Skip to content
cdkd

handledProperties wiring-evidence matrix

For every SDK provider class declaring handledProperties, checks that each declared property is actually CONSUMED — a read off the template property bag (properties['X'] / properties.X / a destructure), tracked per class through this.helper(properties) delegation. A declaration with no such evidence is either a wiring gap or a mis-declared property (the #1392 ECRProvider class), and gen-property-coverage.ts cannot see it: that pre-flight passes on the strength of the declaration alone.

A computed read properties[k] also counts when k iterates a literal name table (table-loop), but only when the loop body DELIVERS one of those reads. A body that merely compares them — an immutability guard or a change-detection scan — earns nothing, since crediting it would let one syntactic site vouch for every name in the table on the strength of a diff. The table itself is resolved LEXICALLY from the loop outward, so a table declared inside another class's method cannot vouch for this one. Reads off previousProperties are never evidence.

Summary

  • Provider classes classified: 84
  • Declared properties: 1138 (1136 with read evidence)
  • Fully wired classes: 82
  • Allow-listed classes (visible, non-blocking): 2
  • Classes with a whole-bag blind spot (recorded, never an excuse): 22
  • Wiring gaps (blocks CI): 0

Wiring gaps

None. Every declared handledProperties entry has read evidence or a rationale'd allow-list entry.

Allow-listed declarations — VISIBLE, non-blocking

Declared handled with no read evidence, deliberately not failing CI. A KNOWN GAP rationale is a real un-wired property awaiting a fix (removing the entry is what makes this critic verify that fix); a NOT-A-BUG rationale is a declaration that is correct without a read.

Provider class Property Type(s) Rationale
IAMAccessKeyProvider Serial AWS::IAM::AccessKey NOT-A-BUG: Serial is a createOnly REPLACEMENT TRIGGER with no IAM API counterpart; the diff layer implements it, and moving it to unhandledByDesign would hard-reject templates via the #614 viability guard
NestedStackProvider TemplateURL AWS::CloudFormation::Stack NOT-A-BUG: the child template is read from the local cloud assembly via Metadata['aws:asset:path'], so the published TemplateURL value is informational and never read

Whole-bag blind spots — visibility only, NOT an excuse

Sites where a whole property bag left the evidence walk (a spread, an unresolvable computed key, a call this script cannot resolve). Every class below still had to earn read evidence for each declared property; the list exists so a reviewer can see where the analysis is blind. Two fully-understood non-deliveries are deliberately NOT listed: a call whose result only feeds a comparison or a .length measurement (JSON.stringify(properties) === ...), and a comparison-only table loop. Nothing is hidden from the walk in either case — the site simply does not deliver.

