cdk-preflight 0.0.95 → 0.0.97

package/.jsii

@@ -9416,7 +9416,7 @@
   },
   "name": "cdk-preflight",
   "readme": {
-    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n  <a href=\"docs/rules.md\"><img src=\"https://img.shields.io/badge/rules-2018-blue\" alt=\"2018 bundled rules\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**: they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
+    "markdown": "<p align=\"center\">\n  <img src=\"https://raw.githubusercontent.com/badmintoncryer/cdk-preflight/main/assets/logo.png\" alt=\"cdk-preflight\" width=\"104\" height=\"104\">\n</p>\n\n<h1 align=\"center\">cdk-preflight</h1>\n\n<p align=\"center\">\n  <strong>Catch deploy-time CloudFormation failures at <code>cdk synth</code> time.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml\"><img src=\"https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg\" alt=\"monthly real-deploy verification\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/v/cdk-preflight.svg\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/cdk-preflight\"><img src=\"https://img.shields.io/npm/dt/cdk-preflight.svg\" alt=\"npm total downloads\"></a>\n  <a href=\"docs/rules.md\"><img src=\"https://img.shields.io/badge/rules-2089-blue\" alt=\"2089 bundled rules\"></a>\n</p>\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS. The handful of rules that could not be reproduced are marked `doc-only` and report as **warnings**: they show up in the validation report but never fail synth. Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## What it catches\n\nFour ordinary-looking snippets. All of them pass `cdk synth` and CloudFormation\npre-deployment validation, and all of them fail minutes into a deployment:\n\n```ts\n// 1) pf-iam-inline-policy-size — enumerate buckets, grant each one, blow past 10,240 chars\n//    \"Maximum policy size of 10240 bytes exceeded for role IngestRole\"\n//    (via role.addToPolicy the CDK auto-splits into managed policies instead,\n//     and you hit the 6,144-char limit as pf-iam-managed-policy-size)\nnew iam.Policy(this, 'IngestPolicy', {\n  roles: [role],\n  statements: [new iam.PolicyStatement({\n    actions: ['s3:GetObject', 's3:ListBucket'],\n    resources: Array.from({ length: 200 },\n      (_, i) => `arn:aws:s3:::data-lake-landing-zone-${i}/year=*/month=*/*`),\n  })],\n});\n\n// 2) pf-lambda-env-size — a config blob in the environment, over the 4KB total\n//    \"Lambda was unable to configure your environment variables because the\n//     environment variables you have provided exceeded the 4KB limit\"\nnew lambda.Function(this, 'Fn', {\n  runtime: lambda.Runtime.NODEJS_22_X,\n  handler: 'index.handler',\n  code: lambda.Code.fromInline('exports.handler = async () => {};'),\n  environment: { FEATURE_FLAGS: JSON.stringify(bigFeatureFlagMap) },\n});\n\n// 3) pf-sfn-asl-missing-state (+ pf-sfn-asl-unreachable-state) — a typo in a state name\n//    \"Invalid State Machine Definition: 'MISSING_TRANSITION_TARGET: ...'\"\nnew sfn.StateMachine(this, 'Pipeline', {\n  definitionBody: sfn.DefinitionBody.fromString(JSON.stringify({\n    StartAt: 'Validate',\n    States: {\n      Validate: { Type: 'Pass', Next: 'Transform' },\n      Trasform: { Type: 'Pass', End: true },   // typo: Transform\n    },\n  })),\n});\n\n// 4) pf-logs-filter-pattern-bracket — a filter pattern opened with '[' and never closed\n//    \"If a filter pattern starts with '[' it must end with ']'\"\nnew logs.MetricFilter(this, 'ErrorFilter', {\n  logGroup,\n  metricNamespace: 'Pipeline',\n  metricName: 'Errors',\n  filterPattern: logs.FilterPattern.literal('[time, level=ERROR, msg'),\n});\n```\n\nNone of these are type errors, so the L2 constructs accept them; none of them are\nexpressible in a resource schema, so CloudFormation accepts the template. With\n`Preflight.apply(app)` in place they fail `cdk synth` instead.