handledProperties wiring-evidence matrix
For every SDK provider class declaring handledProperties, checks that each declared property is actually CONSUMED — a read off the template property bag (properties['X'] / properties.X / a destructure), tracked per class through this.helper(properties) delegation. A declaration with no such evidence is either a wiring gap or a mis-declared property (the #1392 ECRProvider class), and gen-property-coverage.ts cannot see it: that pre-flight passes on the strength of the declaration alone.
A computed read properties[k] also counts when k iterates a literal name table (table-loop), but only when the loop body DELIVERS one of those reads. A body that merely compares them — an immutability guard or a change-detection scan — earns nothing, since crediting it would let one syntactic site vouch for every name in the table on the strength of a diff. The table itself is resolved LEXICALLY from the loop outward, so a table declared inside another class's method cannot vouch for this one. Reads off previousProperties are never evidence.
Summary
- Provider classes classified: 84
- Declared properties: 1138 (1136 with read evidence)
- Fully wired classes: 82
- Allow-listed classes (visible, non-blocking): 2
- Classes with a whole-bag blind spot (recorded, never an excuse): 22
- Wiring gaps (blocks CI): 0
Wiring gaps
None. Every declared handledProperties entry has read evidence or a rationale'd allow-list entry.
Allow-listed declarations — VISIBLE, non-blocking
Declared handled with no read evidence, deliberately not failing CI. A KNOWN GAP rationale is a real un-wired property awaiting a fix (removing the entry is what makes this critic verify that fix); a NOT-A-BUG rationale is a declaration that is correct without a read.
| Provider class | Property | Type(s) | Rationale |
|---|---|---|---|
IAMAccessKeyProvider |
Serial |
AWS::IAM::AccessKey |
NOT-A-BUG: Serial is a createOnly REPLACEMENT TRIGGER with no IAM API counterpart; the diff layer implements it, and moving it to unhandledByDesign would hard-reject templates via the #614 viability guard |
NestedStackProvider |
TemplateURL |
AWS::CloudFormation::Stack |
NOT-A-BUG: the child template is read from the local cloud assembly via Metadata['aws:asset:path'], so the published TemplateURL value is informational and never read |
Whole-bag blind spots — visibility only, NOT an excuse
Sites where a whole property bag left the evidence walk (a spread, an unresolvable computed key, a call this script cannot resolve). Every class below still had to earn read evidence for each declared property; the list exists so a reviewer can see where the analysis is blind. Two fully-understood non-deliveries are deliberately NOT listed: a call whose result only feeds a comparison or a .length measurement (JSON.stringify(properties) === ...), and a comparison-only table loop. Nothing is hidden from the walk in either case — the site simply does not deliver.
| Provider class | Blind spot(s) |
|---|---|
ACMCertificateProvider (acm-certificate-provider.ts) |
computed key in update() |
ApiGatewayProvider (apigateway-provider.ts) |
computed key in updateAuthorizer(), computed key in updateMethod() |
AppSyncProvider (appsync-provider.ts) |
computed key in applyGraphQLApiConfig(), computed key in updateDataSource(), computed key in updateGraphQLApi(), computed key in updateResolver() |
CognitoUserPoolProvider (cognito-provider.ts) |
object spread in narrowMfaConfiguration() |
DynamoDBGlobalTableProvider (dynamodb-globaltable-provider.ts) |
computed key in canonicalizeDriftProperties(), computed key in collectDesiredKeyAttributeNames(), extractLocalTags(...) in update(), object spread in canonicalizeDriftProperties(), object spread in create(), object spread in stripProvisionedCapacityKeys() |
EC2Provider (ec2-provider.ts) |
computed key in narrowRouteDestinations(), object spread in canonicalizeSgInlineRuleProtocols(), object spread in createSecurityGroupIngress(), object spread in narrowIngressIpProtocol(), object spread in narrowRouteDestinations() |
