cdk-preflight 0.0.86 → 0.0.88

package/.jsii

@@ -9391,7 +9391,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/badmintoncryer/cdk-preflight.git",
-  "jsiiVersion": "5.8.27 (build aebddcd)",
+  "jsiiVersion": "6.0.13 (build 5c05d06)",
   "keywords": [
     "aws",
     "aws-cdk",
@@ -9411,11 +9411,12 @@
         "hasDefaultInterfaces": true
       }
     },
-    "tscRootDir": "/home/runner/work/cdk-preflight/cdk-preflight/src"
+    "tscOutDir": "lib",
+    "tscRootDir": "src"
   },
   "name": "cdk-preflight",
   "readme": {
-    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**: they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
+    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n  <a href=\"docs/rules.md\"><img src=\"https://img.shields.io/badge/rules-1844-blue\" alt=\"1844 bundled rules\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**: they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
   },
   "repository": {
     "type": "git",
@@ -9599,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.86",
-  "fingerprint": "7/rpLMLjLyIH/XOzofQPZcnpKcB29ByAkWwrGy1TP2Y="
+  "version": "0.0.88",
+  "fingerprint": "CXzmYwHl9KjGIPP7/0+U/pUgkxVbGmlyO/nAKoQAWgs="
 }

package/AGENTS.md

@@ -190,4 +190,6 @@ bench/                      # real-deploy verification (needs an AWS account; no
 - **A Studio (ZEPPELIN-FLINK) application cannot be created without `glue:GetDatabase` on its service role**, so a Studio *pass* fixture is expensive. Every Studio-specific check (application mode, snapshots, system rollback, custom artifacts, catalog region, note JSON) fires before the Glue call, so the fail fixture can be a Studio app while the clean fixture stays a plain Flink app (measured 2026-09-06).
 - **The CloudFormation handler can word the same rejection differently from the API** (measured 2026-09-06): CreateStream says `ShardCount cannot be set while creating stream in On-Demand StreamMode`, the stack event says `ShardCount is not expected when StreamMode=ON_DEMAND`. Quote the handler's wording in the rule message — that is the string the user will search for.
 - **Kinesis rejects a cross-region ARN before it looks the resource up** ("The region specified in the ARN ... does not match the endpoint region", measured 2026-09-06 for `RegisterStreamConsumer` and `PutResourcePolicy`; `StartStreamEncryption` answers `KMSNotFoundException: Invalid arn us-west-2`). A region-binding repro therefore needs no real resource in the other region.
+- **`E3019` (duplicate resources) only reads `primaryIdentifier`** (measured 2026-09-10). It fires when the identifier is a property the user writes — `AWS::BedrockAgentCore::WorkloadIdentity` has `primaryIdentifier: /properties/Name`, so two same-named ones in a template are caught and the candidate is a duplicate. It is blind whenever the identifier is a read-only ARN, which is the usual shape: Dataset, Evaluator, ConfigurationBundle, Policy, Memory, OnlineEvaluationConfig and HarnessEndpoint all key on `…Arn`, so a name collision that the service rejects with a 409 is invisible to the engine. Check `primaryIdentifier` before deciding a uniqueness candidate is covered.
+- **A resource type the engine's bundled schema does not know fails the whole template with `F3006 Unknown resource type`**, so no rule can be written for it (measured 2026-09-10 on `AWS::BedrockAgentCore::GatewayRateLimit`; `AWS::BedrockAgentCore::PaymentConnector.ProvisionMode` fails the same way with `F3002`). Both are also absent from `aws-cdk-lib` 2.267.0's L1, so this is version lag rather than an engine bug — re-run the duplication guard for those candidates after an `aws-cdk-lib` bump.
 - **CloudFormation's server-side validation does enforce some raw-schema ranges the bundled engine misses** (measured 2026-09-06): `RetentionPeriodHours: 12` on `AWS::Kinesis::Stream` fails before any resource is touched, as a stack-level `Validation failed with 1 error(s). Call DescribeEvents ...` with the stack itself as the LogicalResourceId — while the engine's patched schema carries only the 8760 maximum. A fail template that dies at the *stack* level rather than in a resource handler is the tell; the candidate is a duplicate and does not ship.

package/README.md

@@ -12,6 +12,7 @@
   <a href="https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml"><img src="https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg" alt="monthly real-deploy verification"></a>
   <a href="https://www.npmjs.com/package/cdk-preflight"><img src="https://img.shields.io/npm/v/cdk-preflight.svg" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/cdk-preflight"><img src="https://img.shields.io/npm/dt/cdk-preflight.svg" alt="npm total downloads"></a>
+  <a href="docs/rules.md"><img src="https://img.shields.io/badge/rules-1844-blue" alt="1844 bundled rules"></a>
 </p>
 
 Some CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.

