Skip to content

README.md

Latest commit

 

History

History
37 lines (27 loc) · 3.81 KB

README.md

File metadata and controls

37 lines (27 loc) · 3.81 KB
Raw

CloudFormation

Parity grade: A · SDK aws-sdk-go-v2/service/cloudformation@v1.82.0 · last audited 2026-10-09 (54869319e)

Coverage

Metric Value
PARITY entries audited 73 (72 ok, 1 partial)
Feature families 19 (19 ok)
Known gaps 6
Structural gaps (can't be emulated) 2
Deferred items 0
Resource leaks clean

Known gaps

  • Resource-type strictness is by service namespace only: an AWS::Svc::Res whose Svc is unknown to the spec fixture and the provisioner fails with "Template format error: Unrecognized resource types: [X]" (cfn_resource_services.json, generated by cmd/cfnattrgen), but an unmodelled resource of a known service still falls through to the stub path because the committed spec fixture lists types with attributes only. Unknown/mistyped properties and wrong property types are not rejected: no property schema is vendored (resource_type_schemas.go is trimmed; refreshing the full CloudFormationResourceSpecification needs network). Only the required-property set for ~21 certain types is enforced (cfn_required_properties.json); Rules support Fn::Equals/And/Or/Not/Contains/EachMemberEquals/EachMemberIn (no RefAll/ValueOf/ValueOfAll), and the Parameter-constraint, Rules-assertion and Unrecognized-parameter-type wordings are best-effort recollections of CloudFormation text, not SDK-verifiable.
  • CreateStack/UpdateStack complete synchronously: CREATE_IN_PROGRESS/UPDATE_IN_PROGRESS are only visible as stack events, never via DescribeStacks.
  • Stack policy: Replacement Conditionally is treated as Update:Replace (deliberate, not an AWS-documented rule), and AWS's separate logical-ID/resource-type default-deny note is not modeled; NotAction/NotResource follow plain inversion (gopherstack-cqy3).
  • No nested-stack change-set or public-extension version machinery exists, so these stay unmodeled: CreateChangeSet IncludeNestedStacks (no nested-stack diff machinery), UpdateStack RetainExceptOnCreate, RollbackStack RoleARN, ActivateType MajorVersion/VersionBump/TypeNameAlias (no public extension version catalog) (gopherstack-xhu2t).
  • SAM transform (AWS::Serverless-2016-10-31) still unexpanded (FunctionUrlConfig and EventInvokeConfig now expand; EventInvokeConfig destinations need an explicit Destination ARN): HttpApi Auth/Domain/DefinitionBody/DefinitionUri/PropagateTags and HttpApi event Auth, Api event RequestParameters/RequestModel/ApiKeyRequired/AWS_IAM authorizers/UsagePlan/ResourcePolicy/Domain, Cognito AuthorizationScopes, ScheduleV2 DeadLetterConfig Type SQS (queue generation), SAM policy templates, Application/Connector/GraphQLApi/WebSocketApi, DeploymentPreference, StateMachine Events. All fail the stack/change set with an explicit reason, never silently dropped.
  • SAM HttpApi emits separate AWS::ApiGatewayV2::Integration/Route resources (Integration/Route) instead of the OpenAPI Body real SAM generates, and SAM S3 events omit the Bucket DependsOn Permission edge (it would be circular here); logical IDs for those extras differ from real SAM.

Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • changeset_diff.go requiresRecreation() covers a curated subset of resource types' replacement-forcing properties: CloudFormation resource property schemas are not part of aws-sdk-go-v2, so the full set cannot be derived (gopherstack-e5h).
  • ListResourceScanRelatedResources always returns an empty list: no cross-resource relationship graph is computed for a scan, so MaxResults/Resources have nothing to page or seed from.

More