cdkd
CC-API enrichment-coverage matrix
Classifies every CC-routable resource type (whose CFn schema is cached under tests/fixtures/cfn-schemas/) by whether its computed readOnly Fn::GetAtt attributes are populated by CloudControlProvider.enrichResourceAttributes. A computed attribute that is NOT enriched silently falls through the intrinsic resolver to the physicalId (the bug class fixed in #844 / #864 / #865 / #866).
Gap severity depends on the tier. A gap on an SDK-backed type (sdk-fallback-gap) is only exposed on the #614 silent-drop CC-fallback path — the SDK provider populates the attribute on the primary path — so it is informational and does NOT fail CI. A gap on a pure-CC type (unenriched-computed, no SDK provider) is the real bug class: the CC path is the only path, so the attribute would always fall through. The audit:enrichment-coverage:check critic hard-fails ONLY on unenriched-computed.
NOTE: every cached schema today is an SDK-backed (Tier 1) type — the fixture refresh only fetches registered providers — so the critic currently has 0 hard gaps by construction. It becomes load-bearing the moment a pure-CC type's schema is cached (e.g.
AWS::ElastiCache::ReplicationGroup,AWS::Redshift::Cluster,AWS::OpenSearchService::Domain).
Summary
- Classified types (cached schema): 134
- Fully enriched: 50
- No computed attribute (Ref == physicalId is correct): 15
- Pure-CC latent gaps (unenriched-computed, blocks CI): 0
- SDK-fallback gaps (informational, #614 path only): 69
- Types with allow-listed (not-a-gap) attributes: 87
Pure-CC latent gaps
None. Every computed readOnly attribute on a cached pure-CC type is either enriched or explicitly allow-listed.
SDK-fallback gaps (informational)
SDK-backed types whose computed attribute is unenriched: only exposed on the #614 silent-drop CC-fallback path. Tracked so a future #614-hardening pass can prioritise; does not block CI.
| Resource type | Unenriched computed attributes (CC-fallback only) |
|---|---|
AWS::ApiGatewayV2::Api |
ApiEndpoint |
AWS::AppSync::ApiKey |
ApiKey, Arn |
AWS::AppSync::GraphQLApi |
Arn, GraphQLDns, GraphQLEndpointArn, GraphQLUrl, RealtimeDns, RealtimeUrl |
AWS::AutoScaling::AutoScalingGroup |
AutoScalingGroupARN |
AWS::BedrockAgentCore::Browser |
BrowserId, Name, Status |
AWS::BedrockAgentCore::CodeInterpreter |
CodeInterpreterId, Status |
AWS::BedrockAgentCore::Evaluator |
CreatedAt, EvaluatorId, Status, UpdatedAt |
AWS::BedrockAgentCore::Runtime |
AgentRuntimeArn, AgentRuntimeVersion, CreatedAt, FailureReason, LastUpdatedAt, Status, WorkloadIdentityDetails |
AWS::CloudFormation::Stack |
ChangeSetId, CreationTime, LastUpdateTime, Outputs, ParentId, RootId, StackStatus |
AWS::CloudFront::Distribution |
DomainName |
AWS::CloudTrail::Trail |
Arn, SnsTopicArn |
AWS::CloudWatch::Alarm |
Arn |
AWS::CodeBuild::Project |
Arn |
AWS::CodeCommit::Repository |
Arn, CloneUrlHttp, CloneUrlSsh, Name |
AWS::Cognito::UserPool |
Arn, ProviderName, ProviderURL |
AWS::DLM::LifecyclePolicy |
Arn |
AWS::DocDB::DBCluster |
ClusterResourceId, Endpoint, ReadEndpoint |
AWS::DocDB::DBInstance |
Endpoint, Port |
AWS::DynamoDB::GlobalTable |
Arn, StreamArn, TableId |