package/docs/rules.md

@@ -301,13 +301,18 @@
 | `pf-bedrock-prompt-variant-template-type` | AWS::Bedrock::Prompt | A prompt variant's TemplateConfiguration must match its TemplateType | ERROR | none |
 | `pf-agentcore-apikey-provider-secret-source` | AWS::BedrockAgentCore::ApiKeyCredentialProvider | An API key credential provider takes ApiKey when the secret is MANAGED and ApiKeySecretConfig when it is EXTERNAL, never both | ERROR | none |
 | `pf-agentcore-config-bundle-components-empty` | AWS::BedrockAgentCore::ConfigurationBundle | A configuration bundle needs at least one component | ERROR | none |
+| `pf-agentcore-config-bundle-name-unique` | AWS::BedrockAgentCore::ConfigurationBundle | BundleName must be unique within the account | ERROR | none |
+| `pf-agentcore-dataset-name-unique` | AWS::BedrockAgentCore::Dataset | DatasetName must be unique within the account, compared case-insensitively | ERROR | none |
 | `pf-agentcore-dataset-source-exactly-one` | AWS::BedrockAgentCore::Dataset | Dataset Source must hold exactly one of InlineExamples or S3Source | ERROR | none |
+| `pf-agentcore-evaluator-name-unique` | AWS::BedrockAgentCore::Evaluator | EvaluatorName must be unique within the account | ERROR | none |
 | `pf-agentcore-evaluator-rating-scale-empty` | AWS::BedrockAgentCore::Evaluator | An LLM-as-a-judge evaluator RatingScale must list at least one scale entry | ERROR | none |
+| `pf-agentcore-execution-role-account` | AWS::BedrockAgentCore::OnlineEvaluationConfig<br>AWS::BedrockAgentCore::Memory | An AgentCore execution role must live in the deploy account | ERROR | none |
 | `pf-agentcore-gateway-authorizer-config-unexpected` | AWS::BedrockAgentCore::Gateway | Gateways with AuthorizerType AWS_IAM or NONE must not set AuthorizerConfiguration | ERROR | none |
 | `pf-agentcore-gateway-interceptor-point-unique` | AWS::BedrockAgentCore::Gateway | Gateway interceptors may bind each interception point (REQUEST / RESPONSE) only once | ERROR | none |
 | `pf-agentcore-gateway-jwt-authorizer` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::PaymentManager | Gateways and payment managers with AuthorizerType CUSTOM_JWT require AuthorizerConfiguration | ERROR | none |
 | `pf-agentcore-gateway-mcp-supported-versions` | AWS::BedrockAgentCore::Gateway | Gateway MCP SupportedVersions must be MCP protocol versions the service supports | ERROR | none |
 | `pf-agentcore-gateway-target-credential-provider-required` | AWS::BedrockAgentCore::GatewayTarget | Gateway target credential types OAUTH and API_KEY require the matching CredentialProvider block | ERROR | none |
+| `pf-agentcore-gateway-target-http-unsupported` | AWS::BedrockAgentCore::GatewayTarget | TargetConfiguration.Http cannot be used: CloudFormation gateways are always MCP | ERROR | none |
 | `pf-agentcore-gateway-target-iam-credential-provider` | AWS::BedrockAgentCore::GatewayTarget | OpenAPI and MCP server gateway targets using GATEWAY_IAM_ROLE must set IamCredentialProvider (the SigV4 service) | ERROR | none |
 | `pf-agentcore-gateway-target-lambda-credential-type` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets accept only the GATEWAY_IAM_ROLE credential provider | ERROR | none |
 | `pf-agentcore-gateway-target-lambda-region` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets must be in the gateway's own region | ERROR | none |
@@ -315,6 +320,7 @@
 | `pf-agentcore-gateway-target-lambda-tool-schema-empty` | AWS::BedrockAgentCore::GatewayTarget | Lambda gateway targets need at least one tool in ToolSchema.InlinePayload | ERROR | none |
 | `pf-agentcore-gateway-target-openapi-schema` | AWS::BedrockAgentCore::GatewayTarget | Inline OpenAPI schemas for gateway targets must be OpenAPI 3 with a servers list and an operationId on every operation | ERROR | none |
 | `pf-agentcore-jwt-authorizer-claims` | AWS::BedrockAgentCore::Gateway<br>AWS::BedrockAgentCore::Runtime<br>AWS::BedrockAgentCore::Harness | A CustomJWTAuthorizer needs at least one of AllowedAudience, AllowedClients, AllowedScopes, or CustomClaims | ERROR | none |
+| `pf-agentcore-kms-key-region` | AWS::BedrockAgentCore::Dataset<br>AWS::BedrockAgentCore::Evaluator<br>AWS::BedrockAgentCore::ConfigurationBundle | A KmsKeyArn must name a key in the deploy region | ERROR | none |
 | `pf-agentcore-memory-custom-strategy-execution-role` | AWS::BedrockAgentCore::Memory | Memories with a custom strategy require MemoryExecutionRoleArn | ERROR | none |
 | `pf-agentcore-memory-strategy-exactly-one` | AWS::BedrockAgentCore::Memory | Each MemoryStrategies entry must hold exactly one strategy type, and a CustomMemoryStrategy exactly one Configuration override | ERROR | pending-engine |
