Module pattern 

Shared regex compilation for CloudFormation pattern/AllowedPattern constraints.

CloudFormation validates patterns with a PCRE-style engine that supports lookaround, backreferences, \Z, \uXXXX escapes, POSIX classes and possessive quantifiers. Rust’s regex crate is RE2-style and rejects those, so a provider-supplied pattern that is perfectly valid service-side would fail to compile and - if the caller swallows the error - silently drop the constraint (a false negative) or be treated as non-matching (a false positive).

compile closes that gap. It tries, cheapest first: the regex crate with a raised compiled-size limit, then a normalization pass that rewrites Rust-incompatible-but-equivalent syntax, then the fancy-regex backtracking engine on the raw and normalized forms. A final fallback rewrites oversized bounded-dot repetitions into an equivalent compact form for the backtracking engine. Every pattern shipped in the compiled schemas - and every service-valid AllowedPattern - compiles through one of these paths, so a constraint is never silently discarded. is_service_valid reports whether a pattern is enforceable this way, for the rule that flags genuinely-malformed AllowedPatterns.

Enums

CompiledPattern

A regex compiled from a CloudFormation constraint, backed by whichever engine could compile it.

Functions

anchor_allowed_pattern

Anchor an AllowedPattern the way CloudFormation does before matching: a pattern is implicitly wrapped so it must match the whole value. A leading ^ and/or trailing $ already present are kept; missing anchors are added.

compile

Compile a CloudFormation pattern/AllowedPattern string, preserving its matched language.

default_matches_pattern

Whether every element of value matches pattern (auto-anchored). For a scalar parameter value is the whole default; for a CommaDelimitedList/List<> parameter it is the raw default and each comma-separated, trimmed element must match. Returns None when the pattern cannot be compiled at all - the caller reports that as an invalid pattern rather than a match failure.

is_service_valid

Whether a pattern is a valid regular expression that this tool can enforce - i.e. it either compiles directly or compiles after equivalence-preserving normalization / on the backtracking engine. A pattern that is genuinely malformed (unbalanced groups, dangling quantifier the source engine also rejects) returns false. Used by the rule that reports invalid AllowedPatterns so it never fires on a pattern that is merely PCRE-flavored rather than broken.