Provider class Blind spot(s)
ACMCertificateProvider (acm-certificate-provider.ts) computed key in update()
ApiGatewayProvider (apigateway-provider.ts) computed key in updateAuthorizer(), computed key in updateMethod()
AppSyncProvider (appsync-provider.ts) computed key in applyGraphQLApiConfig(), computed key in updateDataSource(), computed key in updateGraphQLApi(), computed key in updateResolver()
CognitoUserPoolProvider (cognito-provider.ts) object spread in narrowMfaConfiguration()
DynamoDBGlobalTableProvider (dynamodb-globaltable-provider.ts) computed key in canonicalizeDriftProperties(), computed key in collectDesiredKeyAttributeNames(), extractLocalTags(...) in update(), object spread in canonicalizeDriftProperties(), object spread in create(), object spread in stripProvisionedCapacityKeys()
EC2Provider (ec2-provider.ts) computed key in narrowRouteDestinations(), object spread in canonicalizeSgInlineRuleProtocols(), object spread in createSecurityGroupIngress(), object spread in narrowIngressIpProtocol(), object spread in narrowRouteDestinations()
ECRProvider (ecr-provider.ts) hasCdkAutoDeleteTag(...) in delete()
EFSProvider (efs-provider.ts) computed key in updateFileSystem()
ELBv2Provider (elbv2-provider.ts) computed key in updateTargetGroup(), stripHandled(...) in updateLoadBalancer()
EMRClusterProvider (emr-cluster-provider.ts) computed key in update(), object spread in update()
EMRInstanceFleetConfigProvider (emr-instance-fleet-config-provider.ts) computed key in update(), object spread in update()
EMRInstanceGroupConfigProvider (emr-instance-group-config-provider.ts) computed key in update(), object spread in update()
FirehoseProvider (firehose-provider.ts) computed key in applyUpdate()
FSxFileSystemProvider (fsx-filesystem-provider.ts) computed key in detectVariantConfigKey(), computed key in update()
KinesisStreamProvider (kinesis-provider.ts) object spread in canonicalizeDesiredProperties(), object spread in effectiveMetricsProperties()
LambdaEventInvokeConfigProvider (lambda-event-invoke-config-provider.ts) computed key in update()
LambdaEventSourceMappingProvider (lambda-eventsource-provider.ts) computed key in applyUpdate()
LambdaMicrovmImageProvider (lambda-microvm-image-provider.ts) computed key in update()
LambdaUrlProvider (lambda-url-provider.ts) computed key in update(), object spread in update()
S3BucketProvider (s3-bucket-provider.ts) computed key in applyAllSubConfigsForCreate(), computed key in applySubConfigDiffs(), computed key in canonicalizeItemList(), hasCdkAutoDeleteTag(...) in delete(), hasObjectLock(...) in applySubConfigDiffs(), object spread in applyEffectiveOverrides(), object spread in canonicalizeItemList(), S3BucketProvider.applyEffectiveOverrides(...) in create(), S3BucketProvider.applyEffectiveOverrides(...) in update()
S3DirectoryBucketProvider (s3-directory-bucket-provider.ts) hasCdkAutoDeleteTag(...) in delete()
SNSTopicProvider (sns-topic-provider.ts) computed key in applyUpdate()