 | `pf-agentcore-memory-strategy-name-unique` | AWS::BedrockAgentCore::Memory | Memory strategy names must be unique within a memory | ERROR | none |
@@ -327,6 +333,7 @@
 | `pf-agentcore-online-eval-evaluators-or-insights` | AWS::BedrockAgentCore::OnlineEvaluationConfig | An online evaluation config needs a non-empty Evaluators list (or Insights) | ERROR | none |
 | `pf-agentcore-payment-credential-provider-vendor-config` | AWS::BedrockAgentCore::PaymentCredentialProvider | ProviderConfigurationInput must contain the block matching CredentialProviderVendor (CoinbaseCDP / StripePrivy) | ERROR | none |
 | `pf-agentcore-policy-cedar-statement` | AWS::BedrockAgentCore::Policy | A Cedar policy statement must be a permit/forbid clause that constrains the resource and, for permit, carries a condition | ERROR | none |
+| `pf-agentcore-policy-name-unique` | AWS::BedrockAgentCore::Policy | Policy names must be unique within one policy engine | ERROR | none |
 | `pf-agentcore-required-union-empty` | AWS::BedrockAgentCore::Evaluator<br>AWS::BedrockAgentCore::GatewayTarget<br>AWS::BedrockAgentCore::Policy | Required union blocks (EvaluatorConfig, TargetConfiguration, Definition) must not be empty objects | ERROR | pending-engine |
 | `pf-agentcore-resource-policy-document` | AWS::BedrockAgentCore::ResourcePolicy | A resource policy must be a JSON policy whose statements carry Principal, bedrock-agentcore actions, and exactly one Resource ARN | ERROR | none |
 | `pf-agentcore-runtime-artifact-exactly-one` | AWS::BedrockAgentCore::Runtime | AgentRuntimeArtifact must hold exactly one of ContainerConfiguration or CodeConfiguration | ERROR | none |
@@ -1080,12 +1087,74 @@
 | `pf-eventschemas-registry-name-reserved` | AWS::EventSchemas::Registry | A registry name may not use the reserved aws. prefix | ERROR | none |
 | `pf-eventschemas-registry-policy` | AWS::EventSchemas::RegistryPolicy | A registry policy must declare a Version | ERROR | none |
 | `pf-eventschemas-schema-content` | AWS::EventSchemas::Schema | Schema Content must be valid JSON, and valid OpenAPI 3.0 when Type is OpenApi3 | ERROR | none |
+| `pf-firehose-aoss-collection-endpoint` | AWS::KinesisFirehose::DeliveryStream | An OpenSearch Serverless destination needs a collection endpoint | ERROR | none |
+| `pf-firehose-bucket-arn-format` | AWS::KinesisFirehose::DeliveryStream | A destination BucketARN must be an S3 bucket ARN | ERROR | none |
+| `pf-firehose-cloudwatch-log-processing-decompression` | AWS::KinesisFirehose::DeliveryStream | CloudWatch log processing needs a Decompression processor | ERROR | none |
+| `pf-firehose-cloudwatch-log-processing-value` | AWS::KinesisFirehose::DeliveryStream | DataMessageExtraction takes True or False | ERROR | none |
+| `pf-firehose-cloudwatch-logging-names` | AWS::KinesisFirehose::DeliveryStream | Enabled CloudWatch logging needs a log group name | ERROR | none |
+| `pf-firehose-custom-time-zone` | AWS::KinesisFirehose::DeliveryStream | CustomTimeZone must be a time zone Firehose supports | ERROR | none |
+| `pf-firehose-database-source-config` | AWS::KinesisFirehose::DeliveryStream | A database-sourced stream must deliver to Iceberg | ERROR | none |
+| `pf-firehose-deserializer-one` | AWS::KinesisFirehose::DeliveryStream | The deserializer must be exactly one SerDe | ERROR | none |
+| `pf-firehose-deserializer-required` | AWS::KinesisFirehose::DeliveryStream | InputFormatConfiguration must carry a deserializer | ERROR | none |
+| `pf-firehose-dfcc-compression` | AWS::KinesisFirehose::DeliveryStream | Format conversion needs an uncompressed S3 destination | ERROR | none |
 | `pf-firehose-dfcc-required-configs` | AWS::KinesisFirehose::DeliveryStream | Enabled format conversion needs input, output, and schema configs | ERROR | none |
 | `pf-firehose-dynamic-partitioning-buffer` | AWS::KinesisFirehose::DeliveryStream | Dynamic partitioning needs a 64 MB buffer floor | ERROR | none |
 | `pf-firehose-dynamic-partitioning-prefix` | AWS::KinesisFirehose::DeliveryStream | Dynamic partitioning needs partition namespaces in the prefix | ERROR | none |
+| `pf-firehose-dynamic-partitioning-query-key` | AWS::KinesisFirehose::DeliveryStream | Every MetadataExtraction key must appear in the S3 prefix | ERROR | none |
+| `pf-firehose-encryption-key-arn` | AWS::KinesisFirehose::DeliveryStream | A customer managed CMK needs a KeyARN | ERROR | none |
+| `pf-firehose-encryption-key-region` | AWS::KinesisFirehose::DeliveryStream | The stream CMK must be in the deploy region | ERROR | none |
+| `pf-firehose-encryption-kinesis-source` | AWS::KinesisFirehose::DeliveryStream | Server-side encryption is not available with a Kinesis source | ERROR | none |
+| `pf-firehose-encryption-owned-key-arn` | AWS::KinesisFirehose::DeliveryStream | An AWS owned CMK takes no KeyARN | ERROR | none |
