pf-iam-policy-action-vendor-wildcard` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | The service prefix of an action takes no wildcard | ERROR | none |
1103
+ | `pf-iam-policy-arn-partition` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group | Attached policy ARNs live in the deploy partition | ERROR | none |
1104
+ | `pf-iam-policy-condition-arn-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Arn condition operators need an ARN | ERROR | none |
1105
+ | `pf-iam-policy-condition-binary-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | BinaryEquals takes base64 text | ERROR | none |
1106
+ | `pf-iam-policy-condition-date-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Date condition operators need ISO 8601 or epoch seconds | ERROR | none |
1107
+ | `pf-iam-policy-condition-ip-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | IpAddress condition operators need an IP address or CIDR | ERROR | none |
1108
+ | `pf-iam-policy-condition-null-ifexists` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Null does not take the IfExists suffix | ERROR | none |
1109
+ | `pf-iam-policy-condition-numeric-value` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Numeric condition operators need a numeric value | ERROR | none |
1110
+ | `pf-iam-policy-condition-operator` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Condition operators come from a closed grammar | ERROR | none |
1111
+ | `pf-iam-policy-condition-value-type` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Condition values are strings, not nested objects | ERROR | none |
1112
+ | `pf-iam-policy-duplicate-sid` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Statement IDs must be unique within a policy | ERROR | none |
1113
+ | `pf-iam-policy-effect-case` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Effect is case-sensitive Allow or Deny | ERROR | none |
1114
+ | `pf-iam-policy-effect-required` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Every statement needs an Effect | ERROR | none |
1115
+ | `pf-iam-policy-exclusive-fields` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Action/NotAction and Resource/NotResource are exclusive pairs | ERROR | none |
1116
+ | `pf-iam-policy-resource-arn-segments` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | A resource ARN carries six colon-separated segments | ERROR | none |
1117
+ | `pf-iam-policy-resource-format` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Resources must be ARNs or * | ERROR | none |
1118
+ | `pf-iam-policy-resource-global-service-arn` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | S3, IAM and Route 53 ARNs carry no region | ERROR | none |
1119
+ | `pf-iam-policy-resource-partition` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | Resource ARNs live in the deploy partition | ERROR | none |
1120
+ | `pf-iam-policy-resource-service-wildcard` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | The service segment of a resource ARN takes no wildcard | ERROR | none |
1121
+ | `pf-iam-policy-sid-format` | AWS::IAM::Role<br>AWS::IAM::User<br>AWS::IAM::Group<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Policy statement Sid must be alphanumeric | ERROR | none |
1122
+ | `pf-iam-policy-statement-required` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | A policy document needs a non-empty Statement | ERROR | none |
1123
+ | `pf-iam-policy-statement-resource-required` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Identity policy statements need Resource or NotResource | ERROR | none |
1124
+ | `pf-iam-policy-statement-unknown-field` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | A statement holds only the documented policy elements | ERROR | none |
1125
+ | `pf-iam-policy-unknown-toplevel-field` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy<br>AWS::IAM::User<br>AWS::IAM::Group | A policy document holds only Version, Id and Statement | ERROR | none |
1126
+ | `pf-iam-policy-version` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Policy Version must be 2012-10-17 or 2008-10-17 | ERROR | none |
1127
+ | `pf-iam-slr-service-name-format` | AWS::IAM::ServiceLinkedRole | AWSServiceName is a service principal | ERROR | none |
1128
+ | `pf-iam-trust-policy-action-sts-only` | AWS::IAM::Role | A trust policy allows only the STS AssumeRole family | ERROR | none |
1129
+ | `pf-iam-trust-policy-aws-principal-format` | AWS::IAM::Role | An AWS principal is an account id or an IAM ARN | ERROR | none |
1130
+ | `pf-iam-trust-policy-cognito-condition` | AWS::IAM::Role | A Cognito federated principal needs a Condition block | ERROR | none |
1131
+ | `pf-iam-trust-policy-no-resource` | AWS::IAM::Role | Trust policies cannot carry a Resource field | ERROR | none |
1132
+ | `pf-iam-trust-policy-principal-star-string` | AWS::IAM::Role | A trust policy needs a typed principal, not a bare "*" | ERROR | none |
1133
+ | `pf-iam-trust-policy-service-principal` | AWS::IAM::Role | Service principals live under amazonaws.com | ERROR | none |
1134
+ | `pf-iam-trust-policy-service-wildcard` | AWS::IAM::Role | A service principal cannot be a wildcard | ERROR | none |
1135
+ | `pf-kinesis-consumer-duplicate-name` | AWS::Kinesis::StreamConsumer | Two consumers of one stream cannot share a ConsumerName | ERROR | none |
1136
+ | `pf-kinesis-consumer-stream-region` | AWS::Kinesis::StreamConsumer | A stream consumer must reference a stream in its own region | ERROR | none |
1137
+ | `pf-kinesis-encryption-key-region` | AWS::Kinesis::Stream | The stream encryption key must live in the stream region | ERROR | none |
1138
+ | `pf-kinesis-on-demand-shard-count` | AWS::Kinesis::Stream | An on-demand stream cannot set ShardCount | ERROR | none |
1139
+ | `pf-kinesis-provisioned-shard-count` | AWS::Kinesis::Stream | A provisioned stream must set ShardCount | ERROR | none |
1140
+ | `pf-kinesis-resource-policy-action` | AWS::Kinesis::ResourcePolicy | Resource policy actions must be plain kinesis: actions | ERROR | none |
1141
+ | `pf-kinesis-resource-policy-principal` | AWS::Kinesis::ResourcePolicy | Every policy statement needs a Principal (and no NotPrincipal) | ERROR | none |
1142
+ | `pf-kinesis-resource-policy-region` | AWS::Kinesis::ResourcePolicy | A resource policy must target a stream in its own region | ERROR | none |
1143
+ | `pf-kinesis-resource-policy-resource` | AWS::Kinesis::ResourcePolicy | Every policy statement Resource must equal the ResourceArn | ERROR | none |
1144
+ | `pf-kinesis-shard-level-metrics-all` | AWS::Kinesis::Stream | DesiredShardLevelMetrics cannot mix ALL with named metrics | ERROR | none |
1145
+ | `pf-kinesis-warm-throughput-shard-count` | AWS::Kinesis::Stream | WarmThroughputMiBps cannot be combined with ShardCount or provisioned mode | ERROR | none |
1146
+ | `pf-kinesisanalytics-application-mode-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationMode must match the runtime family | ERROR | none |
1147
+ | `pf-kinesisanalytics-checkpoint-configuration-type` | AWS::KinesisAnalyticsV2::Application | CheckpointConfiguration needs ConfigurationType CUSTOM to carry values | ERROR | none |
1148
+ | `pf-kinesisanalytics-code-content-member` | AWS::KinesisAnalyticsV2::Application | CodeContent must carry exactly the member its type names | ERROR | none |
1149
+ | `pf-kinesisanalytics-code-content-type` | AWS::KinesisAnalyticsV2::Application | CodeContentType must match the runtime family | ERROR | none |
1150
+ | `pf-kinesisanalytics-custom-artifact-source` | AWS::KinesisAnalyticsV2::Application | Every Studio custom artifact needs an S3 location or a Maven reference | ERROR | none |
1151
+ | `pf-kinesisanalytics-encryption-key-type` | AWS::KinesisAnalyticsV2::Application | KeyId presence must match the encryption KeyType | ERROR | none |
1152
+ | `pf-kinesisanalytics-glue-database-region` | AWS::KinesisAnalyticsV2::Application | The Studio Glue catalog database must be in the application region | ERROR | none |
1153
+ | `pf-kinesisanalytics-log-stream-arn` | AWS::KinesisAnalyticsV2::ApplicationCloudWatchLoggingOption | LogStreamARN must name a log stream, not a log group | ERROR | none |
1154
+ | `pf-kinesisanalytics-maven-artifact-type` | AWS::KinesisAnalyticsV2::Application | MavenReference is only valid for DEPENDENCY_JAR artifacts | ERROR | none |
1155
+ | `pf-kinesisanalytics-monitoring-configuration-type` | AWS::KinesisAnalyticsV2::Application | MonitoringConfiguration needs ConfigurationType CUSTOM to carry values | ERROR | none |
1156
+ | `pf-kinesisanalytics-parallelism-configuration-type` | AWS::KinesisAnalyticsV2::Application | ParallelismConfiguration needs ConfigurationType CUSTOM to carry values | ERROR | none |
1157
+ | `pf-kinesisanalytics-parallelism-per-kpu` | AWS::KinesisAnalyticsV2::Application | ParallelismPerKPU cannot exceed 8 | ERROR | none |
1158
+ | `pf-kinesisanalytics-property-group-duplicate` | AWS::KinesisAnalyticsV2::Application | PropertyGroupId must be unique within an application | ERROR | none |
1159
+ | `pf-kinesisanalytics-runtime-deprecated` | AWS::KinesisAnalyticsV2::Application | Deprecated runtime environments can no longer be created | ERROR | none |
1160
+ | `pf-kinesisanalytics-service-role-account` | AWS::KinesisAnalyticsV2::Application | ServiceExecutionRole must belong to the deploying account | ERROR | none |
1161
+ | `pf-kinesisanalytics-snapshot-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationSnapshotConfiguration is not applicable to Studio runtimes | ERROR | none |
1162
+ | `pf-kinesisanalytics-sql-configuration-runtime` | AWS::KinesisAnalyticsV2::Application | SqlApplicationConfiguration belongs to the SQL runtime only | ERROR | none |
1163
+ | `pf-kinesisanalytics-sql-only-resource` | AWS::KinesisAnalyticsV2::ApplicationOutput<br>AWS::KinesisAnalyticsV2::ApplicationReferenceDataSource | Outputs and reference data sources need a SQL application | ERROR | none |
1164
+ | `pf-kinesisanalytics-sql-runtime-unsupported` | AWS::KinesisAnalyticsV2::Application | SQL applications can no longer be created | ERROR | none |
1165
+ | `pf-kinesisanalytics-system-rollback-runtime` | AWS::KinesisAnalyticsV2::Application | ApplicationSystemRollbackConfiguration is not applicable to Studio runtimes | ERROR | none |
1166
+ | `pf-kinesisanalytics-zeppelin-configuration-runtime` | AWS::KinesisAnalyticsV2::Application | ZeppelinApplicationConfiguration belongs to Studio runtimes only | ERROR | none |
1167
+ | `pf-kinesisanalytics-zeppelin-note-json` | AWS::KinesisAnalyticsV2::Application | Studio TextContent must be a Zeppelin note JSON | ERROR | none |
1168
+ | `pf-kms-alias-name` | AWS::KMS::Alias | AliasName must not start with alias/aws/ (reserved for AWS managed keys) and may not contain a colon (the CloudFormation schema allows it, CreateAlias does not) | ERROR | none |
1169
+ | `pf-kms-alias-target` | AWS::KMS::Alias | TargetKeyId must be a key id or key ARN (not an alias) of a key in the same account and region | ERROR | none |
1170
+ | `pf-kms-key-origin` | AWS::KMS::Key | Origin AWS_CLOUDHSM and EXTERNAL_KEY_STORE cannot be created by CloudFormation, and Origin EXTERNAL does not support ML-DSA key specs | ERROR | none |
1171
+ | `pf-kms-key-policy-charset` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | A KeyPolicy may only contain tab, LF, CR and characters U+0020..U+00FF (no Japanese or other non-Latin-1 text, e.g. in a Sid) | ERROR | none |
