From 49a7a8ae5134369b1c3c46a9c8f3cd2ad407153d Mon Sep 17 00:00:00 2001 From: vicheey <181402101+vicheey@users.noreply.github.com> Date: Tue, 23 Jun 2026 00:53:30 -0700 Subject: [PATCH 1/4] feat(lambda): Add tag propagation support for AWS::Serverless::CapacityProvider (#3942) --- .cfnlintrc.yaml | 1 + .../aws_serverless_capacity_provider.py | 11 + .../internal/schema_source/sam-docs.json | 5 + samtranslator/model/__init__.py | 27 ++- .../model/capacity_provider/generators.py | 19 ++ .../model/capacity_provider/resources.py | 2 + samtranslator/model/sam_resources.py | 9 + samtranslator/plugins/globals/globals.py | 1 + samtranslator/schema/schema.json | 35 +++ schema_source/sam.schema.json | 35 +++ .../capacity_provider/test_generators.py | 36 +++ .../test_validation_rule_value_syntax.py | 200 +++++++++++++++++ ...pacity_provider_managed_resource_tags.yaml | 48 ++++ ...ged_resource_tags_intrinsic_propagate.yaml | 20 ++ ...anaged_resource_tags_mutual_exclusion.yaml | 31 +++ ...pacity_provider_managed_resource_tags.json | 206 ++++++++++++++++++ ...pacity_provider_managed_resource_tags.json | 206 ++++++++++++++++++ ...pacity_provider_managed_resource_tags.json | 206 ++++++++++++++++++ ...ged_resource_tags_intrinsic_propagate.json | 9 + ...anaged_resource_tags_mutual_exclusion.json | 11 + ..._global_capacity_provider_unsupported.json | 4 +- 21 files changed, 1119 insertions(+), 3 deletions(-) create mode 100644 tests/model/test_validation_rule_value_syntax.py create mode 100644 tests/translator/input/capacity_provider_managed_resource_tags.yaml create mode 100644 tests/translator/input/error_capacity_provider_managed_resource_tags_intrinsic_propagate.yaml create mode 100644 tests/translator/input/error_capacity_provider_managed_resource_tags_mutual_exclusion.yaml create mode 100644 tests/translator/output/aws-cn/capacity_provider_managed_resource_tags.json create mode 100644 tests/translator/output/aws-us-gov/capacity_provider_managed_resource_tags.json create mode 100644 tests/translator/output/capacity_provider_managed_resource_tags.json create mode 100644 tests/translator/output/error_capacity_provider_managed_resource_tags_intrinsic_propagate.json create mode 100644 tests/translator/output/error_capacity_provider_managed_resource_tags_mutual_exclusion.json diff --git a/.cfnlintrc.yaml b/.cfnlintrc.yaml index 560779164..72eda88df 100644 --- a/.cfnlintrc.yaml +++ b/.cfnlintrc.yaml @@ -111,6 +111,7 @@ ignore_templates: - tests/translator/output/**/function_with_msk_with_schema_registry_config.json # cfnlint is not updated to recognize the SchemaRegistryConfig property - tests/translator/output/**/function_with_logging_config.json # cfnlint is not updated to recognize the LoggingConfig property - tests/translator/output/aws-*/*capacity_provider*.json # Ignore Capacity Provider test format in non-aws partitions + - tests/translator/output/**/capacity_provider_managed_resource_tags.json # cfnlint not updated for CapacityProvider mode (Phase 2) ignore_checks: - E2531 # Deprecated runtime; not relevant for transform tests diff --git a/samtranslator/internal/schema_source/aws_serverless_capacity_provider.py b/samtranslator/internal/schema_source/aws_serverless_capacity_provider.py index 28b504108..9179b46bf 100644 --- a/samtranslator/internal/schema_source/aws_serverless_capacity_provider.py +++ b/samtranslator/internal/schema_source/aws_serverless_capacity_provider.py @@ -16,11 +16,18 @@ VPC_CONFIG_STEM = "sam-property-capacityprovider-vpcconfig" INSTANCE_REQUIREMENTS_STEM = "sam-property-capacityprovider-instancerequirements" SCALING_CONFIG_STEM = "sam-property-capacityprovider-scalingconfig" +MANAGED_RESOURCE_TAGS_STEM = "sam-property-capacityprovider-managedresourcetags" properties = get_prop(PROPERTIES_STEM) vpcconfig = get_prop(VPC_CONFIG_STEM) instancerequirements = get_prop(INSTANCE_REQUIREMENTS_STEM) scalingconfig = get_prop(SCALING_CONFIG_STEM) +managedresourcetags = get_prop(MANAGED_RESOURCE_TAGS_STEM) + + +class ManagedResourceTags(BaseModel): + Tags: DictStrAny | None = managedresourcetags("Tags") + Propagate: bool | None = managedresourcetags("Propagate") class VpcConfig(BaseModel): @@ -82,6 +89,8 @@ class Properties(BaseModel): # Uses custom ScalingConfig class because SAM renames construct (CapacityProviderScalingConfig→ScalingConfig) ScalingConfig: ScalingConfig | None = properties("ScalingConfig") + ManagedResourceTags: ManagedResourceTags | None = properties("ManagedResourceTags") + KmsKeyArn: PassThroughProp | None = passthrough_prop( PROPERTIES_STEM, "KmsKeyArn", @@ -113,6 +122,8 @@ class Globals(BaseModel): # Uses custom ScalingConfig class because SAM renames construct (CapacityProviderScalingConfig→ScalingConfig) ScalingConfig: ScalingConfig | None = properties("ScalingConfig") + ManagedResourceTags: ManagedResourceTags | None = properties("ManagedResourceTags") + KmsKeyArn: PassThroughProp | None = passthrough_prop( PROPERTIES_STEM, "KmsKeyArn", diff --git a/samtranslator/internal/schema_source/sam-docs.json b/samtranslator/internal/schema_source/sam-docs.json index 7804e0032..3d062da0b 100644 --- a/samtranslator/internal/schema_source/sam-docs.json +++ b/samtranslator/internal/schema_source/sam-docs.json @@ -120,6 +120,10 @@ "Architectures": "The instruction set architectures for the capacity provider instances. \n*Valid values*: `x86_64` or `arm64` \n*Type*: List \n*Required*: No \n*Default*: `x86_64` \n*CloudFormation compatibility*: This property is passed directly to the [`Architectures`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-capacityprovider-instancerequirements.html#cfn-lambda-capacityprovider-instancerequirements-architectures) property of [`InstanceRequirements`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-instancerequirements) of an `AWS::Lambda::CapacityProvider` resource.", "ExcludedTypes": "A list of EC2 instance types to exclude from the capacity provider. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ExcludedInstanceTypes`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-capacityprovider-instancerequirements.html#cfn-lambda-capacityprovider-instancerequirements-excludedinstancetypes) property of [`InstanceRequirements`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-instancerequirements) of an `AWS::Lambda::CapacityProvider` resource." }, + "sam-property-capacityprovider-managedresourcetags": { + "Propagate": "TODO", + "Tags": "TODO" + }, "sam-property-capacityprovider-scalingconfig": { "AverageCPUUtilization": "The target average CPU utilization percentage (https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/0-100.html) for scaling decisions. When the average CPU utilization exceeds this threshold, the capacity provider will scale up Amazon EC2 instances. When specified, AWS SAM constructs [`CapacityProviderScalingConfig`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-capacityproviderscalingconfig) of an `AWS::Lambda::CapacityProvider` resource with the [`ScalingMode`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-capacityprovider-capacityproviderscalingconfig.html#cfn-lambda-capacityprovider-capacityproviderscalingconfig-scalingmode) set to `'Manual'` and [`ScalingPolicies`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-capacityprovider-capacityproviderscalingconfig.html#cfn-lambda-capacityprovider-capacityproviderscalingconfig-scalingpolicies) set to `[{PredefinedMetricType: 'LambdaCapacityProviderAverageCPUUtilization', TargetValue: }]`. \n*Type*: Double \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an CloudFormation equivalent.", "MaxVCpuCount": "The maximum number of vCPUs that the capacity provider can provision across all compute instances. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`MaxVCpuCount`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-capacityprovider-capacityproviderscalingconfig.html#cfn-lambda-capacityprovider-capacityproviderscalingconfig-maxvcpucount) property of [`CapacityProviderScalingConfig`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-capacityproviderscalingconfig) of an `AWS::Lambda::CapacityProvider` resource." @@ -772,6 +776,7 @@ "CapacityProviderName": "The name of the capacity provider. This name must be unique within your AWS account and region. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CapacityProviderName`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-capacityprovidername) property of an `AWS::Lambda::CapacityProvider` resource.", "InstanceRequirements": "Specifications for the types of compute instances that the capacity provider can use. This includes architecture requirements and `allowed` or `excluded` instance types. \n*Type*: [InstanceRequirements](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-capacityprovider-instancerequirements.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`InstanceRequirements`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-instancerequirements) property of an `AWS::Lambda::CapacityProvider` resource.", "KmsKeyArn": "The ARN of the AWS KMS key used to encrypt data at rest and in transit for the capacity provider. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`KmsKeyArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-kmskeyarn) property of an `AWS::Lambda::CapacityProvider` resource.", + "ManagedResourceTags": "TODO", "OperatorRole": "The ARN of the operator role for Lambda with permissions to create and manage Amazon EC2 instances and related resources in the customer account. If not provided, AWS SAM automatically generates a role with the necessary permissions. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CapacityProviderOperatorRoleArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-capacityprovider-capacityproviderpermissionsconfig.html#cfn-lambda-capacityprovider-capacityproviderpermissionsconfig-capacityprovideroperatorrolearn) property of [`PermissionsConfig`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-permissionsconfig) of an `AWS::Lambda::CapacityProvider` resource.", "PropagateTags": "Indicates whether or not to pass tags from the Tags property to your `AWS::Serverless::CapacityProvider` generated resources. Set this to `True` to propagate tags in your generated resources. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an CloudFormation equivalent.", "ScalingConfig": "The scaling configuration for the capacity provider. Defines how the capacity provider scales Amazon EC2 instances based on demand. \n*Type*: [ScalingConfig](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-capacityprovider-scalingconfig.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CapacityProviderScalingConfig`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-capacityproviderscalingconfig) property of an `AWS::Lambda::CapacityProvider` resource.", diff --git a/samtranslator/model/__init__.py b/samtranslator/model/__init__.py index 5f04e3ad3..44a2bdaaf 100644 --- a/samtranslator/model/__init__.py +++ b/samtranslator/model/__init__.py @@ -576,6 +576,7 @@ class ValidationRule(Enum): # Simple tuple-based rules: (rule_type, [property_names]) +# Property names support "Property.Path=Value" syntax for value-conditional presence checks PropertyRule = tuple[ValidationRule, list[str]] @@ -726,7 +727,7 @@ def validate_before_transform(self, schema_class: type[RT] | None, collect_all_e error_messages = [] for rule_type, properties in rules: - present = [prop for prop in properties if self._get_property_value(prop, validated_model) is not None] + present = [prop for prop in properties if self._is_property_present(prop, validated_model)] if rule_type == ValidationRule.MUTUALLY_EXCLUSIVE: # Check if more than one property exists if len(present) > 1: @@ -779,6 +780,30 @@ def _get_property_value(self, prop: str, validated_model: Any = None) -> Any: except Exception: return None + def _is_property_present(self, prop: str, validated_model: Any = None) -> bool: + """Check if a property is 'present' for validation purposes. + + Supports 'Property.Path=Value' syntax: property is only considered present + when its value matches the specified value. Without '=', checks non-None. + + The '=' is split only on the first occurrence, so values containing '=' or + spaces (e.g. 'Prop=Hello World') are handled correctly. + """ + if "=" not in prop: + return self._get_property_value(prop, validated_model) is not None + + prop_path, expected_str = prop.split("=", 1) + actual_value = self._get_property_value(prop_path, validated_model) + + if actual_value is None: + return False + + if expected_str.lower() == "true": + return actual_value is True + if expected_str.lower() == "false": + return actual_value is False + return str(actual_value) == expected_str + class ResourceTypeResolver: """ResourceTypeResolver maps Resource Types to Resource classes, e.g. AWS::Serverless::Function to diff --git a/samtranslator/model/capacity_provider/generators.py b/samtranslator/model/capacity_provider/generators.py index 037808be3..638d1906e 100644 --- a/samtranslator/model/capacity_provider/generators.py +++ b/samtranslator/model/capacity_provider/generators.py @@ -45,6 +45,7 @@ def __init__(self, logical_id: str, **kwargs: Any) -> None: self.instance_requirements = kwargs.get("instance_requirements") or {} self.scaling_config = kwargs.get("scaling_config") or {} self.kms_key_arn = kwargs.get("kms_key_arn") + self.managed_resource_tags = kwargs.get("managed_resource_tags") self.depends_on = kwargs.get("depends_on") self.resource_attributes = kwargs.get("resource_attributes") self.passthrough_resource_attributes = kwargs.get("passthrough_resource_attributes") @@ -111,6 +112,10 @@ def _create_capacity_provider(self) -> LambdaCapacityProvider: if self.kms_key_arn: capacity_provider.KmsKeyArn = self.kms_key_arn + # Set PropagateTags from ManagedResourceTags if provided + if self.managed_resource_tags: + capacity_provider.PropagateTags = self._transform_managed_resource_tags() + # Pass through resource attributes if self.passthrough_resource_attributes: for attr_name, attr_value in self.passthrough_resource_attributes.items(): @@ -214,3 +219,17 @@ def _create_operator_role(self) -> IAMRole: operator_role.logical_id = role_logical_id return operator_role + + def _transform_managed_resource_tags(self) -> dict[str, Any]: + """ + Transform SAM ManagedResourceTags to CFN PropagateTags format. + """ + tags: dict[str, Any] = self.managed_resource_tags or {} + + if "Tags" in tags: + return {"Mode": "Explicit", "ExplicitTags": get_tag_list(tags["Tags"])} + + if "Propagate" in tags: + return {"Mode": "CapacityProvider" if tags["Propagate"] else "None"} + + return {} diff --git a/samtranslator/model/capacity_provider/resources.py b/samtranslator/model/capacity_provider/resources.py index d178e4590..f073b3358 100644 --- a/samtranslator/model/capacity_provider/resources.py +++ b/samtranslator/model/capacity_provider/resources.py @@ -23,6 +23,7 @@ class LambdaCapacityProvider(Resource): "InstanceRequirements": GeneratedProperty(), "CapacityProviderScalingConfig": GeneratedProperty(), "KmsKeyArn": GeneratedProperty(), + "PropagateTags": GeneratedProperty(), } CapacityProviderName: Intrinsicable[str] | None @@ -32,6 +33,7 @@ class LambdaCapacityProvider(Resource): InstanceRequirements: dict[str, Any] | None CapacityProviderScalingConfig: dict[str, Any] | None KmsKeyArn: Intrinsicable[str] | None + PropagateTags: dict[str, Any] | None runtime_attrs = { "name": lambda self: ref(self.logical_id), diff --git a/samtranslator/model/sam_resources.py b/samtranslator/model/sam_resources.py index 0a3a9ba29..e36f57097 100644 --- a/samtranslator/model/sam_resources.py +++ b/samtranslator/model/sam_resources.py @@ -1552,6 +1552,7 @@ class SamCapacityProvider(SamResourceMacro): "InstanceRequirements": Property(False, IS_DICT), "ScalingConfig": Property(False, IS_DICT), "KmsKeyArn": Property(False, one_of(IS_STR, IS_DICT)), + "ManagedResourceTags": Property(False, IS_DICT), } CapacityProviderName: Intrinsicable[str] | None @@ -1562,6 +1563,7 @@ class SamCapacityProvider(SamResourceMacro): InstanceRequirements: dict[str, Any] | None ScalingConfig: dict[str, Any] | None KmsKeyArn: Intrinsicable[str] | None + ManagedResourceTags: dict[str, Any] | None # Validation rules __validation_rules__ = [ @@ -1569,6 +1571,10 @@ class SamCapacityProvider(SamResourceMacro): ValidationRule.MUTUALLY_EXCLUSIVE, ["InstanceRequirements.AllowedTypes", "InstanceRequirements.ExcludedTypes"], ), + ( + ValidationRule.MUTUALLY_EXCLUSIVE, + ["ManagedResourceTags.Propagate=True", "ManagedResourceTags.Tags"], + ), ] def to_cloudformation(self, **kwargs: Any) -> list[Resource]: @@ -1596,6 +1602,9 @@ def to_cloudformation(self, **kwargs: Any) -> list[Resource]: ), scaling_config=model.ScalingConfig.dict(exclude_none=True) if model.ScalingConfig else None, kms_key_arn=passthrough_value(model.KmsKeyArn), + managed_resource_tags=( + model.ManagedResourceTags.dict(exclude_none=True) if model.ManagedResourceTags else None + ), depends_on=self.depends_on, resource_attributes=self.resource_attributes, passthrough_resource_attributes=self.get_passthrough_resource_attributes(), diff --git a/samtranslator/plugins/globals/globals.py b/samtranslator/plugins/globals/globals.py index 83940b03e..bce449604 100644 --- a/samtranslator/plugins/globals/globals.py +++ b/samtranslator/plugins/globals/globals.py @@ -114,6 +114,7 @@ class Globals: "ScalingConfig", "KmsKeyArn", "PropagateTags", + "ManagedResourceTags", ], SamResourceType.WebSocketApi.value: [ "AccessLogSettings", diff --git a/samtranslator/schema/schema.json b/samtranslator/schema/schema.json index 182f52e75..be0039ccb 100644 --- a/samtranslator/schema/schema.json +++ b/samtranslator/schema/schema.json @@ -367462,6 +367462,23 @@ "title": "MSKEventProperties", "type": "object" }, + "ManagedResourceTags": { + "additionalProperties": false, + "properties": { + "Propagate": { + "markdownDescription": "TODO", + "title": "Propagate", + "type": "boolean" + }, + "Tags": { + "markdownDescription": "TODO", + "title": "Tags", + "type": "object" + } + }, + "title": "ManagedResourceTags", + "type": "object" + }, "OAuth2Authorizer": { "additionalProperties": false, "properties": { @@ -369820,6 +369837,15 @@ "title": "KmsKeyArn", "type": "string" }, + "ManagedResourceTags": { + "allOf": [ + { + "$ref": "#/definitions/ManagedResourceTags" + } + ], + "markdownDescription": "TODO", + "title": "ManagedResourceTags" + }, "OperatorRole": { "allOf": [ { @@ -369883,6 +369909,15 @@ "title": "KmsKeyArn", "type": "string" }, + "ManagedResourceTags": { + "allOf": [ + { + "$ref": "#/definitions/ManagedResourceTags" + } + ], + "markdownDescription": "TODO", + "title": "ManagedResourceTags" + }, "OperatorRole": { "allOf": [ { diff --git a/schema_source/sam.schema.json b/schema_source/sam.schema.json index ffc0b7b66..cdc270736 100644 --- a/schema_source/sam.schema.json +++ b/schema_source/sam.schema.json @@ -3024,6 +3024,23 @@ "title": "MSKEventProperties", "type": "object" }, + "ManagedResourceTags": { + "additionalProperties": false, + "properties": { + "Propagate": { + "markdownDescription": "TODO", + "title": "Propagate", + "type": "boolean" + }, + "Tags": { + "markdownDescription": "TODO", + "title": "Tags", + "type": "object" + } + }, + "title": "ManagedResourceTags", + "type": "object" + }, "OAuth2Authorizer": { "additionalProperties": false, "properties": { @@ -5949,6 +5966,15 @@ ], "title": "KmsKeyArn" }, + "ManagedResourceTags": { + "allOf": [ + { + "$ref": "#/definitions/ManagedResourceTags" + } + ], + "markdownDescription": "TODO", + "title": "ManagedResourceTags" + }, "OperatorRole": { "allOf": [ { @@ -6040,6 +6066,15 @@ ], "title": "KmsKeyArn" }, + "ManagedResourceTags": { + "allOf": [ + { + "$ref": "#/definitions/ManagedResourceTags" + } + ], + "markdownDescription": "TODO", + "title": "ManagedResourceTags" + }, "OperatorRole": { "allOf": [ { diff --git a/tests/model/capacity_provider/test_generators.py b/tests/model/capacity_provider/test_generators.py index dfc785c61..c9b52f48d 100644 --- a/tests/model/capacity_provider/test_generators.py +++ b/tests/model/capacity_provider/test_generators.py @@ -1,6 +1,7 @@ from unittest import TestCase from unittest.mock import patch +from parameterized import parameterized from samtranslator.model import