+| `pf-firehose-error-output-prefix-error-type` | AWS::KinesisFirehose::DeliveryStream | An ErrorOutputPrefix with expressions needs !{firehose:error-output-type} | ERROR | none |
+| `pf-firehose-error-output-prefix-partition-namespace` | AWS::KinesisFirehose::DeliveryStream | Partition namespaces cannot appear in an ErrorOutputPrefix | ERROR | none |
+| `pf-firehose-error-output-prefix-required` | AWS::KinesisFirehose::DeliveryStream | A prefix with expressions needs an ErrorOutputPrefix | ERROR | none |
+| `pf-firehose-hive-timestamp-formats` | AWS::KinesisFirehose::DeliveryStream | HiveJsonSerDe timestamp formats must be Joda patterns | ERROR | none |
+| `pf-firehose-http-attribute-name-unique` | AWS::KinesisFirehose::DeliveryStream | HTTP common attribute names must be unique | ERROR | none |
+| `pf-firehose-http-buffer-size` | AWS::KinesisFirehose::DeliveryStream | HTTP endpoint buffering is capped at 64 MB | ERROR | none |
+| `pf-firehose-iceberg-backup-mode` | AWS::KinesisFirehose::DeliveryStream | Iceberg S3 backup only supports FailedDataOnly | ERROR | none |
+| `pf-firehose-iceberg-catalog-arn-format` | AWS::KinesisFirehose::DeliveryStream | An Iceberg catalog ARN must be a Glue catalog ARN | ERROR | none |
+| `pf-firehose-iceberg-default-table-config` | AWS::KinesisFirehose::DeliveryStream | An Iceberg destination without routing needs a default table | ERROR | none |
 | `pf-firehose-kinesis-source-config` | AWS::KinesisFirehose::DeliveryStream | KinesisStreamAsSource streams need KinesisStreamSourceConfiguration | ERROR | none |
+| `pf-firehose-metadata-extraction-dp-only` | AWS::KinesisFirehose::DeliveryStream | A MetadataExtraction processor needs dynamic partitioning | ERROR | none |
+| `pf-firehose-msk-source-config` | AWS::KinesisFirehose::DeliveryStream | An MSK-sourced stream needs MSKSourceConfiguration | ERROR | none |
 | `pf-firehose-one-destination` | AWS::KinesisFirehose::DeliveryStream | A delivery stream takes exactly one destination configuration | ERROR | none |
+| `pf-firehose-opensearch-endpoint-exclusive` | AWS::KinesisFirehose::DeliveryStream | An OpenSearch destination takes a domain ARN or an endpoint, not both | ERROR | none |
+| `pf-firehose-opensearch-endpoint-required` | AWS::KinesisFirehose::DeliveryStream | An OpenSearch destination needs a domain ARN or an endpoint | ERROR | none |
+| `pf-firehose-opensearch-type-name` | AWS::KinesisFirehose::DeliveryStream | An OpenSearch 7+ destination takes no type name | ERROR | none |
+| `pf-firehose-prefix-expression-syntax` | AWS::KinesisFirehose::DeliveryStream | A "!{" in an S3 prefix must open a complete expression | ERROR | none |
+| `pf-firehose-prefix-expression-value` | AWS::KinesisFirehose::DeliveryStream | An S3 prefix expression value must be one the namespace accepts | ERROR | none |
+| `pf-firehose-prefix-length` | AWS::KinesisFirehose::DeliveryStream | An evaluated S3 prefix cannot exceed 512 characters | ERROR | none |
+| `pf-firehose-prefix-namespace` | AWS::KinesisFirehose::DeliveryStream | An S3 prefix expression takes one of four namespaces | ERROR | none |
+| `pf-firehose-prefix-no-error-output-type` | AWS::KinesisFirehose::DeliveryStream | Prefix cannot interpolate the error output type | ERROR | none |
+| `pf-firehose-processor-buffer-both` | AWS::KinesisFirehose::DeliveryStream | Lambda buffering takes both hints or neither | ERROR | none |
+| `pf-firehose-processor-buffer-interval-range` | AWS::KinesisFirehose::DeliveryStream | A Lambda processor buffers for 0 to 900 seconds | ERROR | none |
+| `pf-firehose-processor-buffer-size-range` | AWS::KinesisFirehose::DeliveryStream | A Lambda processor buffers between 0.2 and 3 MB | ERROR | none |
+| `pf-firehose-processor-count` | AWS::KinesisFirehose::DeliveryStream | A processing configuration takes one to five processors | ERROR | none |
+| `pf-firehose-processor-deaggregation-delimiter` | AWS::KinesisFirehose::DeliveryStream | Delimited de-aggregation needs a Delimiter | ERROR | none |
+| `pf-firehose-processor-duplicate-type` | AWS::KinesisFirehose::DeliveryStream | A destination takes at most one Lambda processor | ERROR | none |
+| `pf-firehose-processor-lambda-arn` | AWS::KinesisFirehose::DeliveryStream | A Lambda processor needs a LambdaArn parameter | ERROR | none |
+| `pf-firehose-processor-metadata-params` | AWS::KinesisFirehose::DeliveryStream | A MetadataExtraction processor needs a query and JQ-1.6 | ERROR | none |
+| `pf-firehose-processor-retries-range` | AWS::KinesisFirehose::DeliveryStream | A Lambda processor retries at most 300 times | ERROR | none |
+| `pf-firehose-processor-subrecord-type` | AWS::KinesisFirehose::DeliveryStream | SubRecordType is JSON or DELIMITED | ERROR | none |