1172
+ | `pf-kms-key-policy-lockout` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | A KeyPolicy must let a principal of the deploying account call kms:PutKeyPolicy, unless BypassPolicyLockoutSafetyCheck is true | ERROR | none |
1173
+ | `pf-kms-key-policy-statement` | AWS::KMS::Key<br>AWS::KMS::ReplicaKey | Every KeyPolicy statement needs Principal, Action and Resource, the Statement list must not be empty, and AWS principals must be *, an account id or an IAM/STS ARN | ERROR | none |
1174
+ | `pf-kms-key-rotation` | AWS::KMS::Key | EnableKeyRotation is only valid for SYMMETRIC_DEFAULT keys with AWS_KMS key material (not asymmetric, HMAC, or Origin EXTERNAL) | ERROR | none |
1175
+ | `pf-kms-key-spec-region` | AWS::KMS::Key | KeySpec SM2 exists only in China regions | ERROR | none |
1176
+ | `pf-kms-key-spec-usage` | AWS::KMS::Key | KeyUsage must match KeySpec (symmetric: ENCRYPT_DECRYPT, HMAC: GENERATE_VERIFY_MAC, RSA: ENCRYPT_DECRYPT|SIGN_VERIFY, NIST ECC: SIGN_VERIFY|KEY_AGREEMENT, ed25519/secp256k1/ML-DSA: SIGN_VERIFY) and is required for every non-symmetric key | ERROR | none |
1177
+ | `pf-kms-replica-primary-arn` | AWS::KMS::ReplicaKey | ReplicaKey.PrimaryKeyArn must be the ARN of a multi-Region primary key (key/mrk-...) in a different region of the same partition, so a primary key in the same stack can never be replicated by it | ERROR | none |
1178
+ | `pf-lambda-alias-additional-version-distinct` | AWS::Lambda::Alias | A weighted alias must route to a different version | ERROR | none |
1179
+ | `pf-lambda-alias-additional-version-not-latest` | AWS::Lambda::Alias | A routing entry cannot name $LATEST | ERROR | none |
1180
+ | `pf-lambda-alias-additional-versions-max-one` | AWS::Lambda::Alias | An alias can carry only one additional version | ERROR | none |
1181
+ | `pf-lambda-alias-routing-not-latest` | AWS::Lambda::Alias | A weighted alias cannot sit on $LATEST | ERROR | none |
1182
+ | `pf-lambda-alias-version-not-alias` | AWS::Lambda::Alias | An alias cannot point at another alias | ERROR | none |
1183
+ | `pf-lambda-alias-version-weight-range` | AWS::Lambda::Alias | A routing weight is a fraction between 0 and 1 | ERROR | none |
1184
+ | `pf-lambda-capacity-provider-arn-region` | AWS::Lambda::Function | A capacity provider lives in the deploy region | ERROR | none |
1185
+ | `pf-lambda-capacity-provider-json-log-only` | AWS::Lambda::Function | Managed-instance functions log in JSON | ERROR | none |
1186
+ | `pf-lambda-capacity-provider-runtime` | AWS::Lambda::Function | Managed instances support only the newer runtimes | ERROR | none |
1187
+ | `pf-lambda-code-s3-pair` | AWS::Lambda::Function | S3-based Code needs both S3Bucket and S3Key | ERROR | none |
1188
+ | `pf-lambda-code-signing-arn-region` | AWS::Lambda::Function | A code signing config lives in the deploy region | ERROR | none |
1189
+ | `pf-lambda-code-signing-zip-only` | AWS::Lambda::Function | Code signing applies to .zip functions only | ERROR | none |
1190
+ | `pf-lambda-code-zipfile-exclusive` | AWS::Lambda::Function | Inline ZipFile excludes every other Code parameter | ERROR | none |
1191
+ | `pf-lambda-csc-untrusted-artifact-enum` | AWS::Lambda::CodeSigningConfig | UntrustedArtifactOnDeployment is Warn or Enforce | ERROR | pending-engine |
1192
+ | `pf-lambda-dlq-no-fifo` | AWS::Lambda::Function | A dead-letter target cannot be a FIFO queue or topic | ERROR | none |
1193
+ | `pf-lambda-dlq-region` | AWS::Lambda::Function | The dead letter target must sit in the deploy region | ERROR | none |
1194
+ | `pf-lambda-dlq-service` | AWS::Lambda::Function | The dead letter target must be an SQS queue or SNS topic | ERROR | none |
1195
+ | `pf-lambda-durable-kms-key-region` | AWS::Lambda::Function | A durable-function KMS key lives in the deploy region | ERROR | none |
1196
+ | `pf-lambda-efs-mount-target-dependson` | AWS::Lambda::Function | A function that mounts EFS waits for the mount target | ERROR | none |
1197
+ | `pf-lambda-efs-mount-target-every-az` | AWS::Lambda::Function | Every subnet of an EFS function needs a mount target in its AZ | ERROR | none |
1198
+ | `pf-lambda-efs-requires-vpc` | AWS::Lambda::Function | Mounting EFS requires VpcConfig | ERROR | none |
1199
+ | `pf-lambda-eic-destination-no-sns-fifo` | AWS::Lambda::EventInvokeConfig | An invoke destination cannot be a FIFO topic | ERROR | none |
1200
+ | `pf-lambda-eic-destination-no-sqs-fifo` | AWS::Lambda::EventInvokeConfig | An invoke destination cannot be a FIFO queue | ERROR | none |
1201
+ | `pf-lambda-eic-destination-region` | AWS::Lambda::EventInvokeConfig | An invoke destination lives in the deploy region | ERROR | none |
1202
+ | `pf-lambda-eic-destination-service` | AWS::Lambda::EventInvokeConfig | An invoke destination is a queue, topic, bucket, function or event bus | ERROR | none |
1203
+ | `pf-lambda-eic-onsuccess-no-s3` | AWS::Lambda::EventInvokeConfig | An S3 bucket is an on-failure destination only | ERROR | none |
1204
+ | `pf-lambda-env-key-start-letter` | AWS::Lambda::Function | An environment variable name starts with a letter | ERROR | none |
1205
+ | `pf-lambda-env-size` | AWS::Lambda::Function | Lambda environment variables are limited to 4096 bytes in total | ERROR | none |
1206
+ | `pf-lambda-esm-batchsize-window` | AWS::Lambda::EventSourceMapping | SQS batch sizes over 10 need a batching window | ERROR | none |
1207
+ | `pf-lambda-esm-bisect-batch-stream-only` | AWS::Lambda::EventSourceMapping | BisectBatchOnFunctionError only applies to Kinesis and DynamoDB streams | ERROR | none |
1208
+ | `pf-lambda-esm-client-certificate-kafka-only` | AWS::Lambda::EventSourceMapping | CLIENT_CERTIFICATE_TLS_AUTH is not accepted on Amazon MQ | ERROR | none |
1209
+ | `pf-lambda-esm-ddb-at-timestamp-unsupported` | AWS::Lambda::EventSourceMapping | DynamoDB Streams rejects AT_TIMESTAMP | ERROR | none |
1210
+ | `pf-lambda-esm-ddb-cross-region` | AWS::Lambda::EventSourceMapping | A DynamoDB stream source must sit in the deploy region | ERROR | none |
1211
+ | `pf-lambda-esm-ddb-destination-standard-only` | AWS::Lambda::EventSourceMapping | An on-failure destination cannot be a FIFO queue or topic | ERROR | none |
1212
+ | `pf-lambda-esm-destination-config-stream-only` | AWS::Lambda::EventSourceMapping | DestinationConfig only applies to stream sources | ERROR | none |
1213
+ | `pf-lambda-esm-docdb-basic-auth-required` | AWS::Lambda::EventSourceMapping | A DocumentDB event source needs BASIC_AUTH credentials | ERROR | none |
1214
+ | `pf-lambda-esm-docdb-cluster-type` | AWS::Lambda::EventSourceMapping | Elastic DocumentDB clusters cannot be event sources | ERROR | none |
1215
+ | `pf-lambda-esm-docdb-database-name-required` | AWS::Lambda::EventSourceMapping | CollectionName needs DatabaseName | ERROR | none |
1216
+ | `pf-lambda-esm-docdb-full-document-values` | AWS::Lambda::EventSourceMapping | FullDocument accepts only UpdateLookup and Default | ERROR | pending-engine |
1217
+ | `pf-lambda-esm-documentdb-arn-rds-service` | AWS::Lambda::EventSourceMapping | A DocumentDB event source is named by its rds cluster ARN | ERROR | none |
1218
+ | `pf-lambda-esm-event-source-arn-service` | AWS::Lambda::EventSourceMapping | EventSourceArn must name a supported event source service | ERROR | none |
1219
+ | `pf-lambda-esm-fifo-batch-size-max` | AWS::Lambda::EventSourceMapping | A FIFO queue source caps BatchSize at 10 | ERROR | none |
1220
+ | `pf-lambda-esm-fifo-batching-window` | AWS::Lambda::EventSourceMapping | FIFO queues reject a batching window | ERROR | none |
1221
+ | `pf-lambda-esm-filter-criteria-docdb-unsupported` | AWS::Lambda::EventSourceMapping | DocumentDB event sources do not support FilterCriteria | ERROR | none |
1222
+ | `pf-lambda-esm-filter-pattern-eventbridge-syntax` | AWS::Lambda::EventSourceMapping | A filter Pattern must be an EventBridge pattern JSON object | ERROR | none |
1223
+ | `pf-lambda-esm-filter-pattern-leaf-array` | AWS::Lambda::EventSourceMapping | Every leaf value in a filter Pattern must be an array | ERROR | none |
1224
+ | `pf-lambda-esm-filters-hard-limit-ten` | AWS::Lambda::EventSourceMapping | An event source mapping takes at most ten filters | ERROR | none |
1225
+ | `pf-lambda-esm-function-name-bare-max-length` | AWS::Lambda::EventSourceMapping | A bare function name in FunctionName is limited to 64 characters | ERROR | none |
1226
+ | `pf-lambda-esm-function-name-format` | AWS::Lambda::EventSourceMapping | FunctionName must be a name, ARN, partial ARN or version/alias ARN | ERROR | none |
1227
+ | `pf-lambda-esm-function-response-types-allowed-value` | AWS::Lambda::EventSourceMapping | FunctionResponseTypes only accepts ReportBatchItemFailures | ERROR | pending-engine |
1228
+ | `pf-lambda-esm-function-response-types-mq-docdb` | AWS::Lambda::EventSourceMapping | Partial batch failure reporting is not available on Amazon MQ or DocumentDB | ERROR | none |
1229
+ | `pf-lambda-esm-kms-key-policy-lambda-principal` | AWS::Lambda::EventSourceMapping<br>AWS::KMS::Key | The filter-criteria key policy must let Lambda decrypt | ERROR | none |
1230
+ | `pf-lambda-esm-logging-config-kafka-only` | AWS::Lambda::EventSourceMapping | LoggingConfig only applies to Kafka sources | ERROR | none |
1231
+ | `pf-lambda-esm-max-concurrency-vs-reserved` | AWS::Lambda::EventSourceMapping<br>AWS::Lambda::Function | MaximumConcurrency cannot exceed the reserved concurrency of the function | ERROR | none |
1232
+ | `pf-lambda-esm-maximum-record-age-stream-only` | AWS::Lambda::EventSourceMapping | MaximumRecordAgeInSeconds only applies to stream sources | ERROR | none |
1233
+ | `pf-lambda-esm-maximum-retry-attempts-stream-only` | AWS::Lambda::EventSourceMapping | MaximumRetryAttempts only applies to stream sources | ERROR | none |
1234
+ | `pf-lambda-esm-metrics-allowed-values` | AWS::Lambda::EventSourceMapping | MetricsConfig.Metrics only accepts EventCount, ErrorCount and KafkaMetrics | ERROR | pending-engine |
1235
+ | `pf-lambda-esm-metrics-error-count-kafka-only` | AWS::Lambda::EventSourceMapping | The ErrorCount metric is Kafka-only | ERROR | none |
1236
+ | `pf-lambda-esm-metrics-kafka-metrics-kafka-only` | AWS::Lambda::EventSourceMapping | The KafkaMetrics metric is Kafka-only | ERROR | none |
1237
+ | `pf-lambda-esm-mq-auth-secret-required` | AWS::Lambda::EventSourceMapping | An Amazon MQ event source needs BASIC_AUTH credentials | ERROR | none |
1238
+ | `pf-lambda-esm-mq-cross-account` | AWS::Lambda::EventSourceMapping | The Amazon MQ broker must live in the deploy account | ERROR | none |
1239
+ | `pf-lambda-esm-mq-starting-position-unsupported` | AWS::Lambda::EventSourceMapping | Amazon MQ event sources reject StartingPosition | ERROR | none |
1240
+ | `pf-lambda-esm-msk-topics-required` | AWS::Lambda::EventSourceMapping | A Kafka event source needs Topics | ERROR | none |
1241
+ | `pf-lambda-esm-on-failure-destination-api-max-length` | AWS::Lambda::EventSourceMapping | An on-failure destination ARN is limited to 350 characters | ERROR | none |
1242
+ | `pf-lambda-esm-on-failure-destination-service` | AWS::Lambda::EventSourceMapping | An on-failure destination must be SNS, SQS, S3 or a Kafka topic | ERROR | none |
1243
+ | `pf-lambda-esm-parallelization-factor-stream-only` | AWS::Lambda::EventSourceMapping | ParallelizationFactor only applies to Kinesis and DynamoDB streams | ERROR | none |