\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n> **If the rules cannot run, the build stops.** When the evaluation engine fails on a template (a rule pack that\n> does not compile, an engine bug), enforce mode reports it as a violation named `pf-engine-error` and fails\n> synthesis for that stack instead of passing green with no rule having run. The other stacks keep their rules.\n> `pf-engine-error` is not a bundled rule and cannot be `exclude`d; `enforce: false` unblocks the build if you\n> need one.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule everywhere, pass its id in `exclude`. To suppress a\nsingle *finding* on one construct, acknowledge it — this works in both modes, the\nid prefix just differs (`cdk-preflight::` when enforcing, `CloudFormation-Validate::`\nin observe-only, as printed in the warning text):\n\n```ts\ncdk.Validations.of(errorFilter).acknowledge({\n  id: 'cdk-preflight::pf-logs-filter-pattern-bracket',\n  reason: 'log group is written by a legacy producer; pattern is fixed upstream',\n});\n```\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
   },
   "repository": {
     "type": "git",
@@ -9600,6 +9600,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.95",
-  "fingerprint": "yrI1dg5YIBfMGO7HsWmT/JFoyHNULs/sKM//uhOXMKQ="
+  "version": "0.0.97",
+  "fingerprint": "+v5mhLKKJVAdhtpH9zG7zDXlBQAY46YwsZQU8sY9i28="
 }

package/README.md

@@ -12,7 +12,7 @@
   <a href="https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml"><img src="https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg" alt="monthly real-deploy verification"></a>
   <a href="https://www.npmjs.com/package/cdk-preflight"><img src="https://img.shields.io/npm/v/cdk-preflight.svg" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/cdk-preflight"><img src="https://img.shields.io/npm/dt/cdk-preflight.svg" alt="npm total downloads"></a>
-  <a href="docs/rules.md"><img src="https://img.shields.io/badge/rules-2018-blue" alt="2018 bundled rules"></a>
+  <a href="docs/rules.md"><img src="https://img.shields.io/badge/rules-2089-blue" alt="2089 bundled rules"></a>
 </p>
 
 Some CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.

package/docs/rules.md

@@ -206,11 +206,46 @@
 | `pf-asg-wp-weighted-mixed-instances-incompatible` | AWS::AutoScaling::WarmPool<br>AWS::AutoScaling::AutoScalingGroup | A weighted mixed instances policy takes no warm pool | ERROR | none |
 | `pf-asg-zonalshift-cross-zone-disabled-requires-skip-validation` | AWS::AutoScaling::AutoScalingGroup | Zonal shift needs cross-zone load balancing on its target groups | ERROR | none |
 | `pf-asg-zone-or-subnet-required` | AWS::AutoScaling::AutoScalingGroup | A group needs AvailabilityZones, AvailabilityZoneIds, or subnets | ERROR | none |
+| `pf-batch-ce-allocation-strategy-compute-type` | AWS::Batch::ComputeEnvironment | The allocation strategy must match the compute resource type | ERROR | none |
+| `pf-batch-ce-bid-percentage-range` | AWS::Batch::ComputeEnvironment | BidPercentage must be between 0 and 100 | ERROR | none |
+| `pf-batch-ce-desired-vcpus-range` | AWS::Batch::ComputeEnvironment | DesiredvCpus must sit between MinvCpus and MaxvCpus | ERROR | none |
+| `pf-batch-ce-ec2-config-image-type` | AWS::Batch::ComputeEnvironment | Ec2Configuration.ImageType must be one of the image types the environment kind accepts | ERROR | none |