+| `pf-firehose-record-deaggregation-dp-only` | AWS::KinesisFirehose::DeliveryStream | A RecordDeAggregation processor needs dynamic partitioning | ERROR | none |
+| `pf-firehose-redshift-credentials` | AWS::KinesisFirehose::DeliveryStream | A Redshift destination needs a password or a secret | ERROR | none |
+| `pf-firehose-redshift-prefix-no-expression` | AWS::KinesisFirehose::DeliveryStream | A Redshift destination takes no prefix expressions | ERROR | none |
+| `pf-firehose-redshift-s3-compression` | AWS::KinesisFirehose::DeliveryStream | A Redshift intermediate bucket takes UNCOMPRESSED or GZIP | ERROR | none |
+| `pf-firehose-role-arn-account` | AWS::KinesisFirehose::DeliveryStream | A delivery role must live in the deploy account | ERROR | none |
 | `pf-firehose-s3-backup-config` | AWS::KinesisFirehose::DeliveryStream | Enabling S3 backup needs S3BackupConfiguration | ERROR | none |
+| `pf-firehose-s3-encryption-exclusive` | AWS::KinesisFirehose::DeliveryStream | S3 encryption takes exactly one configuration | ERROR | none |
+| `pf-firehose-s3-kms-key-region` | AWS::KinesisFirehose::DeliveryStream | The S3 encryption key must be in the deploy region | ERROR | none |
+| `pf-firehose-schema-config-role-account` | AWS::KinesisFirehose::DeliveryStream | The schema configuration role must be in the deploy account | ERROR | none |
+| `pf-firehose-secrets-manager-region` | AWS::KinesisFirehose::DeliveryStream | The destination secret must be in the deploy region | ERROR | none |
+| `pf-firehose-secrets-manager-secret-arn` | AWS::KinesisFirehose::DeliveryStream | An enabled Secrets Manager configuration needs a SecretARN | ERROR | none |
+| `pf-firehose-serializer-one` | AWS::KinesisFirehose::DeliveryStream | The serializer must be exactly one SerDe | ERROR | none |
+| `pf-firehose-serializer-required` | AWS::KinesisFirehose::DeliveryStream | OutputFormatConfiguration must carry a serializer | ERROR | none |
+| `pf-firehose-snowflake-credentials` | AWS::KinesisFirehose::DeliveryStream | A Snowflake destination needs a private key or a secret | ERROR | none |
+| `pf-firehose-snowflake-json-mapping-columns` | AWS::KinesisFirehose::DeliveryStream | JSON mapping takes no Snowflake column names | ERROR | none |
+| `pf-firehose-snowflake-role-config` | AWS::KinesisFirehose::DeliveryStream | An enabled Snowflake role configuration needs a role | ERROR | none |
+| `pf-firehose-snowflake-user` | AWS::KinesisFirehose::DeliveryStream | A Snowflake destination needs a user or a secret | ERROR | none |
+| `pf-firehose-snowflake-variant-columns` | AWS::KinesisFirehose::DeliveryStream | Variant content and metadata mapping needs both column names | ERROR | none |
+| `pf-firehose-splunk-hec-endpoint-https` | AWS::KinesisFirehose::DeliveryStream | A Splunk HEC endpoint must be an HTTPS URL | ERROR | none |
 | `pf-iam-identity-policy-no-principal` | AWS::IAM::Role<br>AWS::IAM::Policy<br>AWS::IAM::ManagedPolicy | Identity policies cannot carry a Principal field | ERROR | none |
 | `pf-iam-inline-policy-size` | AWS::IAM::Policy<br>AWS::IAM::RolePolicy<br>AWS::IAM::UserPolicy<br>AWS::IAM::GroupPolicy | Inline policy documents are limited per identity (role 10240 / group 5120 / user 2048 characters) | ERROR | none |
 | `pf-iam-instance-profile-single-role` | AWS::IAM::InstanceProfile | An instance profile holds exactly one role | ERROR | none |
@@ -1442,12 +1511,25 @@
 | `pf-route53-apex-cname` | AWS::Route53::RecordSet<br>AWS::Route53::HostedZone | A CNAME record is not permitted at the zone apex | ERROR | none |
 | `pf-route53-caa-tag-enum` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A CAA tag must be issue, issuewild or iodef | ERROR | none |
 | `pf-route53-cidr-collection-id-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | CidrRoutingConfig.CollectionId must be a UUID | ERROR | pending-engine |
-| `pf-route53-cidr-location-name-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | CidrRoutingConfig.LocationName is limited to 16 characters of [0-9A-Za-z_-*] | ERROR | none |
+| `pf-route53-cidr-location-name-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup<br>AWS::Route53::CidrCollection | CidrRoutingConfig.LocationName is limited to 16 characters of [0-9A-Za-z_-*] | ERROR | none |
 | `pf-route53-cidr-private-zone` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | IP-based routing is not available in a private hosted zone | ERROR | none |
 | `pf-route53-cidr-same-collection-in-group` | AWS::Route53::RecordSetGroup | IP-based record sets sharing a name and type must use one CIDR collection | ERROR | none |
+| `pf-route53-cidrcollection-blocks-max-1000` | AWS::Route53::CidrCollection | A CIDR collection holds at most 1000 CIDR blocks across all locations | ERROR | none |