1244
+ | `pf-lambda-esm-poller-group-esm-count` | AWS::Lambda::EventSourceMapping | A poller group holds at most 100 event source mappings | WARN | none |
1245
+ | `pf-lambda-esm-poller-group-name-kafka-only` | AWS::Lambda::EventSourceMapping | PollerGroupName only applies to Kafka sources | ERROR | none |
1246
+ | `pf-lambda-esm-pollers-max-ge-min` | AWS::Lambda::EventSourceMapping | MaximumPollers must be at least MinimumPollers | ERROR | none |
1247
+ | `pf-lambda-esm-provisioned-poller-source-support` | AWS::Lambda::EventSourceMapping | ProvisionedPollerConfig only applies to SQS and Kafka sources | ERROR | none |
1248
+ | `pf-lambda-esm-record-age-effective-min` | AWS::Lambda::EventSourceMapping | MaximumRecordAgeInSeconds starts at 60 seconds | ERROR | none |
1249
+ | `pf-lambda-esm-sasl-scram-512-kafka-only` | AWS::Lambda::EventSourceMapping | SASL_SCRAM_512_AUTH is not accepted on Amazon MQ | ERROR | none |
1250
+ | `pf-lambda-esm-scaling-config-sqs-only` | AWS::Lambda::EventSourceMapping | ScalingConfig only applies to SQS event sources | ERROR | none |
1251
+ | `pf-lambda-esm-scaling-provisioned-mutually-exclusive` | AWS::Lambda::EventSourceMapping | ScalingConfig and ProvisionedPollerConfig are mutually exclusive | ERROR | none |
1252
+ | `pf-lambda-esm-sqs-maximum-pollers-min` | AWS::Lambda::EventSourceMapping | ProvisionedPollerConfig MaximumPollers starts at 2 | ERROR | none |
1253
+ | `pf-lambda-esm-sqs-minimum-pollers-min` | AWS::Lambda::EventSourceMapping | ProvisionedPollerConfig MinimumPollers starts at 2 | ERROR | none |
1254
+ | `pf-lambda-esm-sqs-same-region` | AWS::Lambda::EventSourceMapping | The SQS source queue must sit in the deploy region | ERROR | none |
1255
+ | `pf-lambda-esm-sqs-starting-position` | AWS::Lambda::EventSourceMapping | SQS event sources reject StartingPosition | ERROR | none |
1256
+ | `pf-lambda-esm-starting-position-timestamp-mq-unsupported` | AWS::Lambda::EventSourceMapping | Amazon MQ event sources reject StartingPositionTimestamp | ERROR | none |
1257
+ | `pf-lambda-esm-starting-position-timestamp-requires-at-timestamp` | AWS::Lambda::EventSourceMapping | StartingPositionTimestamp needs StartingPosition AT_TIMESTAMP | ERROR | none |
1258
+ | `pf-lambda-esm-starting-position-timestamp-sqs-unsupported` | AWS::Lambda::EventSourceMapping | SQS event sources reject StartingPositionTimestamp | ERROR | none |
1259
+ | `pf-lambda-esm-tumbling-window-stream-only` | AWS::Lambda::EventSourceMapping | TumblingWindowInSeconds only applies to Kinesis and DynamoDB streams | ERROR | none |
1260
+ | `pf-lambda-image-requires-imageuri` | AWS::Lambda::Function | A container-image function needs Code.ImageUri | ERROR | none |
1261
+ | `pf-lambda-image-uri-no-fips` | AWS::Lambda::Function | A container image cannot come from an ECR FIPS endpoint | ERROR | none |
1262
+ | `pf-lambda-image-uri-private-ecr` | AWS::Lambda::Function | A container image lives in a private ECR repository | ERROR | none |
1263
+ | `pf-lambda-image-uri-region` | AWS::Lambda::Function | A container image lives in the deploy region | ERROR | none |
1264
+ | `pf-lambda-imageconfig-requires-image` | AWS::Lambda::Function | ImageConfig belongs to container-image functions | ERROR | none |
1265
+ | `pf-lambda-layer-arn-region` | AWS::Lambda::Function | A layer lives in the deploy region | ERROR | none |
1266
+ | `pf-lambda-layer-compatible-architectures-enum` | AWS::Lambda::LayerVersion | CompatibleArchitectures are x86_64 or arm64 | ERROR | pending-engine |
1267
+ | `pf-lambda-layer-compatible-runtimes-enum` | AWS::Lambda::LayerVersion | CompatibleRuntimes are known runtime identifiers | ERROR | pending-engine |
1268
+ | `pf-lambda-layer-content-storage-mode-enum` | AWS::Lambda::LayerVersion | S3ObjectStorageMode is COPY or REFERENCE | ERROR | pending-engine |
1269
+ | `pf-lambda-layer-cross-account-needs-permission` | AWS::Lambda::Function | A cross-account layer needs a share | ERROR | none |
1270
+ | `pf-lambda-layer-name-pattern` | AWS::Lambda::LayerVersion | A layer name is letters, digits, dashes and underscores | ERROR | none |
1271
+ | `pf-lambda-layer-reference-glacier-storage-class` | AWS::Lambda::LayerVersion | REFERENCE content cannot be archived | WARN | none |
1272
+ | `pf-lambda-layer-reference-needs-bucket-policy` | AWS::Lambda::LayerVersion | REFERENCE content needs a bucket policy for Lambda | WARN | none |
1273
+ | `pf-lambda-layer-reference-needs-object-version` | AWS::Lambda::LayerVersion | REFERENCE content needs an object version | ERROR | none |
1274
+ | `pf-lambda-layer-reference-needs-versioning` | AWS::Lambda::LayerVersion | REFERENCE content needs a versioned bucket | WARN | none |
1275
+ | `pf-lambda-layerperm-arn-length` | AWS::Lambda::LayerVersionPermission | A layer version ARN is at most 140 characters | ERROR | none |
1276
+ | `pf-lambda-layerperm-arn-version-suffix` | AWS::Lambda::LayerVersionPermission | A layer permission names a layer version | ERROR | none |
1277
+ | `pf-lambda-layerperm-organization-id-needs-wildcard-principal` | AWS::Lambda::LayerVersionPermission | OrganizationId narrows a wildcard principal | ERROR | none |
1278
+ | `pf-lambda-layerperm-policy-size` | AWS::Lambda::LayerVersionPermission | A layer version policy has a size limit | ERROR | pending-engine |
1279
+ | `pf-lambda-loggroup-no-aws-prefix` | AWS::Lambda::Function | A custom log group cannot start with aws/ | ERROR | none |
1280
+ | `pf-lambda-loggroup-pattern` | AWS::Lambda::Function | A log group name follows the CloudWatch Logs naming rules | ERROR | none |
1281
+ | `pf-lambda-loglevel-requires-json` | AWS::Lambda::Function | Log-level filters need JSON log format | ERROR | none |
1282
+ | `pf-lambda-memory-max` | AWS::Lambda::Function | MemorySize tops out at 10240 | ERROR | pending-engine |
1283
+ | `pf-lambda-perm-cross-region-function` | AWS::Lambda::Permission | A permission stays in the function region | ERROR | none |
1284
+ | `pf-lambda-perm-function-name-latest` | AWS::Lambda::Permission | A permission cannot name $LATEST | ERROR | none |
1285
+ | `pf-lambda-perm-function-url-auth-type-enum` | AWS::Lambda::Permission | FunctionUrlAuthType is AWS_IAM or NONE | ERROR | pending-engine |
1286
+ | `pf-lambda-perm-policy-size` | AWS::Lambda::Permission | A function resource policy has a size limit | ERROR | pending-engine |
1287
+ | `pf-lambda-perm-principal-service-domain` | AWS::Lambda::Permission | A service principal is a domain-style identifier | ERROR | none |
1288
+ | `pf-lambda-perm-principal-whitespace` | AWS::Lambda::Permission | A principal has no whitespace | ERROR | none |
1289
+ | `pf-lambda-perm-source-arn-with-account-principal` | AWS::Lambda::Permission | SourceArn narrows service principals, not account principals | ERROR | pending-engine |
1290
+ | `pf-lambda-perm-url-auth-action` | AWS::Lambda::Permission | FunctionUrlAuthType goes with the function URL action | ERROR | none |
1291
+ | `pf-lambda-provisioned-concurrency-not-latest` | AWS::Lambda::Alias | Provisioned concurrency cannot sit on $LATEST | ERROR | none |
1292
+ | `pf-lambda-provisioned-sum-not-exceed-reserved` | AWS::Lambda::Function | Provisioned concurrency fits inside the reserved concurrency | ERROR | none |
1293
+ | `pf-lambda-recursive-loop-enum` | AWS::Lambda::Function | RecursiveLoop takes Allow or Terminate | ERROR | pending-engine |
1294
+ | `pf-lambda-runtime-arn-manual-only` | AWS::Lambda::Function | A pinned runtime version needs UpdateRuntimeOn: Manual | ERROR | none |
1295
+ | `pf-lambda-runtime-manual-requires-arn` | AWS::Lambda::Function | Manual runtime updates need a runtime version ARN | ERROR | none |
1296
+ | `pf-lambda-runtime-version-arn-region` | AWS::Lambda::Function | A runtime version ARN names the deploy region | ERROR | none |
1297
+ | `pf-lambda-s3-storage-mode-zip-only` | AWS::Lambda::Function | S3ObjectStorageMode belongs to .zip functions | ERROR | none |
1298
+ | `pf-lambda-scaling-min-max-pair` | AWS::Lambda::Function | FunctionScalingConfig takes both bounds | WARN | none |
1299
+ | `pf-lambda-scaling-min-zero-requires-max-zero` | AWS::Lambda::Function | Scaling to zero means both bounds are zero | WARN | none |
1300
+ | `pf-lambda-system-log-level-enum` | AWS::Lambda::Function | SystemLogLevel takes DEBUG, INFO or WARN | ERROR | pending-engine |
1301
+ | `pf-lambda-tenancy-no-function-url` | AWS::Lambda::Function | A tenant-isolated function cannot have a function URL | ERROR | none |
1302
+ | `pf-lambda-tenancy-no-provisioned-concurrency` | AWS::Lambda::Function | A tenant-isolated function cannot use provisioned concurrency | ERROR | none |
1303
+ | `pf-lambda-tenancy-no-snapstart` | AWS::Lambda::Function | A tenant-isolated function cannot use SnapStart | ERROR | pending-engine |
1304
+ | `pf-lambda-timeout-max` | AWS::Lambda::Function | Timeout tops out at 900 seconds | ERROR | pending-engine |
1305
+ | `pf-lambda-tracing-mode-enum` | AWS::Lambda::Function | TracingConfig.Mode takes Active or PassThrough | ERROR | pending-engine |
1306
+ | `pf-lambda-url-auth-type-enum` | AWS::Lambda::Url | AuthType is AWS_IAM or NONE | ERROR | pending-engine |
1307
+ | `pf-lambda-url-cors-allow-methods-wildcard-mix` | AWS::Lambda::Url | CORS methods are a wildcard or a list, not both | ERROR | none |
1308
+ | `pf-lambda-url-cors-allow-origins-wildcard-mix` | AWS::Lambda::Url | CORS origins are a wildcard or a list, not both | ERROR | none |
1309
+ | `pf-lambda-url-invoke-mode-enum` | AWS::Lambda::Url | InvokeMode is BUFFERED or RESPONSE_STREAM | ERROR | pending-engine |
1310
+ | `pf-lambda-url-qualifier-latest-literal` | AWS::Lambda::Url | A URL qualifier cannot be $LATEST | ERROR | none |
1311
+ | `pf-lambda-url-qualifier-permission-match` | AWS::Lambda::Url | A qualified URL needs a qualified permission | ERROR | none |
1312
+ | `pf-lambda-url-target-arn-and-qualifier` | AWS::Lambda::Url | The qualifier goes in TargetFunctionArn or Qualifier, not both | ERROR | none |
1313
+ | `pf-lambda-url-target-name-length` | AWS::Lambda::Url | A bare target function name is at most 64 characters | ERROR | none |
1314
+ | `pf-lambda-version-runtime-policy-manual-requires-arn` | AWS::Lambda::Version | A version pinned to Manual needs a runtime version ARN | ERROR | none |
1315
+ | `pf-lambda-vpc-no-dedicated-tenancy` | AWS::Lambda::Function | A VPC function cannot sit in a dedicated-tenancy VPC | ERROR | none |
1316
+ | `pf-lambda-vpc-non-empty` | AWS::Lambda::Function | VpcConfig needs at least one subnet and one security group | ERROR | none |
1317
+ | `pf-lambda-vpc-same-vpc` | AWS::Lambda::Function | Subnets and security groups belong to one VPC | ERROR | none |
1318
+ | `pf-lambda-zip-no-imageuri` | AWS::Lambda::Function | A .zip function cannot carry Code.ImageUri | ERROR | none |
1319
+ | `pf-logs-account-policy-document-json` | AWS::Logs::AccountPolicy | An account policy document must be valid JSON | ERROR | none |
1320
+ | `pf-logs-account-policy-selection-criteria-prefix` | AWS::Logs::AccountPolicy | Field index and transformer account policies select with LogGroupNamePrefix | ERROR | none |
1321
+ | `pf-logs-account-policy-selection-criteria-subscription` | AWS::Logs::AccountPolicy | A subscription account policy selects with LogGroupName NOT IN | ERROR | none |
1322