AWS::DynamoDB::Table |
Arn |
AWS::EC2::Instance |
PrivateDnsName, PrivateIp, PublicDnsName, PublicIp, State, VpcId |
AWS::EC2::NatGateway |
AutoProvisionZones, AutoScalingIps, EniId, RouteTableId |
AWS::EC2::SecurityGroup |
GroupId |
AWS::EC2::Subnet |
BlockPublicAccessStates, Ipv6CidrBlocks, NetworkAclAssociationId |
AWS::EC2::VPC |
CidrBlockAssociations, DefaultNetworkAcl, DefaultSecurityGroup, Ipv6CidrBlocks |
AWS::ECS::Cluster |
Arn |
AWS::ECS::Service |
Name |
AWS::EFS::AccessPoint |
Arn |
AWS::EFS::FileSystem |
Arn |
AWS::ElastiCache::CacheCluster |
ConfigurationEndpoint, RedisEndpoint |
AWS::ElasticLoadBalancingV2::LoadBalancer |
CanonicalHostedZoneID, DNSName, LoadBalancerFullName, LoadBalancerName |
AWS::ElasticLoadBalancingV2::TargetGroup |
LoadBalancerArns, TargetGroupFullName, TargetGroupName |
AWS::EMR::Cluster |
MasterPublicDNS |
AWS::Events::EventBus |
Arn |
AWS::FSx::FileSystem |
DNSName, LustreMountName, ResourceARN, RootVolumeId |
AWS::IAM::AccessKey |
SecretAccessKey |
AWS::IAM::Group |
Arn |
AWS::IAM::InstanceProfile |
Arn |
AWS::IAM::ManagedPolicy |
AttachmentCount, CreateDate, DefaultVersionId, IsAttachable, PermissionsBoundaryUsageCount, PolicyId, UpdateDate |
AWS::IAM::Role |
Arn, RoleId |
AWS::IAM::User |
Arn |
AWS::Kinesis::Stream |
WarmThroughputObject |
AWS::Kinesis::StreamConsumer |
ConsumerCreationTimestamp, ConsumerStatus |
AWS::KinesisFirehose::DeliveryStream |
Arn |
AWS::Lambda::EventSourceMapping |
EventSourceMappingArn |
AWS::Lambda::Function |
Arn, SnapStartResponse |
AWS::Lambda::MicrovmImage |
CreatedAt, LatestActiveImageVersion, LatestFailedImageVersion, State, UpdatedAt |
AWS::Logs::LogGroup |
Arn |
AWS::Neptune::DBCluster |
ClusterResourceId, Endpoint, Port, ReadEndpoint |
AWS::Neptune::DBInstance |
Endpoint, Port |
AWS::RDS::DBCluster |
DBClusterArn, StorageEncryptionType, StorageThroughput |
AWS::RDS::DBInstance |
AutomaticRestartTime, CertificateDetails, DBInstanceArn, DBInstanceStatus, DbiResourceId, InstanceCreateTime, IsStorageConfigUpgradeAvailable, LatestRestorableTime, ListenerEndpoint, PercentProgress, ReadReplicaDBClusterIdentifiers, ReadReplicaDBInstanceIdentifiers, ResumeFullAutomationModeTime, SecondaryAvailabilityZone, StatusInfos |
AWS::RDS::DBProxy |
DBProxyArn, Endpoint, VpcId |
AWS::RDS::DBProxyEndpoint |
DBProxyEndpointArn, Endpoint, IsDefault, VpcId |
AWS::RDS::DBSubnetGroup |
DBSubnetGroupArn |
AWS::Route53::HostedZone |
NameServers |
AWS::S3::Bucket |
DomainName, DualStackDomainName, RegionalDomainName, WebsiteURL |
AWS::S3Express::DirectoryBucket |
Arn, AvailabilityZoneName |
AWS::S3Tables::Table |
VersionToken, WarehouseLocation |
AWS::S3Vectors::VectorBucket |
CreationTime |
AWS::Scheduler::Schedule |
Arn |
AWS::ServiceDiscovery::HttpNamespace |
Arn |
AWS::ServiceDiscovery::PrivateDnsNamespace |
Arn, HostedZoneId |
AWS::ServiceDiscovery::PublicDnsNamespace |
Arn, HostedZoneId |
AWS::ServiceDiscovery::Service |
Arn |
AWS::SQS::Queue |
Arn |
AWS::SSM::Parameter |
Arn |
AWS::StepFunctions::StateMachine |
Name, StateMachineRevisionId |
AWS::WAFv2::WebACL |
Arn, Capacity, LabelNamespace |
Full classification
| Resource type | SDK | Bucket | readOnly attributes (status) |