Resource from samtranslator.model.capacity_provider.generators import CapacityProviderGenerator from samtranslator.model.capacity_provider.resources import LambdaCapacityProvider @@ -96,6 +97,7 @@ def test_to_cloudformation_with_provided_permissions(self): ) self.assertEqual(properties["PermissionsConfig"]["CapacityProviderOperatorRoleArn"], operator_role) self.assertEqual(properties["KmsKeyArn"], self.kms_key_arn) + self.assertNotIn("PropagateTags", properties) def test_to_cloudformation_with_auto_generated_permissions(self): """Test to_cloudformation with auto-generated operator role""" @@ -221,3 +223,37 @@ def test_create_operator_role(self): def extract_resource(self, resource_array: list[Resource]): return {r.logical_id: r.to_dict()[r.logical_id] for r in resource_array} + + @parameterized.expand( + [ + ("propagate_true", {"Propagate": True}, {"Mode": "CapacityProvider"}), + ("propagate_false", {"Propagate": False}, {"Mode": "None"}), + ( + "explicit_tags", + {"Tags": {"Env": "prod", "Team": "tooling"}}, + { + "Mode": "Explicit", + "ExplicitTags": [{"Key": "Env", "Value": "prod"}, {"Key": "Team", "Value": "tooling"}], + }, + ), + ("empty_dict", {}, {}), + ] + ) + def test_transform_managed_resource_tags(self, _name, input_tags, expected): + """Test _transform_managed_resource_tags translation cases""" + generator = CapacityProviderGenerator(self.logical_id, managed_resource_tags=input_tags) + result = generator._transform_managed_resource_tags() + self.assertEqual(result, expected) + + def test_to_cloudformation_with_managed_resource_tags(self): + """Test that managed_resource_tags flows through to PropagateTags on the CFN resource""" + generator = CapacityProviderGenerator( + self.logical_id, + vpc_config=self.vpc_config, + operator_role=self.operator_role, + managed_resource_tags={"Propagate": True}, + ) + resources = generator.to_cloudformation() + resource_dict = self.extract_resource(resources) + capacity_provider = resource_dict[self.logical_id] + self.assertEqual(capacity_provider["Properties"]["PropagateTags"], {"Mode": "CapacityProvider"}) diff --git a/tests/model/test_validation_rule_value_syntax.py b/tests/model/test_validation_rule_value_syntax.py new file mode 100644 index 000000000..36ff87525 --- /dev/null +++ b/tests/model/test_validation_rule_value_syntax.py @@ -0,0 +1,200 @@ +"""Tests for MUTUALLY_EXCLUSIVE validation rule with =Value conditional presence syntax. + +Parametrized across: +- Path depth: top-level properties vs nested (dot-notation) properties +- Value types: =True, =False, =StringValue, no = (plain presence check) +- Combinations: condition met, condition not met, property absent +""" + +from unittest import TestCase + +from parameterized import parameterized +from samtranslator.internal.schema_source.common import BaseModel +from samtranslator.model import PropertyType, SamResourceMacro, ValidationRule +from samtranslator.model.exceptions import InvalidResourceException +from samtranslator.model.types import IS_BOOL, IS_DICT, IS_STR + +# --- Schema fixtures --- + + +class NestedProps(BaseModel): + Flag: bool | None = None + Mode: str | None = None + Tags: dict | None = None + + +class SchemaFixture(BaseModel): + TopBool: bool | None = None + TopStr: str | None = None + Nested: NestedProps | None = None + + +class ResourceFixture(SamResourceMacro): + resource_type = "Test::Resource" + property_types = { + "TopBool": PropertyType(False, IS_BOOL), + "TopStr": PropertyType(False, IS_STR), + "Nested": PropertyType(False, IS_DICT), + } + + def to_cloudformation(self, **kwargs): + return [] + + +def _make_resource(rules): + class Resource(ResourceFixture): + __validation_rules__ = rules + + return Resource("TestId") + + +class TestValidationRuleValueSyntax(TestCase): + """Tests for =Value conditional presence syntax in MUTUALLY_EXCLUSIVE rules.""" + + @parameterized.expand( + [ + # Top-level: bool =True + ( + ["TopBool=True", "TopStr"], + {"TopBool": True, "TopStr": "val"}, + "top-level bool=True + top-level str", + ), + # Nested: bool =True + ( + ["Nested.Flag=True", "Nested.Tags"], + {"Nested": {"Flag": True, "Tags": {"k": "v"}}}, + "nested bool=True + nested dict", + ), + # Nested: string =Value + ( + ["Nested.Mode=Explicit", "Nested.Tags"], + {"Nested": {"Mode": "Explicit", "Tags": {"k": "v"}}}, + "nested str=Explicit + nested dict", + ), + # Top-level: bool =False + ( + ["TopBool=False", "TopStr"], + {"TopBool": False, "TopStr": "val"}, + "top-level bool=False + top-level str", + ), + # Plain (no =): both non-None triggers error + ( + ["Nested.Flag", "Nested.Tags"], + {"Nested": {"Flag": False, "Tags": {"k": "v"}}}, + "plain nested props, both non-None (backward compat)", + ), + # Mixed: one with =Value, one plain + ( + ["Nested.Mode=Propagate", "TopStr"], + {"Nested": {"Mode": "Propagate"}, "TopStr": "val"}, + "nested str=Value + top-level plain", + ), + # String value with spaces (split on first = only) + ( + ["Nested.Mode=Hello World", "Nested.Tags"], + {"Nested": {"Mode": "Hello World", "Tags": {"k": "v"}}}, + "string value with spaces", + ), + ] + ) + def test_raises_when_condition_met(self, rule_props, props, description): + """Validation should raise when =Value condition is met and target is present.""" + resource = _make_resource([(ValidationRule.MUTUALLY_EXCLUSIVE, rule_props)]) + for key, val in props.items(): + setattr(resource, key, val) + + with self.assertRaises(InvalidResourceException): + resource.validate_before_transform(SchemaFixture) + + @parameterized.expand( + [ + # =True condition not met (value is False) + ( + ["TopBool=True", "TopStr"], + {"TopBool": False, "TopStr": "val"}, + "top-level bool=True rule, actual=False -> valid", + ), + ( + ["Nested.Flag=True", "Nested.Tags"], + {"Nested": {"Flag": False, "Tags": {"k": "v"}}}, + "nested bool=True rule, actual=False -> valid", + ), + # =False condition not met (value is True) + ( + ["TopBool=False", "TopStr"], + {"TopBool": True, "TopStr": "val"}, + "top-level bool=False rule, actual=True -> valid", + ), + # String =Value not matching + ( + ["Nested.Mode=Explicit", "Nested.Tags"], + {"Nested": {"Mode": "None", "Tags": {"k": "v"}}}, + "nested str=Explicit rule, actual=None -> valid", + ), + # Only condition property present (no target) + ( + ["Nested.Flag=True", "Nested.Tags"], + {"Nested": {"Flag": True}}, + "condition met but target absent -> valid", + ), + # Only target present (no condition property) + ( + ["Nested.Flag=True", "Nested.Tags"], + {"Nested": {"Tags": {"k": "v"}}}, + "target present but condition absent -> valid", + ), + # Both absent + ( + ["Nested.Flag=True", "Nested.Tags"], + {"Nested": {}}, + "both absent -> valid", + ), + # Parent property not set at all + ( + ["Nested.Flag=True", "Nested.Tags"], + {}, + "parent property None -> valid", + ), + # Condition value is None (not set) + ( + ["TopBool=True", "TopStr"], + {"TopStr": "val"}, + "condition property None, target present -> valid", + ), + # Top-level + nested mix, condition not met + ( + ["Nested.Mode=Propagate", "TopStr"], + {"Nested": {"Mode": "Explicit"}, "TopStr": "val"}, + "nested str=Propagate rule, actual=Explicit -> valid", + ), + # String value with spaces - not matching + ( + ["Nested.Mode=Hello World", "Nested.Tags"], + {"Nested": {"Mode": "Other Value", "Tags": {"k": "v"}}}, + "string with spaces, value mismatch -> valid", + ), + ] + ) + def test_valid_when_condition_not_met(self, rule_props, props, description): + """Validation should pass when =Value condition is not met.""" + resource = _make_resource([(ValidationRule.MUTUALLY_EXCLUSIVE, rule_props)]) + for key, val in props.items(): + setattr(resource, key, val) + + resource.validate_before_transform(SchemaFixture) # Should not raise + + def test_error_message_includes_value_syntax(self): + """Error message should show the full 'Property=Value' in the output.""" + resource = _make_resource( + [ + (ValidationRule.MUTUALLY_EXCLUSIVE, ["Nested.Flag=True", "Nested.Tags"]), + ] + ) + resource.Nested = {"Flag": True, "Tags": {"k": "v"}} + + with self.assertRaises(InvalidResourceException) as ctx: + resource.validate_before_transform(SchemaFixture) + + self.assertIn("'Nested.Flag=True'", ctx.exception.message) + self.assertIn("'Nested.Tags'", ctx.exception.message) + self.assertIn("together", ctx.exception.message) diff --git a/tests/translator/input/capacity_provider_managed_resource_tags.yaml b/tests/translator/input/capacity_provider_managed_resource_tags.yaml new file mode 100644 index 000000000..c02d0c514 --- /dev/null +++ b/tests/translator/input/capacity_provider_managed_resource_tags.yaml @@ -0,0 +1,48 @@ +AWSTemplateFormatVersion: '2010-09-09' +Transform: AWS::Serverless-2016-10-31 +Description: Test ManagedResourceTags - all configurations + +Parameters: + Environment: + Type: String + Default: Production + +Globals: + CapacityProvider: + ManagedResourceTags: + Propagate: true + +Resources: + CpInheritsGlobal: + Type: AWS::Serverless::CapacityProvider + Properties: + VpcConfig: + SubnetIds: + - subnet-11111111 + SecurityGroupIds: + - sg-11111111 + + CpOverridePropagateFalse: + Type: AWS::Serverless::CapacityProvider + Properties: + VpcConfig: + SubnetIds: + - subnet-22222222 + SecurityGroupIds: + - sg-22222222 + ManagedResourceTags: + Propagate: false + + CpOverrideWithExplicitTags: + Type: AWS::Serverless::CapacityProvider + Properties: + VpcConfig: + SubnetIds: + - subnet-33333333 + SecurityGroupIds: + - sg-33333333 + ManagedResourceTags: + Propagate: false + Tags: + Environment: !Ref Environment + Team: !Sub '${AWS::StackName}-tooling' diff --git a/tests/translator/input/error_capacity_provider_managed_resource_tags_intrinsic_propagate.yaml b/tests/translator/input/error_capacity_provider_managed_resource_tags_intrinsic_propagate.yaml new file mode 100644 index 000000000..d9defb795 --- /dev/null +++ b/tests/translator/input/error_capacity_provider_managed_resource_tags_intrinsic_propagate.yaml @@ -0,0 +1,20 @@ +AWSTemplateFormatVersion: '2010-09-09' +Transform: AWS::Serverless-2016-10-31 +Description: Test ManagedResourceTags.Propagate rejects intrinsic functions + +Parameters: + EnablePropagation: + Type: String + Default: 'true' + +Resources: + CpPropagateWithRef: + Type: AWS::Serverless::CapacityProvider + Properties: + VpcConfig: + SubnetIds: + - subnet-12345678 + SecurityGroupIds: + - sg-12345678 + ManagedResourceTags: + Propagate: !Ref EnablePropagation diff --git a/tests/translator/input/error_capacity_provider_managed_resource_tags_mutual_exclusion.yaml b/tests/translator/input/error_capacity_provider_managed_resource_tags_mutual_exclusion.yaml new file mode 100644 index 000000000..9e08fb482 --- /dev/null +++ b/tests/translator/input/error_capacity_provider_managed_resource_tags_mutual_exclusion.yaml @@ -0,0 +1,31 @@ +AWSTemplateFormatVersion: '2010-09-09' +Transform: AWS::Serverless-2016-10-31 +Description: Test ManagedResourceTags mutual exclusion error + +Globals: + CapacityProvider: + ManagedResourceTags: + Propagate: true + +Resources: + CpBothSet: + Type: AWS::Serverless::CapacityProvider + Properties: + VpcConfig: + SubnetIds: + - subnet-12345678 + ManagedResourceTags: + Propagate: true + Tags: + Environment: Production + + CpExplicitTagsConflictWithGlobal: + Type: AWS::Serverless::CapacityProvider + Properties: + VpcConfig: + SubnetIds: + - subnet-33333333 + ManagedResourceTags: + Tags: + Environment: Production + Team: Tooling diff --git a/tests/translator/output/aws-cn/capacity_provider_managed_resource_tags.json b/tests/translator/output/aws-cn/capacity_provider_managed_resource_tags.json new file mode 100644 index 000000000..5cce90880 --- /dev/null +++ b/tests/translator/output/aws-cn/capacity_provider_managed_resource_tags.json @@ -0,0 +1,206 @@ +{ + "AWSTemplateFormatVersion": "2010-09-09", + "Description": "Test ManagedResourceTags - all configurations", + "Parameters": { + "Environment": { + "Default": "Production", + "Type": "String" + } + }, + "Resources": { + "CpInheritsGlobal": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpInheritsGlobalOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "Mode": "CapacityProvider" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-11111111" + ], + "SubnetIds": [ + "subnet-11111111" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpInheritsGlobalOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws-cn:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + }, + "CpOverridePropagateFalse": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpOverridePropagateFalseOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "Mode": "None" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-22222222" + ], + "SubnetIds": [ + "subnet-22222222" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpOverridePropagateFalseOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws-cn:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + }, + "CpOverrideWithExplicitTags": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpOverrideWithExplicitTagsOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "ExplicitTags": [ + { + "Key": "Environment", + "Value": { + "Ref": "Environment" + } + }, + { + "Key": "Team", + "Value": { + "Fn::Sub": "${AWS::StackName}-tooling" + } + } + ], + "Mode": "Explicit" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-33333333" + ], + "SubnetIds": [ + "subnet-33333333" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpOverrideWithExplicitTagsOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws-cn:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + } + } +} diff --git a/tests/translator/output/aws-us-gov/capacity_provider_managed_resource_tags.json b/tests/translator/output/aws-us-gov/capacity_provider_managed_resource_tags.json new file mode 100644 index 000000000..93cbb50bc --- /dev/null +++ b/tests/translator/output/aws-us-gov/capacity_provider_managed_resource_tags.json @@ -0,0 +1,206 @@ +{ + "AWSTemplateFormatVersion": "2010-09-09", + "Description": "Test ManagedResourceTags - all configurations", + "Parameters": { + "Environment": { + "Default": "Production", + "Type": "String" + } + }, + "Resources": { + "CpInheritsGlobal": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpInheritsGlobalOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "Mode": "CapacityProvider" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-11111111" + ], + "SubnetIds": [ + "subnet-11111111" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpInheritsGlobalOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws-us-gov:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + }, + "CpOverridePropagateFalse": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpOverridePropagateFalseOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "Mode": "None" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-22222222" + ], + "SubnetIds": [ + "subnet-22222222" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpOverridePropagateFalseOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws-us-gov:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + }, + "CpOverrideWithExplicitTags": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpOverrideWithExplicitTagsOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "ExplicitTags": [ + { + "Key": "Environment", + "Value": { + "Ref": "Environment" + } + }, + { + "Key": "Team", + "Value": { + "Fn::Sub": "${AWS::StackName}-tooling" + } + } + ], + "Mode": "Explicit" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-33333333" + ], + "SubnetIds": [ + "subnet-33333333" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpOverrideWithExplicitTagsOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws-us-gov:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + } + } +} diff --git a/tests/translator/output/capacity_provider_managed_resource_tags.json b/tests/translator/output/capacity_provider_managed_resource_tags.json new file mode 100644 index 000000000..09af81aac --- /dev/null +++ b/tests/translator/output/capacity_provider_managed_resource_tags.json @@ -0,0 +1,206 @@ +{ + "AWSTemplateFormatVersion": "2010-09-09", + "Description": "Test ManagedResourceTags - all configurations", + "Parameters": { + "Environment": { + "Default": "Production", + "Type": "String" + } + }, + "Resources": { + "CpInheritsGlobal": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpInheritsGlobalOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "Mode": "CapacityProvider" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-11111111" + ], + "SubnetIds": [ + "subnet-11111111" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpInheritsGlobalOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + }, + "CpOverridePropagateFalse": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpOverridePropagateFalseOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "Mode": "None" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-22222222" + ], + "SubnetIds": [ + "subnet-22222222" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpOverridePropagateFalseOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + }, + "CpOverrideWithExplicitTags": { + "Properties": { + "PermissionsConfig": { + "CapacityProviderOperatorRoleArn": { + "Fn::GetAtt": [ + "CpOverrideWithExplicitTagsOperatorRole", + "Arn" + ] + } + }, + "PropagateTags": { + "ExplicitTags": [ + { + "Key": "Environment", + "Value": { + "Ref": "Environment" + } + }, + { + "Key": "Team", + "Value": { + "Fn::Sub": "${AWS::StackName}-tooling" + } + } + ], + "Mode": "Explicit" + }, + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ], + "VpcConfig": { + "SecurityGroupIds": [ + "sg-33333333" + ], + "SubnetIds": [ + "subnet-33333333" + ] + } + }, + "Type": "AWS::Lambda::CapacityProvider" + }, + "CpOverrideWithExplicitTagsOperatorRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + } + } +} diff --git a/tests/translator/output/error_capacity_provider_managed_resource_tags_intrinsic_propagate.json b/tests/translator/output/error_capacity_provider_managed_resource_tags_intrinsic_propagate.json new file mode 100644 index 000000000..2ca1bf9b9 --- /dev/null +++ b/tests/translator/output/error_capacity_provider_managed_resource_tags_intrinsic_propagate.json @@ -0,0 +1,9 @@ +{ + "_autoGeneratedBreakdownErrorMessage": [ + "Invalid Serverless Application Specification document. ", + "Number of errors found: 1. ", + "Resource with id [CpPropagateWithRef] is invalid. ", + "Property 'ManagedResourceTags.Propagate' value could not be parsed to a boolean." + ], + "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [CpPropagateWithRef] is invalid. Property 'ManagedResourceTags.Propagate' value could not be parsed to a boolean." +} diff --git a/tests/translator/output/error_capacity_provider_managed_resource_tags_mutual_exclusion.json b/tests/translator/output/error_capacity_provider_managed_resource_tags_mutual_exclusion.json new file mode 100644 index 000000000..9b28acea6 --- /dev/null +++ b/tests/translator/output/error_capacity_provider_managed_resource_tags_mutual_exclusion.json @@ -0,0 +1,11 @@ +{ + "_autoGeneratedBreakdownErrorMessage": [ + "Invalid Serverless Application Specification document. ", + "Number of errors found: 2. ", + "Resource with id [CpBothSet] is invalid. ", + "Cannot specify 'ManagedResourceTags.Propagate=True' and 'ManagedResourceTags.Tags' together. ", + "Resource with id [CpExplicitTagsConflictWithGlobal] is invalid. ", + "Cannot specify 'ManagedResourceTags.Propagate=True' and 'ManagedResourceTags.Tags' together." + ], + "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 2. Resource with id [CpBothSet] is invalid. Cannot specify 'ManagedResourceTags.Propagate=True' and 'ManagedResourceTags.Tags' together. Resource with id [CpExplicitTagsConflictWithGlobal] is invalid. Cannot specify 'ManagedResourceTags.Propagate=True' and 'ManagedResourceTags.Tags' together." +} diff --git a/tests/translator/output/error_global_capacity_provider_unsupported.json b/tests/translator/output/error_global_capacity_provider_unsupported.json index 40e5f5329..504f4d58b 100644 --- a/tests/translator/output/error_global_capacity_provider_unsupported.json +++ b/tests/translator/output/error_global_capacity_provider_unsupported.json @@ -4,7 +4,7 @@ "Number of errors found: 1. ", "'Globals' section is invalid. ", "'CapacityProviderName' is not a supported property of 'CapacityProvider'. ", - "Must be one of the following values - ['VpcConfig', 'OperatorRole', 'Tags', 'InstanceRequirements', 'ScalingConfig', 'KmsKeyArn', 'PropagateTags']" + "Must be one of the following values - ['VpcConfig', 'OperatorRole', 'Tags', 'InstanceRequirements', 'ScalingConfig', 'KmsKeyArn', 'PropagateTags', 'ManagedResourceTags']" ], - "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. 