+ | `pf-logs-account-policy-selection-criteria-unsupported` | AWS::Logs::AccountPolicy | A data protection account policy takes no SelectionCriteria | ERROR | none |
1323
+ | `pf-logs-account-policy-subscription-document` | AWS::Logs::AccountPolicy | A subscription account policy document needs DestinationArn | ERROR | none |
1324
+ | `pf-logs-account-policy-transformer-document` | AWS::Logs::AccountPolicy | A transformer account policy document is an array of processors | ERROR | none |
1325
+ | `pf-logs-anomaly-detector-single-log-group` | AWS::Logs::LogAnomalyDetector | A log anomaly detector watches exactly one log group | ERROR | none |
1326
+ | `pf-logs-data-protection-identifier-arn` | AWS::Logs::LogGroup | A data identifier must be a managed data-identifier ARN | ERROR | none |
1327
+ | `pf-logs-data-protection-identifiers-match` | AWS::Logs::LogGroup | Both data protection statements must list the same data identifiers | ERROR | none |
1328
+ | `pf-logs-data-protection-mask-config-empty` | AWS::Logs::LogGroup | Deidentify MaskConfig takes no fields | ERROR | none |
1329
+ | `pf-logs-data-protection-policy-statements` | AWS::Logs::LogGroup | A data protection policy needs exactly two statements | ERROR | none |
1330
+ | `pf-logs-data-protection-policy-version` | AWS::Logs::LogGroup | A data protection policy version must be 2021-06-01 | ERROR | none |
1331
+ | `pf-logs-delivery-destination-output-format-enum` | AWS::Logs::DeliveryDestination | OutputFormat must be json, plain, w3c, raw or parquet | ERROR | none |
1332
+ | `pf-logs-delivery-destination-output-format-target` | AWS::Logs::DeliveryDestination | A CloudWatch Logs delivery destination cannot use parquet | ERROR | none |
1333
+ | `pf-logs-delivery-destination-region` | AWS::Logs::DeliveryDestination | A delivery destination must be in the stack's own region | ERROR | none |
1334
+ | `pf-logs-destination-policy-json` | AWS::Logs::Destination | DestinationPolicy must be an IAM policy document | ERROR | none |
1335
+ | `pf-logs-field-index-fields-max` | AWS::Logs::LogGroup | A field index policy indexes at most 20 fields | ERROR | none |
1336
+ | `pf-logs-field-selection-criteria-syntax` | AWS::Logs::MetricFilter | FieldSelectionCriteria must reference an @aws system field | ERROR | none |
1337
+ | `pf-logs-filter-name-charset` | AWS::Logs::MetricFilter | A filter name cannot contain a colon or an asterisk | ERROR | none |
1338
+ | `pf-logs-filter-pattern-bracket` | AWS::Logs::MetricFilter<br>AWS::Logs::SubscriptionFilter | A filter pattern starting with '[' must end with ']' | ERROR | none |
1339
+ | `pf-logs-infrequent-access-anomaly-detector` | AWS::Logs::LogGroup<br>AWS::Logs::LogAnomalyDetector | A log anomaly detector needs Standard-class log groups | ERROR | none |
1340
+ | `pf-logs-infrequent-access-metric-filter` | AWS::Logs::LogGroup<br>AWS::Logs::MetricFilter | A metric filter needs a Standard-class log group | ERROR | none |
1341
+ | `pf-logs-infrequent-access-subscription-filter` | AWS::Logs::LogGroup<br>AWS::Logs::SubscriptionFilter | A subscription filter needs a Standard-class log group | ERROR | none |
1342
+ | `pf-logs-infrequent-access-transformer` | AWS::Logs::LogGroup<br>AWS::Logs::Transformer | A transformer needs a Standard-class log group | ERROR | none |
1343
+ | `pf-logs-metric-dimension-selector` | AWS::Logs::MetricFilter | A metric filter dimension value must be a field selector | ERROR | none |
1344
+ | `pf-logs-metric-dimensions-default-exclusive` | AWS::Logs::MetricFilter | Dimensions and DefaultValue are mutually exclusive | ERROR | none |
1345
+ | `pf-logs-metric-namespace-reserved` | AWS::Logs::MetricFilter | A metric filter cannot publish into the AWS/ namespace | ERROR | none |
1346
+ | `pf-logs-query-definition-log-groups-max` | AWS::Logs::QueryDefinition | A saved query names at most 50 log groups | ERROR | none |
1347
+ | `pf-logs-resource-policy-json` | AWS::Logs::ResourcePolicy | PolicyDocument must be an IAM policy document | ERROR | none |
1348
+ | `pf-logs-subscription-destination-vendor` | AWS::Logs::SubscriptionFilter | A subscription destination must be Lambda, Kinesis, Firehose or a Logs destination | ERROR | none |
1349
+ | `pf-logs-subscription-firehose-role` | AWS::Logs::SubscriptionFilter | A Firehose destination needs RoleArn | ERROR | none |
1350
+ | `pf-logs-subscription-kinesis-role` | AWS::Logs::SubscriptionFilter | A Kinesis destination needs RoleArn | ERROR | none |
1351
+ | `pf-logs-subscription-lambda-no-role` | AWS::Logs::SubscriptionFilter | A Lambda destination must not carry RoleArn | ERROR | none |
1352
+ | `pf-logs-transformer-grok-pattern` | AWS::Logs::Transformer | A grok match may only use supported pattern names | ERROR | none |
1353
+ | `pf-logs-transformer-parser-first` | AWS::Logs::Transformer | A transformer config must begin with a parser | ERROR | none |
1354
+ | `pf-memorydb-data-tiering-node-type` | AWS::MemoryDB::Cluster | DataTiering only works on r6gd node types | ERROR | none |
1355
+ | `pf-memorydb-engine` | AWS::MemoryDB::Cluster | MemoryDB runs Valkey or Redis, not Memcached | ERROR | none |
1356
+ | `pf-memorydb-kms-key-region` | AWS::MemoryDB::Cluster | KmsKeyId must name a key in the deploy region | ERROR | none |
1357
+ | `pf-memorydb-maintenance-window` | AWS::MemoryDB::Cluster | MaintenanceWindow must be ddd:hh24:mi-ddd:hh24:mi and span at least 60 minutes | ERROR | none |
1358
+ | `pf-memorydb-port` | AWS::MemoryDB::Cluster | Port must be in 1150-8004 or 8006-65535 | ERROR | none |
1359
+ | `pf-memorydb-replicas-per-shard` | AWS::MemoryDB::Cluster | NumReplicasPerShard is 0-5 | ERROR | none |
1360
+ | `pf-memorydb-snapshot-retention` | AWS::MemoryDB::Cluster | SnapshotRetentionLimit is 0-35 days | ERROR | none |
1361
+ | `pf-memorydb-snapshot-window` | AWS::MemoryDB::Cluster | SnapshotWindow must be hh24:mi-hh24:mi and must not overlap the maintenance window | ERROR | none |
1362
+ | `pf-memorydb-user-password` | AWS::MemoryDB::User | A password user needs passwords of 16-128 characters | ERROR | none |
1363
+ | `pf-pipes-batch-size-target-limit` | AWS::Pipes::Pipe | Source BatchSize is capped by what the target accepts per call | ERROR | none |
1364
+ | `pf-pipes-cross-region` | AWS::Pipes::Pipe | A pipe's source and target must be in the pipe's Region | ERROR | none |
1365
+ | `pf-pipes-enrichment-type` | AWS::Pipes::Pipe | Pipe enrichment must be Lambda, Step Functions, API Gateway or an API destination | ERROR | none |
1366
+ | `pf-pipes-filter-pattern` | AWS::Pipes::Pipe | A pipe filter Pattern must be a valid, non-empty event pattern | ERROR | none |
1367
+ | `pf-pipes-input-template-variables` | AWS::Pipes::Pipe | InputTemplate may only use the aws.pipes.* reserved variables | ERROR | none |
1368
+ | `pf-pipes-log-configuration` | AWS::Pipes::Pipe | A log level other than OFF needs a destination, and S3 logs must be JSON | ERROR | none |
1369
+ | `pf-pipes-source-parameters` | AWS::Pipes::Pipe | Source parameters must match the source, and stream sources require theirs | ERROR | none |
1370
+ | `pf-pipes-target-parameters` | AWS::Pipes::Pipe | Target parameters must match the target's resource type | ERROR | none |
1371
+ | `pf-pipes-target-sns-fifo` | AWS::Pipes::Pipe | A FIFO SNS topic cannot be a pipe target | ERROR | none |
1372
+ | `pf-rds-backtrack` | AWS::RDS::DBCluster | Backtrack only works on aurora-mysql, with a window of at most 259200 seconds | ERROR | none |
1373
+ | `pf-rds-backup-retention-range` | AWS::RDS::DBInstance | BackupRetentionPeriod must be at most 35 days | ERROR | none |
1374
+ | `pf-rds-backup-window-duration` | AWS::RDS::DBInstance | The backup window must be at least 30 minutes | ERROR | none |
1375
+ | `pf-rds-backup-window-format` | AWS::RDS::DBInstance | PreferredBackupWindow must be hh24:mi-hh24:mi | ERROR | none |
1376
+ | `pf-rds-character-set-engine` | AWS::RDS::DBInstance | CharacterSetName is only accepted by Oracle engines | ERROR | none |
1377
+ | `pf-rds-cluster-allocated-storage-aurora` | AWS::RDS::DBCluster | AllocatedStorage is only for Multi-AZ DB clusters, not Aurora | ERROR | none |
1378
+ | `pf-rds-cluster-az-count` | AWS::RDS::DBCluster | AvailabilityZones accepts at most 3 zones | ERROR | none |
1379
+ | `pf-rds-cluster-instance-class-aurora` | AWS::RDS::DBCluster | DBClusterInstanceClass is only for Multi-AZ DB clusters, not Aurora | ERROR | none |
1380
+ | `pf-rds-cluster-logs-exports-engine` | AWS::RDS::DBCluster | Cluster EnableCloudwatchLogsExports values depend on the Aurora engine | ERROR | none |
1381
+ | `pf-rds-cluster-port-range` | AWS::RDS::DBCluster | DBCluster Port must be between 1150 and 65535 | ERROR | none |
1382
+ | `pf-rds-cluster-publicly-accessible-aurora` | AWS::RDS::DBCluster | PubliclyAccessible is only for Multi-AZ DB clusters, not Aurora | ERROR | none |
1383
+ | `pf-rds-cluster-storage-type` | AWS::RDS::DBCluster | Aurora clusters only accept the aurora storage types | ERROR | none |
1384
+ | `pf-rds-database-insights-advanced` | AWS::RDS::DBCluster | DatabaseInsightsMode: advanced requires Performance Insights with at least 31 days retention | ERROR | none |
1385
+ | `pf-rds-dbname-format` | AWS::RDS::DBInstance | postgres DBName must begin with a letter | ERROR | none |
1386
+ | `pf-rds-description-printable` | AWS::RDS::DBSubnetGroup<br>AWS::RDS::DBParameterGroup | RDS group descriptions must be printable ASCII | ERROR | none |
1387
+ | `pf-rds-engine-mode-serverless-retired` | AWS::RDS::DBCluster | EngineMode: serverless (Aurora Serverless v1) can no longer be created | ERROR | none |
1388
+ | `pf-rds-event-subscription-categories` | AWS::RDS::EventSubscription | EventCategories must exist for the SourceType | ERROR | none |
1389
+ | `pf-rds-event-subscription-source-ids-require-type` | AWS::RDS::EventSubscription | SourceIds requires SourceType | ERROR | none |
1390
+ | `pf-rds-event-subscription-source-type-values` | AWS::RDS::EventSubscription | SourceType must be one of the RDS event source types | ERROR | none |
1391
+ | `pf-rds-global-write-forwarding-requires-global` | AWS::RDS::DBCluster | EnableGlobalWriteForwarding requires GlobalClusterIdentifier | ERROR | none |
1392
+ | `pf-rds-gp3-iops-storage-threshold` | AWS::RDS::DBInstance | gp3 below 400 GiB cannot take custom Iops or StorageThroughput (postgres/mysql) | ERROR | none |
1393
+ | `pf-rds-iam-auth-engine` | AWS::RDS::DBInstance | IAM database authentication is only supported by MySQL, MariaDB and PostgreSQL | ERROR | none |
1394
+ | `pf-rds-io1-iops-ratio` | AWS::RDS::DBInstance | postgres io1 Iops may not exceed 50 per GiB of storage | ERROR | none |
1395
+ | `pf-rds-iops-required` | AWS::RDS::DBInstance | io1 and io2 storage require the Iops property | ERROR | none |
1396
+ | `pf-rds-license-model-engine` | AWS::RDS::DBInstance | LicenseModel must match the engine | ERROR | none |
1397
+ | `pf-rds-limitless-delete-automated-backups` | AWS::RDS::DBCluster | Limitless clusters cannot set DeleteAutomatedBackups: false | ERROR | none |
1398
+ | `pf-rds-logs-exports-engine` | AWS::RDS::DBInstance | EnableCloudwatchLogsExports values depend on the engine | ERROR | none |
1399
+ | `pf-rds-magnetic-storage-deprecated` | AWS::RDS::DBInstance | Magnetic (standard) storage cannot be created any more | ERROR | none |
1400
+ | `pf-rds-manage-master-password-exclusive` | AWS::RDS::DBInstance | ManageMasterUserPassword and MasterUserPassword are mutually exclusive | ERROR | none |
