template_model/
value_patterns.rs

1//! Regexes for well-known AWS resource value formats (identifiers, record
2//! values, names) shared by the schema validator and the rule engines.
3
4/// Regex for the `AWS::IAM::Role.Arn` schema *format* check: the partition must be
5/// `aws`-prefixed and the role name is unrestricted (`.+`), so a role name containing a space or
6/// other legal-but-unusual character is accepted here.
7pub const IAM_ROLE_ARN_PATTERN: &str = r"^arn:aws[a-zA-Z-]*:iam::\d{12}:role/.+$";
8
9/// Regex for the resource-property IAM role-ARN *rule* check: the partition group is
10/// optional and the role name is constrained to the IAM role-name character class. This is
11/// intentionally stricter than [`IAM_ROLE_ARN_PATTERN`] - the two correspond to two distinct checks
12/// and must not be conflated.
13pub const IAM_ROLE_ARN_RULE_PATTERN: &str = r"^arn:(aws[a-zA-Z-]*)?:iam::\d{12}:role/[a-zA-Z_0-9+=,.@\-_/]+$";
14
15/// Regex for a valid EC2 Security Group name. The class mirrors the character set the service
16/// accepts; the `+` requires at least one character.
17pub const SECURITY_GROUP_NAME_PATTERN: &str = r"^[a-zA-Z0-9 \._\-:/()#,@\[\]+=&;\{\}!\$\*]+$";
18
19/// Regex for a Route53 `MX` record value: a preference `0`–`65535`, a single whitespace, then the
20/// mail-exchange host. The bounded-preference alternation enforces the 16-bit range (an unbounded
21/// `\d+` would wrongly accept `70000`), and the single `\s` rejects the double-space form the
22/// service rejects.
23pub const MX_RECORD_PATTERN: &str =
24    r"^(0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])\s\S+$";
25
26/// Regex for a Route53 `CAA` record value: a flag `0` or `128`, a tag, and a quoted value, each
27/// separated by a single whitespace. The single `\s` (not `\s+`) matches the service's own
28/// single-separator requirement.
29pub const CAA_RECORD_PATTERN: &str = r#"^(0|128)\s([a-zA-Z0-9]+)\s(".+")$"#;
30
31/// Regex recognizing a hardcoded EC2 Availability Zone name (e.g. `us-east-1a`, `us-gov-west-1a`,
32/// `us-iso-east-1a`). The repeated `(-[a-z]+)+` segment matches partition-qualified zones
33/// (GovCloud/ISO) a single-segment pattern would miss.
34pub const AVAILABILITY_ZONE_PATTERN: &str = r"^[a-z]{2}(-[a-z]+)+-[0-9][a-z]$";
35
36/// Regex for an EC2 AMI identifier: `ami-` followed by an 8- or 17-character hex id. The two fixed
37/// lengths (not a `{8,17}` range) reflect the only id widths EC2 issues, so a 9–16 character string
38/// is not mistaken for an AMI id.
39pub const AMI_ID_PATTERN: &str = r"^ami-([0-9a-f]{8}|[0-9a-f]{17})$";
template_model/value_patterns.rs

template_model/
value_patterns.rs