+| `pf-route53-cidrcollection-cidr-item-blank` | AWS::Route53::CidrCollection | A CIDR block entry cannot be blank | ERROR | none |
+| `pf-route53-cidrcollection-cidr-item-length` | AWS::Route53::CidrCollection | A CIDR block entry must be 1 to 50 characters | ERROR | none |
+| `pf-route53-cidrcollection-cidrlist-required` | AWS::Route53::CidrCollection | Every location in a CIDR collection needs at least one CIDR block | ERROR | none |
+| `pf-route53-cidrcollection-duplicate-cidr-block` | AWS::Route53::CidrCollection | The same CIDR block cannot appear twice in one collection | ERROR | none |
+| `pf-route53-cidrcollection-duplicate-name` | AWS::Route53::CidrCollection | Two CIDR collections cannot share a name | ERROR | none |
+| `pf-route53-cidrcollection-ipv4-prefix-max-24` | AWS::Route53::CidrCollection | An IPv4 CIDR block in a collection cannot be longer than /24 | ERROR | none |
+| `pf-route53-cidrcollection-ipv6-prefix-max-48` | AWS::Route53::CidrCollection | An IPv6 CIDR block in a collection cannot be longer than /48 | ERROR | none |
+| `pf-route53-cidrcollection-locationname-wildcard` | AWS::Route53::CidrCollection | The default location * cannot be created as a location of a collection | ERROR | none |
+| `pf-route53-cidrcollection-zero-prefix-default-location` | AWS::Route53::CidrCollection | A zero-length CIDR block belongs to the default location only | ERROR | none |
 | `pf-route53-cname-name-collision` | AWS::Route53::RecordSetGroup | A CNAME cannot share its name with a record set of another type | ERROR | none |
 | `pf-route53-coordinates-latitude-range` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Coordinates.Latitude must be -90 to 90 | ERROR | none |
 | `pf-route53-coordinates-longitude-range` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Coordinates.Longitude must be -180 to 180 | ERROR | none |
+| `pf-route53-dnssec-dependson-ksk` | AWS::Route53::DNSSEC | Enabling DNSSEC needs an explicit DependsOn on the key signing key | ERROR | none |
+| `pf-route53-dnssec-requires-active-ksk` | AWS::Route53::DNSSEC | DNSSEC signing needs a key signing key in ACTIVE status | ERROR | none |
+| `pf-route53-dnssec-requires-ksk` | AWS::Route53::DNSSEC | DNSSEC cannot be enabled on a hosted zone without a key signing key | ERROR | none |
 | `pf-route53-ds-field-count` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A DS record value needs exactly 4 space-separated fields | ERROR | none |
 | `pf-route53-failover-alias-evaluate-target-health` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A PRIMARY failover alias must set EvaluateTargetHealth to true | ERROR | none |
 | `pf-route53-failover-enum` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Failover must be PRIMARY or SECONDARY | ERROR | pending-engine |
@@ -1464,8 +1546,60 @@
 | `pf-route53-geoproximity-exclusive` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoProximityLocation takes exactly one of AWSRegion, LocalZoneGroup or Coordinates | ERROR | pending-engine |
 | `pf-route53-geoproximity-localzonegroup-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | GeoProximityLocation.LocalZoneGroup must be a Local Zone group name | ERROR | none |
 | `pf-route53-geoproximity-max-30-same-name-type` | AWS::Route53::RecordSetGroup | A geoproximity group may hold at most 30 record sets per name and type | ERROR | none |
+| `pf-route53-healthcheck-alarm-extended-statistic` | AWS::Route53::HealthCheck<br>AWS::CloudWatch::Alarm | A CloudWatch alarm health check cannot watch an alarm on an extended statistic | ERROR | none |
+| `pf-route53-healthcheck-alarm-high-resolution` | AWS::Route53::HealthCheck<br>AWS::CloudWatch::Alarm | A CloudWatch alarm health check cannot watch a high-resolution alarm | ERROR | none |
+| `pf-route53-healthcheck-alarm-metric-math` | AWS::Route53::HealthCheck<br>AWS::CloudWatch::Alarm | A CloudWatch alarm health check cannot watch a metric math alarm | ERROR | none |
+| `pf-route53-healthcheck-alarmidentifier-cloudwatch-only` | AWS::Route53::HealthCheck | AlarmIdentifier is only valid on a CLOUDWATCH_METRIC health check | ERROR | none |
+| `pf-route53-healthcheck-alarmidentifier-region-format` | AWS::Route53::HealthCheck | AlarmIdentifier.Region must be a region name, not an availability zone | ERROR | none |
+| `pf-route53-healthcheck-alarmidentifier-required-cloudwatch` | AWS::Route53::HealthCheck | A CLOUDWATCH_METRIC health check needs an AlarmIdentifier | ERROR | none |
+| `pf-route53-healthcheck-calculated-child-calculated` | AWS::Route53::HealthCheck | A CALCULATED health check cannot have another CALCULATED health check as a child | ERROR | none |