1401
+ | `pf-rds-master-username-length` | AWS::RDS::DBInstance | MasterUsername length limit depends on the engine | ERROR | none |
1402
+ | `pf-rds-master-username-reserved` | AWS::RDS::DBInstance | MasterUsername must not be an engine reserved word | ERROR | none |
1403
+ | `pf-rds-max-allocated-storage` | AWS::RDS::DBInstance | MaxAllocatedStorage must be greater than AllocatedStorage | ERROR | none |
1404
+ | `pf-rds-monitoring-interval-values` | AWS::RDS::DBInstance<br>AWS::RDS::DBCluster | MonitoringInterval must be one of 0, 1, 5, 10, 15, 30, 60 | ERROR | none |
1405
+ | `pf-rds-monitoring-role-required` | AWS::RDS::DBInstance<br>AWS::RDS::DBCluster | MonitoringRoleArn is required when MonitoringInterval is not 0 | ERROR | none |
1406
+ | `pf-rds-multiaz-availability-zone` | AWS::RDS::DBInstance | MultiAZ and AvailabilityZone are mutually exclusive | ERROR | none |
1407
+ | `pf-rds-option-group-engine` | AWS::RDS::DBInstance<br>AWS::RDS::OptionGroup | OptionGroup EngineName must match the engine of the instance that uses it | ERROR | none |
1408
+ | `pf-rds-parameter-group-family-engine` | AWS::RDS::DBInstance<br>AWS::RDS::DBParameterGroup | DBParameterGroup Family must match the engine of the instance that uses it | ERROR | none |
1409
+ | `pf-rds-password-valid` | AWS::RDS::DBInstance<br>AWS::RDS::DBCluster | MasterUserPassword must be at least 8 characters without '/', '@', '\"' or spaces | ERROR | none |
1410
+ | `pf-rds-pi-retention-period` | AWS::RDS::DBInstance | PerformanceInsightsRetentionPeriod must be 7, 731, or a multiple of 31 up to 713 | ERROR | none |
1411
+ | `pf-rds-pi-retention-requires-enable` | AWS::RDS::DBInstance | PerformanceInsightsRetentionPeriod requires EnablePerformanceInsights: true | ERROR | none |
1412
+ | `pf-rds-port-range` | AWS::RDS::DBInstance | The database port must be within 1150-65535 | ERROR | none |
1413
+ | `pf-rds-processor-features-engine` | AWS::RDS::DBInstance | ProcessorFeatures is only supported by Oracle and SQL Server | ERROR | none |
1414
+ | `pf-rds-promotion-tier-cluster-only` | AWS::RDS::DBInstance | PromotionTier is only valid on a cluster member instance | ERROR | none |
1415
+ | `pf-rds-proxy-client-password-auth-engine` | AWS::RDS::DBProxy | ClientPasswordAuthType must match the proxy EngineFamily | ERROR | none |
1416
+ | `pf-rds-proxy-iam-auth-enabled` | AWS::RDS::DBProxy | IAMAuth: ENABLED is only valid for SQL Server proxies | ERROR | none |
1417
+ | `pf-rds-proxy-iam-auth-requires-tls` | AWS::RDS::DBProxy | IAMAuth: REQUIRED needs RequireTLS: true | ERROR | none |
1418
+ | `pf-rds-proxy-idle-client-timeout` | AWS::RDS::DBProxy | IdleClientTimeout must be between 1 and 28800 seconds | ERROR | none |
1419
+ | `pf-rds-proxy-pool-percent` | AWS::RDS::DBProxyTargetGroup | Connection pool percentages and borrow timeout have fixed ranges | ERROR | none |
1420
+ | `pf-rds-proxy-target-group-name` | AWS::RDS::DBProxyTargetGroup | DBProxyTargetGroup TargetGroupName must be "default" | ERROR | none |
1421
+ | `pf-rds-scaling-configuration-serverless-v1-only` | AWS::RDS::DBCluster | ScalingConfiguration only applies to Aurora Serverless v1 clusters | ERROR | none |
1422
+ | `pf-rds-serverless-v2-auto-pause` | AWS::RDS::DBCluster | SecondsUntilAutoPause requires MinCapacity 0 | ERROR | none |
1423
+ | `pf-rds-serverless-v2-capacity` | AWS::RDS::DBCluster | Serverless v2 MinCapacity must not exceed MaxCapacity, and MaxCapacity is at most 256 | ERROR | none |
1424
+ | `pf-rds-serverless-v2-capacity-step` | AWS::RDS::DBCluster | Serverless v2 capacity must be a multiple of 0.5 ACU | ERROR | none |
1425
+ | `pf-rds-shard-group-acu` | AWS::RDS::DBShardGroup | DBShardGroup MaxACU must be at least MinACU | WARN | none |
1426
+ | `pf-rds-sqlserver-dbname-null` | AWS::RDS::DBInstance | DBName is not accepted by SQL Server engines | ERROR | none |
1427
+ | `pf-rds-sqlserver-reserved-port` | AWS::RDS::DBInstance | SQL Server reserves several ports | ERROR | none |
1428
+ | `pf-rds-storage-throughput-gp3-only` | AWS::RDS::DBInstance | StorageThroughput is only valid with StorageType gp3 | ERROR | none |
1429
+ | `pf-rds-storage-throughput-max` | AWS::RDS::DBInstance | gp3 StorageThroughput is capped at 4000 MiBps | ERROR | none |
1430
+ | `pf-rds-subnet-group-name` | AWS::RDS::DBSubnetGroup | DB subnet group names allow only letters, numbers, spaces, dot, underscore and hyphen | ERROR | none |
1431
+ | `pf-rds-subnet-group-name-reserved` | AWS::RDS::DBSubnetGroup | DBSubnetGroupName: default is reserved | ERROR | none |
1432
+ | `pf-rds-timezone-engine` | AWS::RDS::DBInstance | Timezone is only accepted by Db2 and SQL Server engines | ERROR | none |
1433
+ | `pf-rds-window-overlap` | AWS::RDS::DBInstance | The backup window and the maintenance window must not overlap | ERROR | none |
1434
+ | `pf-route53-alias-cloudfront-zone-id` | AWS::Route53::RecordSet | A CloudFront alias target must use hosted zone Z2FDTNDATAQYW2 | ERROR | none |
1435
+ | `pf-route53-apex-cname` | AWS::Route53::RecordSet<br>AWS::Route53::HostedZone | A CNAME record is not permitted at the zone apex | ERROR | none |
1436
+ | `pf-route53-geolocation-exclusive` | AWS::Route53::RecordSet | GeoLocation cannot specify both ContinentCode and CountryCode | ERROR | pending-engine |
1437
+ | `pf-route53-multivalue-alias` | AWS::Route53::RecordSet | MultiValueAnswer cannot be combined with AliasTarget | ERROR | none |
1438
+ | `pf-route53-record-type-routing-policy` | AWS::Route53::RecordSet | NS records take no routing policy; CNAME cannot be multivalue | ERROR | none |
1439
+ | `pf-route53-record-value-source` | AWS::Route53::RecordSet | A record set needs AliasTarget or the full TTL+ResourceRecords pair | ERROR | none |
1440
+ | `pf-route53-routing-policy-exclusive` | AWS::Route53::RecordSet | A record set can use only one routing policy | ERROR | none |
1441
+ | `pf-route53-set-identifier-pairing` | AWS::Route53::RecordSet | SetIdentifier and a routing policy must appear together | ERROR | none |
1442
+ | `pf-route53-ttl-range` | AWS::Route53::RecordSet | TTL must fit in 32 bits (0..2147483647 seconds) | ERROR | pending-engine |
1443
+ | `pf-route53-weight-range` | AWS::Route53::RecordSet | Weight must be between 0 and 255 | ERROR | pending-engine |
1444
+ | `pf-route53-zonename-trailing-dot` | AWS::Route53::RecordSet | HostedZoneName must end with a trailing dot | ERROR | none |
1445
+ | `pf-s3-accelerate-dotted-name` | AWS::S3::Bucket | Transfer Acceleration rejects bucket names with periods | ERROR | none |
1446
+ | `pf-s3-acl-public-blocked` | AWS::S3::Bucket | A public canned ACL cannot be applied while Block Public Access is on | ERROR | none |
1447
+ | `pf-s3-ap-name-alias-suffix` | AWS::S3::AccessPoint | An access point name must not end with an alias suffix | ERROR | none |
1448
+ | `pf-s3-bucket-name-double-dot` | AWS::S3::Bucket | A bucket name must not contain two adjacent periods | ERROR | none |
1449
+ | `pf-s3-bucket-name-ip-address` | AWS::S3::Bucket | A bucket name must not look like an IP address | ERROR | none |
1450
+ | `pf-s3-bucket-name-reserved-prefix` | AWS::S3::Bucket | A bucket name must not start with a reserved prefix | ERROR | none |
1451
+ | `pf-s3-bucket-name-reserved-suffix` | AWS::S3::Bucket | A bucket name must not end with a reserved suffix | ERROR | none |
1452
+ | `pf-s3-bucket-namespace-account-regional-name` | AWS::S3::Bucket | An account-regional bucket takes a BucketNamePrefix, not a BucketName | ERROR | none |
1453
+ | `pf-s3-bucket-policy-action-resource` | AWS::S3::BucketPolicy | Object-level actions need an object-level Resource | ERROR | none |
1454
+ | `pf-s3-bucket-policy-principal` | AWS::S3::BucketPolicy | Bucket policy statements need a Principal | ERROR | none |
1455
+ | `pf-s3-bucket-policy-version` | AWS::S3::BucketPolicy | A policy document Version must be a known IAM policy language version | ERROR | none |
1456
+ | `pf-s3-encryption-kms-key-with-aes256` | AWS::S3::Bucket | KMSMasterKeyID is only valid with a KMS server-side encryption algorithm | ERROR | none |
1457
+ | `pf-s3-intelligent-tiering-archive-before-deep` | AWS::S3::Bucket | ARCHIVE_ACCESS must come before DEEP_ARCHIVE_ACCESS | ERROR | none |
1458
+ | `pf-s3-intelligent-tiering-duplicate-tier` | AWS::S3::Bucket | An Intelligent-Tiering configuration must not repeat an access tier | ERROR | none |
1459
+ | `pf-s3-lifecycle-abort-mpu-with-tag-filter` | AWS::S3::Bucket | AbortIncompleteMultipartUpload cannot be used in a tag-filtered rule | ERROR | none |
1460
+ | `pf-s3-lifecycle-date-days-mix` | AWS::S3::Bucket | A lifecycle rule must not mix day-based and date-based schedules | ERROR | none |
1461
+ | `pf-s3-lifecycle-date-midnight-utc` | AWS::S3::Bucket | Lifecycle dates must be UTC midnight | ERROR | none |
1462
+ | `pf-s3-lifecycle-days-order` | AWS::S3::Bucket | Lifecycle archive transitions must come 30+ days after IA, and expiration after every transition | ERROR | none |
1463
+ | `pf-s3-lifecycle-delete-marker-exclusive` | AWS::S3::Bucket | ExpiredObjectDeleteMarker cannot be combined with an expiration or a tag filter | ERROR | none |
1464
+ | `pf-s3-lifecycle-expiration-positive` | AWS::S3::Bucket | ExpirationInDays must be a positive integer | ERROR | pending-engine |
1465
+ | `pf-s3-lifecycle-min-storage-duration-chain` | AWS::S3::Bucket | A transition must wait out the minimum storage duration of the class it leaves | ERROR | none |
1466
+ | `pf-s3-lifecycle-object-size-order` | AWS::S3::Bucket | ObjectSizeGreaterThan must be smaller than ObjectSizeLessThan | ERROR | none |
1467
+ | `pf-s3-lifecycle-rule-id-duplicate` | AWS::S3::Bucket | Lifecycle rule ids must be unique within a bucket | ERROR | none |
1468
+ | `pf-s3-lifecycle-rule-no-action` | AWS::S3::Bucket | A lifecycle rule needs at least one action | ERROR | none |
1469
+ | `pf-s3-lifecycle-tag-key-duplicate` | AWS::S3::Bucket | Lifecycle tag filter keys must be unique within a rule | ERROR | none |
1470
+ | `pf-s3-lifecycle-transition-singular-plural-exclusive` | AWS::S3::Bucket | A lifecycle rule must not use both the singular and the plural transition property | ERROR | none |
1471
+ | `pf-s3-lifecycle-transition-storage-class-duplicate` | AWS::S3::Bucket | A lifecycle rule must not transition to the same storage class twice | ERROR | none |
1472
+ | `pf-s3-lifecycle-transition-waterfall-order` | AWS::S3::Bucket | Lifecycle transitions may only move down the storage-class waterfall | ERROR | none |
1473
+ | `pf-s3-metadata-kms-requires-key` | AWS::S3::Bucket | A KMS-encrypted metadata table needs a KmsKeyArn | ERROR | none |
1474
+ | `pf-s3-metadata-record-expiration-days` | AWS::S3::Bucket | Metadata journal record expiration must be at least 7 days | ERROR | none |
1475
+ | `pf-s3-metadata-v1-v2-exclusive` | AWS::S3::Bucket | MetadataConfiguration and MetadataTableConfiguration cannot both be set | ERROR | none |
1476
+ | `pf-s3-notification-destination-region` | AWS::S3::Bucket | A notification destination must live in the bucket region | ERROR | none |
1477
+ | `pf-s3-notification-duplicate-filter-type` | AWS::S3::Bucket | A notification filter may hold one prefix rule and one suffix rule | ERROR | none |
1478
+ | `pf-s3-notification-event-name` | AWS::S3::Bucket | The notification Event must be an S3 event type | ERROR | none |