'Globals' section is invalid. 'CapacityProviderName' is not a supported property of 'CapacityProvider'. Must be one of the following values - ['VpcConfig', 'OperatorRole', 'Tags', 'InstanceRequirements', 'ScalingConfig', 'KmsKeyArn', 'PropagateTags']" + "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. 'Globals' section is invalid. 'CapacityProviderName' is not a supported property of 'CapacityProvider'. Must be one of the following values - ['VpcConfig', 'OperatorRole', 'Tags', 'InstanceRequirements', 'ScalingConfig', 'KmsKeyArn', 'PropagateTags', 'ManagedResourceTags']" } From f29d329cb8b69c15796aa1dc975228d01ec05b68 Mon Sep 17 00:00:00 2001 From: Renato Valenzuela <37676028+valerena@users.noreply.github.com> Date: Tue, 23 Jun 2026 15:28:17 -0700 Subject: [PATCH 2/4] test: fix subnets ref parameters in tests (#3947) --- tests/translator/input/basic_function.yaml | 4 ++-- tests/translator/output/aws-cn/basic_function.json | 4 ++-- tests/translator/output/aws-us-gov/basic_function.json | 4 ++-- tests/translator/output/basic_function.json | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/translator/input/basic_function.yaml b/tests/translator/input/basic_function.yaml index 98a0fc1a9..544cca893 100644 --- a/tests/translator/input/basic_function.yaml +++ b/tests/translator/input/basic_function.yaml @@ -1,10 +1,10 @@ Parameters: SomeParameter: Type: String - Default: param + Default: subnet-987654 SomeOtherParameter: Type: String - Default: otherparam + Default: subnet-123456 Resources: MinimalFunction: Type: AWS::Serverless::Function diff --git a/tests/translator/output/aws-cn/basic_function.json b/tests/translator/output/aws-cn/basic_function.json index 79d8c4c2a..f66c4d8a4 100644 --- a/tests/translator/output/aws-cn/basic_function.json +++ b/tests/translator/output/aws-cn/basic_function.json @@ -1,11 +1,11 @@ { "Parameters": { "SomeOtherParameter": { - "Default": "otherparam", + "Default": "subnet-123456", "Type": "String" }, "SomeParameter": { - "Default": "param", + "Default": "subnet-987654", "Type": "String" } }, diff --git a/tests/translator/output/aws-us-gov/basic_function.json b/tests/translator/output/aws-us-gov/basic_function.json index 23abc5e83..5d5fab213 100644 --- a/tests/translator/output/aws-us-gov/basic_function.json +++ b/tests/translator/output/aws-us-gov/basic_function.json @@ -1,11 +1,11 @@ { "Parameters": { "SomeOtherParameter": { - "Default": "otherparam", + "Default": "subnet-123456", "Type": "String" }, "SomeParameter": { - "Default": "param", + "Default": "subnet-987654", "Type": "String" } }, diff --git a/tests/translator/output/basic_function.json b/tests/translator/output/basic_function.json index 7d25e094c..81b82b3ce 100644 --- a/tests/translator/output/basic_function.json +++ b/tests/translator/output/basic_function.json @@ -1,11 +1,11 @@ { "Parameters": { "SomeOtherParameter": { - "Default": "otherparam", + "Default": "subnet-123456", "Type": "String" }, "SomeParameter": { - "Default": "param", + "Default": "subnet-987654", "Type": "String" } }, From ed441b4e5c0984a2223e2bfd5580f26bb9ff7d9f Mon Sep 17 00:00:00 2001 From: licjun_aws Date: Tue, 7 Jul 2026 14:21:46 -0700 Subject: [PATCH 3/4] chore(network-connector): switch OperatorRole to managed policy and fill sam-docs descriptions (#3954) --- .../single/test_basic_network_connector.py | 13 +- .../internal/schema_source/sam-docs.json | 152 ++++++------- .../model/network_connector/generators.py | 80 +++---- samtranslator/schema/schema.json | 202 +++++++++--------- schema_source/sam.schema.json | 202 +++++++++--------- .../network_connector/test_generators.py | 9 +- .../output/aws-cn/network_connector.json | 57 +---- .../network_connector_with_intrinsics.json | 57 +---- ...network_connector_with_propagate_tags.json | 57 +---- .../output/aws-us-gov/network_connector.json | 57 +---- .../network_connector_with_intrinsics.json | 57 +---- ...network_connector_with_propagate_tags.json | 57 +---- .../translator/output/network_connector.json | 57 +---- .../network_connector_with_intrinsics.json | 57 +---- ...network_connector_with_propagate_tags.json | 57 +---- 15 files changed, 330 insertions(+), 841 deletions(-) diff --git a/integration/single/test_basic_network_connector.py b/integration/single/test_basic_network_connector.py index d05cb8505..8e7b6dbc7 100644 --- a/integration/single/test_basic_network_connector.py +++ b/integration/single/test_basic_network_connector.py @@ -48,12 +48,13 @@ def test_basic_network_connector(self): principals.extend(service) self.assertIn("lambda.amazonaws.com", principals) - # Verify inline policy - role_policy = iam_client.get_role_policy(RoleName=role_name, PolicyName="NetworkConnectorOperatorPolicy") - statements = role_policy["PolicyDocument"]["Statement"] - all_actions = [s["Action"] for s in statements] - self.assertIn("ec2:CreateNetworkInterface", all_actions) - self.assertIn("ec2:CreateTags", all_actions) + # Verify managed policy + attached = iam_client.list_attached_role_policies(RoleName=role_name) + policy_arns = [p["PolicyArn"] for p in attached["AttachedPolicies"]] + self.assertTrue( + any("AWSLambdaNetworkConnectorOperatorPolicy" in arn for arn in policy_arns), + "OperatorRole should have AWSLambdaNetworkConnectorOperatorPolicy attached", + ) def test_network_connector_with_custom_role(self): """ diff --git a/samtranslator/internal/schema_source/sam-docs.json b/samtranslator/internal/schema_source/sam-docs.json index e0db02d26..1242ad857 100644 --- a/samtranslator/internal/schema_source/sam-docs.json +++ b/samtranslator/internal/schema_source/sam-docs.json @@ -711,22 +711,22 @@ "State": "The state of the schedule. \n*Accepted values:* `DISABLED | ENABLED` \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`State`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-scheduler-schedule.html#cfn-scheduler-schedule-state) property of an `AWS::Scheduler::Schedule` resource." }, "sam-property-websocketapi-authconfiguration": { - "AuthArn": "TODO", - "InvokeRole": "TODO", - "AuthType": "TODO", - "PayloadFormatVersion": "TODO", - "IdentitySource": "TODO", - "Name": "TODO" + "AuthArn": "The ARN of the Lambda function to use for authorization. Required when `AuthType` is `CUSTOM`. \n*Type*: String \n*Required*: Conditional \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", + "InvokeRole": "The ARN of the IAM role that API Gateway assumes when invoking the authorizer function. If not specified, AWS SAM automatically creates a resource-based permission that allows API Gateway to invoke the authorizer function. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AuthorizerCredentialsArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-authorizercredentialsarn) property of an `AWS::ApiGatewayV2::Authorizer` resource.", + "AuthType": "The type of authorization. Valid values are `NONE`, `AWS_IAM`, or `CUSTOM`. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", + "PayloadFormatVersion": "The format of the payload sent to the authorizer Lambda function. Valid values are `1.0` and `2.0`. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AuthorizerPayloadFormatVersion`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-authorizerpayloadformatversion) property of an `AWS::ApiGatewayV2::Authorizer` resource.", + "IdentitySource": "The identity source for which authorization is requested. For example, `route.request.header.Authorization`. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`IdentitySource`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-identitysource) property of an `AWS::ApiGatewayV2::Authorizer` resource.", + "Name": "The name of the authorizer. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-name) property of an `AWS::ApiGatewayV2::Authorizer` resource." }, "sam-property-websocketapi-routeconfiguration": { - "ApiKeyRequired": "TODO", - "FunctionArn": "TODO", - "IntegrationTimeout": "TODO", - "ModelSelectionExpression": "TODO", - "OperationName": "TODO", - "RequestModels": "TODO", - "RequestParameters": "TODO", - "RouteResponseSelectionExpression": "TODO" + "ApiKeyRequired": "Specifies whether an API key is required for this route. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ApiKeyRequired`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-apikeyrequired) property of an `AWS::ApiGatewayV2::Route` resource.", + "FunctionArn": "The ARN of the Lambda function that handles this route. AWS SAM creates an integration and the necessary permissions for API Gateway to invoke the function. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", + "IntegrationTimeout": "The timeout for the integration, in milliseconds. The maximum value is 29,000 milliseconds (29 seconds). \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`TimeoutInMillis`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-integration.html#cfn-apigatewayv2-integration-timeoutinmillis) property of an `AWS::ApiGatewayV2::Integration` resource.", + "ModelSelectionExpression": "The model selection expression for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ModelSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-modelselectionexpression) property of an `AWS::ApiGatewayV2::Route` resource.", + "OperationName": "The operation name for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`OperationName`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-operationname) property of an `AWS::ApiGatewayV2::Route` resource.", + "RequestModels": "The request models for the route. \n*Type*: Json \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RequestModels`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-requestmodels) property of an `AWS::ApiGatewayV2::Route` resource.", + "RequestParameters": "The request parameters for the route. \n*Type*: Json \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RequestParameters`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-requestparameters) property of an `AWS::ApiGatewayV2::Route` resource.", + "RouteResponseSelectionExpression": "The route response selection expression for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RouteResponseSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-routeresponseselectionexpression) property of an `AWS::ApiGatewayV2::Route` resource." }, "sam-property-statemachine-statemachinetarget": { "Id": "The logical ID of the target. \nThe value of `Id` can include alphanumeric characters, periods (`.`), hyphens (`-`), and underscores (`_`). \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`Id`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-target.html#cfn-events-rule-target-id) property of the `AWS::Events::Rule` `Target` data type." @@ -784,56 +784,56 @@ "VpcConfig": "The VPC configuration for the capacity provider. Specifies the VPC subnets and security groups where Amazon EC2 instances will be launched. \n*Type*: [VpcConfig](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-capacityprovider-vpcconfig.html) \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`VpcConfig`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-capacityprovider.html#cfn-lambda-capacityprovider-vpcconfig) property of an `AWS::Lambda::CapacityProvider` resource." }, "sam-resource-microvmimage": { - "Name": "TODO", - "CodeUri": "TODO", - "BaseImageArn": "TODO", - "BuildRoleArn": "TODO", - "BaseImageVersion": "TODO", - "Description": "TODO", - "Tags": "TODO", - "Logging": "TODO", - "EgressNetworkConnectors": "TODO", - "CpuConfigurations": "TODO", - "Resources": "TODO", - "AdditionalOsCapabilities": "TODO", - "Hooks": "TODO", - "EnvironmentVariables": "TODO", - "PropagateTags": "TODO" + "Name": "The name of the MicroVM image. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-name) property of an `AWS::Lambda::MicrovmImage` resource.", + "CodeUri": "The Amazon S3 URI of the zip artifact containing the Dockerfile and application code. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is transformed to the [`CodeArtifact`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-codeartifact) property of an `AWS::Lambda::MicrovmImage` resource. AWS SAM wraps the URI into the `CodeArtifact.Uri` structure.", + "BaseImageArn": "The ARN of the base MicroVM image to build from. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimagearn) property of an `AWS::Lambda::MicrovmImage` resource.", + "BuildRoleArn": "The ARN of the IAM role that the MicroVM build service assumes to download your code artifact from Amazon S3 and write build logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`BuildRoleArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-buildrolearn) property of an `AWS::Lambda::MicrovmImage` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `BuildRole`. If your code artifact is encrypted with a customer managed key in AWS KMS, you must provide your own role with the appropriate `kms:Decrypt` permission.", + "BaseImageVersion": "The version of the base MicroVM image to use. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageVersion`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimageversion) property of an `AWS::Lambda::MicrovmImage` resource.", + "Description": "A description of the MicroVM image. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Description`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-description) property of an `AWS::Lambda::MicrovmImage` resource.", + "Tags": "A map of key-value pairs that specifies the tags added to this MicroVM image. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-tags) property of an `AWS::Lambda::MicrovmImage` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this resource, and to the default roles that are generated for it.", + "Logging": "Configuration for MicroVM logging output. Specify exactly one: `CloudWatch` to enable CloudWatch logging, or `Disabled` to turn off logging. \n*Type*: [Logging](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Logging`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-logging) property of an `AWS::Lambda::MicrovmImage` resource.", + "EgressNetworkConnectors": "The list of egress network connector ARNs available to the MicroVM at runtime. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`EgressNetworkConnectors`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-egressnetworkconnectors) property of an `AWS::Lambda::MicrovmImage` resource.", + "CpuConfigurations": "A list of [CpuConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cpuconfiguration.html) objects that specify the supported CPU architectures for the MicroVM. If you don't specify a value, the service uses the default CPU architecture. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CpuConfigurations`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-cpuconfigurations) property of an `AWS::Lambda::MicrovmImage` resource.", + "Resources": "A list of [Resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-resources.html) objects that specify the resource requirements for the MicroVM. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Resources`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-resources) property of an `AWS::Lambda::MicrovmImage` resource.", + "AdditionalOsCapabilities": "Additional OS capabilities to grant to the MicroVM runtime environment. If you don't specify a value, the service grants no additional OS capabilities. \n*Valid values*: `ALL` \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AdditionalOsCapabilities`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-additionaloscapabilities) property of an `AWS::Lambda::MicrovmImage` resource.", + "Hooks": "Lifecycle hook configuration for MicroVMs and MicroVM images. \n*Type*: [Hooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Hooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-hooks) property of an `AWS::Lambda::MicrovmImage` resource.", + "EnvironmentVariables": "Environment variables set in the MicroVM runtime environment. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`EnvironmentVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-environmentvariables) property of an `AWS::Lambda::MicrovmImage` resource. In AWS SAM, specify as a map (for example, `KEY: value`). AWS SAM converts to the CloudFormation array format `[{Key: KEY, Value: value}]`.", + "PropagateTags": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated build role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent." }, "sam-property-microvmimage-hooks": { - "Port": "TODO", - "MicrovmHooks": "TODO", - "MicrovmImageHooks": "TODO" + "Port": "The port on which the application listens for lifecycle hook invocations. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Port`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-port) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource.", + "MicrovmHooks": "Lifecycle hooks called at MicroVM instance lifecycle transitions (run, resume, suspend, terminate). \n*Type*: [MicrovmHooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-microvmhooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`MicrovmHooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-microvmhooks) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource.", + "MicrovmImageHooks": "Lifecycle hooks called during MicroVM image build (ready, validate). \n*Type*: [MicrovmImageHooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-microvmimagehooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`MicrovmImageHooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-microvmimagehooks) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource." }, "sam-property-microvmimage-microvmhooks": { - "Run": "TODO", - "RunTimeoutInSeconds": "TODO", - "Resume": "TODO", - "ResumeTimeoutInSeconds": "TODO", - "Suspend": "TODO", - "SuspendTimeoutInSeconds": "TODO", - "Terminate": "TODO", - "TerminateTimeoutInSeconds": "TODO" + "Run": "Specifies whether the run hook is enabled. The run hook is called when a MicroVM instance is launched from a snapshot. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Run` property of `MicrovmHooks`.", + "RunTimeoutInSeconds": "The timeout in seconds for the run hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `RunTimeoutInSeconds` property of `MicrovmHooks`.", + "Resume": "Specifies whether the resume hook is enabled. The resume hook is called when a MicroVM resumes from an in-place suspend. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Resume` property of `MicrovmHooks`.", + "ResumeTimeoutInSeconds": "The timeout in seconds for the resume hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ResumeTimeoutInSeconds` property of `MicrovmHooks`.", + "Suspend": "Specifies whether the suspend hook is enabled. The suspend hook is called before a MicroVM is suspended. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Suspend` property of `MicrovmHooks`.", + "SuspendTimeoutInSeconds": "The timeout in seconds for the suspend hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `SuspendTimeoutInSeconds` property of `MicrovmHooks`.", + "Terminate": "Specifies whether the terminate hook is enabled. The terminate hook is called before a MicroVM is terminated. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Terminate` property of `MicrovmHooks`.", + "TerminateTimeoutInSeconds": "The timeout in seconds for the terminate hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `TerminateTimeoutInSeconds` property of `MicrovmHooks`." }, "sam-property-microvmimage-microvmimagehooks": { - "Ready": "TODO", - "ReadyTimeoutInSeconds": "TODO", - "Validate": "TODO", - "ValidateTimeoutInSeconds": "TODO" + "Ready": "Specifies whether the ready hook is enabled. The ready hook is called during image build to confirm the application has started successfully. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Ready` property of `MicrovmImageHooks`.", + "ReadyTimeoutInSeconds": "The timeout in seconds for the ready hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ReadyTimeoutInSeconds` property of `MicrovmImageHooks`.", + "Validate": "Specifies whether the validate hook is enabled. The validate hook is called during image build to validate the application. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Validate` property of `MicrovmImageHooks`.", + "ValidateTimeoutInSeconds": "The timeout in seconds for the validate hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ValidateTimeoutInSeconds` property of `MicrovmImageHooks`." }, "sam-property-microvmimage-logging": { - "Disabled": "TODO", - "CloudWatch": "TODO" + "Disabled": "Set to `true` to disable logging for the MicroVM. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Disabled`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html#cfn-lambda-microvmimage-logging-disabled) property of the `Logging` property of an `AWS::Lambda::MicrovmImage` resource.", + "CloudWatch": "CloudWatch logging configuration for the MicroVM. \n*Type*: [CloudWatch](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cloudwatchlogging.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CloudWatch`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html#cfn-lambda-microvmimage-logging-cloudwatch) property of the `Logging` property of an `AWS::Lambda::MicrovmImage` resource." }, "sam-property-microvmimage-cloudwatchlogging": { - "LogGroup": "TODO", - "LogStream": "TODO" + "LogGroup": "The CloudWatch log group name for MicroVM logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `LogGroup` property of the `CloudWatch` logging configuration.", + "LogStream": "The CloudWatch log stream name for MicroVM logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `LogStream` property of the `CloudWatch` logging configuration." }, "sam-property-microvmimage-resource": { - "MinimumMemoryInMiB": "TODO" + "MinimumMemoryInMiB": "The minimum memory in MiB for the MicroVM. \n*Type*: Integer \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`MinimumMemoryInMiB`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-resources.html#cfn-lambda-microvmimage-resources-minimummemoryinmib) property of a `Resources` item of an `AWS::Lambda::MicrovmImage` resource." }, "sam-property-microvmimage-cpuconfiguration": { - "Architecture": "TODO" + "Architecture": "The CPU architecture for the MicroVM. \n*Valid values*: `ARM_64` \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`Architecture`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cpuconfiguration.html#cfn-lambda-microvmimage-cpuconfiguration-architecture) property of a `CpuConfigurations` item of an `AWS::Lambda::MicrovmImage` resource." }, "sam-resource-connector": { "Destination": "The destination resource. \n*Type*: [ ResourceReference](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-connector-resourcereference.html) \\$1 List of [ResourceReference](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-connector-resourcereference.html) \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an CloudFormation equivalent.", @@ -964,36 +964,36 @@ "UseAliasAsEventTarget": "Indicate whether or not to pass the alias, created by using the `AutoPublishAlias` property, to the events source's target defined with [Events](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/#sam-statemachine-events.html#sam-statemachine-events)\\. \nSpecify `True` to use the alias as the events' target\\. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\." }, "sam-resource-websocketapi": { - "ApiKeySelectionExpression": "TODO", - "AccessLogSettings": "TODO", - "Auth": "TODO", - "DefaultRouteSettings": "TODO", - "Description": "TODO", - "DisableExecuteApiEndpoint": "TODO", - "DisableSchemaValidation": "TODO", - "Domain": "TODO", - "FailOnWarnings": "TODO", - "IpAddressType": "TODO", - "Name": "TODO", - "PropagateTags": "TODO", - "Routes": "TODO", - "RouteSelectionExpression": "TODO", - "RouteSettings": "TODO", - "StageName": "TODO", - "StageVariables": "TODO", - "Tags": "TODO" + "ApiKeySelectionExpression": "An API key selection expression. For more information, see [API Key Selection Expressions](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions) in the *API Gateway Developer Guide*. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ApiKeySelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-apikeyselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", + "AccessLogSettings": "The settings for access logging in a stage. \n*Type*: [AccessLogSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AccessLogSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) property of an `AWS::ApiGatewayV2::Stage` resource.", + "Auth": "Configures authorization for controlling access to your WebSocket API. Authorization is applied to the `$connect` route. \n*Type*: [WebSocketApiAuth](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-websocketapiauth.html) \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", + "DefaultRouteSettings": "The default route settings for this WebSocket API. These settings apply to all routes unless overridden by the `RouteSettings` property for certain routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DefaultRouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-defaultroutesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", + "Description": "A description of the WebSocket API. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Description`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-description) property of an `AWS::ApiGatewayV2::Api` resource.", + "DisableExecuteApiEndpoint": "Specifies whether clients can invoke your API by using the default `execute-api` endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableExecuteApiEndpoint`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableexecuteapiendpoint) property of an `AWS::ApiGatewayV2::Api` resource.", + "DisableSchemaValidation": "Avoid validating models when creating a deployment. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableSchemaValidation`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableschemavalidation) property of an `AWS::ApiGatewayV2::Api` resource.", + "Domain": "Configures a custom domain for this WebSocket API. \n*Type*: [WebSocketApiDomainConfiguration](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-websocketapidomainconfiguration.html) \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", + "FailOnWarnings": "Specifies whether to roll back the API creation when a warning is encountered. When set to `true`, the API is rolled back if a warning is encountered. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`FailOnWarnings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-failonwarnings) property of an `AWS::ApiGatewayV2::Api` resource.", + "IpAddressType": "The IP address type for the API. Valid values are `ipv4` for IPv4 only and `dualstack` for IPv4 and IPv6. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`IpAddressType`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-ipaddresstype) property of an `AWS::ApiGatewayV2::Api` resource.", + "Name": "A name for the WebSocket API. If you don't specify a name, AWS SAM generates a name for you. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-name) property of an `AWS::ApiGatewayV2::Api` resource.", + "PropagateTags": "If `true`, AWS SAM adds the `Tags` property to the `AWS::ApiGatewayV2::Stage` and `AWS::ApiGatewayV2::DomainName` resources that AWS SAM generates. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", + "Routes": "The route configurations for this WebSocket API. Routes define how messages are routed to Lambda functions. Each route consists of a route key and a Lambda function ARN. WebSocket APIs support three predefined routes: `$connect`, `$disconnect`, and `$default`. You can also define custom routes. \n*Type*: [RouteConfiguration](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-routeconfiguration.html) \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", + "RouteSelectionExpression": "The route selection expression for the WebSocket API. A common value is `$request.body.action`, which routes messages based on an `action` field in the message body. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-routeselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", + "RouteSettings": "The route settings for this WebSocket API. These settings override the `DefaultRouteSettings` for specific routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", + "StageName": "The name of the API stage. If you don't specify a name, AWS SAM uses `default` as the stage name. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`StageName`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagename) property of an `AWS::ApiGatewayV2::Stage` resource.", + "StageVariables": "A map that defines the stage variables. Variable names can have alphanumeric and underscore characters, and the values must match `[A-Za-z0-9-._~:/?#&=,]+`. \n*Type*: [Json](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`StageVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) property of an `AWS::ApiGatewayV2::Stage` resource.", + "Tags": "A map (string to string) that specifies the tags to be added to this WebSocket API. For details about valid keys and values for tags, see [Resource tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) in the *CloudFormation User Guide*. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent." }, "sam-resource-networkconnector": { - "Name": "TODO", - "VpcConfig": "TODO", - "OperatorRole": "TODO", - "Tags": "TODO", - "PropagateTags": "TODO" + "Name": "The name of the network connector. The name must be unique within your account and Region. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-name) property of an `AWS::Lambda::NetworkConnector` resource.", + "VpcConfig": "The VPC egress configuration for the network connector, including the subnets, security groups, and network protocol for elastic network interface (ENI) provisioning. \n*Type*: [VpcConfig](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-networkconnector-vpcconfig.html) \n*Required*: Yes \n*CloudFormation compatibility*: This property is transformed to the [`Configuration.VpcEgressConfiguration`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-configuration) property of an `AWS::Lambda::NetworkConnector` resource. AWS SAM also injects `AssociatedComputeResourceTypes: [MicroVm]` automatically.", + "OperatorRole": "The ARN of the IAM role that the network connector service assumes to create and manage elastic network interfaces (ENIs). \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`OperatorRole`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-operatorrole) property of an `AWS::Lambda::NetworkConnector` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `OperatorRole`.", + "Tags": "A map of key-value pairs that specifies the tags added to this network connector. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-tags) property of an `AWS::Lambda::NetworkConnector` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this network connector, and to the default roles that are generated for it.", + "PropagateTags": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated operator role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent." }, "sam-property-networkconnector-vpcconfig": { - "SubnetIds": "TODO", - "SecurityGroupIds": "TODO", - "NetworkProtocol": "TODO" + "SubnetIds": "A list of subnet IDs where the service provisions ENIs for VPC egress connectivity. \n*Type*: List \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`SubnetIds`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-subnetids) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource.", + "SecurityGroupIds": "A list of security group IDs to associate with the elastic network interfaces (ENIs). \n*Type*: List \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`SecurityGroupIds`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-securitygroupids) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource.", + "NetworkProtocol": "The network protocol for the VPC egress connection. \n*Valid values*: `IPv4`, `DualStack` \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`NetworkProtocol`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-networkprotocol) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource." } } } \ No newline at end of file diff --git a/samtranslator/model/network_connector/generators.py b/samtranslator/model/network_connector/generators.py index 546de6b0e..1a6d0e977 100644 --- a/samtranslator/model/network_connector/generators.py +++ b/samtranslator/model/network_connector/generators.py @@ -5,10 +5,13 @@ from typing import Any from samtranslator.model import Resource -from samtranslator.model.iam import IAMRole, IAMRolePolicies +from samtranslator.model.iam import IAMRolePolicies from samtranslator.model.intrinsics import fnGetAtt from samtranslator.model.network_connector.resources import LambdaNetworkConnector +from samtranslator.model.resource_policies import ResourcePolicies +from samtranslator.model.role_utils import construct_role_for_resource from samtranslator.model.tags.resource_tagging import get_tag_list +from samtranslator.translator.arn_generator import ArnGenerator class NetworkConnectorGenerator: @@ -72,65 +75,30 @@ def _create_network_connector(self) -> LambdaNetworkConnector: return connector - def _create_operator_role(self) -> IAMRole: + def _create_operator_role(self) -> Resource: role_logical_id = f"{self.logical_id}OperatorRole" - assume_role_policy = IAMRolePolicies.construct_assume_role_policy_for_service_principal("lambda.amazonaws.com") - - role = IAMRole(role_logical_id, attributes=self.passthrough_resource_attributes) - role.AssumeRolePolicyDocument = assume_role_policy - role.Policies = [ - { - "PolicyName": "NetworkConnectorOperatorPolicy", - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowCreateEniInAnySubnet", - "Effect": "Allow", - "Action": "ec2:CreateNetworkInterface", - "Resource": {"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*"}, - }, - { - "Sid": "AllowCreateEniWithSecurityGroups", - "Effect": "Allow", - "Action": "ec2:CreateNetworkInterface", - "Resource": {"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*"}, - }, - { - "Sid": "AllowCreateEniWithLambdaTagKeys", - "Effect": "Allow", - "Action": "ec2:CreateNetworkInterface", - "Resource": {"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*"}, - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId", - ] - } - }, - }, - { - "Sid": "TagENIOnCreate", - "Effect": "Allow", - "Action": "ec2:CreateTags", - "Resource": {"Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*"}, - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com", - } - }, - }, - ], - }, - } - ] + assume_role_policy_document = IAMRolePolicies.construct_assume_role_policy_for_service_principal( + "lambda.amazonaws.com" + ) + + tags = self._transform_tags() + + managed_policy_arns = [ArnGenerator.generate_aws_managed_policy_arn("AWSLambdaNetworkConnectorOperatorPolicy")] + + operator_role = construct_role_for_resource( + resource_logical_id=self.logical_id, + attributes=self.passthrough_resource_attributes, + managed_policy_map=None, + assume_role_policy_document=assume_role_policy_document, + resource_policies=ResourcePolicies({}), + managed_policy_arns=managed_policy_arns, + tags=tags, + ) - role.Tags = self._transform_tags() + operator_role.logical_id = role_logical_id - return role + return operator_role def _transform_tags(self, tags: dict[str, Any] | None = None) -> list[dict[str, str]]: tags_dict = (tags or {}).copy() diff --git a/samtranslator/schema/schema.json b/samtranslator/schema/schema.json index 8d359c70d..98f334781 100644 --- a/samtranslator/schema/schema.json +++ b/samtranslator/schema/schema.json @@ -364741,7 +364741,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the Lambda function to use for authorization. Required when `AuthType` is `CUSTOM`. \n*Type*: String \n*Required*: Conditional \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "AuthArn" }, "AuthType": { @@ -364750,7 +364750,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The type of authorization. Valid values are `NONE`, `AWS_IAM`, or `CUSTOM`. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "AuthType" }, "IdentitySource": { @@ -364759,7 +364759,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The identity source for which authorization is requested. For example, `route.request.header.Authorization`. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`IdentitySource`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-identitysource) property of an `AWS::ApiGatewayV2::Authorizer` resource.", "title": "IdentitySource" }, "InvokeRole": { @@ -364771,7 +364771,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that API Gateway assumes when invoking the authorizer function. If not specified, AWS SAM automatically creates a resource-based permission that allows API Gateway to invoke the authorizer function. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AuthorizerCredentialsArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-authorizercredentialsarn) property of an `AWS::ApiGatewayV2::Authorizer` resource.", "title": "InvokeRole" }, "Name": { @@ -364780,7 +364780,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The name of the authorizer. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-name) property of an `AWS::ApiGatewayV2::Authorizer` resource.", "title": "Name" } }, @@ -364929,7 +364929,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The CloudWatch log group name for MicroVM logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `LogGroup` property of the `CloudWatch` logging configuration.", "title": "LogGroup" }, "LogStream": { @@ -364941,7 +364941,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The CloudWatch log stream name for MicroVM logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `LogStream` property of the `CloudWatch` logging configuration.", "title": "LogStream" } }, @@ -365256,7 +365256,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The CPU architecture for the MicroVM. \n*Valid values*: `ARM_64` \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`Architecture`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cpuconfiguration.html#cfn-lambda-microvmimage-cpuconfiguration-architecture) property of a `CpuConfigurations` item of an `AWS::Lambda::MicrovmImage` resource.", "title": "Architecture" } }, @@ -367504,7 +367504,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the resume hook is enabled. The resume hook is called when a MicroVM resumes from an in-place suspend. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Resume` property of `MicrovmHooks`.", "title": "Resume" }, "ResumeTimeoutInSeconds": { @@ -367516,7 +367516,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the resume hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ResumeTimeoutInSeconds` property of `MicrovmHooks`.", "title": "ResumeTimeoutInSeconds" }, "Run": { @@ -367532,7 +367532,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the run hook is enabled. The run hook is called when a MicroVM instance is launched from a snapshot. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Run` property of `MicrovmHooks`.", "title": "Run" }, "RunTimeoutInSeconds": { @@ -367544,7 +367544,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the run hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `RunTimeoutInSeconds` property of `MicrovmHooks`.", "title": "RunTimeoutInSeconds" }, "Suspend": { @@ -367560,7 +367560,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the suspend hook is enabled. The suspend hook is called before a MicroVM is suspended. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Suspend` property of `MicrovmHooks`.", "title": "Suspend" }, "SuspendTimeoutInSeconds": { @@ -367572,7 +367572,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the suspend hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `SuspendTimeoutInSeconds` property of `MicrovmHooks`.", "title": "SuspendTimeoutInSeconds" }, "Terminate": { @@ -367588,7 +367588,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the terminate hook is enabled. The terminate hook is called before a MicroVM is terminated. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Terminate` property of `MicrovmHooks`.", "title": "Terminate" }, "TerminateTimeoutInSeconds": { @@ -367600,7 +367600,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the terminate hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `TerminateTimeoutInSeconds` property of `MicrovmHooks`.", "title": "TerminateTimeoutInSeconds" } }, @@ -367623,7 +367623,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the ready hook is enabled. The ready hook is called during image build to confirm the application has started successfully. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Ready` property of `MicrovmImageHooks`.", "title": "Ready" }, "ReadyTimeoutInSeconds": { @@ -367635,7 +367635,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the ready hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ReadyTimeoutInSeconds` property of `MicrovmImageHooks`.", "title": "ReadyTimeoutInSeconds" }, "Validate": { @@ -367651,7 +367651,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the validate hook is enabled. The validate hook is called during image build to validate the application. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Validate` property of `MicrovmImageHooks`.", "title": "Validate" }, "ValidateTimeoutInSeconds": { @@ -367663,7 +367663,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the validate hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ValidateTimeoutInSeconds` property of `MicrovmImageHooks`.", "title": "ValidateTimeoutInSeconds" } }, @@ -368051,7 +368051,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The minimum memory in MiB for the MicroVM. \n*Type*: Integer \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`MinimumMemoryInMiB`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-resources.html#cfn-lambda-microvmimage-resources-minimummemoryinmib) property of a `Resources` item of an `AWS::Lambda::MicrovmImage` resource.", "title": "MinimumMemoryInMiB" } }, @@ -368901,7 +368901,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether an API key is required for this route. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ApiKeyRequired`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-apikeyrequired) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "ApiKeyRequired" }, "FunctionArn": { @@ -368913,7 +368913,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the Lambda function that handles this route. AWS SAM creates an integration and the necessary permissions for API Gateway to invoke the function. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "FunctionArn" }, "IntegrationTimeout": { @@ -368922,7 +368922,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout for the integration, in milliseconds. The maximum value is 29,000 milliseconds (29 seconds). \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`TimeoutInMillis`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-integration.html#cfn-apigatewayv2-integration-timeoutinmillis) property of an `AWS::ApiGatewayV2::Integration` resource.", "title": "IntegrationTimeout" }, "ModelSelectionExpression": { @@ -368931,7 +368931,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The model selection expression for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ModelSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-modelselectionexpression) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "ModelSelectionExpression" }, "OperationName": { @@ -368940,7 +368940,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The operation name for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`OperationName`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-operationname) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "OperationName" }, "RequestModels": { @@ -368949,7 +368949,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The request models for the route. \n*Type*: Json \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RequestModels`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-requestmodels) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "RequestModels" }, "RequestParameters": { @@ -368958,7 +368958,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The request parameters for the route. \n*Type*: Json \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RequestParameters`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-requestparameters) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "RequestParameters" }, "RouteResponseSelectionExpression": { @@ -368967,7 +368967,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The route response selection expression for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RouteResponseSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-routeresponseselectionexpression) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "RouteResponseSelectionExpression" } }, @@ -372750,7 +372750,7 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "Additional OS capabilities to grant to the MicroVM runtime environment. If you don't specify a value, the service grants no additional OS capabilities. \n*Valid values*: `ALL` \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AdditionalOsCapabilities`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-additionaloscapabilities) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "AdditionalOsCapabilities", "type": "array" }, @@ -372763,7 +372763,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the base MicroVM image to build from. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimagearn) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "BaseImageArn" }, "BaseImageVersion": { @@ -372775,7 +372775,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The version of the base MicroVM image to use. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageVersion`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimageversion) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "BaseImageVersion" }, "BuildRoleArn": { @@ -372787,14 +372787,14 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that the MicroVM build service assumes to download your code artifact from Amazon S3 and write build logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`BuildRoleArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-buildrolearn) property of an `AWS::Lambda::MicrovmImage` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `BuildRole`. If your code artifact is encrypted with a customer managed key in AWS KMS, you must provide your own role with the appropriate `kms:Decrypt` permission.", "title": "BuildRoleArn" }, "CpuConfigurations": { "items": { "$ref": "#/definitions/CpuConfiguration" }, - "markdownDescription": "TODO", + "markdownDescription": "A list of [CpuConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cpuconfiguration.html) objects that specify the supported CPU architectures for the MicroVM. If you don't specify a value, the service uses the default CPU architecture. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CpuConfigurations`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-cpuconfigurations) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "CpuConfigurations", "type": "array" }, @@ -372809,12 +372809,12 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "The list of egress network connector ARNs available to the MicroVM at runtime. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`EgressNetworkConnectors`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-egressnetworkconnectors) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "EgressNetworkConnectors", "type": "array" }, "EnvironmentVariables": { - "markdownDescription": "TODO", + "markdownDescription": "Environment variables set in the MicroVM runtime environment. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`EnvironmentVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-environmentvariables) property of an `AWS::Lambda::MicrovmImage` resource. In AWS SAM, specify as a map (for example, `KEY: value`). AWS SAM converts to the CloudFormation array format `[{Key: KEY, Value: value}]`.", "title": "EnvironmentVariables", "type": "object" }, @@ -372824,7 +372824,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_microvmimage__Hooks" } ], - "markdownDescription": "TODO", + "markdownDescription": "Lifecycle hook configuration for MicroVMs and MicroVM images. \n*Type*: [Hooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Hooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-hooks) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Hooks" }, "Logging": { @@ -372833,11 +372833,11 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_microvmimage__Logging" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configuration for MicroVM logging output. Specify exactly one: `CloudWatch` to enable CloudWatch logging, or `Disabled` to turn off logging. \n*Type*: [Logging](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Logging`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-logging) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Logging" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated build role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, @@ -372845,12 +372845,12 @@ "items": { "$ref": "#/definitions/ResourceSpec" }, - "markdownDescription": "TODO", + "markdownDescription": "A list of [Resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-resources.html) objects that specify the resource requirements for the MicroVM. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Resources`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-resources) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Resources", "type": "array" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map of key-value pairs that specifies the tags added to this MicroVM image. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-tags) property of an `AWS::Lambda::MicrovmImage` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this resource, and to the default roles that are generated for it.", "title": "Tags", "type": "object" } @@ -372867,7 +372867,7 @@ "$ref": "#/definitions/MicrovmHooks" } ], - "markdownDescription": "TODO", + "markdownDescription": "Lifecycle hooks called at MicroVM instance lifecycle transitions (run, resume, suspend, terminate). \n*Type*: [MicrovmHooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-microvmhooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`MicrovmHooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-microvmhooks) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "MicrovmHooks" }, "MicrovmImageHooks": { @@ -372876,7 +372876,7 @@ "$ref": "#/definitions/MicrovmImageHooks" } ], - "markdownDescription": "TODO", + "markdownDescription": "Lifecycle hooks called during MicroVM image build (ready, validate). \n*Type*: [MicrovmImageHooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-microvmimagehooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`MicrovmImageHooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-microvmimagehooks) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "MicrovmImageHooks" }, "Port": { @@ -372888,7 +372888,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The port on which the application listens for lifecycle hook invocations. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Port`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-port) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Port" } }, @@ -372904,11 +372904,11 @@ "$ref": "#/definitions/CloudWatchLogging" } ], - "markdownDescription": "TODO", + "markdownDescription": "CloudWatch logging configuration for the MicroVM. \n*Type*: [CloudWatch](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cloudwatchlogging.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CloudWatch`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html#cfn-lambda-microvmimage-logging-cloudwatch) property of the `Logging` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "CloudWatch" }, "Disabled": { - "markdownDescription": "TODO", + "markdownDescription": "Set to `true` to disable logging for the MicroVM. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Disabled`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html#cfn-lambda-microvmimage-logging-disabled) property of the `Logging` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Disabled", "type": "boolean" } @@ -372933,7 +372933,7 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "Additional OS capabilities to grant to the MicroVM runtime environment. If you don't specify a value, the service grants no additional OS capabilities. \n*Valid values*: `ALL` \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AdditionalOsCapabilities`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-additionaloscapabilities) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "AdditionalOsCapabilities", "type": "array" }, @@ -372946,7 +372946,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the base MicroVM image to build from. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimagearn) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "BaseImageArn" }, "BaseImageVersion": { @@ -372958,7 +372958,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The version of the base MicroVM image to use. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageVersion`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimageversion) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "BaseImageVersion" }, "BuildRoleArn": { @@ -372970,7 +372970,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that the MicroVM build service assumes to download your code artifact from Amazon S3 and write build logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`BuildRoleArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-buildrolearn) property of an `AWS::Lambda::MicrovmImage` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `BuildRole`. If your code artifact is encrypted with a customer managed key in AWS KMS, you must provide your own role with the appropriate `kms:Decrypt` permission.", "title": "BuildRoleArn" }, "CodeUri": { @@ -372982,14 +372982,14 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The Amazon S3 URI of the zip artifact containing the Dockerfile and application code. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is transformed to the [`CodeArtifact`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-codeartifact) property of an `AWS::Lambda::MicrovmImage` resource. AWS SAM wraps the URI into the `CodeArtifact.Uri` structure.", "title": "CodeUri" }, "CpuConfigurations": { "items": { "$ref": "#/definitions/CpuConfiguration" }, - "markdownDescription": "TODO", + "markdownDescription": "A list of [CpuConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cpuconfiguration.html) objects that specify the supported CPU architectures for the MicroVM. If you don't specify a value, the service uses the default CPU architecture. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CpuConfigurations`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-cpuconfigurations) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "CpuConfigurations", "type": "array" }, @@ -373002,7 +373002,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "A description of the MicroVM image. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Description`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-description) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Description" }, "EgressNetworkConnectors": { @@ -373016,12 +373016,12 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "The list of egress network connector ARNs available to the MicroVM at runtime. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`EgressNetworkConnectors`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-egressnetworkconnectors) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "EgressNetworkConnectors", "type": "array" }, "EnvironmentVariables": { - "markdownDescription": "TODO", + "markdownDescription": "Environment variables set in the MicroVM runtime environment. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`EnvironmentVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-environmentvariables) property of an `AWS::Lambda::MicrovmImage` resource. In AWS SAM, specify as a map (for example, `KEY: value`). AWS SAM converts to the CloudFormation array format `[{Key: KEY, Value: value}]`.", "title": "EnvironmentVariables", "type": "object" }, @@ -373031,7 +373031,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_microvmimage__Hooks" } ], - "markdownDescription": "TODO", + "markdownDescription": "Lifecycle hook configuration for MicroVMs and MicroVM images. \n*Type*: [Hooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Hooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-hooks) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Hooks" }, "Logging": { @@ -373040,7 +373040,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_microvmimage__Logging" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configuration for MicroVM logging output. Specify exactly one: `CloudWatch` to enable CloudWatch logging, or `Disabled` to turn off logging. \n*Type*: [Logging](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Logging`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-logging) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Logging" }, "Name": { @@ -373052,11 +373052,11 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The name of the MicroVM image. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-name) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Name" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated build role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, @@ -373064,12 +373064,12 @@ "items": { "$ref": "#/definitions/ResourceSpec" }, - "markdownDescription": "TODO", + "markdownDescription": "A list of [Resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-resources.html) objects that specify the resource requirements for the MicroVM. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Resources`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-resources) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Resources", "type": "array" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map of key-value pairs that specifies the tags added to this MicroVM image. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-tags) property of an `AWS::Lambda::MicrovmImage` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this resource, and to the default roles that are generated for it.", "title": "Tags", "type": "object" } @@ -373145,16 +373145,16 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that the network connector service assumes to create and manage elastic network interfaces (ENIs). \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`OperatorRole`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-operatorrole) property of an `AWS::Lambda::NetworkConnector` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `OperatorRole`.", "title": "OperatorRole" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated operator role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map of key-value pairs that specifies the tags added to this network connector. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-tags) property of an `AWS::Lambda::NetworkConnector` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this network connector, and to the default roles that are generated for it.", "title": "Tags", "type": "object" } @@ -373174,7 +373174,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The name of the network connector. The name must be unique within your account and Region. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-name) property of an `AWS::Lambda::NetworkConnector` resource.", "title": "Name" }, "OperatorRole": { @@ -373186,16 +373186,16 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that the network connector service assumes to create and manage elastic network interfaces (ENIs). \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`OperatorRole`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-operatorrole) property of an `AWS::Lambda::NetworkConnector` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `OperatorRole`.", "title": "OperatorRole" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated operator role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map of key-value pairs that specifies the tags added to this network connector. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-tags) property of an `AWS::Lambda::NetworkConnector` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this network connector, and to the default roles that are generated for it.", "title": "Tags", "type": "object" }, @@ -373205,7 +373205,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_networkconnector__VpcConfig" } ], - "markdownDescription": "TODO", + "markdownDescription": "The VPC egress configuration for the network connector, including the subnets, security groups, and network protocol for elastic network interface (ENI) provisioning. \n*Type*: [VpcConfig](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-networkconnector-vpcconfig.html) \n*Required*: Yes \n*CloudFormation compatibility*: This property is transformed to the [`Configuration.VpcEgressConfiguration`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-configuration) property of an `AWS::Lambda::NetworkConnector` resource. AWS SAM also injects `AssociatedComputeResourceTypes: [MicroVm]` automatically.", "title": "VpcConfig" } }, @@ -373281,7 +373281,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The network protocol for the VPC egress connection. \n*Valid values*: `IPv4`, `DualStack` \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`NetworkProtocol`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-networkprotocol) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource.", "title": "NetworkProtocol" }, "SecurityGroupIds": { @@ -373295,7 +373295,7 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "A list of security group IDs to associate with the elastic network interfaces (ENIs). \n*Type*: List \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`SecurityGroupIds`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-securitygroupids) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource.", "title": "SecurityGroupIds", "type": "array" }, @@ -373310,7 +373310,7 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "A list of subnet IDs where the service provisions ENIs for VPC egress connectivity. \n*Type*: List \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`SubnetIds`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-subnetids) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource.", "title": "SubnetIds", "type": "array" } @@ -374474,11 +374474,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The settings for access logging in a stage. \n*Type*: [AccessLogSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AccessLogSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "AccessLogSettings" }, "ApiKeySelectionExpression": { - "markdownDescription": "TODO", + "markdownDescription": "An API key selection expression. For more information, see [API Key Selection Expressions](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions) in the *API Gateway Developer Guide*. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ApiKeySelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-apikeyselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "ApiKeySelectionExpression", "type": "string" }, @@ -374488,16 +374488,16 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The default route settings for this WebSocket API. These settings apply to all routes unless overridden by the `RouteSettings` property for certain routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DefaultRouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-defaultroutesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "DefaultRouteSettings" }, "DisableExecuteApiEndpoint": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether clients can invoke your API by using the default `execute-api` endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableExecuteApiEndpoint`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableexecuteapiendpoint) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "DisableExecuteApiEndpoint", "type": "boolean" }, "DisableSchemaValidation": { - "markdownDescription": "TODO", + "markdownDescription": "Avoid validating models when creating a deployment. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableSchemaValidation`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableschemavalidation) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "DisableSchemaValidation", "type": "boolean" }, @@ -374507,21 +374507,21 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_websocketapi__Domain" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configures a custom domain for this WebSocket API. \n*Type*: [WebSocketApiDomainConfiguration](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-websocketapidomainconfiguration.html) \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Domain" }, "IpAddressType": { - "markdownDescription": "TODO", + "markdownDescription": "The IP address type for the API. Valid values are `ipv4` for IPv4 only and `dualstack` for IPv4 and IPv6. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`IpAddressType`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-ipaddresstype) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "IpAddressType", "type": "string" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "If `true`, AWS SAM adds the `Tags` property to the `AWS::ApiGatewayV2::Stage` and `AWS::ApiGatewayV2::DomainName` resources that AWS SAM generates. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, "RouteSelectionExpression": { - "markdownDescription": "TODO", + "markdownDescription": "The route selection expression for the WebSocket API. A common value is `$request.body.action`, which routes messages based on an `action` field in the message body. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-routeselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "RouteSelectionExpression", "type": "string" }, @@ -374531,7 +374531,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The route settings for this WebSocket API. These settings override the `DefaultRouteSettings` for specific routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "RouteSettings" }, "StageVariables": { @@ -374540,11 +374540,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "A map that defines the stage variables. Variable names can have alphanumeric and underscore characters, and the values must match `[A-Za-z0-9-._~:/?#&=,]+`. \n*Type*: [Json](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`StageVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "StageVariables" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map (string to string) that specifies the tags to be added to this WebSocket API. For details about valid keys and values for tags, see [Resource tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) in the *CloudFormation User Guide*. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Tags", "type": "object" } @@ -374561,7 +374561,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The settings for access logging in a stage. \n*Type*: [AccessLogSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AccessLogSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "AccessLogSettings" }, "ApiKeySelectionExpression": { @@ -374570,7 +374570,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "An API key selection expression. For more information, see [API Key Selection Expressions](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions) in the *API Gateway Developer Guide*. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ApiKeySelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-apikeyselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "ApiKeySelectionExpression" }, "Auth": { @@ -374579,7 +374579,7 @@ "$ref": "#/definitions/AuthConfig" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configures authorization for controlling access to your WebSocket API. Authorization is applied to the `$connect` route. \n*Type*: [WebSocketApiAuth](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-websocketapiauth.html) \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Auth" }, "DefaultRouteSettings": { @@ -374588,11 +374588,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The default route settings for this WebSocket API. These settings apply to all routes unless overridden by the `RouteSettings` property for certain routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DefaultRouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-defaultroutesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "DefaultRouteSettings" }, "Description": { - "markdownDescription": "TODO", + "markdownDescription": "A description of the WebSocket API. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Description`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-description) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "Description", "type": "string" }, @@ -374602,11 +374602,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether clients can invoke your API by using the default `execute-api` endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableExecuteApiEndpoint`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableexecuteapiendpoint) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "DisableExecuteApiEndpoint" }, "DisableSchemaValidation": { - "markdownDescription": "TODO", + "markdownDescription": "Avoid validating models when creating a deployment. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableSchemaValidation`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableschemavalidation) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "DisableSchemaValidation", "type": "boolean" }, @@ -374616,7 +374616,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_websocketapi__Domain" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configures a custom domain for this WebSocket API. \n*Type*: [WebSocketApiDomainConfiguration](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-websocketapidomainconfiguration.html) \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Domain" }, "IpAddressType": { @@ -374625,7 +374625,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The IP address type for the API. Valid values are `ipv4` for IPv4 only and `dualstack` for IPv4 and IPv6. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`IpAddressType`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-ipaddresstype) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "IpAddressType" }, "Name": { @@ -374634,11 +374634,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "A name for the WebSocket API. If you don't specify a name, AWS SAM generates a name for you. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-name) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "Name" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "If `true`, AWS SAM adds the `Tags` property to the `AWS::ApiGatewayV2::Stage` and `AWS::ApiGatewayV2::DomainName` resources that AWS SAM generates. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, @@ -374648,7 +374648,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The route selection expression for the WebSocket API. A common value is `$request.body.action`, which routes messages based on an `action` field in the message body. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-routeselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "RouteSelectionExpression" }, "RouteSettings": { @@ -374657,14 +374657,14 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The route settings for this WebSocket API. These settings override the `DefaultRouteSettings` for specific routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "RouteSettings" }, "Routes": { "additionalProperties": { "$ref": "#/definitions/WebSocketApiRoute" }, - "markdownDescription": "TODO", + "markdownDescription": "The route configurations for this WebSocket API. Routes define how messages are routed to Lambda functions. Each route consists of a route key and a Lambda function ARN. WebSocket APIs support three predefined routes: `$connect`, `$disconnect`, and `$default`. You can also define custom routes. \n*Type*: [RouteConfiguration](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-routeconfiguration.html) \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Routes", "type": "object" }, @@ -374674,7 +374674,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The name of the API stage. If you don't specify a name, AWS SAM uses `default` as the stage name. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`StageName`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagename) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "StageName" }, "StageVariables": { @@ -374683,11 +374683,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "A map that defines the stage variables. Variable names can have alphanumeric and underscore characters, and the values must match `[A-Za-z0-9-._~:/?#&=,]+`. \n*Type*: [Json](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`StageVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "StageVariables" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map (string to string) that specifies the tags to be added to this WebSocket API. For details about valid keys and values for tags, see [Resource tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) in the *CloudFormation User Guide*. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Tags", "type": "object" } diff --git a/schema_source/sam.schema.json b/schema_source/sam.schema.json index 0070efa21..11cb241d9 100644 --- a/schema_source/sam.schema.json +++ b/schema_source/sam.schema.json @@ -166,7 +166,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the Lambda function to use for authorization. Required when `AuthType` is `CUSTOM`. \n*Type*: String \n*Required*: Conditional \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "AuthArn" }, "AuthType": { @@ -175,7 +175,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The type of authorization. Valid values are `NONE`, `AWS_IAM`, or `CUSTOM`. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "AuthType" }, "IdentitySource": { @@ -184,7 +184,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The identity source for which authorization is requested. For example, `route.request.header.Authorization`. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`IdentitySource`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-identitysource) property of an `AWS::ApiGatewayV2::Authorizer` resource.", "title": "IdentitySource" }, "InvokeRole": { @@ -196,7 +196,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that API Gateway assumes when invoking the authorizer function. If not specified, AWS SAM automatically creates a resource-based permission that allows API Gateway to invoke the authorizer function. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AuthorizerCredentialsArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-authorizercredentialsarn) property of an `AWS::ApiGatewayV2::Authorizer` resource.", "title": "InvokeRole" }, "Name": { @@ -205,7 +205,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The name of the authorizer. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-authorizer.html#cfn-apigatewayv2-authorizer-name) property of an `AWS::ApiGatewayV2::Authorizer` resource.", "title": "Name" } }, @@ -354,7 +354,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The CloudWatch log group name for MicroVM logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `LogGroup` property of the `CloudWatch` logging configuration.", "title": "LogGroup" }, "LogStream": { @@ -366,7 +366,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The CloudWatch log stream name for MicroVM logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `LogStream` property of the `CloudWatch` logging configuration.", "title": "LogStream" } }, @@ -717,7 +717,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The CPU architecture for the MicroVM. \n*Valid values*: `ARM_64` \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`Architecture`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cpuconfiguration.html#cfn-lambda-microvmimage-cpuconfiguration-architecture) property of a `CpuConfigurations` item of an `AWS::Lambda::MicrovmImage` resource.", "title": "Architecture" } }, @@ -3066,7 +3066,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the resume hook is enabled. The resume hook is called when a MicroVM resumes from an in-place suspend. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Resume` property of `MicrovmHooks`.", "title": "Resume" }, "ResumeTimeoutInSeconds": { @@ -3078,7 +3078,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the resume hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ResumeTimeoutInSeconds` property of `MicrovmHooks`.", "title": "ResumeTimeoutInSeconds" }, "Run": { @@ -3094,7 +3094,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the run hook is enabled. The run hook is called when a MicroVM instance is launched from a snapshot. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Run` property of `MicrovmHooks`.", "title": "Run" }, "RunTimeoutInSeconds": { @@ -3106,7 +3106,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the run hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `RunTimeoutInSeconds` property of `MicrovmHooks`.", "title": "RunTimeoutInSeconds" }, "Suspend": { @@ -3122,7 +3122,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the suspend hook is enabled. The suspend hook is called before a MicroVM is suspended. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Suspend` property of `MicrovmHooks`.", "title": "Suspend" }, "SuspendTimeoutInSeconds": { @@ -3134,7 +3134,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the suspend hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `SuspendTimeoutInSeconds` property of `MicrovmHooks`.", "title": "SuspendTimeoutInSeconds" }, "Terminate": { @@ -3150,7 +3150,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the terminate hook is enabled. The terminate hook is called before a MicroVM is terminated. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Terminate` property of `MicrovmHooks`.", "title": "Terminate" }, "TerminateTimeoutInSeconds": { @@ -3162,7 +3162,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the terminate hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `TerminateTimeoutInSeconds` property of `MicrovmHooks`.", "title": "TerminateTimeoutInSeconds" } }, @@ -3185,7 +3185,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the ready hook is enabled. The ready hook is called during image build to confirm the application has started successfully. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Ready` property of `MicrovmImageHooks`.", "title": "Ready" }, "ReadyTimeoutInSeconds": { @@ -3197,7 +3197,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the ready hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ReadyTimeoutInSeconds` property of `MicrovmImageHooks`.", "title": "ReadyTimeoutInSeconds" }, "Validate": { @@ -3213,7 +3213,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether the validate hook is enabled. The validate hook is called during image build to validate the application. \n*Valid values*: `ENABLED`, `DISABLED` \n*Type*: String \n*Required*: No \n*Default*: `DISABLED` \n*CloudFormation compatibility*: This property is passed directly to the `Validate` property of `MicrovmImageHooks`.", "title": "Validate" }, "ValidateTimeoutInSeconds": { @@ -3225,7 +3225,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout in seconds for the validate hook. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the `ValidateTimeoutInSeconds` property of `MicrovmImageHooks`.", "title": "ValidateTimeoutInSeconds" } }, @@ -3544,7 +3544,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The minimum memory in MiB for the MicroVM. \n*Type*: Integer \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`MinimumMemoryInMiB`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-resources.html#cfn-lambda-microvmimage-resources-minimummemoryinmib) property of a `Resources` item of an `AWS::Lambda::MicrovmImage` resource.", "title": "MinimumMemoryInMiB" } }, @@ -4418,7 +4418,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether an API key is required for this route. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ApiKeyRequired`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-apikeyrequired) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "ApiKeyRequired" }, "FunctionArn": { @@ -4430,7 +4430,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the Lambda function that handles this route. AWS SAM creates an integration and the necessary permissions for API Gateway to invoke the function. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "FunctionArn" }, "IntegrationTimeout": { @@ -4439,7 +4439,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The timeout for the integration, in milliseconds. The maximum value is 29,000 milliseconds (29 seconds). \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`TimeoutInMillis`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-integration.html#cfn-apigatewayv2-integration-timeoutinmillis) property of an `AWS::ApiGatewayV2::Integration` resource.", "title": "IntegrationTimeout" }, "ModelSelectionExpression": { @@ -4448,7 +4448,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The model selection expression for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ModelSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-modelselectionexpression) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "ModelSelectionExpression" }, "OperationName": { @@ -4457,7 +4457,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The operation name for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`OperationName`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-operationname) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "OperationName" }, "RequestModels": { @@ -4466,7 +4466,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The request models for the route. \n*Type*: Json \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RequestModels`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-requestmodels) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "RequestModels" }, "RequestParameters": { @@ -4475,7 +4475,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The request parameters for the route. \n*Type*: Json \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RequestParameters`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-requestparameters) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "RequestParameters" }, "RouteResponseSelectionExpression": { @@ -4484,7 +4484,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The route response selection expression for the route. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RouteResponseSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html#cfn-apigatewayv2-route-routeresponseselectionexpression) property of an `AWS::ApiGatewayV2::Route` resource.", "title": "RouteResponseSelectionExpression" } }, @@ -9447,7 +9447,7 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "Additional OS capabilities to grant to the MicroVM runtime environment. If you don't specify a value, the service grants no additional OS capabilities. \n*Valid values*: `ALL` \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AdditionalOsCapabilities`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-additionaloscapabilities) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "AdditionalOsCapabilities", "type": "array" }, @@ -9460,7 +9460,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the base MicroVM image to build from. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimagearn) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "BaseImageArn" }, "BaseImageVersion": { @@ -9472,7 +9472,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The version of the base MicroVM image to use. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageVersion`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimageversion) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "BaseImageVersion" }, "BuildRoleArn": { @@ -9484,14 +9484,14 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that the MicroVM build service assumes to download your code artifact from Amazon S3 and write build logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`BuildRoleArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-buildrolearn) property of an `AWS::Lambda::MicrovmImage` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `BuildRole`. If your code artifact is encrypted with a customer managed key in AWS KMS, you must provide your own role with the appropriate `kms:Decrypt` permission.", "title": "BuildRoleArn" }, "CpuConfigurations": { "items": { "$ref": "#/definitions/CpuConfiguration" }, - "markdownDescription": "TODO", + "markdownDescription": "A list of [CpuConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cpuconfiguration.html) objects that specify the supported CPU architectures for the MicroVM. If you don't specify a value, the service uses the default CPU architecture. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CpuConfigurations`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-cpuconfigurations) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "CpuConfigurations", "type": "array" }, @@ -9506,12 +9506,12 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "The list of egress network connector ARNs available to the MicroVM at runtime. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`EgressNetworkConnectors`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-egressnetworkconnectors) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "EgressNetworkConnectors", "type": "array" }, "EnvironmentVariables": { - "markdownDescription": "TODO", + "markdownDescription": "Environment variables set in the MicroVM runtime environment. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`EnvironmentVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-environmentvariables) property of an `AWS::Lambda::MicrovmImage` resource. In AWS SAM, specify as a map (for example, `KEY: value`). AWS SAM converts to the CloudFormation array format `[{Key: KEY, Value: value}]`.", "title": "EnvironmentVariables", "type": "object" }, @@ -9521,7 +9521,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_microvmimage__Hooks" } ], - "markdownDescription": "TODO", + "markdownDescription": "Lifecycle hook configuration for MicroVMs and MicroVM images. \n*Type*: [Hooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Hooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-hooks) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Hooks" }, "Logging": { @@ -9530,11 +9530,11 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_microvmimage__Logging" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configuration for MicroVM logging output. Specify exactly one: `CloudWatch` to enable CloudWatch logging, or `Disabled` to turn off logging. \n*Type*: [Logging](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Logging`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-logging) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Logging" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated build role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, @@ -9542,12 +9542,12 @@ "items": { "$ref": "#/definitions/ResourceSpec" }, - "markdownDescription": "TODO", + "markdownDescription": "A list of [Resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-resources.html) objects that specify the resource requirements for the MicroVM. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Resources`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-resources) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Resources", "type": "array" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map of key-value pairs that specifies the tags added to this MicroVM image. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-tags) property of an `AWS::Lambda::MicrovmImage` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this resource, and to the default roles that are generated for it.", "title": "Tags", "type": "object" } @@ -9564,7 +9564,7 @@ "$ref": "#/definitions/MicrovmHooks" } ], - "markdownDescription": "TODO", + "markdownDescription": "Lifecycle hooks called at MicroVM instance lifecycle transitions (run, resume, suspend, terminate). \n*Type*: [MicrovmHooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-microvmhooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`MicrovmHooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-microvmhooks) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "MicrovmHooks" }, "MicrovmImageHooks": { @@ -9573,7 +9573,7 @@ "$ref": "#/definitions/MicrovmImageHooks" } ], - "markdownDescription": "TODO", + "markdownDescription": "Lifecycle hooks called during MicroVM image build (ready, validate). \n*Type*: [MicrovmImageHooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-microvmimagehooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`MicrovmImageHooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-microvmimagehooks) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "MicrovmImageHooks" }, "Port": { @@ -9585,7 +9585,7 @@ "type": "integer" } ], - "markdownDescription": "TODO", + "markdownDescription": "The port on which the application listens for lifecycle hook invocations. \n*Type*: Integer \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Port`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html#cfn-lambda-microvmimage-hooks-port) property of the `Hooks` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Port" } }, @@ -9601,11 +9601,11 @@ "$ref": "#/definitions/CloudWatchLogging" } ], - "markdownDescription": "TODO", + "markdownDescription": "CloudWatch logging configuration for the MicroVM. \n*Type*: [CloudWatch](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cloudwatchlogging.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CloudWatch`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html#cfn-lambda-microvmimage-logging-cloudwatch) property of the `Logging` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "CloudWatch" }, "Disabled": { - "markdownDescription": "TODO", + "markdownDescription": "Set to `true` to disable logging for the MicroVM. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Disabled`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html#cfn-lambda-microvmimage-logging-disabled) property of the `Logging` property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Disabled", "type": "boolean" } @@ -9630,7 +9630,7 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "Additional OS capabilities to grant to the MicroVM runtime environment. If you don't specify a value, the service grants no additional OS capabilities. \n*Valid values*: `ALL` \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AdditionalOsCapabilities`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-additionaloscapabilities) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "AdditionalOsCapabilities", "type": "array" }, @@ -9643,7 +9643,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the base MicroVM image to build from. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimagearn) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "BaseImageArn" }, "BaseImageVersion": { @@ -9655,7 +9655,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The version of the base MicroVM image to use. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`BaseImageVersion`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-baseimageversion) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "BaseImageVersion" }, "BuildRoleArn": { @@ -9667,7 +9667,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that the MicroVM build service assumes to download your code artifact from Amazon S3 and write build logs. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`BuildRoleArn`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-buildrolearn) property of an `AWS::Lambda::MicrovmImage` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `BuildRole`. If your code artifact is encrypted with a customer managed key in AWS KMS, you must provide your own role with the appropriate `kms:Decrypt` permission.", "title": "BuildRoleArn" }, "CodeUri": { @@ -9679,14 +9679,14 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The Amazon S3 URI of the zip artifact containing the Dockerfile and application code. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is transformed to the [`CodeArtifact`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-codeartifact) property of an `AWS::Lambda::MicrovmImage` resource. AWS SAM wraps the URI into the `CodeArtifact.Uri` structure.", "title": "CodeUri" }, "CpuConfigurations": { "items": { "$ref": "#/definitions/CpuConfiguration" }, - "markdownDescription": "TODO", + "markdownDescription": "A list of [CpuConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-cpuconfiguration.html) objects that specify the supported CPU architectures for the MicroVM. If you don't specify a value, the service uses the default CPU architecture. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`CpuConfigurations`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-cpuconfigurations) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "CpuConfigurations", "type": "array" }, @@ -9699,7 +9699,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "A description of the MicroVM image. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Description`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-description) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Description" }, "EgressNetworkConnectors": { @@ -9713,12 +9713,12 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "The list of egress network connector ARNs available to the MicroVM at runtime. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`EgressNetworkConnectors`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-egressnetworkconnectors) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "EgressNetworkConnectors", "type": "array" }, "EnvironmentVariables": { - "markdownDescription": "TODO", + "markdownDescription": "Environment variables set in the MicroVM runtime environment. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`EnvironmentVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-environmentvariables) property of an `AWS::Lambda::MicrovmImage` resource. In AWS SAM, specify as a map (for example, `KEY: value`). AWS SAM converts to the CloudFormation array format `[{Key: KEY, Value: value}]`.", "title": "EnvironmentVariables", "type": "object" }, @@ -9728,7 +9728,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_microvmimage__Hooks" } ], - "markdownDescription": "TODO", + "markdownDescription": "Lifecycle hook configuration for MicroVMs and MicroVM images. \n*Type*: [Hooks](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-hooks.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Hooks`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-hooks) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Hooks" }, "Logging": { @@ -9737,7 +9737,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_microvmimage__Logging" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configuration for MicroVM logging output. Specify exactly one: `CloudWatch` to enable CloudWatch logging, or `Disabled` to turn off logging. \n*Type*: [Logging](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-logging.html) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Logging`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-logging) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Logging" }, "Name": { @@ -9749,11 +9749,11 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The name of the MicroVM image. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-name) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Name" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated build role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, @@ -9761,12 +9761,12 @@ "items": { "$ref": "#/definitions/ResourceSpec" }, - "markdownDescription": "TODO", + "markdownDescription": "A list of [Resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-microvmimage-resources.html) objects that specify the resource requirements for the MicroVM. \n*Type*: List \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Resources`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-resources) property of an `AWS::Lambda::MicrovmImage` resource.", "title": "Resources", "type": "array" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map of key-value pairs that specifies the tags added to this MicroVM image. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-microvmimage.html#cfn-lambda-microvmimage-tags) property of an `AWS::Lambda::MicrovmImage` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this resource, and to the default roles that are generated for it.", "title": "Tags", "type": "object" } @@ -9842,16 +9842,16 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that the network connector service assumes to create and manage elastic network interfaces (ENIs). \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`OperatorRole`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-operatorrole) property of an `AWS::Lambda::NetworkConnector` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `OperatorRole`.", "title": "OperatorRole" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated operator role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map of key-value pairs that specifies the tags added to this network connector. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-tags) property of an `AWS::Lambda::NetworkConnector` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this network connector, and to the default roles that are generated for it.", "title": "Tags", "type": "object" } @@ -9871,7 +9871,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The name of the network connector. The name must be unique within your account and Region. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-name) property of an `AWS::Lambda::NetworkConnector` resource.", "title": "Name" }, "OperatorRole": { @@ -9883,16 +9883,16 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The ARN of the IAM role that the network connector service assumes to create and manage elastic network interfaces (ENIs). \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`OperatorRole`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-operatorrole) property of an `AWS::Lambda::NetworkConnector` resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of `OperatorRole`.", "title": "OperatorRole" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether to pass tags from the `Tags` property to generated resources, such as the auto-generated operator role. \n*Type*: Boolean \n*Required*: No \n*Default*: `False` \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map of key-value pairs that specifies the tags added to this network connector. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-tags) property of an `AWS::Lambda::NetworkConnector` resource. The `Tags` property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of `Tag` objects). Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this network connector, and to the default roles that are generated for it.", "title": "Tags", "type": "object" }, @@ -9902,7 +9902,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_networkconnector__VpcConfig" } ], - "markdownDescription": "TODO", + "markdownDescription": "The VPC egress configuration for the network connector, including the subnets, security groups, and network protocol for elastic network interface (ENI) provisioning. \n*Type*: [VpcConfig](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-networkconnector-vpcconfig.html) \n*Required*: Yes \n*CloudFormation compatibility*: This property is transformed to the [`Configuration.VpcEgressConfiguration`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-networkconnector.html#cfn-lambda-networkconnector-configuration) property of an `AWS::Lambda::NetworkConnector` resource. AWS SAM also injects `AssociatedComputeResourceTypes: [MicroVm]` automatically.", "title": "VpcConfig" } }, @@ -9978,7 +9978,7 @@ "type": "string" } ], - "markdownDescription": "TODO", + "markdownDescription": "The network protocol for the VPC egress connection. \n*Valid values*: `IPv4`, `DualStack` \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`NetworkProtocol`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-networkprotocol) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource.", "title": "NetworkProtocol" }, "SecurityGroupIds": { @@ -9992,7 +9992,7 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "A list of security group IDs to associate with the elastic network interfaces (ENIs). \n*Type*: List \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`SecurityGroupIds`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-securitygroupids) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource.", "title": "SecurityGroupIds", "type": "array" }, @@ -10007,7 +10007,7 @@ } ] }, - "markdownDescription": "TODO", + "markdownDescription": "A list of subnet IDs where the service provisions ENIs for VPC egress connectivity. \n*Type*: List \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`SubnetIds`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-lambda-networkconnector-vpcegressconfiguration.html#cfn-lambda-networkconnector-vpcegressconfiguration-subnetids) property of `Configuration.VpcEgressConfiguration` of an `AWS::Lambda::NetworkConnector` resource.", "title": "SubnetIds", "type": "array" } @@ -11253,11 +11253,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The settings for access logging in a stage. \n*Type*: [AccessLogSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AccessLogSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "AccessLogSettings" }, "ApiKeySelectionExpression": { - "markdownDescription": "TODO", + "markdownDescription": "An API key selection expression. For more information, see [API Key Selection Expressions](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions) in the *API Gateway Developer Guide*. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ApiKeySelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-apikeyselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "ApiKeySelectionExpression", "type": "string" }, @@ -11267,16 +11267,16 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The default route settings for this WebSocket API. These settings apply to all routes unless overridden by the `RouteSettings` property for certain routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DefaultRouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-defaultroutesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "DefaultRouteSettings" }, "DisableExecuteApiEndpoint": { - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether clients can invoke your API by using the default `execute-api` endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableExecuteApiEndpoint`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableexecuteapiendpoint) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "DisableExecuteApiEndpoint", "type": "boolean" }, "DisableSchemaValidation": { - "markdownDescription": "TODO", + "markdownDescription": "Avoid validating models when creating a deployment. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableSchemaValidation`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableschemavalidation) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "DisableSchemaValidation", "type": "boolean" }, @@ -11286,21 +11286,21 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_websocketapi__Domain" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configures a custom domain for this WebSocket API. \n*Type*: [WebSocketApiDomainConfiguration](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-websocketapidomainconfiguration.html) \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Domain" }, "IpAddressType": { - "markdownDescription": "TODO", + "markdownDescription": "The IP address type for the API. Valid values are `ipv4` for IPv4 only and `dualstack` for IPv4 and IPv6. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`IpAddressType`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-ipaddresstype) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "IpAddressType", "type": "string" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "If `true`, AWS SAM adds the `Tags` property to the `AWS::ApiGatewayV2::Stage` and `AWS::ApiGatewayV2::DomainName` resources that AWS SAM generates. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, "RouteSelectionExpression": { - "markdownDescription": "TODO", + "markdownDescription": "The route selection expression for the WebSocket API. A common value is `$request.body.action`, which routes messages based on an `action` field in the message body. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-routeselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "RouteSelectionExpression", "type": "string" }, @@ -11310,7 +11310,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The route settings for this WebSocket API. These settings override the `DefaultRouteSettings` for specific routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "RouteSettings" }, "StageVariables": { @@ -11319,11 +11319,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "A map that defines the stage variables. Variable names can have alphanumeric and underscore characters, and the values must match `[A-Za-z0-9-._~:/?#&=,]+`. \n*Type*: [Json](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`StageVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "StageVariables" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map (string to string) that specifies the tags to be added to this WebSocket API. For details about valid keys and values for tags, see [Resource tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) in the *CloudFormation User Guide*. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Tags", "type": "object" } @@ -11340,7 +11340,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The settings for access logging in a stage. \n*Type*: [AccessLogSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`AccessLogSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-accesslogsettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "AccessLogSettings" }, "ApiKeySelectionExpression": { @@ -11349,7 +11349,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "An API key selection expression. For more information, see [API Key Selection Expressions](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-selection-expressions.html#apigateway-websocket-api-apikey-selection-expressions) in the *API Gateway Developer Guide*. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`ApiKeySelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-apikeyselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "ApiKeySelectionExpression" }, "Auth": { @@ -11358,7 +11358,7 @@ "$ref": "#/definitions/AuthConfig" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configures authorization for controlling access to your WebSocket API. Authorization is applied to the `$connect` route. \n*Type*: [WebSocketApiAuth](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-websocketapiauth.html) \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Auth" }, "DefaultRouteSettings": { @@ -11367,11 +11367,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The default route settings for this WebSocket API. These settings apply to all routes unless overridden by the `RouteSettings` property for certain routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DefaultRouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-defaultroutesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "DefaultRouteSettings" }, "Description": { - "markdownDescription": "TODO", + "markdownDescription": "A description of the WebSocket API. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Description`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-description) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "Description", "type": "string" }, @@ -11381,11 +11381,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "Specifies whether clients can invoke your API by using the default `execute-api` endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableExecuteApiEndpoint`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableexecuteapiendpoint) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "DisableExecuteApiEndpoint" }, "DisableSchemaValidation": { - "markdownDescription": "TODO", + "markdownDescription": "Avoid validating models when creating a deployment. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`DisableSchemaValidation`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-disableschemavalidation) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "DisableSchemaValidation", "type": "boolean" }, @@ -11395,7 +11395,7 @@ "$ref": "#/definitions/samtranslator__internal__schema_source__aws_serverless_websocketapi__Domain" } ], - "markdownDescription": "TODO", + "markdownDescription": "Configures a custom domain for this WebSocket API. \n*Type*: [WebSocketApiDomainConfiguration](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-websocketapidomainconfiguration.html) \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Domain" }, "IpAddressType": { @@ -11404,7 +11404,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The IP address type for the API. Valid values are `ipv4` for IPv4 only and `dualstack` for IPv4 and IPv6. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`IpAddressType`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-ipaddresstype) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "IpAddressType" }, "Name": { @@ -11413,11 +11413,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "A name for the WebSocket API. If you don't specify a name, AWS SAM generates a name for you. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`Name`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-name) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "Name" }, "PropagateTags": { - "markdownDescription": "TODO", + "markdownDescription": "If `true`, AWS SAM adds the `Tags` property to the `AWS::ApiGatewayV2::Stage` and `AWS::ApiGatewayV2::DomainName` resources that AWS SAM generates. \n*Type*: Boolean \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "PropagateTags", "type": "boolean" }, @@ -11427,7 +11427,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The route selection expression for the WebSocket API. A common value is `$request.body.action`, which routes messages based on an `action` field in the message body. \n*Type*: String \n*Required*: Yes \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-routeselectionexpression) property of an `AWS::ApiGatewayV2::Api` resource.", "title": "RouteSelectionExpression" }, "RouteSettings": { @@ -11436,14 +11436,14 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The route settings for this WebSocket API. These settings override the `DefaultRouteSettings` for specific routes. \n*Type*: [RouteSettings](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`RouteSettings`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-routesettings) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "RouteSettings" }, "Routes": { "additionalProperties": { "$ref": "#/definitions/WebSocketApiRoute" }, - "markdownDescription": "TODO", + "markdownDescription": "The route configurations for this WebSocket API. Routes define how messages are routed to Lambda functions. Each route consists of a route key and a Lambda function ARN. WebSocket APIs support three predefined routes: `$connect`, `$disconnect`, and `$default`. You can also define custom routes. \n*Type*: [RouteConfiguration](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-websocketapi-routeconfiguration.html) \n*Required*: Yes \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Routes", "type": "object" }, @@ -11453,7 +11453,7 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "The name of the API stage. If you don't specify a name, AWS SAM uses `default` as the stage name. \n*Type*: String \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`StageName`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagename) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "StageName" }, "StageVariables": { @@ -11462,11 +11462,11 @@ "$ref": "#/definitions/PassThroughProp" } ], - "markdownDescription": "TODO", + "markdownDescription": "A map that defines the stage variables. Variable names can have alphanumeric and underscore characters, and the values must match `[A-Za-z0-9-._~:/?#&=,]+`. \n*Type*: [Json](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) \n*Required*: No \n*CloudFormation compatibility*: This property is passed directly to the [`StageVariables`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-stage.html#cfn-apigatewayv2-stage-stagevariables) property of an `AWS::ApiGatewayV2::Stage` resource.", "title": "StageVariables" }, "Tags": { - "markdownDescription": "TODO", + "markdownDescription": "A map (string to string) that specifies the tags to be added to this WebSocket API. For details about valid keys and values for tags, see [Resource tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) in the *CloudFormation User Guide*. \n*Type*: Map \n*Required*: No \n*CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have a CloudFormation equivalent.", "title": "Tags", "type": "object" } diff --git a/tests/model/network_connector/test_generators.py b/tests/model/network_connector/test_generators.py index 1fb1d8d93..197d23b55 100644 --- a/tests/model/network_connector/test_generators.py +++ b/tests/model/network_connector/test_generators.py @@ -123,12 +123,9 @@ def test_operator_role_policy(self): resources = gen.to_cloudformation() role = resources[0] - policy = role.Policies[0] - self.assertEqual(policy["PolicyName"], "NetworkConnectorOperatorPolicy") - statements = policy["PolicyDocument"]["Statement"] - all_actions = [s["Action"] for s in statements] - self.assertIn("ec2:CreateNetworkInterface", all_actions) - self.assertIn("ec2:CreateTags", all_actions) + managed_policy_arns = role.ManagedPolicyArns + self.assertEqual(len(managed_policy_arns), 1) + self.assertIn("AWSLambdaNetworkConnectorOperatorPolicy", managed_policy_arns[0]) def test_operator_role_has_sam_marker_tag(self): gen = NetworkConnectorGenerator( diff --git a/tests/translator/output/aws-cn/network_connector.json b/tests/translator/output/aws-cn/network_connector.json index 5374eb6a9..c05da21f7 100644 --- a/tests/translator/output/aws-cn/network_connector.json +++ b/tests/translator/output/aws-cn/network_connector.json @@ -60,61 +60,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws-cn:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { diff --git a/tests/translator/output/aws-cn/network_connector_with_intrinsics.json b/tests/translator/output/aws-cn/network_connector_with_intrinsics.json index b498977c5..8b4c67cb6 100644 --- a/tests/translator/output/aws-cn/network_connector_with_intrinsics.json +++ b/tests/translator/output/aws-cn/network_connector_with_intrinsics.json @@ -63,61 +63,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws-cn:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { diff --git a/tests/translator/output/aws-cn/network_connector_with_propagate_tags.json b/tests/translator/output/aws-cn/network_connector_with_propagate_tags.json index 8a5f2456d..1b3f0a7a9 100644 --- a/tests/translator/output/aws-cn/network_connector_with_propagate_tags.json +++ b/tests/translator/output/aws-cn/network_connector_with_propagate_tags.json @@ -59,61 +59,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws-cn:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { diff --git a/tests/translator/output/aws-us-gov/network_connector.json b/tests/translator/output/aws-us-gov/network_connector.json index 5374eb6a9..33113846d 100644 --- a/tests/translator/output/aws-us-gov/network_connector.json +++ b/tests/translator/output/aws-us-gov/network_connector.json @@ -60,61 +60,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws-us-gov:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { diff --git a/tests/translator/output/aws-us-gov/network_connector_with_intrinsics.json b/tests/translator/output/aws-us-gov/network_connector_with_intrinsics.json index b498977c5..b7595d48a 100644 --- a/tests/translator/output/aws-us-gov/network_connector_with_intrinsics.json +++ b/tests/translator/output/aws-us-gov/network_connector_with_intrinsics.json @@ -63,61 +63,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws-us-gov:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { diff --git a/tests/translator/output/aws-us-gov/network_connector_with_propagate_tags.json b/tests/translator/output/aws-us-gov/network_connector_with_propagate_tags.json index 8a5f2456d..6e863f92a 100644 --- a/tests/translator/output/aws-us-gov/network_connector_with_propagate_tags.json +++ b/tests/translator/output/aws-us-gov/network_connector_with_propagate_tags.json @@ -59,61 +59,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws-us-gov:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { diff --git a/tests/translator/output/network_connector.json b/tests/translator/output/network_connector.json index 5374eb6a9..a125bc6c9 100644 --- a/tests/translator/output/network_connector.json +++ b/tests/translator/output/network_connector.json @@ -60,61 +60,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { diff --git a/tests/translator/output/network_connector_with_intrinsics.json b/tests/translator/output/network_connector_with_intrinsics.json index b498977c5..c89f7f62e 100644 --- a/tests/translator/output/network_connector_with_intrinsics.json +++ b/tests/translator/output/network_connector_with_intrinsics.json @@ -63,61 +63,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { diff --git a/tests/translator/output/network_connector_with_propagate_tags.json b/tests/translator/output/network_connector_with_propagate_tags.json index 8a5f2456d..d69afe601 100644 --- a/tests/translator/output/network_connector_with_propagate_tags.json +++ b/tests/translator/output/network_connector_with_propagate_tags.json @@ -59,61 +59,8 @@ ], "Version": "2012-10-17" }, - "Policies": [ - { - "PolicyDocument": { - "Statement": [ - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:subnet/*" - }, - "Sid": "AllowCreateEniInAnySubnet" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:security-group/*" - }, - "Sid": "AllowCreateEniWithSecurityGroups" - }, - { - "Action": "ec2:CreateNetworkInterface", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "aws:lambda:networkConnectorName", - "aws:lambda:networkConnectorId" - ] - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "AllowCreateEniWithLambdaTagKeys" - }, - { - "Action": "ec2:CreateTags", - "Condition": { - "StringEquals": { - "ec2:CreateAction": "CreateNetworkInterface", - "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com" - } - }, - "Effect": "Allow", - "Resource": { - "Fn::Sub": "arn:${AWS::Partition}:ec2:*:*:network-interface/*" - }, - "Sid": "TagENIOnCreate" - } - ], - "Version": "2012-10-17" - }, - "PolicyName": "NetworkConnectorOperatorPolicy" - } + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/AWSLambdaNetworkConnectorOperatorPolicy" ], "Tags": [ { From e7b6f98d70dbeb52ae1806cc0157ef784c4b9257 Mon Sep 17 00:00:00 2001 From: aws-sam-cli-bot <46753707+aws-sam-cli-bot@users.noreply.github.com> Date: Thu, 13 Aug 2026 22:19:33 +0000 Subject: [PATCH 4/4] chore: bump version to 1.112.0 --- samtranslator/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/samtranslator/__init__.py b/samtranslator/__init__.py index ff02d400a..fe9ed65d9 100644 --- a/samtranslator/__init__.py +++ b/samtranslator/__init__.py @@ -1 +1 @@ -__version__ = "1.111.0" +__version__ = "1.112.0"