+| `pf-batch-ce-ec2-config-image-type-eol` | AWS::Batch::ComputeEnvironment | Amazon Linux 2 image types are end of life and rejected at create time | ERROR | none |
+| `pf-batch-ce-eks-allocation-strategy` | AWS::Batch::ComputeEnvironment | An EKS compute environment must name an allocation strategy | ERROR | none |
+| `pf-batch-ce-eks-cluster-arn-format` | AWS::Batch::ComputeEnvironment | EksClusterArn must be an EKS cluster ARN | ERROR | none |
+| `pf-batch-ce-eks-cluster-arn-region` | AWS::Batch::ComputeEnvironment | The EKS cluster must live in the region of the compute environment | ERROR | none |
+| `pf-batch-ce-eks-compute-type` | AWS::Batch::ComputeEnvironment | An EKS compute environment runs on EC2 or SPOT, never Fargate | ERROR | none |
+| `pf-batch-ce-eks-min-vcpus` | AWS::Batch::ComputeEnvironment | An EKS compute environment must set MinvCpus | ERROR | none |
+| `pf-batch-ce-eks-namespace-default` | AWS::Batch::ComputeEnvironment | The Kubernetes namespace of an EKS compute environment cannot be default | ERROR | none |
+| `pf-batch-ce-eks-namespace-format` | AWS::Batch::ComputeEnvironment | The Kubernetes namespace must be a DNS-1123 label | ERROR | none |
+| `pf-batch-ce-eks-namespace-kube-prefix` | AWS::Batch::ComputeEnvironment | The Kubernetes namespace of an EKS compute environment cannot be a kube- system namespace | ERROR | none |
+| `pf-batch-ce-eks-namespace-length` | AWS::Batch::ComputeEnvironment | The Kubernetes namespace must be at most 63 characters | ERROR | none |
+| `pf-batch-ce-fargate-security-groups-max` | AWS::Batch::ComputeEnvironment | Fargate compute resources allow at most 5 security groups | ERROR | none |
+| `pf-batch-ce-fargate-subnets-max` | AWS::Batch::ComputeEnvironment | Fargate compute resources allow at most 16 subnets | ERROR | none |
+| `pf-batch-ce-instance-role-required` | AWS::Batch::ComputeEnvironment | EC2 and SPOT compute resources require an InstanceRole | ERROR | none |
+| `pf-batch-ce-instance-types-architecture` | AWS::Batch::ComputeEnvironment | All instance types in a compute environment must share one CPU architecture | ERROR | none |
+| `pf-batch-ce-instance-types-required` | AWS::Batch::ComputeEnvironment | EC2 and SPOT compute resources require a non-empty InstanceTypes list | ERROR | none |
+| `pf-batch-ce-launch-template-id-or-name` | AWS::Batch::ComputeEnvironment | A launch template specification names exactly one of LaunchTemplateId and LaunchTemplateName | ERROR | none |
+| `pf-batch-ce-launch-template-override-id-or-name` | AWS::Batch::ComputeEnvironment | A launch template override cannot set both LaunchTemplateId and LaunchTemplateName | ERROR | none |
+| `pf-batch-ce-launch-template-override-target-overlap` | AWS::Batch::ComputeEnvironment | Launch template overrides must not target the same instance type twice | ERROR | none |
+| `pf-batch-ce-launch-template-override-target-subset` | AWS::Batch::ComputeEnvironment | Override TargetInstanceTypes must be a subset of the compute environment InstanceTypes | ERROR | none |
+| `pf-batch-ce-launch-template-override-targets` | AWS::Batch::ComputeEnvironment | Every launch template override must name its TargetInstanceTypes | ERROR | none |
+| `pf-batch-ce-launch-template-overrides-max` | AWS::Batch::ComputeEnvironment | A launch template specification allows at most 10 overrides | ERROR | none |
+| `pf-batch-ce-launch-template-userdata-type` | AWS::Batch::ComputeEnvironment | UserdataType needs a launch template that carries an ImageId | ERROR | none |
+| `pf-batch-ce-launch-template-version` | AWS::Batch::ComputeEnvironment | LaunchTemplate.Version must be a version number, $Default or $Latest | ERROR | none |