1479
+ | `pf-s3-notification-fifo-queue` | AWS::S3::Bucket | S3 event notifications cannot target a FIFO SQS queue | ERROR | none |
1480
+ | `pf-s3-notification-fifo-topic` | AWS::S3::Bucket | S3 event notifications cannot target a FIFO SNS topic | ERROR | none |
1481
+ | `pf-s3-notification-overlapping-filters` | AWS::S3::Bucket | Notification entries must not overlap for the same event type | ERROR | none |
1482
+ | `pf-s3-objectlock-requires-versioning` | AWS::S3::Bucket | ObjectLockConfiguration needs versioning enabled | ERROR | none |
1483
+ | `pf-s3-objectlock-retention-days-years-exclusive` | AWS::S3::Bucket | DefaultRetention takes exactly one of Days or Years | ERROR | none |
1484
+ | `pf-s3-objectlock-versioning-suspended` | AWS::S3::Bucket | Object Lock forbids suspending versioning | ERROR | none |
1485
+ | `pf-s3-policy-public-with-block-public-policy` | AWS::S3::BucketPolicy<br>AWS::S3::Bucket | A public bucket policy cannot be put on a bucket that blocks public policies | ERROR | none |
1486
+ | `pf-s3-replication-acl-translation-needs-account` | AWS::S3::Bucket | AccessControlTranslation requires the destination Account | ERROR | none |
1487
+ | `pf-s3-replication-dest-versioning` | AWS::S3::Bucket | The replication destination bucket needs versioning enabled | ERROR | none |
1488
+ | `pf-s3-replication-destination-bucket-arn` | AWS::S3::Bucket | The replication destination must be a bucket ARN, not a bucket name | ERROR | none |
1489
+ | `pf-s3-replication-filter-requires-delete-marker` | AWS::S3::Bucket | A V2 replication rule with a Filter must also set Priority and DeleteMarkerReplication | ERROR | none |
1490
+ | `pf-s3-replication-priority-duplicate` | AWS::S3::Bucket | Replication rule priorities must be unique | ERROR | none |
1491
+ | `pf-s3-replication-requires-versioning` | AWS::S3::Bucket | ReplicationConfiguration requires versioning to be enabled on the source bucket | ERROR | none |
1492
+ | `pf-s3-replication-rtc-minutes-15` | AWS::S3::Bucket | Replication Time Control accepts only 15 minutes | ERROR | none |
1493
+ | `pf-s3-replication-rtc-needs-metrics` | AWS::S3::Bucket | Replication Time Control needs Metrics, and Metrics needs ReplicationTime | ERROR | none |
1494
+ | `pf-s3-replication-sse-kms-needs-replica-key` | AWS::S3::Bucket | Replicating SSE-KMS objects requires a replica KMS key | ERROR | none |
1495
+ | `pf-s3-replication-tag-filter-delete-marker` | AWS::S3::Bucket | A tag-filtered replication rule must disable delete marker replication | ERROR | none |
1496
+ | `pf-s3-replication-v1-v2-mixed` | AWS::S3::Bucket | A replication rule must not mix the V1 Prefix with the V2 Filter | ERROR | none |
1497
+ | `pf-s3-storagelens-bucket-level-needs-account-level` | AWS::S3::StorageLens | A bucket-level advanced metric must also be enabled at the account level | ERROR | none |
1498
+ | `pf-s3-storagelens-buckets-arn` | AWS::S3::StorageLens | Storage Lens scope buckets are given as ARNs | ERROR | none |
1499
+ | `pf-s3-storagelens-include-empty` | AWS::S3::StorageLens | A Storage Lens Include or Exclude must list at least one bucket or region | ERROR | none |
1500
+ | `pf-s3-storagelens-include-exclude-exclusive` | AWS::S3::StorageLens | A Storage Lens configuration takes either Include or Exclude | ERROR | none |
1501
+ | `pf-s3-storagelens-prefix-delimiter-length` | AWS::S3::StorageLens | PrefixDelimiter is a single character | ERROR | none |
1502
+ | `pf-s3-storagelensgroup-match-any-max` | AWS::S3::StorageLensGroup | A Storage Lens group match list holds at most 10 entries | ERROR | none |
1503
+ | `pf-s3-storagelensgroup-object-age-order` | AWS::S3::StorageLensGroup | MatchObjectAge DaysGreaterThan must be smaller than DaysLessThan | ERROR | none |
1504
+ | `pf-s3-storagelensgroup-object-size-order` | AWS::S3::StorageLensGroup | MatchObjectSize BytesGreaterThan must be smaller than BytesLessThan | ERROR | none |
1505
+ | `pf-s3-versioning-suspended-with-replication` | AWS::S3::Bucket | A replicating bucket must keep versioning enabled | ERROR | none |
1506
+ | `pf-s3-website-empty-condition` | AWS::S3::Bucket | A RoutingRuleCondition needs a key prefix or an HTTP error code | ERROR | none |
1507
+ | `pf-s3-website-empty-redirect-rule` | AWS::S3::Bucket | A RedirectRule must carry at least one element | ERROR | none |
1508
+ | `pf-s3-website-redirect-exclusive` | AWS::S3::Bucket | RedirectAllRequestsTo excludes every other website setting | ERROR | none |
1509
+ | `pf-s3-website-replace-key-exclusive` | AWS::S3::Bucket | ReplaceKeyWith and ReplaceKeyPrefixWith are mutually exclusive | ERROR | none |
1510
+ | `pf-s3-website-routing-rules-need-index` | AWS::S3::Bucket | RoutingRules require an IndexDocument | ERROR | none |
1511
+ | `pf-s3express-ap-name-suffix` | AWS::S3Express::AccessPoint | An S3 Express access point name must end with --<availability-zone-id>--xa-s3 | ERROR | none |
1512
+ | `pf-s3express-ap-scope-permissions` | AWS::S3Express::AccessPoint | Access point scope permissions are bare API names, not s3: actions | ERROR | none |
1513
+ | `pf-s3express-ap-zone-mismatch` | AWS::S3Express::AccessPoint | An S3 Express access point must carry the same zone id as its bucket | ERROR | none |
1514
+ | `pf-s3express-bucket-key-enabled-false` | AWS::S3Express::DirectoryBucket | A directory bucket must keep BucketKeyEnabled true | ERROR | none |
1515
+ | `pf-s3express-bucket-location-region` | AWS::S3Express::DirectoryBucket | LocationName must name a zone in the region the stack deploys to | ERROR | none |
1516
+ | `pf-s3express-bucket-name-dot` | AWS::S3Express::DirectoryBucket | A directory bucket name must not contain a period | ERROR | none |
1517
+ | `pf-s3express-bucket-name-reserved-prefix` | AWS::S3Express::DirectoryBucket | A directory bucket name must not start with a reserved prefix | ERROR | none |
1518
+ | `pf-s3express-bucket-name-suffix` | AWS::S3Express::DirectoryBucket | A directory bucket name must end with --<availability-zone-id>--x-s3 | ERROR | none |
1519
+ | `pf-s3express-bucket-redundancy-location` | AWS::S3Express::DirectoryBucket | DataRedundancy must match the kind of zone LocationName names | ERROR | none |
1520
+ | `pf-s3express-bucket-zone-mismatch` | AWS::S3Express::DirectoryBucket | The zone id in a directory bucket name must equal LocationName | ERROR | none |
1521
+ | `pf-s3express-kms-key-alias` | AWS::S3Express::DirectoryBucket | A directory bucket KMS key must be given as a key id or ARN, not an alias | ERROR | none |
1522
+ | `pf-s3express-kms-key-with-aes256` | AWS::S3Express::DirectoryBucket | KMSMasterKeyID is only valid when SSEAlgorithm is aws:kms | ERROR | none |
1523
+ | `pf-s3express-lifecycle-object-size-order` | AWS::S3Express::DirectoryBucket | ObjectSizeGreaterThan must be smaller than ObjectSizeLessThan | ERROR | none |
1524
+ | `pf-s3express-lifecycle-rule-no-action` | AWS::S3Express::DirectoryBucket | A directory bucket lifecycle rule must declare an expiration or an abort action | ERROR | none |
1525
+ | `pf-scheduler-date-format` | AWS::Scheduler::Schedule | StartDate and EndDate need millisecond precision | ERROR | none |
1526
+ | `pf-scheduler-flexible-time-window` | AWS::Scheduler::Schedule | MaximumWindowInMinutes is only valid when the flexible time window is on | ERROR | none |
1527
+ | `pf-scheduler-flexible-window` | AWS::Scheduler::Schedule | FLEXIBLE mode needs MaximumWindowInMinutes, OFF forbids it | ERROR | none |
1528
+ | `pf-scheduler-group-name-default` | AWS::Scheduler::ScheduleGroup | A schedule group may not be named 'default' | ERROR | none |
1529
+ | `pf-scheduler-rate-positive` | AWS::Scheduler::Schedule | A Scheduler rate() value must be positive | ERROR | none |
1530
+ | `pf-scheduler-schedule-expression` | AWS::Scheduler::Schedule | Schedule expression must parse as a valid rate(), cron() or at() | ERROR | none |
1531
+ | `pf-scheduler-start-end-order` | AWS::Scheduler::Schedule | StartDate must come before EndDate | ERROR | none |
1532
+ | `pf-scheduler-target-input-json` | AWS::Scheduler::Schedule | Target Input must be valid JSON | ERROR | none |
1533
+ | `pf-scheduler-target-parameters` | AWS::Scheduler::Schedule | Target parameters must match the target, and FIFO queues and Fargate tasks need theirs | ERROR | none |
1534
+ | `pf-scheduler-target-region` | AWS::Scheduler::Schedule | A schedule can only invoke a target in its own Region | ERROR | none |
1535
+ | `pf-scheduler-universal-target` | AWS::Scheduler::Schedule | Universal targets need the bare ARN shape, an Input, and an API that changes state | ERROR | none |
1536
+ | `pf-secretsmanager-generate-secret-string` | AWS::SecretsManager::Secret | GenerateSecretString must leave at least one character type, a PasswordLength (1..4096) that fits every required type, ExcludeCharacters under 4096 chars that does not wipe out a required type, and SecretStringTemplate (a JSON object) together with GenerateStringKey | ERROR | none |
1537
+ | `pf-secretsmanager-hosted-rotation` | AWS::SecretsManager::RotationSchedule | HostedRotationLambda needs the AWS::SecretsManager transform, a known RotationType, MasterSecretArn/SuperuserSecretArn only for *MultiUser types (never both), and no Runtime with the 2024-09-16 transform | ERROR | none |
1538
+ | `pf-secretsmanager-kms-key` | AWS::SecretsManager::Secret | KmsKeyId must be a key in the deploy region, and AWS managed keys of other services (alias/aws/<service>) cannot encrypt a secret | ERROR | none |
1539
+ | `pf-secretsmanager-replica-regions` | AWS::SecretsManager::Secret | ReplicaRegions must name other regions than the one the secret deploys to | ERROR | none |
1540
+ | `pf-secretsmanager-rotation-lambda` | AWS::SecretsManager::RotationSchedule | A RotationSchedule needs exactly one of RotationLambdaARN (a Lambda ARN in the deploy region) or HostedRotationLambda | ERROR | none |
1541
+ | `pf-secretsmanager-rotation-rules` | AWS::SecretsManager::RotationSchedule | RotationRules: AutomaticallyAfterDays (1..1000) or ScheduleExpression, not both; rate() every 4..23 hours or 1..1000 days; cron() with 6 fields, minute 0, year *, one of day-of-month/day-of-week ?, and hours at least 4 apart; Duration Nh in 1..24 that fits the rotation interval and the UTC day | ERROR | none |
1542
+ | `pf-secretsmanager-rotation-schedule-unique` | AWS::SecretsManager::RotationSchedule | A secret can have only one RotationSchedule | ERROR | none |
1543
+ | `pf-secretsmanager-secret-name` | AWS::SecretsManager::Secret | A secret Name may only contain ASCII letters, digits and -/_+=.@! (no spaces, colons, hashes or non-ASCII text) | ERROR | none |
1544
+ | `pf-secretsmanager-secret-string-exclusive` | AWS::SecretsManager::Secret | SecretString and GenerateSecretString cannot both be set on a secret | ERROR | none |
1545
+ | `pf-secretsmanager-target-attachment` | AWS::SecretsManager::SecretTargetAttachment | SecretTargetAttachment needs a TargetType from the documented list and a secret whose value is a JSON object (SecretString JSON or GenerateSecretString with SecretStringTemplate) | ERROR | none |
1546
+ | `pf-sns-delivery-policy` | AWS::SNS::Subscription<br>AWS::SNS::Topic | HTTP/S DeliveryPolicy retry values: minDelayTarget >= 1, maxDelayTarget <= 3600 and >= minDelayTarget, numRetries 0..100 and at least the sum of the phase retries, phase counts >= 0, backoffFunction one of arithmetic|exponential|geometric|linear, maxReceivesPerSecond >= 1 (subscription DeliveryPolicy and topic DeliveryPolicy.http) | ERROR | none |