+| `pf-route53-healthcheck-childhealthchecks-only-calculated` | AWS::Route53::HealthCheck | ChildHealthChecks is only valid on a CALCULATED health check | ERROR | none |
+| `pf-route53-healthcheck-childhealthchecks-quota-255` | AWS::Route53::HealthCheck | A CALCULATED health check can aggregate at most 255 child health checks | WARN | none |
+| `pf-route53-healthcheck-enablesni-https-only` | AWS::Route53::HealthCheck | EnableSNI is only valid on an HTTPS health check | ERROR | none |
+| `pf-route53-healthcheck-endpoint-required` | AWS::Route53::HealthCheck | An endpoint health check needs IPAddress or FullyQualifiedDomainName | ERROR | none |
+| `pf-route53-healthcheck-failurethreshold-recovery-control` | AWS::Route53::HealthCheck | FailureThreshold cannot be set on a RECOVERY_CONTROL health check | WARN | none |
+| `pf-route53-healthcheck-healththreshold-only-calculated` | AWS::Route53::HealthCheck | HealthThreshold is only valid on a CALCULATED health check | ERROR | none |
+| `pf-route53-healthcheck-insufficientdata-cloudwatch-only` | AWS::Route53::HealthCheck | InsufficientDataHealthStatus is only valid on a CLOUDWATCH_METRIC health check | ERROR | none |
+| `pf-route53-healthcheck-insufficientdata-enum` | AWS::Route53::HealthCheck | InsufficientDataHealthStatus must be Healthy, LastKnownStatus or Unhealthy | ERROR | none |
+| `pf-route53-healthcheck-ipaddress-calculated` | AWS::Route53::HealthCheck | IPAddress cannot be set on a CALCULATED health check | ERROR | none |
+| `pf-route53-healthcheck-ipaddress-cloudwatch-metric` | AWS::Route53::HealthCheck | IPAddress cannot be set on a CLOUDWATCH_METRIC health check | ERROR | none |
+| `pf-route53-healthcheck-ipaddress-private-range` | AWS::Route53::HealthCheck | A health check cannot target a private, documentation or otherwise non-routable address | ERROR | none |
+| `pf-route53-healthcheck-measurelatency-recovery-control` | AWS::Route53::HealthCheck | MeasureLatency cannot be set on a RECOVERY_CONTROL health check | WARN | none |
+| `pf-route53-healthcheck-port-calculated` | AWS::Route53::HealthCheck | Port cannot be set on a CALCULATED health check | ERROR | none |
+| `pf-route53-healthcheck-port-cloudwatch-metric` | AWS::Route53::HealthCheck | Port cannot be set on a CLOUDWATCH_METRIC health check | ERROR | none |
+| `pf-route53-healthcheck-regions-endpoint-types-only` | AWS::Route53::HealthCheck | Regions is only valid on an endpoint health check | ERROR | none |
+| `pf-route53-healthcheck-regions-enum` | AWS::Route53::HealthCheck | Health checkers can only be placed in the eight regions Route 53 offers | ERROR | none |
+| `pf-route53-healthcheck-requestinterval-discrete` | AWS::Route53::HealthCheck | RequestInterval must be exactly 10 or 30 seconds | ERROR | none |
+| `pf-route53-healthcheck-requestinterval-recovery-control` | AWS::Route53::HealthCheck | RequestInterval cannot be set on a RECOVERY_CONTROL health check | WARN | none |
+| `pf-route53-healthcheck-resourcepath-http-only` | AWS::Route53::HealthCheck | ResourcePath is only valid on an HTTP or HTTPS health check | ERROR | none |
+| `pf-route53-healthcheck-routingcontrolarn-required` | AWS::Route53::HealthCheck | A RECOVERY_CONTROL health check needs a RoutingControlArn | ERROR | none |
+| `pf-route53-healthcheck-searchstring-required-strmatch` | AWS::Route53::HealthCheck | A string-matching health check needs a SearchString | ERROR | none |
+| `pf-route53-healthcheck-searchstring-strmatch-only` | AWS::Route53::HealthCheck | SearchString is only valid on a string-matching health check | ERROR | none |
+| `pf-route53-healthcheck-type-enum` | AWS::Route53::HealthCheck | HealthCheckConfig.Type must be one of the eight health check types | ERROR | none |
+| `pf-route53-hostedzone-duplicate-private-zone-vpc` | AWS::Route53::HostedZone | Two private hosted zones for the same domain cannot share a VPC | ERROR | none |
+| `pf-route53-hostedzone-name-charset` | AWS::Route53::HostedZone | A hosted zone name can only hold printable ASCII without spaces | ERROR | none |
+| `pf-route53-hostedzone-name-label-63` | AWS::Route53::HostedZone | Every label of a hosted zone name must be 63 bytes or fewer | ERROR | none |
+| `pf-route53-hostedzone-name-punycode` | AWS::Route53::HostedZone | An internationalized hosted zone name must be given in Punycode | ERROR | none |
+| `pf-route53-hostedzone-name-required` | AWS::Route53::HostedZone | A hosted zone needs a Name even though CloudFormation marks it optional | ERROR | none |
+| `pf-route53-hostedzone-name-tld` | AWS::Route53::HostedZone | A hosted zone cannot be created for a bare top-level domain | ERROR | none |
+| `pf-route53-hostedzone-name-total-255` | AWS::Route53::HostedZone | A hosted zone name must be 255 bytes or fewer | ERROR | none |
