cfn-typed 0.1.0__tar.gz

cfn_typed-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,11 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yml

cfn_typed-0.1.0/.github/workflows/docs.yml

@@ -0,0 +1,36 @@
+name: Documentation
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/configure-pages@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+      - run: pip install zensical .
+      - run: scripts/build-docs.sh # downloads the schemas, generates types and reference pages, builds the site
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+      - uses: actions/deploy-pages@v5
+        id: deployment

cfn_typed-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,34 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  test:
+    uses: ./.github/workflows/test.yml
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set version from release tag
+        run: |
+          VERSION="${{ github.ref_name }}"
+          VERSION="${VERSION#v}"
+          sed -i "s/^version = .*/version = \"$VERSION\"/" pyproject.toml
+          echo "Set version to $VERSION"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Build package
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

cfn_typed-0.1.0/.github/workflows/test.yml

@@ -0,0 +1,36 @@
+name: Test
+
+on:
+  workflow_call:
+    inputs:
+      python-versions:
+        description: JSON array of Python versions to test
+        type: string
+        default: '["3.14"]'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ${{ fromJson(inputs.python-versions) }}
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Generate the types the examples and tests use
+        run: uv run cfn-typegen --out examples/cfn_types $(grep -v '^#' examples/types.txt)
+
+      - name: Run type checks
+        run: uv run ty check
+
+      - name: Run tests
+        run: uv run pytest tests/ -v

cfn_typed-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+.venv/
+__pycache__/
+.pytest_cache/
+site/
+.cache/
+examples/cfn_types/
+docs/reference/
+uv.lock
+dist/

cfn_typed-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ville Vainio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