1547
+ | `pf-sns-fifo-only-attributes` | AWS::SNS::Topic | ContentBasedDeduplication, ArchivePolicy and FifoThroughputScope are FIFO-only topic attributes, and ArchivePolicy.MessageRetentionPeriod is 1..365 days | ERROR | none |
1548
+ | `pf-sns-fifo-queue-on-standard-topic` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A FIFO SQS queue cannot subscribe to a standard topic (a FIFO topic may fan out to standard queues, not the reverse) | ERROR | none |
1549
+ | `pf-sns-fifo-topic-name` | AWS::SNS::Topic | FIFO topic names must end with '.fifo' (and '.fifo' names require FifoTopic) | ERROR | none |
1550
+ | `pf-sns-fifo-topic-protocol` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A FIFO topic only accepts sqs subscriptions (lambda, http/https, email, email-json, sms, firehose are rejected) | ERROR | none |
1551
+ | `pf-sns-filter-policy` | AWS::SNS::Subscription<br>AWS::SNS::Topic | FilterPolicy shape: at most 5 keys, every value an array or object, no empty arrays, no arrays inside arrays, nesting only with FilterPolicyScope MessageBody, and FilterPolicyScope is MessageAttributes or MessageBody | ERROR | none |
1552
+ | `pf-sns-firehose-subscription-role` | AWS::SNS::Subscription<br>AWS::SNS::Topic | A firehose subscription requires SubscriptionRoleArn | ERROR | none |
1553
+ | `pf-sns-raw-message-delivery` | AWS::SNS::Subscription<br>AWS::SNS::Topic | RawMessageDelivery is only supported for sqs, http, https and firehose subscriptions | ERROR | none |
1554
+ | `pf-sns-subscription-endpoint` | AWS::SNS::Subscription<br>AWS::SNS::Topic | Subscription Protocol is one of the nine SNS protocols and the Endpoint matches it: an ARN of the right service for sqs/lambda/firehose/application, an email address, a URL with the same scheme for http/https, a phone number for sms | ERROR | none |
1555
+ | `pf-sns-subscription-redrive` | AWS::SNS::Subscription<br>AWS::SNS::Topic | Subscription RedrivePolicy needs deadLetterTargetArn, which must be an SQS queue ARN in the deploy region | ERROR | none |
1556
+ | `pf-sns-subscription-region` | AWS::SNS::Subscription | Subscription.Region must be the topic's region (the region in a literal TopicArn, or the deploy region for a topic in this template) | ERROR | none |
1557
+ | `pf-sns-topic-attribute-values` | AWS::SNS::Topic | Topic DisplayName is at most 100 characters, SignatureVersion is 1 or 2, and TracingConfig is PassThrough or Active | ERROR | none |
1558
+ | `pf-sns-topic-name-format` | AWS::SNS::Topic | Topic names allow only letters, numbers, hyphen and underscore (plus a .fifo suffix) | ERROR | none |
1559
+ | `pf-sns-topic-policy-topics` | AWS::SNS::TopicPolicy | TopicPolicy.Topics takes topic ARNs (Ref Topic), not topic names | ERROR | none |
1560
+ | `pf-sqs-dlq-same-type` | AWS::SQS::Queue | A dead-letter queue named by a literal ARN must be the same type as its source (FIFO for FIFO, standard for standard); Fn::GetAtt wiring is covered by engine rule E3502 | ERROR | none |
1561
+ | `pf-sqs-fifo-name-suffix` | AWS::SQS::Queue | A QueueName ending in .fifo requires FifoQueue: true (a FIFO queue without the suffix is engine rule E2504) | ERROR | none |
1562
+ | `pf-sqs-fifo-only-attributes` | AWS::SQS::Queue | ContentBasedDeduplication, DeduplicationScope and FifoThroughputLimit are FIFO-only queue attributes (and the two enums are messageGroup|queue and perQueue|perMessageGroupId) | ERROR | none |
1563
+ | `pf-sqs-high-throughput-pairing` | AWS::SQS::Queue | FifoThroughputLimit perMessageGroupId requires DeduplicationScope messageGroup | ERROR | none |
1564
+ | `pf-sqs-queue-name-format` | AWS::SQS::Queue | Queue names allow only letters, numbers, hyphen and underscore (max 80, plus a .fifo suffix) | ERROR | none |
1565
+ | `pf-sqs-queue-policy-queues` | AWS::SQS::QueuePolicy | QueuePolicy.Queues takes queue URLs (Ref Queue), never ARNs (Fn::GetAtt Queue.Arn), and must not be empty | ERROR | none |
1566
+ | `pf-sqs-redrive-allow-policy` | AWS::SQS::Queue | RedriveAllowPolicy: redrivePermission is required (allowAll|denyAll|byQueue); byQueue needs 1..10 sourceQueueArns and the other two forbid them | ERROR | none |
1567
+ | `pf-sqs-redrive-arn-region` | AWS::SQS::Queue | The dead-letter target and every RedriveAllowPolicy source queue must sit in the deploy region | ERROR | none |
1568
+ | `pf-sqs-redrive-policy` | AWS::SQS::Queue | RedrivePolicy needs deadLetterTargetArn (an SQS queue ARN) and maxReceiveCount in 1..1000 | ERROR | none |
1569
+ | `pf-sqs-sse-exclusive` | AWS::SQS::Queue | SqsManagedSseEnabled: true and KmsMasterKeyId are mutually exclusive (one SSE type per queue) | ERROR | none |
1570
+ | `pf-ssm-association-document` | AWS::SSM::Association | Association document checks: no DocumentVersion on Amazon-owned documents (a new document in this stack only has version 1), the document must be in the deploy region, Session documents cannot be associated, SyncCompliance MANUAL needs an AssociationId parameter, Automation documents with Targets need AutomationTargetParameterName, and Parameters must match the document declaration | ERROR | none |
1571
+ | `pf-ssm-association-schedule` | AWS::SSM::Association | Association schedules: rate() of at least 30 minutes with matching singular/plural unit; cron() only in the accepted forms (every 30 minutes, every 1/2/4/8/12 hours, a time every day or on one weekday, nth or last weekday of the month); at() only with ApplyOnlyAtCronInterval; ApplyOnlyAtCronInterval not with rate(); ScheduleOffset only with ApplyOnlyAtCronInterval and a #n/L weekday cron | ERROR | none |
1572
+ | `pf-ssm-association-targets` | AWS::SSM::Association | An association needs InstanceId or Targets; target keys are InstanceIds, aws:NoOpAutomationTag, resource-groups:Name, tag-key or tag:<key>, with non-empty values and well-formed instance ids | ERROR | none |
1573
+ | `pf-ssm-document-content` | AWS::SSM::Document | Document Content must be JSON for DocumentFormat JSON, have mainSteps (2.x/0.3) or runtimeConfig (1.2), name every step uniquely with a known plugin/action, declare typed parameters that every {{ ref }} resolves to, and keep Automation step links (nextStep, onFailure, isEnd, outputs) consistent | ERROR | none |
1574
+ | `pf-ssm-document-name` | AWS::SSM::Document | Document Name must not start with aws-, amazon or amzn (case-insensitive) | ERROR | none |
1575
+ | `pf-ssm-document-schema` | AWS::SSM::Document | schemaVersion must match DocumentType (Command 1.0/1.2/2.0/2.2, Automation 0.3, Session 1.0, Policy 2.0/2.2), 2.2 needs an explicit DocumentType, ChangeCalendar needs DocumentFormat TEXT (and TEXT only ChangeCalendar), and ApplicationConfiguration needs Requires | ERROR | none |
1576
+ | `pf-ssm-maintenance-window-cutoff` | AWS::SSM::MaintenanceWindow | Cutoff must be smaller than Duration | ERROR | none |
1577
+ | `pf-ssm-maintenance-window-schedule` | AWS::SSM::MaintenanceWindow | Schedule must be rate(N minutes|hours|days), a 6/7-field cron() with in-range fields and one of day-of-month/day-of-week as ?, or at(yyyy-MM-ddTHH:mm:ss); ScheduleOffset only with an nth-/last-weekday cron; StartDate/EndDate need a UTC offset with Start before End; ScheduleTimezone is an IANA name or ±HH:MM | ERROR | none |
1578
+ | `pf-ssm-maintenance-window-target` | AWS::SSM::MaintenanceWindowTarget | MaintenanceWindowTarget with ResourceType INSTANCE takes either a single InstanceIds target or up to five tag:/tag-key targets; RESOURCE_GROUP takes a resource-groups:Name target | ERROR | none |
1579
+ | `pf-ssm-maintenance-window-task` | AWS::SSM::MaintenanceWindowTask | RUN_COMMAND tasks need Targets; tasks with Targets need MaxConcurrency and MaxErrors (and targetless tasks must not set them); TaskInvocationParameters may only hold the block for the TaskType; target keys are InstanceIds or WindowTargetIds; a NotificationConfig needs ServiceRoleArn | ERROR | none |
1580
+ | `pf-ssm-parameter-allowed-pattern` | AWS::SSM::Parameter | Value (each item of a StringList) must match AllowedPattern | ERROR | none |
1581
+ | `pf-ssm-parameter-name` | AWS::SSM::Parameter | Parameter Name must not start with aws or ssm (case-insensitive), must not end with / or contain empty segments, uses only [A-Za-z0-9_.-] per segment, and with the ARN prefix must stay within 1011 characters | ERROR | none |
1582
+ | `pf-ssm-parameter-policies` | AWS::SSM::Parameter | Policies is a JSON array of at most 10 {Type, Version "1.0", Attributes} entries: one Expiration with an ISO-8601 Timestamp, ExpirationNotification (Before + Unit) only alongside it, NoChangeNotification (After + Unit), Unit Days or Hours | ERROR | none |
1583
+ | `pf-ssm-parameter-tier` | AWS::SSM::Parameter | Standard-tier parameters (Tier omitted uses the account default, normally Standard) hold at most 4096 characters and no Policies; Advanced and Intelligent-Tiering hold at most 8192 | ERROR | none |
1584
+ | `pf-ssm-parameter-value` | AWS::SSM::Parameter | Value must be non-empty and must not contain {{ }}; DataType is text, aws:ec2:image or aws:ssm:integration (lowercase), and aws:ec2:image needs Type String with an ami-... value | ERROR | none |
1585
+ | `pf-sfn-asl-branch-shape` | AWS::StepFunctions::StateMachine | Parallel Branches is a non-empty array and every branch / Map ItemProcessor / Iterator carries both StartAt and States | ERROR | none |
1586
+ | `pf-sfn-asl-choice-rules` | AWS::StepFunctions::StateMachine | Choice rules: Choices is non-empty, each top-level rule has Next and exactly one selector (Variable / And / Or / Not / Condition), a Variable rule has exactly one comparator, and Next never sits inside And/Or/Not | ERROR | none |
1587
+ | `pf-sfn-asl-credentials` | AWS::StepFunctions::StateMachine | A Task Credentials object needs RoleArn, and Credentials is not accepted on an Activity resource | ERROR | none |
1588
+ | `pf-sfn-asl-duplicate-state-name` | AWS::StepFunctions::StateMachine | ASL state names must be unique across the whole state machine, including Parallel branches and Map item processors | ERROR | none |
1589
+ | `pf-sfn-asl-integration-parameters` | AWS::StepFunctions::StateMachine | An arn:<partition>:states::: integration Task needs Parameters (JSONPath) or Arguments (JSONata), and the common integrations need their required fields (lambda:invoke FunctionName, sqs:sendMessage QueueUrl+MessageBody, sns:publish Message, dynamodb:putItem TableName+Item, dynamodb:getItem TableName+Key, states:startExecution StateMachineArn, events:putEvents Entries, ecs:runTask TaskDefinition, glue:startJobRun JobName) | ERROR | none |
1590
+ | `pf-sfn-asl-jsonpath-syntax` | AWS::StepFunctions::StateMachine | JSONPath fields start with $ (InputPath, OutputPath, *Path, Choice Variable), ResultPath/ItemsPath are Reference Paths (no *, .., ?, @), values of ".$" keys are a path or a States.* intrinsic, and Assign variable names are alphanumeric and not the reserved "states" | ERROR | none |
1591
+ | `pf-sfn-asl-map-distributed` | AWS::StepFunctions::StateMachine | Map ProcessorConfig and ItemReader shape: DISTRIBUTED requires ExecutionType (STANDARD|EXPRESS) and INLINE forbids it; ItemReader.Resource is s3:getObject or s3:listObjectsV2; CSV input needs CSVHeaderLocation (GIVEN needs CSVHeaders) and JSON input forbids it | ERROR | none |