|---|---|---|---|
AWS::ApiGateway::Account |
yes | enriched | Id (allow) |
AWS::ApiGateway::Authorizer |
yes | enriched | AuthorizerId (allow) |
AWS::ApiGateway::Deployment |
yes | enriched | DeploymentId (allow) |
AWS::ApiGateway::Method |
yes | no-computed-attr | (none) |
AWS::ApiGateway::Resource |
yes | enriched | ResourceId (allow) |
AWS::ApiGateway::Stage |
yes | no-computed-attr | (none) |
AWS::ApiGatewayV2::Api |
yes | sdk-fallback-gap | ApiEndpoint (GAP), ApiId (allow) |
AWS::ApiGatewayV2::Authorizer |
yes | enriched | AuthorizerId (allow) |
AWS::ApiGatewayV2::Integration |
yes | enriched | IntegrationId (allow) |
AWS::ApiGatewayV2::Route |
yes | enriched | RouteId (allow) |
AWS::ApiGatewayV2::Stage |
yes | no-computed-attr | (none) |
AWS::AppSync::ApiKey |
yes | sdk-fallback-gap | ApiKey (GAP), ApiKeyId (allow), Arn (GAP) |
AWS::AppSync::DataSource |
yes | enriched | DataSourceArn (allow) |
AWS::AppSync::GraphQLApi |
yes | sdk-fallback-gap | ApiId (allow), Arn (GAP), GraphQLDns (GAP), GraphQLEndpointArn (GAP), GraphQLUrl (GAP), RealtimeDns (GAP), RealtimeUrl (GAP) |
AWS::AppSync::GraphQLSchema |
yes | enriched | Id (allow) |
AWS::AppSync::Resolver |
yes | enriched | ResolverArn (allow) |
AWS::AutoScaling::AutoScalingGroup |
yes | sdk-fallback-gap | AutoScalingGroupARN (GAP) |
AWS::BedrockAgentCore::Browser |
yes | sdk-fallback-gap | BrowserArn (allow), BrowserId (GAP), Name (GAP), Status (GAP) |
AWS::BedrockAgentCore::CodeInterpreter |
yes | sdk-fallback-gap | CodeInterpreterArn (allow), CodeInterpreterId (GAP), Status (GAP) |
AWS::BedrockAgentCore::Evaluator |
yes | sdk-fallback-gap | CreatedAt (GAP), EvaluatorArn (allow), EvaluatorId (GAP), Status (GAP), UpdatedAt (GAP) |
AWS::BedrockAgentCore::Runtime |
yes | sdk-fallback-gap | AgentRuntimeArn (GAP), AgentRuntimeId (allow), AgentRuntimeVersion (GAP), CreatedAt (GAP), FailureReason (GAP), LastUpdatedAt (GAP), Status (GAP), WorkloadIdentityDetails (GAP) |
AWS::Budgets::Budget |
yes | enriched | Id (allow) |
AWS::CertificateManager::Certificate |
yes | enriched | CertificateArn (allow) |
AWS::CloudFormation::Stack |
yes | sdk-fallback-gap | ChangeSetId (GAP), CreationTime (GAP), LastUpdateTime (GAP), Outputs (GAP), ParentId (GAP), RootId (GAP), StackId (allow), StackStatus (GAP) |
AWS::CloudFormation::WaitConditionHandle |
yes | enriched | Id (allow) |
AWS::CloudFront::CloudFrontOriginAccessIdentity |
yes | enriched | Id (allow), S3CanonicalUserId (OK) |
AWS::CloudFront::Distribution |
yes | sdk-fallback-gap | DomainName (GAP), Id (allow) |
AWS::CloudFront::OriginAccessControl |
yes | enriched | Id (OK) |
AWS::CloudTrail::Trail |
yes | sdk-fallback-gap | Arn (GAP), SnsTopicArn (GAP) |
AWS::CloudWatch::Alarm |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::CloudWatch::AnomalyDetector |
yes | enriched | Id (allow) |
AWS::CodeBuild::Project |
yes | sdk-fallback-gap | Arn (GAP), Id (allow) |
AWS::CodeCommit::Repository |
yes | sdk-fallback-gap | Arn (GAP), CloneUrlHttp (GAP), CloneUrlSsh (GAP), Id (allow), Name (GAP) |
AWS::Cognito::UserPool |
yes | sdk-fallback-gap | Arn (GAP), ProviderName (GAP), ProviderURL (GAP), UserPoolId (allow) |
AWS::DLM::LifecyclePolicy |