cfn_typed-0.1.0/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.5
+Name: cfn-typed
+Version: 0.1.0
+Summary: CloudFormation templates as typed Python dicts, with types generated from the registry schemas
+Project-URL: Homepage, https://github.com/vivainio/cfn-typed
+Project-URL: Documentation, https://vivainio.github.io/cfn-typed/
+Project-URL: Repository, https://github.com/vivainio/cfn-typed
+Project-URL: Issues, https://github.com/vivainio/cfn-typed/issues
+License-Expression: MIT
+License-File: LICENSE
+Keywords: aws,cloudformation,codegen,infrastructure-as-code,typeddict,typing
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Code Generators
+Classifier: Typing :: Typed
+Requires-Python: >=3.14
+Requires-Dist: typing-extensions>=4.13
+Provides-Extra: yaml
+Requires-Dist: pyyaml>=6; extra == 'yaml'
+Description-Content-Type: text/markdown
+
+# cfn-typed
+
+CloudFormation templates as typed Python dicts. Resource factories and their
+`TypedDict`s are **generated from the official CloudFormation registry
+schemas** (1,873 resource types), so a type checker catches typos, wrong types
+and missing required properties before CloudFormation does. Checked with
+[`ty`](https://docs.astral.sh/ty/).
+
+```python
+import json
+import cfn_typed as cfn
+from cfn_types import sqs  # generated, see below
+
+template: cfn.Template = {
+    "Resources": {
+        "DLQ": sqs.queue(),
+        "Queue": sqs.queue(
+            VisibilityTimeout=180,
+            RedrivePolicy={"deadLetterTargetArn": cfn.get_att("DLQ", "Arn"), "maxReceiveCount": 3},
+        ),
+    },
+}
+print(json.dumps(template, indent=2))
+```
+
+```text
+error[unknown-argument]: Argument `MemorySise` does not match any known parameter of function `function`
+error[invalid-argument-type]: Expected `Expr[int]`, found `Literal["30"]`
+error[missing-argument]: No arguments provided for required parameters `Code`, `Role`
+```
+
+## Generating only what you use
+
+The package ships no resource types. You generate the ones you need into your
+own project, so the output stays small (four resources is about 44 KB):
+
+```sh
+cfn-typegen --out cfn_types AWS::SQS::Queue 'AWS::Lambda::*'
+cfn-typegen --out cfn_types --template template.json   # types a JSON template uses
+cfn-typegen --out cfn_types --all                      # everything, ~19 MB
+```
+
+Type names are case-insensitive globs and an unmatched name is an error. The
+schema zip is downloaded once into `~/.cache/cfn-typegen/`; `--schemas` points at a local copy.
+Rerunning replaces earlier generated files in the output directory.
+
+## Layout of the generated modules
+
+One module per service. For `AWS::Lambda::Function` there is
+`lambda_.function(**props)` (the factory), `lambda_.Function` (the resource dict),
+`lambda_.FunctionProps`, and one type per nested definition
+(`lambda_.FunctionCode`, ...). Python keywords get a trailing `_`. Factories also
+take `depends_on`, `deletion_policy`, `update_replace_policy`, `condition` and
+`metadata` as snake_case keywords, so they never collide with a property name.
+
+`cfn_typed` itself holds the runtime pieces the generated code imports:
+`intrinsics` (`Ref`, `GetAtt`, ..., and `Expr[T]` = `T | Intrinsic`, which every
+generated property uses), `base` (`Template`, `Tag`, `build`) and a few helpers.
+`examples/` has a worked SQS + Lambda stack and `examples/cfn_types/` is its
+generated output.
+
+## JSON or YAML
+
+`cfn.to_json(template)` and `cfn.to_yaml(template)` (YAML needs `cfn-typed[yaml]`) render
+the same template. The YAML uses short-form intrinsics (`!Ref`, `!GetAtt A.Arn`, ...).
+
+## Patterns
+
+Helper functions that return a resource or a small fragment (a queue with its
+dead-letter queue, a Lambda role, ...) are documented in the book, with working
+code in `examples/patterns.py`. Build it locally with `uv run zensical serve`.
+
+## Type checking notes
+
+Read-only properties (`Arn`, `Id`, ...) are left out of the inputs. Shapes whose
+schema says `additionalProperties: false` are emitted as PEP 728 `closed=True`
+TypedDicts, which is what makes `ty` reject unknown names.
+
+Known gaps: enums are plain `str` (no `Literal`, so newly added values never
+break you); `oneOf` constraints between properties are not modelled; arrays are
+`list`, which is invariant, so a variable typed `list[Tag]` needs
+`list[Expr[Tag]]`.
+
+## Development
+
+The repo contains no generated types. The examples and tests need a few, which are
+generated into `examples/cfn_types/` (gitignored) the first time pytest runs, or by hand:
+
+```sh
+cfn-typegen --out examples/cfn_types AWS::SQS::Queue AWS::Lambda::Function \
+    AWS::Lambda::EventSourceMapping AWS::IAM::Role
+uv run ty check
+uv run pytest
+scripts/build-docs.sh        # generate types and reference pages, build the book (needs zensical)
+```
+
+## Releasing
+
+Releases are published to PyPI from GitHub with trusted publishing (no token). The
+version in `pyproject.toml` stays `0.0.0.dev0`; the workflow sets it from the tag.
+
+```sh
+gh release create v0.1.0 --generate-notes
+```
+
+That runs the tests, builds with `uv build` and publishes. One-time setup on PyPI:
+add a trusted publisher for the project `cfn-typed` (owner `vivainio`, repository
+`cfn-typed`, workflow `publish.yml`, environment `pypi`), and create the `pypi`
+environment under the repository's Settings, Environments.