1592
+ | `pf-sfn-asl-missing-state` | AWS::StepFunctions::StateMachine | ASL Next/Default/Choices[].Next/Catch[].Next must reference a state defined in the same States block, at every nesting level (a dangling StartAt is covered by engine rule E3601) | ERROR | none |
1593
+ | `pf-sfn-asl-name-limits` | AWS::StepFunctions::StateMachine | ASL state names are at most 80 characters; a Distributed Map Label is at most 40 characters and unique within the state machine | ERROR | none |
1594
+ | `pf-sfn-asl-next-end` | AWS::StepFunctions::StateMachine | A Task/Pass/Wait/Parallel/Map state carries exactly one of Next or End: true | ERROR | none |
1595
+ | `pf-sfn-asl-numeric-ranges` | AWS::StepFunctions::StateMachine | ASL numeric fields have service-side ranges the schema does not carry: TimeoutSeconds/HeartbeatSeconds 1..99999999, Wait Seconds 0..99999999, MaxConcurrency >= 0, ToleratedFailurePercentage <= 100, Retry MaxAttempts 0..99999999, BackoffRate >= 1.0, MaxDelaySeconds 1..31622400, and integers must be numbers | ERROR | none |
1596
+ | `pf-sfn-asl-path-exclusive` | AWS::StepFunctions::StateMachine | A static ASL field and its Path variant are mutually exclusive (TimeoutSeconds/TimeoutSecondsPath, HeartbeatSeconds/HeartbeatSecondsPath, MaxConcurrency/MaxConcurrencyPath, ToleratedFailurePercentage/-Path, Error/ErrorPath, Cause/CausePath), and a Map state has exactly one of ItemProcessor / Iterator | ERROR | none |
1597
+ | `pf-sfn-asl-query-language` | AWS::StepFunctions::StateMachine | JSONPath-only fields (InputPath, OutputPath, ResultPath, Parameters, ResultSelector, Result, *Path, Variable rules) and JSONata-only fields (Arguments, Output, Items, Condition) must match the effective QueryLanguage; a JSONata state machine cannot contain JSONPath states; {% must close with %} | ERROR | none |
1598
+ | `pf-sfn-asl-resource-arn` | AWS::StepFunctions::StateMachine | Task Resource is an ARN, and an integration pattern the service does not offer fails creation: .sync on Lambda/SNS/SQS/DynamoDB/EventBridge/API Gateway/aws-sdk, .waitForTaskToken on Athena/Batch/CodeBuild/EMR/Glue/DataBrew/MediaConvert/SageMaker/DynamoDB, and .sync:2 anywhere but states:startExecution | ERROR | none |
1599
+ | `pf-sfn-asl-retry-catch` | AWS::StepFunctions::StateMachine | Retry/Catch entries: ErrorEquals is present and non-empty, States.ALL appears alone and only in the last entry, every Catch has Next, and JitterStrategy is NONE or FULL | ERROR | none |
1600
+ | `pf-sfn-asl-state-fields` | AWS::StepFunctions::StateMachine | ASL fields are per state type: a known field placed on a type that does not accept it (Retry on Pass, End on Choice, Next on Fail, ...) fails creation | ERROR | none |
1601
+ | `pf-sfn-asl-terminal-state` | AWS::StepFunctions::StateMachine | An ASL state machine needs at least one terminal state (End: true, Succeed or Fail) at the top level | ERROR | none |
1602
+ | `pf-sfn-asl-unreachable-state` | AWS::StepFunctions::StateMachine | Every ASL state must be reachable: a state that is not StartAt and that no other state transitions to fails creation | ERROR | none |
1603
+ | `pf-sfn-asl-wait-timing` | AWS::StepFunctions::StateMachine | A Wait state carries exactly one of Seconds / Timestamp / SecondsPath / TimestampPath, and a literal Timestamp is RFC3339 with T and Z (all four absent is covered by engine rule E3601) | ERROR | none |
1604
+ | `pf-sfn-definition-exactly-one` | AWS::StepFunctions::StateMachine | A state machine carries exactly one of Definition, DefinitionString or DefinitionS3Location | ERROR | none |
1605
+ | `pf-sfn-encryption-config` | AWS::StepFunctions::StateMachine<br>AWS::StepFunctions::Activity | EncryptionConfiguration: CUSTOMER_MANAGED_KMS_KEY requires KmsKeyId, and AWS_OWNED_KEY rejects KmsKeyId and KmsDataKeyReusePeriodSeconds (state machines and activities) | ERROR | none |
1606
+ | `pf-sfn-express-unsupported` | AWS::StepFunctions::StateMachine | An EXPRESS state machine cannot use .sync / .waitForTaskToken integrations, Activity resources, or Distributed Map (at any nesting level) | ERROR | none |
1607
+ | `pf-sfn-kms-key-region` | AWS::StepFunctions::StateMachine<br>AWS::StepFunctions::Activity | EncryptionConfiguration.KmsKeyId must be a key in the deploy region (state machines and activities) | ERROR | none |
1608
+ | `pf-sfn-logging-destination` | AWS::StepFunctions::StateMachine | LoggingConfiguration with Level other than OFF needs exactly one Destinations entry carrying CloudWatchLogsLogGroup.LogGroupArn, and a literal ARN must be a CloudWatch Logs log-group ARN ending in :* | ERROR | none |
1609
+ | `pf-sfn-logging-name-ascii` | AWS::StepFunctions::StateMachine | With CloudWatch Logs logging enabled (Level other than OFF) the StateMachineName may only contain 0-9, A-Z, a-z, . - and _ (non-ASCII names are accepted only without logging) | ERROR | none |
1610
+ | `pf-sfn-name-charset` | AWS::StepFunctions::StateMachine<br>AWS::StepFunctions::Activity | StateMachineName and Activity Name may not contain whitespace, brackets (< > { } [ ]), wildcards (? *), the special characters " # % \ ^ | ~ ` $ & , ; : / or control characters (non-ASCII letters are accepted) | ERROR | none |
1611
+ | `pf-tags-aws-prefix` | * | Tag keys may not use the reserved aws: prefix | ERROR | none |
1612
+ | `pf-tags-count-max` | * | A resource may carry at most 50 tags | ERROR | none |
1613
+ | `pf-wafv2-association-config-scope` | AWS::WAFv2::WebACL | AssociationConfig.RequestBody keys must match the web ACL Scope | ERROR | none |
1614
+ | `pf-wafv2-association-resource-arn` | AWS::WAFv2::WebACLAssociation | ResourceArn must be a supported protected-resource ARN in the deploy account and region | ERROR | none |
1615
+ | `pf-wafv2-association-webacl-arn` | AWS::WAFv2::WebACLAssociation | WebACLArn must be the ARN of a web ACL in the deploy region | ERROR | none |
1616
+ | `pf-wafv2-byte-match` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | ByteMatchStatement: exactly one of SearchString / SearchStringBase64, at most 200 bytes, non-blank, and CONTAINS_WORD only with [A-Za-z0-9_] | ERROR | none |
1617
+ | `pf-wafv2-capacity` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule group Capacity must be 1..5000 and cover the WCUs of its rules; a web ACL is limited to 5000 WCUs | ERROR | none |
1618
+ | `pf-wafv2-challenge-immunity-time` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Challenge immunity time must be at least 300 seconds | ERROR | none |
1619
+ | `pf-wafv2-cloudfront-only-features` | AWS::WAFv2::WebACL | ResponseInspection and the Monetize action only work in CLOUDFRONT-scoped web ACLs (Monetize also needs MonetizationConfig) | ERROR | none |
1620
+ | `pf-wafv2-custom-request-handling` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Inserted request headers: unique names, at most 10 per action and 100 per web ACL / rule group | ERROR | none |
1621
+ | `pf-wafv2-custom-response` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Custom responses: no content-type or duplicate headers, at most 10 headers, body keys must exist, bodies within 4 KB / 50 entries / 50 KB total | ERROR | none |
1622
+ | `pf-wafv2-data-protection` | AWS::WAFv2::WebACL | Data protection fields: FieldKeys required for single-key types, forbidden for QUERY_STRING / BODY, one entry per field type | ERROR | none |
1623
+ | `pf-wafv2-ipset-addresses` | AWS::WAFv2::IPSet | IP set addresses must be CIDR blocks of the declared version with a 1..32 / 1..128 prefix and no host bits set | ERROR | none |
1624
+ | `pf-wafv2-label-syntax` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule labels and label match keys must follow the label syntax (no reserved words, no empty components, at most 8 components of 128 chars, no labels on rule group references) | ERROR | none |
1625
+ | `pf-wafv2-logging-destination` | AWS::WAFv2::LoggingConfiguration | Exactly one log destination whose name starts with aws-waf-logs-, in the web ACL account and region | ERROR | none |
1626
+ | `pf-wafv2-logging-filter-condition` | AWS::WAFv2::LoggingConfiguration | Each logging filter condition is exactly one of ActionCondition / LabelNameCondition | ERROR | none |
1627
+ | `pf-wafv2-logging-unique` | AWS::WAFv2::LoggingConfiguration | One LoggingConfiguration per web ACL in a template | ERROR | none |
1628
+ | `pf-wafv2-managed-rule-group` | AWS::WAFv2::WebACL | Managed rule group statements: known AWS group names, matching and complete ManagedRuleGroupConfigs, consistent overrides and response inspection | ERROR | none |
1629
+ | `pf-wafv2-metric-name-reserved` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | MetricName Default_Action is reserved | ERROR | none |
1630
+ | `pf-wafv2-name-unique` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::IPSet<br>AWS::WAFv2::RegexPatternSet | Two WAFv2 entities of the same type, Scope and Name in one template | ERROR | none |
1631
+ | `pf-wafv2-rate-based-statement` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rate-based statement aggregation settings must be consistent (keys, forwarded IP config, scope-down, counts) | ERROR | none |
1632
+ | `pf-wafv2-reference-arn` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | IP set / regex pattern set / rule group references must match the web ACL scope, region and account | ERROR | none |
1633
+ | `pf-wafv2-regex-syntax` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::RegexPatternSet | Regular expressions must stay within the supported PCRE subset (no backreferences, lookaround, possessive / atomic groups, conditionals, recursion, \K, \R, control verbs), at most 10 per pattern set | ERROR | none |
1634
+ | `pf-wafv2-rule-action` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule group references take OverrideAction, every other rule takes Action; each action object names exactly one action | ERROR | none |
1635
+ | `pf-wafv2-rule-unique` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Rule priorities and names must be unique within a web ACL / rule group | ERROR | none |
1636
+ | `pf-wafv2-scope-region` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup<br>AWS::WAFv2::IPSet<br>AWS::WAFv2::RegexPatternSet | Scope CLOUDFRONT is only accepted in us-east-1 | ERROR | none |
1637
+ | `pf-wafv2-statement-exactly-one` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Statement, FieldToMatch, MatchPattern and custom-key objects name exactly one alternative | ERROR | none |
1638
+ | `pf-wafv2-statement-limits` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Statement limits: 50 country codes, 30-character query argument names, 50 reference statements per web ACL / rule group, unique header and cookie filters | ERROR | none |
1639
+ | `pf-wafv2-statement-nesting` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | And/Or need two nested statements; managed rule group, rule group reference and rate-based statements cannot be nested | ERROR | none |
1640
+ | `pf-wafv2-text-transformations` | AWS::WAFv2::WebACL<br>AWS::WAFv2::RuleGroup | Text transformations: unique priorities, at most 10, and pre-parse transformations only on query-argument components with pre-parse types | ERROR | none |
1641
+ | `pf-wafv2-token-domains` | AWS::WAFv2::WebACL | Token domains must be registrable domains (no bare labels, TLDs or public suffixes), at most 10 | ERROR | none |