+| `pf-batch-ce-min-vcpus-negative` | AWS::Batch::ComputeEnvironment | MinvCpus must not be negative | ERROR | none |
 | `pf-batch-ce-name` | AWS::Batch::ComputeEnvironment | Compute environment names allow only letters, numbers, hyphen and underscore | ERROR | none |
+| `pf-batch-ce-ordered-strategy-instance-bundles` | AWS::Batch::ComputeEnvironment | The ordered allocation strategies reject instance type bundles | ERROR | none |
+| `pf-batch-ce-security-groups-required` | AWS::Batch::ComputeEnvironment | Compute resources require SecurityGroupIds unless a launch template supplies them | ERROR | none |
+| `pf-batch-ce-spot-fleet-role` | AWS::Batch::ComputeEnvironment | SPOT compute resources on the BEST_FIT strategy require SpotIamFleetRole | ERROR | none |
+| `pf-batch-ce-state-enabled` | AWS::Batch::ComputeEnvironment | A compute environment must be created in the ENABLED state | ERROR | none |
+| `pf-batch-ce-unmanaged-service-linked-role` | AWS::Batch::ComputeEnvironment | The Batch service-linked role cannot serve an UNMANAGED compute environment | ERROR | none |
+| `pf-batch-ce-unmanaged-service-role` | AWS::Batch::ComputeEnvironment | An UNMANAGED compute environment must name a ServiceRole | ERROR | none |
+| `pf-batch-ce-unmanaged-vcpus` | AWS::Batch::ComputeEnvironment | UnmanagedvCpus is only accepted on an UNMANAGED compute environment | ERROR | none |
 | `pf-batch-ce-vcpus-order` | AWS::Batch::ComputeEnvironment | MaxvCpus must be at least MinvCpus | ERROR | none |
 | `pf-batch-cr-name` | AWS::Batch::ConsumableResource | Consumable resource names allow only letters, numbers, hyphen and underscore | ERROR | none |
 | `pf-batch-cr-total-quantity-negative` | AWS::Batch::ConsumableResource | TotalQuantity may not be negative | ERROR | none |
-| `pf-batch-fargate-ce-fields` | AWS::Batch::ComputeEnvironment | Fargate compute environments cannot take AllocationStrategy or InstanceTypes | ERROR | none |
+| `pf-batch-fargate-ce-fields` | AWS::Batch::ComputeEnvironment | Fargate compute environments reject the EC2-only compute resource fields | ERROR | none |
 | `pf-batch-fargate-cpu-memory` | AWS::Batch::JobDefinition | Fargate job definitions must use a supported vCPU/memory combination | ERROR | none |
 | `pf-batch-fargate-execution-role` | AWS::Batch::JobDefinition | Fargate job definitions require ExecutionRoleArn | ERROR | none |
 | `pf-batch-fargate-multinode` | AWS::Batch::JobDefinition | Multi-node parallel jobs are not supported on Fargate | ERROR | none |
@@ -235,6 +270,30 @@
 | `pf-batch-jd-efs-file-system-id-format` | AWS::Batch::JobDefinition | EFS FileSystemId must be an fs- identifier | ERROR | none |
 | `pf-batch-jd-efs-iam-transit-encryption` | AWS::Batch::JobDefinition | EFS IAM authorization requires transit encryption | ERROR | none |
 | `pf-batch-jd-efs-transit-encryption-port-range` | AWS::Batch::JobDefinition | EFS TransitEncryptionPort must be a valid port number | ERROR | none |
+| `pf-batch-jd-eks-annotation-key-reserved-prefix` | AWS::Batch::JobDefinition | Pod annotation keys must not use a reserved Kubernetes prefix | ERROR | none |
+| `pf-batch-jd-eks-annotation-value-length` | AWS::Batch::JobDefinition | Pod annotation values are limited to 255 characters | ERROR | none |
+| `pf-batch-jd-eks-container-name-unique` | AWS::Batch::JobDefinition | Container names must be unique within an EKS pod | ERROR | none |
+| `pf-batch-jd-eks-containers-required` | AWS::Batch::JobDefinition | An EKS pod must define at least one container | ERROR | none |
+| `pf-batch-jd-eks-cpu-limits-ge-requests` | AWS::Batch::JobDefinition | A cpu request must not exceed the cpu limit | ERROR | none |