yes | sdk-fallback-gap | Arn (GAP), Id (allow) |
AWS::DocDB::DBCluster |
yes | sdk-fallback-gap | ClusterResourceId (GAP), Endpoint (GAP), Id (allow), ReadEndpoint (GAP) |
AWS::DocDB::DBInstance |
yes | sdk-fallback-gap | Endpoint (GAP), Id (allow), Port (GAP) |
AWS::DocDB::DBSubnetGroup |
yes | enriched | Id (allow) |
AWS::DynamoDB::GlobalTable |
yes | sdk-fallback-gap | Arn (GAP), StreamArn (GAP), TableId (GAP) |
AWS::DynamoDB::Table |
yes | sdk-fallback-gap | Arn (GAP), StreamArn (OK) |
AWS::EC2::EIP |
yes | enriched | AllocationId (OK), PublicIp (OK) |
AWS::EC2::Instance |
yes | sdk-fallback-gap | InstanceId (allow), PrivateDnsName (GAP), PrivateIp (GAP), PublicDnsName (GAP), PublicIp (GAP), State (GAP), VpcId (GAP) |
AWS::EC2::InternetGateway |
yes | enriched | InternetGatewayId (allow) |
AWS::EC2::NatGateway |
yes | sdk-fallback-gap | AutoProvisionZones (GAP), AutoScalingIps (GAP), EniId (GAP), NatGatewayId (allow), RouteTableId (GAP) |
AWS::EC2::NetworkAcl |
yes | enriched | Id (allow) |
AWS::EC2::NetworkAclEntry |
yes | enriched | Id (allow) |
AWS::EC2::Route |
yes | enriched | CidrBlock (allow) |
AWS::EC2::RouteTable |
yes | enriched | RouteTableId (allow) |
AWS::EC2::SecurityGroup |
yes | sdk-fallback-gap | GroupId (GAP), Id (allow) |
AWS::EC2::SecurityGroupIngress |
yes | enriched | Id (allow) |
AWS::EC2::Subnet |
yes | sdk-fallback-gap | BlockPublicAccessStates (GAP), Ipv6CidrBlocks (GAP), NetworkAclAssociationId (GAP), SubnetId (allow) |
AWS::EC2::SubnetNetworkAclAssociation |
yes | enriched | AssociationId (allow) |
AWS::EC2::SubnetRouteTableAssociation |
yes | enriched | Id (allow) |
AWS::EC2::VPC |
yes | sdk-fallback-gap | CidrBlockAssociations (GAP), DefaultNetworkAcl (GAP), DefaultSecurityGroup (GAP), Ipv6CidrBlocks (GAP), VpcId (allow) |
AWS::EC2::VPCGatewayAttachment |
yes | enriched | AttachmentType (allow) |
AWS::ECR::Repository |
yes | enriched | Arn (OK), RepositoryUri (OK) |
AWS::ECS::Cluster |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::ECS::Service |
yes | sdk-fallback-gap | Name (GAP), ServiceArn (allow) |
AWS::ECS::TaskDefinition |
yes | enriched | TaskDefinitionArn (allow) |
AWS::EFS::AccessPoint |
yes | sdk-fallback-gap | AccessPointId (allow), Arn (GAP) |
AWS::EFS::FileSystem |
yes | sdk-fallback-gap | Arn (GAP), FileSystemId (allow) |
AWS::EFS::MountTarget |
yes | enriched | Id (allow) |
AWS::ElastiCache::CacheCluster |
yes | sdk-fallback-gap | ConfigurationEndpoint (GAP), RedisEndpoint (GAP) |
AWS::ElastiCache::SubnetGroup |
yes | no-computed-attr | (none) |
AWS::ElasticLoadBalancingV2::Listener |
yes | enriched | ListenerArn (allow) |
AWS::ElasticLoadBalancingV2::LoadBalancer |
yes | sdk-fallback-gap | CanonicalHostedZoneID (GAP), DNSName (GAP), LoadBalancerArn (allow), LoadBalancerFullName (GAP), LoadBalancerName (GAP) |
AWS::ElasticLoadBalancingV2::TargetGroup |
yes | sdk-fallback-gap | LoadBalancerArns (GAP), TargetGroupArn (allow), TargetGroupFullName (GAP), TargetGroupName (GAP) |
AWS::EMR::Cluster |
yes | sdk-fallback-gap | Id (allow), MasterPublicDNS (GAP) |
AWS::EMR::InstanceFleetConfig |
yes | enriched | Id (allow) |
AWS::EMR::InstanceGroupConfig |
yes | enriched | Id (allow) |
AWS::Events::EventBus |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::Events::Rule |
yes | enriched | Arn (allow) |
AWS::FSx::FileSystem |
yes | sdk-fallback-gap | DNSName (GAP), Id (allow), LustreMountName (GAP), ResourceARN (GAP), RootVolumeId (GAP) |
AWS::Glue::Connection |
yes | enriched | Id (allow) |
AWS::Glue::Crawler |
yes | no-computed-attr | (none) |
AWS::Glue::Database |
yes | no-computed-attr | (none) |
AWS::Glue::Job |
yes | no-computed-attr | (none) |
AWS::Glue::SecurityConfiguration |
yes | no-computed-attr | (none) |
AWS::Glue::Table |
yes | enriched | Id (allow) |
AWS::Glue::Trigger |
yes | no-computed-attr | (none) |
AWS::Glue::Workflow |
yes | no-computed-attr | (none) |
AWS::IAM::AccessKey |
yes | sdk-fallback-gap | Id (allow), SecretAccessKey (GAP) |
AWS::IAM::Group |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::IAM::InstanceProfile |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::IAM::ManagedPolicy |
yes | sdk-fallback-gap | AttachmentCount (GAP), CreateDate (GAP), DefaultVersionId (GAP), IsAttachable (GAP), PermissionsBoundaryUsageCount (GAP), PolicyArn (allow), PolicyId (GAP), UpdateDate (GAP) |
AWS::IAM::Policy |
yes | enriched | Id (allow) |
AWS::IAM::Role |
yes | sdk-fallback-gap | Arn (GAP), RoleId (GAP) |
AWS::IAM::User |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::IAM::UserToGroupAddition |
yes | enriched | Id (allow) |
AWS::Kinesis::Stream |
yes | sdk-fallback-gap | Arn (OK), WarmThroughputObject (GAP) |
AWS::Kinesis::StreamConsumer |
yes | sdk-fallback-gap | ConsumerARN (allow), ConsumerCreationTimestamp (GAP), ConsumerStatus (GAP) |
AWS::KinesisFirehose::DeliveryStream |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::KMS::Alias |
yes | no-computed-attr | (none) |
AWS::KMS::Key |
yes | enriched | Arn (OK), KeyId (OK) |
AWS::Lambda::EventInvokeConfig |
yes | no-computed-attr | (none) |
AWS::Lambda::EventSourceMapping |
yes | sdk-fallback-gap | EventSourceMappingArn (GAP), Id (allow) |
AWS::Lambda::Function |
yes | sdk-fallback-gap | Arn (GAP), SnapStartResponse (GAP) |
AWS::Lambda::LayerVersion |
yes | enriched | LayerVersionArn (allow) |
AWS::Lambda::MicrovmImage |
yes | sdk-fallback-gap | CreatedAt (GAP), ImageArn (allow), LatestActiveImageVersion (GAP), LatestFailedImageVersion (GAP), State (GAP), UpdatedAt (GAP) |
AWS::Lambda::Permission |
yes | enriched | Id (allow) |
AWS::Lambda::Url |
yes | enriched | FunctionArn (OK), FunctionUrl (OK) |
AWS::Logs::LogGroup |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::Neptune::DBCluster |
yes | sdk-fallback-gap | ClusterResourceId (GAP), Endpoint (GAP), Port (GAP), ReadEndpoint (GAP) |
AWS::Neptune::DBInstance |
yes | sdk-fallback-gap | Endpoint (GAP), Port (GAP) |
AWS::Neptune::DBSubnetGroup |
yes | no-computed-attr | (none) |
AWS::RDS::DBCluster |
yes | sdk-fallback-gap | DBClusterArn (GAP), DBClusterResourceId (OK), Endpoint (OK), ReadEndpoint (OK), StorageEncryptionType (GAP), StorageThroughput (GAP) |
AWS::RDS::DBInstance |