cfn_typed-0.1.0/README.md

@@ -0,0 +1,109 @@
+# cfn-typed
+
+CloudFormation templates as typed Python dicts. Resource factories and their
+`TypedDict`s are **generated from the official CloudFormation registry
+schemas** (1,873 resource types), so a type checker catches typos, wrong types
+and missing required properties before CloudFormation does. Checked with
+[`ty`](https://docs.astral.sh/ty/).
+
+```python
+import json
+import cfn_typed as cfn
+from cfn_types import sqs  # generated, see below
+
+template: cfn.Template = {
+    "Resources": {
+        "DLQ": sqs.queue(),
+        "Queue": sqs.queue(
+            VisibilityTimeout=180,
+            RedrivePolicy={"deadLetterTargetArn": cfn.get_att("DLQ", "Arn"), "maxReceiveCount": 3},
+        ),
+    },
+}
+print(json.dumps(template, indent=2))
+```
+
+```text
+error[unknown-argument]: Argument `MemorySise` does not match any known parameter of function `function`
+error[invalid-argument-type]: Expected `Expr[int]`, found `Literal["30"]`
+error[missing-argument]: No arguments provided for required parameters `Code`, `Role`
+```
+
+## Generating only what you use
+
+The package ships no resource types. You generate the ones you need into your
+own project, so the output stays small (four resources is about 44 KB):
+
+```sh
+cfn-typegen --out cfn_types AWS::SQS::Queue 'AWS::Lambda::*'
+cfn-typegen --out cfn_types --template template.json   # types a JSON template uses
+cfn-typegen --out cfn_types --all                      # everything, ~19 MB
+```
+
+Type names are case-insensitive globs and an unmatched name is an error. The
+schema zip is downloaded once into `~/.cache/cfn-typegen/`; `--schemas` points at a local copy.
+Rerunning replaces earlier generated files in the output directory.
+
+## Layout of the generated modules
+
+One module per service. For `AWS::Lambda::Function` there is
+`lambda_.function(**props)` (the factory), `lambda_.Function` (the resource dict),
+`lambda_.FunctionProps`, and one type per nested definition
+(`lambda_.FunctionCode`, ...). Python keywords get a trailing `_`. Factories also
+take `depends_on`, `deletion_policy`, `update_replace_policy`, `condition` and
+`metadata` as snake_case keywords, so they never collide with a property name.
+
+`cfn_typed` itself holds the runtime pieces the generated code imports:
+`intrinsics` (`Ref`, `GetAtt`, ..., and `Expr[T]` = `T | Intrinsic`, which every
+generated property uses), `base` (`Template`, `Tag`, `build`) and a few helpers.
+`examples/` has a worked SQS + Lambda stack and `examples/cfn_types/` is its
+generated output.
+
+## JSON or YAML
+
+`cfn.to_json(template)` and `cfn.to_yaml(template)` (YAML needs `cfn-typed[yaml]`) render
+the same template. The YAML uses short-form intrinsics (`!Ref`, `!GetAtt A.Arn`, ...).
+
+## Patterns
+
+Helper functions that return a resource or a small fragment (a queue with its
+dead-letter queue, a Lambda role, ...) are documented in the book, with working
+code in `examples/patterns.py`. Build it locally with `uv run zensical serve`.
+
+## Type checking notes
+
+Read-only properties (`Arn`, `Id`, ...) are left out of the inputs. Shapes whose
+schema says `additionalProperties: false` are emitted as PEP 728 `closed=True`
+TypedDicts, which is what makes `ty` reject unknown names.
+
+Known gaps: enums are plain `str` (no `Literal`, so newly added values never
+break you); `oneOf` constraints between properties are not modelled; arrays are
+`list`, which is invariant, so a variable typed `list[Tag]` needs
+`list[Expr[Tag]]`.
+
+## Development
+
+The repo contains no generated types. The examples and tests need a few, which are
+generated into `examples/cfn_types/` (gitignored) the first time pytest runs, or by hand:
+
+```sh
+cfn-typegen --out examples/cfn_types AWS::SQS::Queue AWS::Lambda::Function \
+    AWS::Lambda::EventSourceMapping AWS::IAM::Role
+uv run ty check
+uv run pytest
+scripts/build-docs.sh        # generate types and reference pages, build the book (needs zensical)
+```
+
+## Releasing
+
+Releases are published to PyPI from GitHub with trusted publishing (no token). The
+version in `pyproject.toml` stays `0.0.0.dev0`; the workflow sets it from the tag.
+
+```sh
+gh release create v0.1.0 --generate-notes
+```
+
+That runs the tests, builds with `uv build` and publishes. One-time setup on PyPI:
+add a trusted publisher for the project `cfn-typed` (owner `vivainio`, repository
+`cfn-typed`, workflow `publish.yml`, environment `pypi`), and create the `pypi`
+environment under the repository's Settings, Environments.

