Module value_patterns 

Regexes for well-known AWS resource value formats (identifiers, record values, names) shared by the schema validator and the rule engines.

Constants

AMI_ID_PATTERN

Regex for an EC2 AMI identifier: ami- followed by an 8- or 17-character hex id. The two fixed lengths (not a {8,17} range) reflect the only id widths EC2 issues, so a 9–16 character string is not mistaken for an AMI id.

AVAILABILITY_ZONE_PATTERN

Regex recognizing a hardcoded EC2 Availability Zone name (e.g. us-east-1a, us-gov-west-1a, us-iso-east-1a). The repeated (-[a-z]+)+ segment matches partition-qualified zones (GovCloud/ISO) a single-segment pattern would miss.

CAA_RECORD_PATTERN

Regex for a Route53 CAA record value: a flag 0 or 128, a tag, and a quoted value, each separated by a single whitespace. The single \s (not \s+) matches the service’s own single-separator requirement.

IAM_ROLE_ARN_PATTERN

Regex for the AWS::IAM::Role.Arn schema format check: the partition must be aws-prefixed and the role name is unrestricted (.+), so a role name containing a space or other legal-but-unusual character is accepted here.

IAM_ROLE_ARN_RULE_PATTERN

Regex for the resource-property IAM role-ARN rule check: the partition group is optional and the role name is constrained to the IAM role-name character class. This is intentionally stricter than IAM_ROLE_ARN_PATTERN - the two correspond to two distinct checks and must not be conflated.

MX_RECORD_PATTERN

Regex for a Route53 MX record value: a preference 0–65535, a single whitespace, then the mail-exchange host. The bounded-preference alternation enforces the 16-bit range (an unbounded \d+ would wrongly accept 70000), and the single \s rejects the double-space form the service rejects.

SECURITY_GROUP_NAME_PATTERN

Regex for a valid EC2 Security Group name. The class mirrors the character set the service accepts; the + requires at least one character.