yes | sdk-fallback-gap | AutomaticRestartTime (GAP), CertificateDetails (GAP), DBInstanceArn (GAP), DBInstanceStatus (GAP), DbiResourceId (GAP), Endpoint (OK), InstanceCreateTime (GAP), IsStorageConfigUpgradeAvailable (GAP), LatestRestorableTime (GAP), ListenerEndpoint (GAP), PercentProgress (GAP), ReadReplicaDBClusterIdentifiers (GAP), ReadReplicaDBInstanceIdentifiers (GAP), ResumeFullAutomationModeTime (GAP), SecondaryAvailabilityZone (GAP), StatusInfos (GAP) |
AWS::RDS::DBProxy |
yes | sdk-fallback-gap | DBProxyArn (GAP), Endpoint (GAP), VpcId (GAP) |
AWS::RDS::DBProxyEndpoint |
yes | sdk-fallback-gap | DBProxyEndpointArn (GAP), Endpoint (GAP), IsDefault (GAP), VpcId (GAP) |
AWS::RDS::DBProxyTargetGroup |
yes | enriched | TargetGroupArn (allow) |
AWS::RDS::DBSubnetGroup |
yes | sdk-fallback-gap | DBSubnetGroupArn (GAP) |
AWS::Route53::HostedZone |
yes | sdk-fallback-gap | Id (allow), NameServers (GAP) |
AWS::Route53::RecordSet |
yes | enriched | Id (allow) |
AWS::S3::Bucket |
yes | sdk-fallback-gap | Arn (OK), DomainName (GAP), DualStackDomainName (GAP), RegionalDomainName (GAP), WebsiteURL (GAP) |
AWS::S3::BucketPolicy |
yes | no-computed-attr | (none) |
AWS::S3Express::DirectoryBucket |
yes | sdk-fallback-gap | Arn (GAP), AvailabilityZoneName (GAP) |
AWS::S3Tables::Namespace |
yes | no-computed-attr | (none) |
AWS::S3Tables::Table |
yes | sdk-fallback-gap | TableARN (allow), VersionToken (GAP), WarehouseLocation (GAP) |
AWS::S3Tables::TableBucket |
yes | enriched | TableBucketARN (allow) |
AWS::S3Vectors::VectorBucket |
yes | sdk-fallback-gap | CreationTime (GAP), VectorBucketArn (allow) |
AWS::Scheduler::Schedule |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::SecretsManager::Secret |
yes | enriched | Id (allow) |
AWS::ServiceDiscovery::HttpNamespace |
yes | sdk-fallback-gap | Arn (GAP), Id (allow) |
AWS::ServiceDiscovery::PrivateDnsNamespace |
yes | sdk-fallback-gap | Arn (GAP), HostedZoneId (GAP), Id (allow) |
AWS::ServiceDiscovery::PublicDnsNamespace |
yes | sdk-fallback-gap | Arn (GAP), HostedZoneId (GAP), Id (allow) |
AWS::ServiceDiscovery::Service |
yes | sdk-fallback-gap | Arn (GAP), Id (allow) |
AWS::SNS::Subscription |
yes | enriched | Arn (allow) |
AWS::SNS::Topic |
yes | enriched | TopicArn (allow) |
AWS::SNS::TopicPolicy |
yes | enriched | Id (allow) |
AWS::SQS::Queue |
yes | sdk-fallback-gap | Arn (GAP), QueueUrl (allow) |
AWS::SQS::QueuePolicy |
yes | enriched | Id (allow) |
AWS::SSM::Parameter |
yes | sdk-fallback-gap | Arn (GAP) |
AWS::StepFunctions::StateMachine |
yes | sdk-fallback-gap | Arn (allow), Name (GAP), StateMachineRevisionId (GAP) |
AWS::WAFv2::WebACL |
yes | sdk-fallback-gap | Arn (GAP), Capacity (GAP), Id (allow), LabelNamespace (GAP) |
Enrichment cases without a cached schema
These types have an enrichResourceAttributes case but no cached CFn schema, so their readOnly coverage cannot be verified offline. Refresh the fixture (node scripts/refresh-cfn-schemas.mjs) to bring them under the matrix.
AWS::ApiGateway::RestApiAWS::Backup::BackupPlanAWS::Backup::BackupSelectionAWS::Backup::BackupVaultAWS::ElastiCache::ReplicationGroupAWS::Events::ApiDestinationAWS::Events::ConnectionAWS::Lambda::VersionAWS::OpenSearchService::DomainAWS::Pipes::PipeAWS::Redshift::ClusterAWS::ResourceGroups::GroupAWS::Route53::HealthCheckAWS::S3::AccessPoint