cfn_typed-0.1.0/docs/gen_reference.py

@@ -0,0 +1,100 @@
+"""Render a reference page per resource type from the CloudFormation schemas.
+
+Run by scripts/build-docs.sh (and CI) before `zensical build`; the output in
+docs/reference/ is gitignored, so the pages always match the schemas just downloaded.
+"""
+
+import re
+from pathlib import Path
+from typing import Any
+
+from cfn_typed import typegen
+
+ROOT = Path(__file__).resolve().parent.parent
+OUT = ROOT / "docs" / "reference"
+
+
+def cell(text: str | None) -> str:
+    return (text or "").replace("|", "\\|").replace("\n", " ").strip()
+
+
+def describe(node: dict[str, Any], schema: dict[str, Any], depth: int = 0) -> str:
+    if "$ref" in node and depth < 5:
+        target: Any = schema
+        for part in node["$ref"].removeprefix("#/").split("/"):
+            target = target[part]
+        name = node["$ref"].rsplit("/", 1)[-1]
+        return f"{name} (object)" if target.get("properties") else describe(target, schema, depth + 1)
+    t = node.get("type")
+    if isinstance(t, list):
+        return " or ".join(describe({**node, "type": x}, schema, depth) for x in t)
+    if t == "array":
+        item = node.get("items")
+        return f"list of {describe(item, schema, depth + 1)}" if isinstance(item, dict) else "list"
+    if t == "object":
+        return "object" if node.get("properties") else "map"
+    if t == "string" and node.get("enum"):
+        return "string (one of a fixed set)"
+    return t or "any"
+
+
+def render(schema: dict[str, Any]) -> str:
+    type_name = schema["typeName"]
+    parts = type_name.split("::")
+    res = typegen.pascal("".join(parts[2:]))
+    svc = parts[1].lower() + ("_" if parts[1].lower() in typegen.keyword.kwlist else "")
+    factory = typegen.snake(res) + ("_" if typegen.reserved(typegen.snake(res)) else "")
+    hidden = typegen.readonly_props(schema)
+    required = set(schema.get("required", ())) - hidden
+    rows = [
+        f"| `{k}` | {cell(describe(v, schema))} | {'yes' if k in required else ''} | {cell(typegen.short(v.get('description')))} |"
+        for k, v in schema.get("properties", {}).items() if k not in hidden
+    ]
+    attrs = sorted(hidden)
+    lines = [
+        f"# {type_name}",
+        "",
+        cell(typegen.short(schema.get("description"))),
+        "",
+        "```python",
+        f"from cfn_types import {svc}",
+        "",
+        f"{svc}.{factory}(**props)   # returns {svc}.{res}",
+        "```",
+        "",
+        "## Properties",
+        "",
+        "| Property | Type | Required | Description |",
+        "|---|---|---|---|",
+        *rows,
+        "",
+    ]
+    if attrs:
+        lines += [
+            "## Attributes",
+            "",
+            "Read-only values you can read with `get_att(logical_id, attribute)`. They are not accepted as inputs.",
+            "",
+            *[f"- `{a}`" for a in attrs],
+            "",
+        ]
+    if url := schema.get("documentationUrl"):
+        lines += [f"[AWS documentation]({url})", ""]
+    return "\n".join(lines)
+
+
+def main() -> None:
+    wanted = [t for t in (ROOT / "examples" / "types.txt").read_text().split("\n") if t and not t.startswith("#")]
+    schemas = typegen.select(typegen.load_schemas(typegen.ensure_schemas(typegen.CACHE)), wanted)
+    OUT.mkdir(parents=True, exist_ok=True)
+    index = ["# Reference", "", "Generated from the CloudFormation registry schemas when the book is built.", ""]
+    for schema in schemas:
+        slug = re.sub(r"\W+", "-", schema["typeName"].replace("AWS::", "")).lower()
+        (OUT / f"{slug}.md").write_text(render(schema))
+        index.append(f"- [{schema['typeName']}]({slug}.md)")
+    (OUT / "index.md").write_text("\n".join(index) + "\n")
+    print(f"wrote {len(schemas)} reference pages to {OUT}")
+
+
+if __name__ == "__main__":
+    main()

cfn_typed-0.1.0/docs/generator.md

@@ -0,0 +1,48 @@
+# The generator
+
+`cfn-typegen` turns AWS's CloudFormation registry schemas (about 1,900 resource
+types) into Python modules, for **only the types you select**.
+
+```sh
+cfn-typegen --out cfn_types AWS::SQS::Queue 'AWS::Lambda::*'
+cfn-typegen --out cfn_types --template template.json
+cfn-typegen --out cfn_types --all                         # everything, ~19 MB
+```
+
+Type names are case-insensitive globs and an unmatched name is an error. The
+schema zip is downloaded once into `~/.cache/cfn-typegen/`; `--schemas` points at
+a local copy. A rerun replaces only files it generated earlier.
+
+## What one resource looks like
+
+For `AWS::SQS::Queue`, one module `sqs.py` holds:
+
+| Name | Purpose |
+|---|---|
+| `QueueProps` | the properties, as a `TypedDict` |
+| `Queue` | the resource dict, with `Type: Literal["AWS::SQS::Queue"]` |
+| `queue(**props)` | a factory; keyword arguments are checked against `QueueProps` |
+| one class per nested definition | named `{Resource}{Definition}`, for example `FunctionCode` |
+
+Factories also take `depends_on`, `deletion_policy`, `update_replace_policy`,
+`condition` and `metadata` as snake_case keywords, so they never collide with a
+property name. Python keywords and builtins get a trailing underscore
+(`lambda_`).
+
+## Why the checker is strict
+
+- **Closed TypedDicts.** Shapes the schema marks `additionalProperties: false` are
+  emitted with `closed=True` (PEP 728). That is what turns `MemorySise` into an
+  error; `ty` ignores unknown keywords on ordinary TypedDicts.
+- **`Expr[T]` everywhere.** A property is `T` or an intrinsic, because
+  CloudFormation accepts `Ref`, `Fn::GetAtt` and friends wherever a value goes.
+- **Read-only properties are left out.** You cannot set `Arn` or `QueueUrl`, so the
+  inputs do not offer them.
+
+## Known gaps
+
+- Enums are plain `str`, not `Literal`, so values AWS adds later never break you.
+- `oneOf` constraints between properties are not modelled.
+- Arrays are `list`, which is invariant: a variable typed `list[Tag]` must be
+  `list[Expr[Tag]]` to be passed in. `cfn.tags()` returns the right type.
+- Types do not replace `cfn-lint`: they check shape, not values.

cfn_typed-0.1.0/docs/getting-started.md

@@ -0,0 +1,98 @@
+# Getting started
+
+## Install
+
+```sh
+uv add cfn-typed          # the runtime pieces and the cfn-typegen command
+uv add --dev ty           # the type checker this project is tested with
+```
+
+Until it is on PyPI, install from GitHub:
+`uv add git+https://github.com/vivainio/cfn-typed`. Python 3.14 or later is required.
+
+## Generate the types you use
+
+The package ships no resource types. You generate the ones your templates need
+into your own project:
+
+```sh
+cfn-typegen --out cfn_types AWS::SQS::Queue 'AWS::Lambda::*' AWS::IAM::Role
+```
+
+Or point it at a template that already exists and it emits exactly the types that
+template uses:
+
+```sh
+cfn-typegen --out cfn_types --template template.json
+```
+
+Each service becomes one module (`cfn_types/sqs.py`, `cfn_types/lambda_.py`, ...).
+Each run writes a clean set of modules and replaces only files it generated earlier.
+Whether to commit them or generate them in CI is up to you.
+
+## A minimal program
+
+The whole program is one file: build the template as data, print it as JSON.
+
+```python
+--8<-- "examples/minimal.py:main"
+```
+
+`build` is a pure function of its arguments, so tests can call it directly. `main`
+only reads the stage from the command line and prints. Render and deploy:
+
+```sh
+python minimal.py prod > template.json
+aws cloudformation deploy --template-file template.json --stack-name jobs-prod
+```
+
+## JSON or YAML
+
+`cfn.to_json(template)` is `json.dumps` with a default indent. `cfn.to_yaml(template)`
+writes the same template as readable CloudFormation YAML:
+
+```python
+print(cfn.to_yaml(build("prod")))
+```
+
+```yaml
+AWSTemplateFormatVersion: '2010-09-09'
+Resources:
+  Jobs:
+    Type: AWS::SQS::Queue
+    Properties:
+      VisibilityTimeout: 60
+      Tags:
+        - Key: Stage
+          Value: prod
+Outputs:
+  JobsUrl:
+    Value: !Ref Jobs
+```
+
+Intrinsics use CloudFormation's short forms (`!Ref`, `!GetAtt Jobs.Arn`, `!Sub`, `!Join`,
+...), keys keep the order you wrote them, lists are indented under their key, and
+multi-line strings such as `UserData` become `|` blocks. A list that is shared between
+resources (the tags in the examples) is repeated, never turned into a YAML anchor.
+
+!!! note "YAML needs PyYAML"
+    JSON has no dependencies. For YAML install the extra: `uv add 'cfn-typed[yaml]'`.
+
+!!! note "Nested short forms"
+    CloudFormation does not allow a short form directly inside another one
+    (`!Base64 !Sub ...`). When that happens `to_yaml` keeps the outer function in long
+    form (`Fn::Base64: !Sub ...`). Functions with no short form, such as `Fn::Length`,
+    also stay long. Parsing the YAML back gives exactly the template you started with;
+    the test suite checks that round trip.
+
+## Let the checker help
+
+```sh
+ty check
+```
+
+Anywhere a property takes a value you can pass either a literal or an intrinsic
+such as `cfn.ref(...)` or `cfn.get_att(...)`: every generated property is
+`Expr[T]`, meaning `T` or an intrinsic. Unknown names, wrong types and missing
+required properties are reported before any template exists. Keep `cfn-lint` in CI
+as well: types do not check values, such as whether a Lambda runtime exists.