ECRProvider (ecr-provider.ts) |
hasCdkAutoDeleteTag(...) in delete() |
EFSProvider (efs-provider.ts) |
computed key in updateFileSystem() |
ELBv2Provider (elbv2-provider.ts) |
computed key in updateTargetGroup(), stripHandled(...) in updateLoadBalancer() |
EMRClusterProvider (emr-cluster-provider.ts) |
computed key in update(), object spread in update() |
EMRInstanceFleetConfigProvider (emr-instance-fleet-config-provider.ts) |
computed key in update(), object spread in update() |
EMRInstanceGroupConfigProvider (emr-instance-group-config-provider.ts) |
computed key in update(), object spread in update() |
FirehoseProvider (firehose-provider.ts) |
computed key in applyUpdate() |
FSxFileSystemProvider (fsx-filesystem-provider.ts) |
computed key in detectVariantConfigKey(), computed key in update() |
KinesisStreamProvider (kinesis-provider.ts) |
object spread in canonicalizeDesiredProperties(), object spread in effectiveMetricsProperties() |
LambdaEventInvokeConfigProvider (lambda-event-invoke-config-provider.ts) |
computed key in update() |
LambdaEventSourceMappingProvider (lambda-eventsource-provider.ts) |
computed key in applyUpdate() |
LambdaMicrovmImageProvider (lambda-microvm-image-provider.ts) |
computed key in update() |
LambdaUrlProvider (lambda-url-provider.ts) |
computed key in update(), object spread in update() |
S3BucketProvider (s3-bucket-provider.ts) |
computed key in applyAllSubConfigsForCreate(), computed key in applySubConfigDiffs(), computed key in canonicalizeItemList(), hasCdkAutoDeleteTag(...) in delete(), hasObjectLock(...) in applySubConfigDiffs(), object spread in applyEffectiveOverrides(), object spread in canonicalizeItemList(), S3BucketProvider.applyEffectiveOverrides(...) in create(), S3BucketProvider.applyEffectiveOverrides(...) in update() |
S3DirectoryBucketProvider (s3-directory-bucket-provider.ts) |
hasCdkAutoDeleteTag(...) in delete() |
SNSTopicProvider (sns-topic-provider.ts) |
computed key in applyUpdate() |
Full classification
| Provider class | File | Bucket | Declared | Wired |
|---|---|---|---|---|
ACMCertificateProvider |
acm-certificate-provider.ts | wired | 9 | 9 |
AgentCoreBrowserProvider |
agentcore-browser-provider.ts | wired | 0 | 0 |
AgentCoreCodeInterpreterProvider |
agentcore-code-interpreter-provider.ts | wired | 0 | 0 |
AgentCoreEvaluatorProvider |
agentcore-evaluator-provider.ts | wired | 6 | 6 |
AgentCoreRuntimeProvider |
agentcore-runtime-provider.ts | wired | 10 | 10 |
ApiGatewayProvider |
apigateway-provider.ts | wired | 38 | 38 |
ApiGatewayV2Provider |
apigatewayv2-provider.ts | wired | 54 | 54 |
AppSyncProvider |
appsync-provider.ts | wired | 48 | 48 |
ASGProvider |
asg-provider.ts | wired | 33 | 33 |
BudgetsBudgetProvider |
budgets-budget-provider.ts | wired | 3 | 3 |
CloudFrontDistributionProvider |
cloudfront-distribution-provider.ts | wired | 2 | 2 |
CloudFrontOACProvider |
cloudfront-oac-provider.ts | wired | 1 | 1 |
CloudFrontOAIProvider |
cloudfront-oai-provider.ts | wired | 1 | 1 |
CloudTrailProvider |
cloudtrail-provider.ts | wired | 15 | 15 |
CloudWatchAlarmProvider |
cloudwatch-alarm-provider.ts | wired | 22 | 22 |
CloudWatchAnomalyDetectorProvider |
cloudwatch-anomaly-detector-provider.ts | wired | 8 | 8 |
CodeBuildProvider |
codebuild-provider.ts | wired | 22 | 22 |
CodeCommitRepositoryProvider |
codecommit-repository-provider.ts | wired | 6 | 6 |
CognitoUserPoolProvider |
cognito-provider.ts | wired | 29 | 29 |
DLMLifecyclePolicyProvider |
dlm-lifecycle-policy-provider.ts | wired | 12 | 12 |
DocDBProvider |
docdb-provider.ts | wired | 21 | 21 |
DynamoDBGlobalTableProvider |
dynamodb-globaltable-provider.ts | wired | 14 | 14 |
DynamoDBTableProvider |
dynamodb-table-provider.ts | wired | 19 | 19 |
EC2Provider |
ec2-provider.ts | wired | 70 | 70 |
ECRProvider |
ecr-provider.ts | wired | 9 | 9 |
ECSProvider |
ecs-provider.ts | wired | 48 | 48 |
