Keys that identify a well-formed boolean condition expression when used
as the sole key of a single-key mapping. Inputs to Fn::And, Fn::Or,
and Fn::Not must be one of these.
Intrinsic functions whose output can stand in for an Fn::Equals argument.
An Fn::Equals argument that is a single-key mapping must use one of these
keys to be considered well-formed. An Fn::Equals operand must resolve to a
scalar, so only the string/value-producing functions are permitted. Boolean
and reference-shaped functions (Fn::And/Fn::Or/Fn::Not, a nested
Fn::Equals, Condition, Fn::GetAtt, Fn::GetAZs, Fn::ImportValue,
Fn::Base64, and the Rules-section membership functions) produce a
non-scalar and are rejected here, matching CloudFormation’s own restriction
on comparison operands.
Every intrinsic-function key that the parser can write into a node’s build
path. Path-based checks that ask “is this string nested inside a function?”
must match against this list rather than the bare Fn:: prefix: a user map
key may legitimately start with Fn:: (e.g. a Lambda environment variable
named Fn::Custom) without being a function.
Largest joint product of a container’s member scenarios that is enumerated in
full. A list or map whose members are gated by N independent conditions has
2^N joint assignments; past this many, the product is replaced by an
alternative-covering set (see resolved_value::cover_cartesian_scenarios).
The covering set includes every member scenario and pair of condition states
while growing linearly in the sum of member alternatives. Matches
MAX_ENUM_EXPANSION so a single value never materializes more joint copies
than enumerated variants.
Maximum number of concrete variants a single value may expand to during
intrinsic resolution (e.g. an Fn::Join over enumerated elements). Bounds
per-value combinatorial blow-up and the memory a resolved value holds;
beyond it the expansion is truncated. The narrowest analysis bound - it
operates on a single value.
Maximum nesting depth walked while building an expression fingerprint. A
subtree deeper than this yields no fingerprint at all rather than a truncated
one, because a truncated fingerprint could be shared by two expressions that
differ only below the cut.
Cumulative work budget for Fn::ForEach transform expansion across all
sections of a single template. Charged for every loop iteration (one unit per
element emitted) and every recursive body-traversal node visited. Once
exhausted, expansion stops immediately and emits a single visible transform
diagnostic - no further materialization occurs, no silent truncation.
Largest parameter space a single satisfiability query will search. The query
searches assignments of concrete values to the parameters its conditions read;
the number of such assignments is the product of each parameter’s candidate
values, and so is exponential in the number of distinct parameters. When that
product exceeds this cap the query returns a conservative true without
searching - see ConditionModel::is_satisfiable for the exact
diagnostic-direction guarantee, including that through a negated use
(condition_implies) a conservative true can surface an extra false-positive
diagnostic.
Per-query budget for a single satisfiability search: the maximum number of
evaluation steps ConditionModel::is_satisfiable performs before returning a
conservative true. This is the effective per-query work bound -
MAX_PARAM_COMBINATIONS is only an O(1) pre-filter on the size of a query’s
parameter space, so a query that passes that pre-filter is still explored only
up to this budget.
Maximum number of distinct (value, condition-assignment) scenarios a single
value may resolve into before that value’s scenario enumeration is
truncated. A value composed from or gated by many conditions/parameters can
take many concrete forms; this bounds that set so per-scenario rule
evaluation stays bounded. This is a per-value cap only - the cumulative
scenario work across an entire validation is bounded separately by
MAX_TOTAL_SCENARIO_COMBINATIONS. Sits above MAX_ENUM_EXPANSION (per-value
variant expansion) and below the parameter/satisfiability bounds.
Largest number of ResolvedValue nodes a fully enumerated joint product may
materialize (scenario count times nodes per scenario). Bounds the memory of
one expansion by size rather than count: a product of large member values
switches to the covering set before MAX_COMPLETE_SCENARIO_PRODUCT would.
Cumulative satisfiability search budget across all queries of a single
validation. MAX_SAT_ITERATIONS bounds one query, but the condition model
issues a query per pairwise condition-compatibility check - quadratic in the
condition count - plus per-resource and per-rule checks, so the number of
queries is itself unbounded on adversarial input. This caps the total search
work for one model so no template can drive validation into a denial of
service.
Cumulative scenario-expansion budget across all values resolved during a
single validation. MAX_SCENARIO_COMBINATIONS bounds one value’s expansion,
but scenario resolution runs per resource property and per rule, so the
number of expansions is itself unbounded on adversarial input - a template
packed with many heavily-gated values would otherwise drive up to
num_values * MAX_SCENARIO_COMBINATIONS of work with no global ceiling. This
caps the total scenarios materialized for one model; once it is reached,
further scenario resolution yields no scenarios rather than continuing to
expand. Sized far above the worst legitimate template - real values resolve
to a single scenario and conditional ones to a handful - while still cutting
off a pathological blow-up. Mirrors the SAT path’s MAX_TOTAL_SAT_ITERATIONS
(here 128x the per-value cap).
Maximum number of YAML nodes that alias resolution may copy into one
document. An alias is resolved by copying its anchored value, so nested
aliases multiply: eight levels of nine aliases over a nine-element list
expand a few hundred bytes into 9^8 scalars. The bound counts copied nodes
across the whole document and rejects the template with a located parse
error once exceeded. It is far above any template that uses anchors to share
configuration (a 10 MiB template cannot author this many nodes directly) and
well below the point where the copies exhaust memory.
Maximum structural nesting depth the YAML loader permits before rejecting
the document with a parse error. Each MappingStart or SequenceStart event
increments the depth; the corresponding end event decrements it. Once the
ceiling is reached, the loader sets a structural parse error and suppresses
further tree construction without attempting to build or drop a recursively
deep Yaml value.
Sentinel value used by the satisfiability search to represent “any value
other than the literals the parameter is compared against”. Added to the
candidate-value set of a parameter (or pseudo-parameter) without an explicit
AllowedValues list or override, so the SAT solver treats the symbol as a
free variable that can also disagree with every literal it is compared to.
Without this sentinel a parameter compared against a single literal would be
pinned to that literal and the SAT solver would mark the negative branch
unreachable.
Resource property paths where an ssm-secure dynamic reference is
supported - the fixed set CloudFormation documents for secure-string
resolution. Paths use the resource type
(not the logical ID) and * for array indices.
Prefixes of the ResolvedValue::Dynamic reason produced by a partially
resolved Fn::Sub or Fn::Join, and the placeholders standing in for values
the partial could not resolve. Defined once because the resolver writes them
and length estimation reads them back: a partial that still carries a
placeholder has no known length, and only a shared spelling keeps the reader
and the writer from drifting apart.
Display label for the expression form of Fn::If (the condition is itself an
intrinsic rather than a named condition). This is an internal variant, not a
CloudFormation tag, so it is deliberately absent from SHORT_TAG_TO_FN_KEY.
The YAML 1.1 merge key. A mapping entry <<: <alias-or-list-of-aliases> splices
the referenced mapping(s) into the enclosing mapping, with explicit keys winning
over merged ones and earlier merge sources winning over later ones.