+| `pf-route53-hostedzone-name-wildcard-label` | AWS::Route53::HostedZone | A hosted zone name cannot start with a wildcard label | ERROR | none |
+| `pf-route53-hostedzone-nameservers-private` | AWS::Route53::HostedZone<br>AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Fn::GetAtt NameServers is not available on a private hosted zone | ERROR | none |
+| `pf-route53-hostedzone-querylogging-arn-format` | AWS::Route53::HostedZone | The query logging log group must be given as a CloudWatch Logs log-group ARN | ERROR | none |
+| `pf-route53-hostedzone-querylogging-loggroup-region` | AWS::Route53::HostedZone | The query logging log group must live in us-east-1 | ERROR | none |
+| `pf-route53-hostedzone-querylogging-private-zone` | AWS::Route53::HostedZone | Query logging can only be turned on for a public hosted zone | ERROR | none |
+| `pf-route53-hostedzone-vpc-region-format` | AWS::Route53::HostedZone | VPCRegion must be a region name, not an availability zone | ERROR | none |
 | `pf-route53-https-field-format` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | An HTTPS record value needs a priority and a target name | ERROR | none |
 | `pf-route53-https-svcpriority-range` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | The HTTPS SvcPriority must be 0-32767 | ERROR | none |
+| `pf-route53-keysigningkey-kms-key-enabled` | AWS::Route53::KeySigningKey<br>AWS::KMS::Key | The KMS key behind a key signing key must be enabled | ERROR | none |
+| `pf-route53-keysigningkey-kms-key-policy-actions` | AWS::Route53::KeySigningKey<br>AWS::KMS::Key | The KMS key policy must let Route 53 DNSSEC describe, read and sign | ERROR | none |
+| `pf-route53-keysigningkey-kms-key-policy-principal` | AWS::Route53::KeySigningKey<br>AWS::KMS::Key | The KMS key policy must name the Route 53 DNSSEC service principal | ERROR | none |
+| `pf-route53-keysigningkey-kms-key-region` | AWS::Route53::KeySigningKey | The DNSSEC signing key must live in us-east-1 | ERROR | none |
+| `pf-route53-keysigningkey-kms-keyspec` | AWS::Route53::KeySigningKey<br>AWS::KMS::Key | The DNSSEC signing key must be an ECC_NIST_P256 key used for SIGN_VERIFY | ERROR | none |
+| `pf-route53-keysigningkey-kmsarn-unique-per-zone` | AWS::Route53::KeySigningKey | Two key signing keys in one hosted zone cannot share a KMS key | ERROR | none |
+| `pf-route53-keysigningkey-max-2-per-zone` | AWS::Route53::KeySigningKey | A hosted zone can hold at most two key signing keys | ERROR | none |
+| `pf-route53-keysigningkey-name-unique-per-zone` | AWS::Route53::KeySigningKey | Two key signing keys in one hosted zone cannot share a name | ERROR | none |
+| `pf-route53-keysigningkey-status-enum` | AWS::Route53::KeySigningKey | A key signing key is either ACTIVE or INACTIVE | ERROR | pending-engine |
 | `pf-route53-latency-one-record-per-region` | AWS::Route53::RecordSetGroup | A latency group may hold only one record set per Region | ERROR | none |
 | `pf-route53-latency-region-enum` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | The latency Region must be an existing AWS Region | ERROR | none |
 | `pf-route53-mixed-routing-policy-same-name-type` | AWS::Route53::RecordSetGroup | Record sets sharing a name and type must use the same routing policy | ERROR | none |
@@ -1478,7 +1612,7 @@
 | `pf-route53-naptr-regexp-quotes` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | The NAPTR regexp field must be quoted | ERROR | none |
 | `pf-route53-naptr-regexp-replacement-exclusive` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A NAPTR value carries either a regexp or a replacement, never both | ERROR | none |
 | `pf-route53-naptr-service-quotes` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | The NAPTR service field must be quoted | ERROR | none |
-| `pf-route53-private-zone-health-check-policy` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A simple record in a private hosted zone cannot carry a health check | ERROR | none |
+| `pf-route53-private-zone-health-check-policy` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A record with no routing policy cannot reference a health check | ERROR | none |
 | `pf-route53-record-comment-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Comment is limited to 256 characters | ERROR | pending-engine |
 | `pf-route53-record-name-charset` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | A record name cannot contain a space | ERROR | none |
 | `pf-route53-record-name-label-length` | AWS::Route53::RecordSet<br>AWS::Route53::RecordSetGroup | Each label of a record name is limited to 63 bytes | ERROR | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.86" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.88" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */