Module constants

Expand description

Every hardcoded service constraint, and the JSON the build gate checks them with.

Each number and pattern below is transcribed from the botocore service model for lambda-microvms, API version MODEL_API_VERSION. The model is a machine-readable statement of the service’s own request validation, and restating it by hand is how this project published a 16 KB runHookPayload ceiling against a real ceiling of 4096 — wrong by 4x in the dangerous direction, since it told a caller four times as much secret material fits as actually does.

§Why they are checked locally at all

Because the SDK does not check them. Measured 2026-08-07 by reading botocore’s validate.py: VALIDATED_METADATA_ATTRS is {'required', 'min', 'document', 'union'}, so a min violation is caught before the wire while max, pattern, and enum violations are serialized, sent, and answered with a ValidationException — confirmed empirically for max (runHookPayload 4097, maximumDurationInSeconds 28801, ImageName 65 chars, NetworkConnectorList 11 items, clientToken 129 chars), for pattern (ImageName "a b!"), and for enum (architecture X86_64, additionalOsCapabilities CAP_SYS_ADMIN). Every one reached the wire. So the guards built on these values are load-bearing rather than belt-and-braces, and the obvious future simplification — “the SDK validates the model already, delete these” — silently reopens all of them.

IdlePolicy.maxIdleDurationSeconds used to be listed here as the counter-example — the one constraint with no constant, on the grounds that its min: 60 is a min and botocore enforces those locally. That reasoning does not transfer to this client and the exemption is gone (MIN_IDLE_DURATION_SEC). It was true of the deleted Python client, which called through botocore; this one signs with aws-sigv4 and sends with reqwest, and validate.py is never on the path. Every constraint here is enforced by this crate or by nothing, min included.

§The drift gate (TRAP-12)

as_json emits every value in this module as one object. The names are the keys consumed by tools/check-model-drift.py, which compares each value with the pinned model. MEASURED_REGIONS, the deprecated MICROVM_REGIONS and SIZE_CLASSES have no model source; the gate compares them with independently pinned literals.

The names are therefore a contract with a script, not a style choice. Renaming MAX_RUN_HOOK_PAYLOAD_BYTES here without renaming it there does not fail compilation; it makes a check silently stop comparing. The test at the bottom of this file pins the key set for that reason.

Constants§

ARCHITECTURES: The Architecture enum, which is exactly this one value: a MicroVM cannot be x86.
BUILD_STATES: The BuildState enum, in the model’s order.
CAPABILITIES: The Capability enum, which is exactly this one value.
CHIPSETS: The Chipset enum, which is exactly this one value.
DEAD_STATES: The subset of TERMINAL_STATES from which nothing comes back.
DOCUMENTED_RUN_HOOK_PAYLOAD_BYTES: The figure the model’s own runHookPayload documentation string claims, which is not the ceiling.
HOOK_STATES: The HookState enum, in the model’s order. DISABLED first.
IMAGE_NAME_PATTERN: ImageName.pattern, as the model spells it.
IMAGE_STATES: The MicrovmImageState enum, in the model’s order.
IMAGE_VERSION_STATES: The MicrovmImageVersionState enum, in the model’s order.
IMAGE_VERSION_STATUSES: The MicrovmImageVersionStatus enum, in the model’s order.
LOG_GROUP_PATTERN: CloudWatchLoggingLogGroupString.pattern, as the model spells it.
LOG_STREAM_PATTERN: CloudWatchLoggingLogStreamString.pattern — anything but : and *.
MAX_CLIENT_TOKEN_LEN: Create/Run/UpdateMicrovmImageRequestClientTokenString.max, all three 128.
MAX_DURATION_SEC: RunMicrovmRequestMaximumDurationInSecondsInteger.max — eight hours, and the hard ceiling on any single VM’s life. A longer session needs a second VM, not a larger number.
MAX_HOOK_PORT: HooksPortInteger.max.
MAX_IDENTIFIER_LEN: MicrovmIdentifier.max and MicrovmImageIdentifier.max, which are the same number.
MAX_IMAGE_ARN_LEN: MicrovmImageArn.max — 2048, the number that contradicts MAX_IDENTIFIER_LEN.
MAX_IMAGE_EGRESS_CONNECTORS: The image-level egress list’s max, which is 1 and not 10.
MAX_IMAGE_HOOK_TIMEOUT_SEC: MicrovmImageHooks*TimeoutInSecondsInteger.max (ready, validate).
MAX_IMAGE_NAME_LEN: ImageName.max.
MAX_LOG_GROUP_LEN: CloudWatchLoggingLogGroupString.max — the ceiling on logging.cloudWatch.logGroup.
MAX_LOG_STREAM_LEN: CloudWatchLoggingLogStreamString.max — the ceiling on logging.cloudWatch.logStream.
MAX_MICROVM_HOOK_TIMEOUT_SEC: MicrovmHooks*TimeoutInSecondsInteger.max (run, resume, suspend, terminate).
MAX_NETWORK_CONNECTORS: NetworkConnectorList.max — the VM-level list, which RunMicrovm sends.
MAX_NETWORK_CONNECTOR_LEN: NetworkConnector.max — the maximum ARN length accepted by RunMicrovm.
MAX_NON_BLANK_LEN: NonBlankString.max, which today equals MAX_VERSION_LEN and is a different shape.
MAX_PORT: PortNumber.max, which equals MAX_HOOK_PORT and is a different shape.
MAX_RESOURCES: ResourcesList.max.
MAX_ROLE_ARN_LEN: RoleArn.max.
MAX_RUN_HOOK_PAYLOAD_BYTES: RunMicrovmRequestRunHookPayloadString.max.
MAX_TAG_KEY_LEN: TagKey.max. Minimum is 1, so a blank key is not a tag.
MAX_TAG_VALUE_LEN: TagValue.max. Minimum is 0 — an empty tag value is legal, unlike an empty key.
MAX_USER_LOG_STREAM_LEN: The ceiling on a caller-supplied log stream name: MAX_LOG_STREAM_LEN minus the 17 characters of per-build discriminator this client always appends (/ + 16 hex).
MAX_VERSION_LEN: Version.max, which is also NonBlankString.max.
MICROVM_STATES: The MicrovmState enum, in the model’s order.
MIN_IDLE_DURATION_SEC: IdlePolicyMaxIdleDurationSecondsInteger.min — 60 seconds, with no maximum.
MIN_PORT: PortNumber.min, and also HooksPortInteger.min. 1, not 0.
MIN_ROLE_ARN_LEN: RoleArn.min — 20 characters, which is the shortest thing that can be an IAM role ARN.
MODEL_API_VERSION: The model version every constraint here was read from.
MODEL_IMAGE_READY_STATES: The MicrovmImageState values that mean “built and usable”, as the model spells them.
NON_BLANK_PATTERN: NonBlankString.pattern — the same [^\s]+ VERSION_PATTERN carries, held separately for the reason MAX_NON_BLANK_LEN gives.
ROLE_ARN_PATTERN: RoleArn.pattern, as the model spells it.
TAG_COMPONENT_PATTERN: The TagKey/TagValue pattern, which both shapes share verbatim.
TERMINAL_STATES: Terminal MicrovmState values.
TOLERATED_IMAGE_READY_STATES: Spellings that are not in the 2025-09-09 MicrovmImageState enum, tolerated when the service answers with one.
VERSION_PATTERN: Version.pattern — no whitespace anywhere, not merely “not blank”.

Functions§

as_json: Every constant in this module as one JSON object, keyed for the model drift gate.
is_valid_image_name: Whether name satisfies IMAGE_NAME_PATTERN and MAX_IMAGE_NAME_LEN.
is_valid_log_group: Whether group satisfies LOG_GROUP_PATTERN and MAX_LOG_GROUP_LEN.
is_valid_role_arn: Whether arn is structurally an IAM role ARN, per ROLE_ARN_PATTERN.
is_valid_tag_component: Whether every character of component is in TAG_COMPONENT_PATTERN’s set.