+| `pf-batch-jd-eks-cpu-value` | AWS::Batch::JobDefinition | EKS cpu values must be whole numbers or multiples of 0.25 | ERROR | none |
+| `pf-batch-jd-eks-dns-policy-value` | AWS::Batch::JobDefinition | DnsPolicy must be Default, ClusterFirst or ClusterFirstWithHostNet | ERROR | none |
+| `pf-batch-jd-eks-empty-dir-medium-value` | AWS::Batch::JobDefinition | EksEmptyDir.Medium must be empty or Memory | ERROR | none |
+| `pf-batch-jd-eks-empty-dir-size-limit-unit` | AWS::Batch::JobDefinition | EksEmptyDir.SizeLimit must be expressed in MiB | ERROR | none |
+| `pf-batch-jd-eks-gpu-integer` | AWS::Batch::JobDefinition | nvidia.com/gpu must be a whole number | ERROR | none |
+| `pf-batch-jd-eks-gpu-limits-eq-requests` | AWS::Batch::JobDefinition | A GPU request must equal the GPU limit | ERROR | none |
+| `pf-batch-jd-eks-image-pull-policy-value` | AWS::Batch::JobDefinition | ImagePullPolicy must be Always, IfNotPresent or Never | ERROR | none |
+| `pf-batch-jd-eks-label-key-format` | AWS::Batch::JobDefinition | Pod label key names must be valid Kubernetes names | ERROR | none |
+| `pf-batch-jd-eks-label-key-reserved-prefix` | AWS::Batch::JobDefinition | Pod label keys must not use a reserved Kubernetes prefix | ERROR | none |
+| `pf-batch-jd-eks-label-value-format` | AWS::Batch::JobDefinition | Pod label values are limited to 63 characters | ERROR | none |
+| `pf-batch-jd-eks-memory-limits-eq-requests` | AWS::Batch::JobDefinition | A memory request must equal the memory limit | ERROR | none |
+| `pf-batch-jd-eks-memory-unit` | AWS::Batch::JobDefinition | EKS memory values must be expressed in MiB | ERROR | none |
+| `pf-batch-jd-eks-metadata-namespace-default` | AWS::Batch::JobDefinition | The pod namespace cannot be the default Kubernetes namespace | ERROR | none |
+| `pf-batch-jd-eks-metadata-namespace-kube-prefix` | AWS::Batch::JobDefinition | The pod namespace cannot be a reserved kube- namespace | ERROR | none |
+| `pf-batch-jd-eks-node-properties` | AWS::Batch::JobDefinition | EksProperties and NodeProperties are mutually exclusive | ERROR | none |
+| `pf-batch-jd-eks-propagate-tags` | AWS::Batch::JobDefinition | Batch on EKS does not support tag propagation | ERROR | none |
+| `pf-batch-jd-eks-resource-key-unsupported` | AWS::Batch::JobDefinition | EKS resource keys are limited to cpu, memory and nvidia.com/gpu | ERROR | none |
+| `pf-batch-jd-eks-resources-required` | AWS::Batch::JobDefinition | An EKS container must request cpu and memory | ERROR | none |
+| `pf-batch-jd-eks-volume-mount-name-exists` | AWS::Batch::JobDefinition | A volume mount must name a volume declared in the pod | ERROR | none |
 | `pf-batch-jd-env-name-required` | AWS::Batch::JobDefinition | Every Environment entry needs a Name | ERROR | none |
 | `pf-batch-jd-evaluate-on-exit-condition-required` | AWS::Batch::JobDefinition | Each EvaluateOnExit entry needs at least one condition | ERROR | none |
 | `pf-batch-jd-evaluate-on-exit-exitcode-format` | AWS::Batch::JobDefinition | EvaluateOnExit.OnExitCode accepts only digits and * | ERROR | none |
@@ -258,10 +317,21 @@
 | `pf-batch-jd-log-awslogs-unknown-option` | AWS::Batch::JobDefinition | The awslogs driver takes only the documented options | ERROR | none |
 | `pf-batch-jd-max-swap-requires-swappiness` | AWS::Batch::JobDefinition | LinuxParameters.MaxSwap requires Swappiness | ERROR | none |
 | `pf-batch-jd-memory-minimum` | AWS::Batch::JobDefinition | ContainerProperties.Memory must be at least 4 MiB | ERROR | none |
+| `pf-batch-jd-mi-no-multinode` | AWS::Batch::JobDefinition | MANAGED_INSTANCES job definitions do not support multi-node parallel jobs | ERROR | none |