EFSProvider |
efs-provider.ts | wired | 18 | 18 |
ElastiCacheProvider |
elasticache-provider.ts | wired | 26 | 26 |
ELBv2Provider |
elbv2-provider.ts | wired | 38 | 38 |
EMRClusterProvider |
emr-cluster-provider.ts | wired | 27 | 27 |
EMRInstanceFleetConfigProvider |
emr-instance-fleet-config-provider.ts | wired | 8 | 8 |
EMRInstanceGroupConfigProvider |
emr-instance-group-config-provider.ts | wired | 11 | 11 |
EventBridgeBusProvider |
eventbridge-bus-provider.ts | wired | 8 | 8 |
EventBridgeRuleProvider |
eventbridge-rule-provider.ts | wired | 9 | 9 |
FirehoseProvider |
firehose-provider.ts | wired | 13 | 13 |
FSxFileSystemProvider |
fsx-filesystem-provider.ts | wired | 14 | 14 |
GlueConnectionProvider |
glue-provider.ts | wired | 2 | 2 |
GlueCrawlerProvider |
glue-provider.ts | wired | 15 | 15 |
GlueJobProvider |
glue-provider.ts | wired | 24 | 24 |
GlueProvider |
glue-provider.ts | wired | 6 | 6 |
GlueSecurityConfigurationProvider |
glue-provider.ts | wired | 2 | 2 |
GlueTriggerProvider |
glue-provider.ts | wired | 10 | 10 |
GlueWorkflowProvider |
glue-provider.ts | wired | 5 | 5 |
IAMAccessKeyProvider |
iam-access-key-provider.ts | allow-listed | 3 | 2 |
IAMInstanceProfileProvider |
iam-instance-profile-provider.ts | wired | 3 | 3 |
IAMManagedPolicyProvider |
iam-managed-policy-provider.ts | wired | 8 | 8 |
IAMPolicyProvider |
iam-policy-provider.ts | wired | 5 | 5 |
IAMRoleProvider |
iam-role-provider.ts | wired | 9 | 9 |
IAMUserGroupProvider |
iam-user-group-provider.ts | wired | 10 | 10 |
KinesisStreamProvider |
kinesis-provider.ts | wired | 8 | 8 |
KinesisStreamConsumerProvider |
kinesis-streamconsumer-provider.ts | wired | 3 | 3 |
KMSProvider |
kms-provider.ts | wired | 14 | 14 |
LambdaEventInvokeConfigProvider |
lambda-event-invoke-config-provider.ts | wired | 5 | 5 |
LambdaEventSourceMappingProvider |
lambda-eventsource-provider.ts | wired | 28 | 28 |
LambdaFunctionProvider |
lambda-function-provider.ts | wired | 28 | 28 |
LambdaLayerVersionProvider |
lambda-layer-provider.ts | wired | 6 | 6 |
LambdaMicrovmImageProvider |
lambda-microvm-image-provider.ts | wired | 14 | 14 |
LambdaPermissionProvider |
lambda-permission-provider.ts | wired | 9 | 9 |
LambdaUrlProvider |
lambda-url-provider.ts | wired | 5 | 5 |
LogsLogGroupProvider |
logs-loggroup-provider.ts | wired | 9 | 9 |
NeptuneProvider |
neptune-provider.ts | wired | 22 | 22 |
NestedStackProvider |
nested-stack-provider.ts | allow-listed | 2 | 1 |
RDSDBProxyEndpointProvider |
rds-dbproxy-endpoint-provider.ts | wired | 6 | 6 |
RDSDBProxyProvider |
rds-dbproxy-provider.ts | wired | 10 | 10 |
RDSDBProxyTargetGroupProvider |
rds-dbproxy-targetgroup-provider.ts | wired | 5 | 5 |
RDSProvider |
rds-provider.ts | wired | 27 | 27 |
Route53Provider |
route53-provider.ts | wired | 22 | 22 |
S3BucketPolicyProvider |
s3-bucket-policy-provider.ts | wired | 2 | 2 |
S3BucketProvider |
s3-bucket-provider.ts | wired | 19 | 19 |
S3DirectoryBucketProvider |
s3-directory-bucket-provider.ts | wired | 4 | 4 |
S3TablesProvider |
s3-tables-provider.ts | wired | 8 | 8 |
S3VectorsProvider |
s3-vectors-provider.ts | wired | 3 | 3 |
SchedulerScheduleProvider |
scheduler-schedule-provider.ts | wired | 11 | 11 |
SecretsManagerSecretProvider |
secretsmanager-secret-provider.ts | wired | 8 | 8 |
ServiceDiscoveryProvider |
servicediscovery-provider.ts | wired | 11 | 11 |
SNSSubscriptionProvider |
sns-subscription-provider.ts | wired | 10 | 10 |
SNSTopicPolicyProvider |
sns-topic-policy-provider.ts | wired | 2 | 2 |
SNSTopicProvider |
sns-topic-provider.ts | wired | 13 | 13 |
SQSQueuePolicyProvider |
sqs-queue-policy-provider.ts | wired | 2 | 2 |
SQSQueueProvider |
sqs-queue-provider.ts | wired | 16 | 16 |
SSMParameterProvider |
ssm-parameter-provider.ts | wired | 9 | 9 |
StepFunctionsProvider |
stepfunctions-provider.ts | wired | 11 | 11 |
WAFv2WebACLProvider |
wafv2-provider.ts | wired | 12 | 12 |
WaitConditionHandleProvider |
wait-condition-handle-provider.ts | wired | 0 | 0 |