guard-translator

Evaluates CloudFormation Guard DSL files with the Guard evaluator itself and turns its report into engine-agnostic findings. Every rule engine calls this one code path, so a Guard rule produces the same findings whichever engine runs it, and those findings are the ones cfn-guard validate reports.

How It Works

  Guard DSL (.guard) ──▶ GuardRuleFile::parse ──▶ syntax checked and rule metadata recorded at load time
                                                        │
  SemanticModel::authored_template_json() ──▶ GuardRuleFile::evaluate (re-parses rules) ──▶ Vec<GuardFinding>
                                                        │
                                   validation-engine GuardRuleSet ──▶ Vec<Diagnostic>

• Parsing and evaluation are done by cloudformation-guard-lang, the crate cfn-guard is built on, so the whole Guard language is supported and no Guard semantics are re-implemented here.
• Rules are evaluated against the template as the author wrote it, with intrinsic functions in long form - the same view cfn-guard evaluates, rendered by template-model.
• Each failed check becomes a GuardFinding carrying the rule name, the slash-separated template path the check was evaluated at (Resources/Bucket/Properties/BucketName), the unresolved query remainder when a property is missing, the author's <<message>>, and the check text. validation-engine maps findings onto diagnostics (entity, property path, source span, guard:<pack> category).

API