 | `pf-batch-jd-mi-os-family-linux` | AWS::Batch::JobDefinition | ECS Managed Instances jobs only support the LINUX operating system family | ERROR | none |
 | `pf-batch-jd-mi-requires-ecs-properties` | AWS::Batch::JobDefinition | MANAGED_INSTANCES job definitions must use EcsProperties | ERROR | none |
 | `pf-batch-jd-multinode-requires-node-properties` | AWS::Batch::JobDefinition | A multinode job definition requires NodeProperties | ERROR | none |
 | `pf-batch-jd-name` | AWS::Batch::JobDefinition | Job definition names allow only letters, numbers, hyphen and underscore | ERROR | none |
+| `pf-batch-jd-node-instance-types-ecs-only` | AWS::Batch::JobDefinition | A node range may only set InstanceTypes together with EcsProperties | ERROR | none |
+| `pf-batch-jd-node-main-node-lt-num` | AWS::Batch::JobDefinition | MainNode must be smaller than NumNodes | ERROR | none |
+| `pf-batch-jd-node-num-nodes-max` | AWS::Batch::JobDefinition | A multi-node job supports between 1 and 1000 nodes | ERROR | none |
+| `pf-batch-jd-node-properties-requires-multinode` | AWS::Batch::JobDefinition | NodeProperties requires the multinode job definition type | ERROR | none |
+| `pf-batch-jd-node-range-payload-exclusive` | AWS::Batch::JobDefinition | A node range uses exactly one of Container, EcsProperties and EksProperties | ERROR | none |
+| `pf-batch-jd-node-range-payload-required` | AWS::Batch::JobDefinition | A node range must define Container, EcsProperties or EksProperties | ERROR | none |
+| `pf-batch-jd-node-ranges-max` | AWS::Batch::JobDefinition | A multi-node job supports at most 5 node ranges | ERROR | none |
+| `pf-batch-jd-node-target-nodes-coverage` | AWS::Batch::JobDefinition | Node ranges must cover every node of the job | ERROR | none |
+| `pf-batch-jd-node-target-nodes-format` | AWS::Batch::JobDefinition | TargetNodes must use the n, n:, :m or n:m form | ERROR | none |
+| `pf-batch-jd-node-target-nodes-in-range` | AWS::Batch::JobDefinition | TargetNodes indexes must be smaller than NumNodes | ERROR | none |
 | `pf-batch-jd-platform-capabilities-single` | AWS::Batch::JobDefinition | PlatformCapabilities takes exactly one value | ERROR | none |
 | `pf-batch-jd-platform-capability-value` | AWS::Batch::JobDefinition | PlatformCapabilities accepts only EC2, FARGATE and MANAGED_INSTANCES | ERROR | none |
 | `pf-batch-jd-props-container-and-ecs` | AWS::Batch::JobDefinition | ContainerProperties and EcsProperties are mutually exclusive | ERROR | none |
@@ -284,6 +354,7 @@
 | `pf-batch-jd-tmpfs-size-min` | AWS::Batch::JobDefinition | Tmpfs.Size must be a positive number of MiB | ERROR | none |
 | `pf-batch-jd-volume-config-exclusive` | AWS::Batch::JobDefinition | A volume takes exactly one configuration type | ERROR | none |
 | `pf-batch-jq-ce-arn-region` | AWS::Batch::JobQueue | Attached compute environments must live in the deployment region | ERROR | none |
+| `pf-batch-jq-ce-mix-fargate-ec2` | AWS::Batch::JobQueue | A job queue cannot mix Fargate and EC2 compute environments | ERROR | none |
 | `pf-batch-jq-ce-order-duplicate-ce` | AWS::Batch::JobQueue | The same compute environment may not be attached twice | ERROR | none |
 | `pf-batch-jq-ce-order-duplicate-order` | AWS::Batch::JobQueue | ComputeEnvironmentOrder entries need distinct Order values | ERROR | none |
 | `pf-batch-jq-ce-order-max` | AWS::Batch::JobQueue | A job queue may reference at most 3 compute environments | ERROR | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.95" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.97" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */