parity: Kinesis Video Streams service, CloudFormation 429 types (sweep #5, in progress)

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build build-check ui-install ui-lint ui-check ui-lint-fix ui-fmt ui-fmt-fix ui-test ui-build install-deps install-tofu lint lint-changed lint-fix test integration-test terraform-test e2e e2e-test total-coverage clean demo all dev-mcp-install dev-mcp-check pgo docs check-pins bd-audit parity-lint
+.PHONY: build build-check ui-install ui-lint ui-check ui-lint-fix ui-fmt ui-fmt-fix ui-test ui-build install-deps install-tofu lint lint-changed lint-fix test integration-test terraform-test e2e e2e-test total-coverage clean demo all dev-mcp-install dev-mcp-check pgo docs check-pins bd-audit parity-lint cfn-attrs-gen cfn-attrs-spec-refresh
 
 BINARY_NAME=gopherstack
 VERSION_PKG=github.com/blackbirdworks/gopherstack/pkgs/version
@@ -240,6 +240,20 @@ bd-audit:
 parity-lint:
 	go run ./cmd/paritylint
 
+# Regenerate services/cloudformation/cfn_attributes.json (Fn::GetAtt
+# attribute table) from the committed spec fixture and the current
+# resTypeXxx constants. See cmd/cfnattrgen.
+cfn-attrs-gen:
+	go run ./cmd/cfnattrgen -spec cmd/cfnattrgen/testdata/cfn_resource_spec.json -src services/cloudformation -out services/cloudformation/cfn_attributes.json
+
+# Refresh cmd/cfnattrgen/testdata/cfn_resource_spec.json from a fresh
+# download of the full CloudFormation resource specification. Run this
+# occasionally, then `make cfn-attrs-gen` and commit both files.
+cfn-attrs-spec-refresh:
+	curl -sL https://d1uauaxba7bl26.cloudfront.net/latest/gzip/CloudFormationResourceSpecification.json | gunzip > /tmp/cfn_full_spec.json
+	go run ./cmd/cfnattrgen -spec /tmp/cfn_full_spec.json -trimspec-out cmd/cfnattrgen/testdata/cfn_resource_spec.json
+	rm -f /tmp/cfn_full_spec.json
+
 demo: ui-build
 	docker compose down
 	docker compose build

README.md

@@ -470,7 +470,7 @@ Every service links to its own page with a coverage breakdown — audited operat
 | [Batch](services/batch/README.md) | A | 45 | 8 gaps |
 | [EC2](services/ec2/README.md) | A | — | 22 families; 16 gaps; 2 structural gaps; 8 deferred |
 | [Elastic Beanstalk](services/elasticbeanstalk/README.md) | A | 47 | 13 gaps |
-| [Lambda](services/lambda/README.md) | A | — | 10 families; 2 gaps |
+| [Lambda](services/lambda/README.md) | A | — | 10 families |
 
 ### Containers
 
@@ -488,7 +488,7 @@ Every service links to its own page with a coverage breakdown — audited operat
 | [Data Lifecycle Manager](services/dlm/README.md) | A | 8 | clean |
 | [EFS](services/efs/README.md) | A | 31 | 4 gaps; 2 deferred |
 | [FSx](services/fsx/README.md) | A | — | 13 families; 12 gaps |
-| [S3](services/s3/README.md) | A | 24 | 8 gaps |
+| [S3](services/s3/README.md) | A | 26 | 8 gaps |
 | [S3 Control](services/s3control/README.md) | A | 44 | 4 gaps; 3 deferred |
 | [S3 Glacier](services/glacier/README.md) | A | 33 | 2 gaps |
 | [S3 Tables](services/s3tables/README.md) | A | 49 | 1 gap |
@@ -499,7 +499,7 @@ Every service links to its own page with a coverage breakdown — audited operat
 |---|---|---|---|
 | [DAX](services/dax/README.md) | A | 21 | 1 gap; 1 deferred |
 | [DocumentDB](services/docdb/README.md) | A | 55 | 10 gaps; 1 deferred |
-| [DynamoDB](services/dynamodb/README.md) | A | — | 15 families; 8 gaps; 2 deferred |
+| [DynamoDB](services/dynamodb/README.md) | A | — | 15 families; 6 gaps; 2 deferred |
 | [DynamoDB Streams](services/dynamodbstreams/README.md) | A | 4 | clean |
 | [ElastiCache](services/elasticache/README.md) | A | 75 | 3 gaps; 2 deferred |
 | [MemoryDB](services/memorydb/README.md) | A | 45 | 5 gaps; 3 deferred |
@@ -517,7 +517,7 @@ Every service links to its own page with a coverage breakdown — audited operat
 
 | Service | Parity | PARITY Entries | Notes |
 |---|---|---|---|
-| [API Gateway](services/apigateway/README.md) | A | 123 | 3 gaps; 1 deferred |
+| [API Gateway](services/apigateway/README.md) | A | 123 | 2 gaps; 1 deferred |
 | [API Gateway Management API](services/apigatewaymanagementapi/README.md) | A | 3 | 1 gap; 2 deferred |
 | [API Gateway v2](services/apigatewayv2/README.md) | A | 77 | 4 gaps; 6 deferred |
 | [App Mesh](services/appmesh/README.md) | A | 38 | 2 gaps |
@@ -543,7 +543,7 @@ Every service links to its own page with a coverage breakdown — audited operat
 | [SES](services/ses/README.md) | A | 71 | 6 gaps; 1 deferred |
 | [SES v2](services/sesv2/README.md) | A | 112 | 3 gaps |
 | [SNS](services/sns/README.md) | A | 34 | 2 gaps; 2 deferred |
-| [SQS](services/sqs/README.md) | A | 20 | 4 gaps; 4 deferred |
+| [SQS](services/sqs/README.md) | A | 20 | 3 gaps; 4 deferred |
 | [SWF](services/swf/README.md) | A | 39 | 4 gaps |
 | [Step Functions](services/stepfunctions/README.md) | A | 37 | 9 gaps |
 | [WorkMail](services/workmail/README.md) | A | 92 | 5 gaps |
@@ -594,7 +594,7 @@ Every service links to its own page with a coverage breakdown — audited operat
 | [Cognito Identity](services/cognitoidentity/README.md) | A | 23 | 2 gaps; 4 deferred |
 | [Cognito Identity Provider](services/cognitoidp/README.md) | A | 68 | 2 gaps |
 | [Directory Service](services/directoryservice/README.md) | A | 80 | 10 gaps; 2 deferred |
-| [IAM](services/iam/README.md) | A | 37 | 8 gaps |
+| [IAM](services/iam/README.md) | A | 38 | 5 gaps |
 | [IAM Access Analyzer](services/accessanalyzer/README.md) | A | 39 | 6 gaps; 1 deferred |
 | [IAM Identity Center (SSO)](services/ssoadmin/README.md) | A | 56 | 4 gaps |
 | [IAM Roles Anywhere](services/rolesanywhere/README.md) | A | 30 | 5 gaps |
@@ -622,7 +622,7 @@ Every service links to its own page with a coverage breakdown — audited operat
 | [Resource Access Manager](services/ram/README.md) | A | 36 | 5 gaps; 3 deferred |
 | [Resource Groups](services/resourcegroups/README.md) | A | 23 | 3 gaps |
 | [Resource Groups Tagging API](services/resourcegroupstaggingapi/README.md) | A | 9 | 3 gaps; 1 deferred |
-| [Systems Manager](services/ssm/README.md) | A | 105 | 31 gaps |
+| [Systems Manager](services/ssm/README.md) | A | 105 | 29 gaps |
 
 ### Developer Tools
 
@@ -704,8 +704,12 @@ Every service links to its own page with a coverage breakdown — audited operat
 | [Azurestoragevhost](services/azurestoragevhost/README.md) | B | 2 | 2 gaps; 1 deferred |
 | [Cloudfrontkeyvaluestore](services/cloudfrontkeyvaluestore/README.md) | A | 6 | 2 structural gaps |
 | [Directconnect](services/directconnect/README.md) | A | 64 | 4 gaps; 8 structural gaps; 1 deferred |
+| [Dsql](services/dsql/README.md) | B | 16 | 5 gaps |
+| [Ecrpublic](services/ecrpublic/README.md) | B | 23 | 5 gaps |
 | [Grafana](services/grafana/README.md) | A | 25 | 2 gaps; 1 structural gap |
 | [HealthOmics](services/omics/README.md) | A | — | 25 families; 4 gaps; 1 deferred |
+| [Kafkaconnect](services/kafkaconnect/README.md) | B | 19 | 3 gaps |
+| [Kinesisvideo](services/kinesisvideo/README.md) | B | 22 | 3 gaps |
 | [Lightsail](services/lightsail/README.md) | A | — | 28 families; 18 gaps; 2 deferred |
 | [Managed Blockchain](services/managedblockchain/README.md) | A | 27 | 4 gaps |
 | [Mgn](services/mgn/README.md) | A | 95 | 3 gaps; 5 structural gaps; 1 deferred |

cli.go

@@ -122,11 +122,13 @@ import (
 	dlmbackend "github.com/blackbirdworks/gopherstack/services/dlm"
 	dmsbackend "github.com/blackbirdworks/gopherstack/services/dms"
 	docdbbackend "github.com/blackbirdworks/gopherstack/services/docdb"
+	dsqlbackend "github.com/blackbirdworks/gopherstack/services/dsql"
 	ddbbackend "github.com/blackbirdworks/gopherstack/services/dynamodb"
 	ddbmodels "github.com/blackbirdworks/gopherstack/services/dynamodb/models"
 	dynamodbstreamsbackend "github.com/blackbirdworks/gopherstack/services/dynamodbstreams"
 	ec2backend "github.com/blackbirdworks/gopherstack/services/ec2"
 	ecrbackend "github.com/blackbirdworks/gopherstack/services/ecr"
+	ecrpublicbackend "github.com/blackbirdworks/gopherstack/services/ecrpublic"
 	ecsbackend "github.com/blackbirdworks/gopherstack/services/ecs"
 	efsbackend "github.com/blackbirdworks/gopherstack/services/efs"
 	eksbackend "github.com/blackbirdworks/gopherstack/services/eks"
@@ -154,9 +156,11 @@ import (
 	iotdataplanebackend "github.com/blackbirdworks/gopherstack/services/iotdataplane"
 	iotwirelessbackend "github.com/blackbirdworks/gopherstack/services/iotwireless"
 	kafkabackend "github.com/blackbirdworks/gopherstack/services/kafka"
+	kafkaconnectbackend "github.com/blackbirdworks/gopherstack/services/kafkaconnect"
 	kinesisbackend "github.com/blackbirdworks/gopherstack/services/kinesis"
 	kinesisanalyticsbackend "github.com/blackbirdworks/gopherstack/services/kinesisanalytics"
 	kinesisanalyticsv2backend "github.com/blackbirdworks/gopherstack/services/kinesisanalyticsv2"
+	kinesisvideobackend "github.com/blackbirdworks/gopherstack/services/kinesisvideo"
 	kmsbackend "github.com/blackbirdworks/gopherstack/services/kms"
 	lakeformationbackend "github.com/blackbirdworks/gopherstack/services/lakeformation"
 	lambdabackend "github.com/blackbirdworks/gopherstack/services/lambda"
@@ -358,8 +362,10 @@ type CLI struct {
 	codeStarConnectionsHandler    service.Registerable
 	dynamodbStreamsHandler        service.Registerable
 	docdbHandler                  service.Registerable
+	dsqlHandler                   service.Registerable
 	elasticbeanstalkHandler       service.Registerable
 	ecrHandler                    service.Registerable
+	ecrPublicHandler              service.Registerable
 	ecsHandler                    service.Registerable
 	efsHandler                    service.Registerable
 	eksHandler                    service.Registerable
@@ -381,7 +387,9 @@ type CLI struct {
 	inspector2Handler             service.Registerable
 	iotanalyticsHandler           service.Registerable
 	kafkaHandler                  service.Registerable
+	kafkaconnectHandler           service.Registerable
 	kinesisanalyticsv2Handler     service.Registerable
+	kinesisvideoHandler           service.Registerable
 	managedblockchainHandler      service.Registerable
 	mediaconvertHandler           service.Registerable
 	mqHandler                     service.Registerable
@@ -1302,6 +1310,11 @@ func (c *CLI) GetSupportHandler() service.Registerable { return c.supportHandler
 //nolint:ireturn // architecturally required to return interface
 func (c *CLI) GetECRHandler() service.Registerable { return c.ecrHandler }
 
+// GetECRPublicHandler returns the ECR Public handler (dashboard.AWSSDKProvider).
+//
+//nolint:ireturn // architecturally required to return interface
+func (c *CLI) GetECRPublicHandler() service.Registerable { return c.ecrPublicHandler }
+
 // GetECSHandler returns the ECS handler (dashboard.AWSSDKProvider).
 //
 //nolint:ireturn // architecturally required to return interface
@@ -1367,13 +1380,23 @@ func (c *CLI) GetInspector2Handler() service.Registerable { return c.inspector2H
 //nolint:ireturn // architecturally required to return interface
 func (c *CLI) GetKafkaHandler() service.Registerable { return c.kafkaHandler }
 
+// GetKafkaConnectHandler returns the MSK Connect handler (dashboard.AWSSDKProvider).
+//
+//nolint:ireturn // architecturally required to return interface
+func (c *CLI) GetKafkaConnectHandler() service.Registerable { return c.kafkaconnectHandler }
+
 // GetKinesisAnalyticsV2Handler returns the Kinesis Data Analytics v2 handler (dashboard.AWSSDKProvider).
 //
 //nolint:ireturn // architecturally required to return interface
 func (c *CLI) GetKinesisAnalyticsV2Handler() service.Registerable {
 	return c.kinesisanalyticsv2Handler
 }
 
+// GetKinesisVideoHandler returns the Kinesis Video Streams handler (dashboard.AWSSDKProvider).
+//
+//nolint:ireturn // architecturally required to return interface
+func (c *CLI) GetKinesisVideoHandler() service.Registerable { return c.kinesisvideoHandler }
+
 // GetManagedBlockchainHandler returns the Managed Blockchain handler (dashboard.AWSSDKProvider).
 //
 //nolint:ireturn // architecturally required to return interface
@@ -1736,6 +1759,11 @@ func (c *CLI) GetElasticbeanstalkHandler() service.Registerable { return c.elast
 //nolint:ireturn // architecturally required to return interface
 func (c *CLI) GetDocDBHandler() service.Registerable { return c.docdbHandler }
 
+// GetDSQLHandler returns the Aurora DSQL handler (dashboard.AWSSDKProvider).
+//
+//nolint:ireturn // architecturally required to return interface
+func (c *CLI) GetDSQLHandler() service.Registerable { return c.dsqlHandler }
+
 // GetFISHandler returns the FIS handler (dashboard.AWSSDKProvider).
 //
 //nolint:ireturn // architecturally required to return interface
@@ -2778,6 +2806,7 @@ func storeCLIExtendedHandlers(cli *CLI, byName map[string]service.Registerable)
 	cli.bedrockHandler = byName["Bedrock"]
 	cli.bedrockruntimeHandler = byName["BedrockRuntime"]
 	cli.ecrHandler = byName["ECR"]
+	cli.ecrPublicHandler = byName["ECRPublic"]
 	cli.ecsHandler = byName["ECS"]
 	cli.iotHandler = byName["IoT"]
 	cli.cognitoIDPHandler = byName["CognitoIDP"]
@@ -2819,7 +2848,9 @@ func storeCLILatestHandlers(cli *CLI, byName map[string]service.Registerable) {
 	cli.inspector2Handler = byName["Inspector2"]
 	cli.iotanalyticsHandler = byName["IoTAnalytics"]
 	cli.kafkaHandler = byName["Kafka"]
+	cli.kafkaconnectHandler = byName["KafkaConnect"]
 	cli.kinesisanalyticsv2Handler = byName["KinesisAnalyticsV2"]
+	cli.kinesisvideoHandler = byName["KinesisVideo"]
 	cli.managedblockchainHandler = byName["ManagedBlockchain"]
 	cli.mediaconvertHandler = byName["MediaConvert"]
 	cli.mqHandler = byName["MQ"]
@@ -2835,6 +2866,7 @@ func storeCLINewestHandlers(cli *CLI, byName map[string]service.Registerable) {
 	cli.mwaaHandler = byName["MWAA"]
 	cli.neptuneHandler = byName["Neptune"]
 	cli.docdbHandler = byName["DocDB"]
+	cli.dsqlHandler = byName["DSQL"]
 	cli.pinpointHandler = byName["Pinpoint"]
 	cli.pipesHandler = byName["Pipes"]
 	cli.rdsdataHandler = byName["RDSData"]
@@ -3448,22 +3480,39 @@ type elbCertificateResolverAdapter struct {
 	iamBackend *iambackend.InMemoryBackend
 }
 
+// elbResolverServerCertMatches walks every page of IAM server certificates
+// looking for certARN, since ListServerCertificates now paginates.
+func elbResolverServerCertMatches(b *iambackend.InMemoryBackend, certARN string) bool {
+	marker := ""
+	for {
+		p, err := b.ListServerCertificates("", marker, 0)
+		if err != nil {
+			return false
+		}
+
+		for _, c := range p.Data {
+			if c.Arn == certARN {
+				return true
+			}
+		}
+
+		if p.Next == "" {
+			return false
+		}
+
+		marker = p.Next
+	}
+}
+
 func (a *elbCertificateResolverAdapter) ResolveCertificate(ctx context.Context, certARN string) bool {
 	if a.acmBackend != nil {
 		if _, err := a.acmBackend.DescribeCertificate(ctx, certARN); err == nil {
 			return true
 		}
 	}
 
-	if a.iamBackend != nil {
-		certs, err := a.iamBackend.ListServerCertificates("")
-		if err == nil {
-			for _, c := range certs {
-				if c.Arn == certARN {
-					return true
-				}
-			}
-		}
+	if a.iamBackend != nil && elbResolverServerCertMatches(a.iamBackend, certARN) {
+		return true
 	}
 
 	return false
@@ -3519,15 +3568,8 @@ func (a *elbv2CertificateResolverAdapter) ResolveCertificate(certARN string) boo
 		}
 	}
 
-	if a.iamBackend != nil {
-		certs, err := a.iamBackend.ListServerCertificates("")
-		if err == nil {
-			for _, c := range certs {
-				if c.Arn == certARN {
-					return true
-				}
-			}
-		}
+	if a.iamBackend != nil && elbResolverServerCertMatches(a.iamBackend, certARN) {
+		return true
 	}
 
 	return false
@@ -4052,12 +4094,16 @@ func getRemainingServiceProviders() []service.Provider {
 		&guarddutybackend.Provider{},
 		&inspector2backend.Provider{},
 		&docdbbackend.Provider{},
+		&dsqlbackend.Provider{},
 		&glacierbackend.Provider{},
 		&iotanalyticsbackend.Provider{},
 		&iotwirelessbackend.Provider{},
 		&kinesisanalyticsbackend.Provider{},
 		&kafkabackend.Provider{},
+		&kafkaconnectbackend.Provider{},
 		&kinesisanalyticsv2backend.Provider{},
+		&kinesisvideobackend.Provider{},
+		&ecrpublicbackend.Provider{},
 		&lakeformationbackend.Provider{},
 		&managedblockchainbackend.Provider{},
 		&mediaconvertbackend.Provider{},