Full classification

Provider class File Bucket Declared Wired
ACMCertificateProvider acm-certificate-provider.ts wired 9 9
AgentCoreBrowserProvider agentcore-browser-provider.ts wired 0 0
AgentCoreCodeInterpreterProvider agentcore-code-interpreter-provider.ts wired 0 0
AgentCoreEvaluatorProvider agentcore-evaluator-provider.ts wired 6 6
AgentCoreRuntimeProvider agentcore-runtime-provider.ts wired 10 10
ApiGatewayProvider apigateway-provider.ts wired 38 38
ApiGatewayV2Provider apigatewayv2-provider.ts wired 54 54
AppSyncProvider appsync-provider.ts wired 48 48
ASGProvider asg-provider.ts wired 33 33
BudgetsBudgetProvider budgets-budget-provider.ts wired 3 3
CloudFrontDistributionProvider cloudfront-distribution-provider.ts wired 2 2
CloudFrontOACProvider cloudfront-oac-provider.ts wired 1 1
CloudFrontOAIProvider cloudfront-oai-provider.ts wired 1 1
CloudTrailProvider cloudtrail-provider.ts wired 15 15
CloudWatchAlarmProvider cloudwatch-alarm-provider.ts wired 22 22
CloudWatchAnomalyDetectorProvider cloudwatch-anomaly-detector-provider.ts wired 8 8
CodeBuildProvider codebuild-provider.ts wired 22 22
CodeCommitRepositoryProvider codecommit-repository-provider.ts wired 6 6
CognitoUserPoolProvider cognito-provider.ts wired 29 29
DLMLifecyclePolicyProvider dlm-lifecycle-policy-provider.ts wired 12 12
DocDBProvider docdb-provider.ts wired 21 21
DynamoDBGlobalTableProvider dynamodb-globaltable-provider.ts wired 14 14
DynamoDBTableProvider dynamodb-table-provider.ts wired 19 19
EC2Provider ec2-provider.ts wired 70 70
ECRProvider ecr-provider.ts wired 9 9
ECSProvider ecs-provider.ts wired 48 48
EFSProvider efs-provider.ts wired 18 18
ElastiCacheProvider elasticache-provider.ts wired 26 26
ELBv2Provider elbv2-provider.ts wired 38 38
EMRClusterProvider emr-cluster-provider.ts wired 27 27
EMRInstanceFleetConfigProvider emr-instance-fleet-config-provider.ts wired 8 8
EMRInstanceGroupConfigProvider emr-instance-group-config-provider.ts wired 11 11
EventBridgeBusProvider eventbridge-bus-provider.ts wired 8 8
EventBridgeRuleProvider eventbridge-rule-provider.ts wired 9 9
FirehoseProvider firehose-provider.ts wired 13 13
FSxFileSystemProvider fsx-filesystem-provider.ts wired 14 14
GlueConnectionProvider glue-provider.ts wired 2 2
GlueCrawlerProvider glue-provider.ts wired 15 15
GlueJobProvider glue-provider.ts wired 24 24
GlueProvider glue-provider.ts wired 6 6
GlueSecurityConfigurationProvider glue-provider.ts wired 2 2
GlueTriggerProvider glue-provider.ts wired 10 10
GlueWorkflowProvider glue-provider.ts wired 5 5
IAMAccessKeyProvider iam-access-key-provider.ts allow-listed 3 2
IAMInstanceProfileProvider iam-instance-profile-provider.ts wired 3 3
IAMManagedPolicyProvider iam-managed-policy-provider.ts wired 8 8
IAMPolicyProvider iam-policy-provider.ts wired 5 5
IAMRoleProvider iam-role-provider.ts wired 9 9
IAMUserGroupProvider iam-user-group-provider.ts wired 10 10
KinesisStreamProvider kinesis-provider.ts wired 8 8
KinesisStreamConsumerProvider kinesis-streamconsumer-provider.ts wired 3 3
KMSProvider kms-provider.ts wired 14 14
LambdaEventInvokeConfigProvider lambda-event-invoke-config-provider.ts wired 5 5
LambdaEventSourceMappingProvider lambda-eventsource-provider.ts wired 28 28
LambdaFunctionProvider lambda-function-provider.ts wired 28 28
LambdaLayerVersionProvider lambda-layer-provider.ts wired 6 6
LambdaMicrovmImageProvider lambda-microvm-image-provider.ts wired 14 14
LambdaPermissionProvider lambda-permission-provider.ts wired 9 9
LambdaUrlProvider lambda-url-provider.ts wired 5 5
LogsLogGroupProvider logs-loggroup-provider.ts wired 9 9
NeptuneProvider neptune-provider.ts wired 22 22
NestedStackProvider nested-stack-provider.ts allow-listed 2 1
RDSDBProxyEndpointProvider rds-dbproxy-endpoint-provider.ts wired 6 6
RDSDBProxyProvider rds-dbproxy-provider.ts wired 10 10
RDSDBProxyTargetGroupProvider rds-dbproxy-targetgroup-provider.ts wired 5 5
RDSProvider rds-provider.ts wired 27 27
Route53Provider route53-provider.ts wired 22 22
S3BucketPolicyProvider s3-bucket-policy-provider.ts wired 2 2
S3BucketProvider s3-bucket-provider.ts wired 19 19
S3DirectoryBucketProvider s3-directory-bucket-provider.ts wired 4 4
S3TablesProvider s3-tables-provider.ts wired 8 8
S3VectorsProvider s3-vectors-provider.ts wired 3 3
SchedulerScheduleProvider scheduler-schedule-provider.ts wired 11 11
SecretsManagerSecretProvider secretsmanager-secret-provider.ts wired 8 8
ServiceDiscoveryProvider servicediscovery-provider.ts wired 11 11
SNSSubscriptionProvider sns-subscription-provider.ts wired 10 10
SNSTopicPolicyProvider sns-topic-policy-provider.ts wired 2 2
SNSTopicProvider sns-topic-provider.ts wired 13 13
SQSQueuePolicyProvider sqs-queue-policy-provider.ts wired 2 2
SQSQueueProvider sqs-queue-provider.ts wired 16 16
SSMParameterProvider ssm-parameter-provider.ts wired 9 9
StepFunctionsProvider stepfunctions-provider.ts wired 11 11
WAFv2WebACLProvider wafv2-provider.ts wired 12 12
WaitConditionHandleProvider wait-condition-handle-provider.ts wired 0 0

Last updated: