Skip to content

fix(aws): validate AWS integrations against SDK and API docs #9952

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 6 commits into from
Nov 12, 2026
+4,389 −187
Merged

fix(aws): validate AWS integrations against SDK and API docs #9952

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
72e82d7
fix(aws): validate AWS integrations against SDK and API docs
waleedlatif1 Nov 12, 2026
9b15b65
fix(aws): keep stale and empty subBlock values out of tool input
waleedlatif1 Nov 12, 2026
c6b3602
fix(aws): address review round and close remaining empty-value leaks
waleedlatif1 Nov 12, 2026
bca7d49
fix(aws): restrict string consistentRead to true/false and validate S…
waleedlatif1 Nov 12, 2026
c965d77
fix(identity-center): always assign the list_account_assignments acco…
waleedlatif1 Nov 12, 2026
36cc4b2
fix(ses): drop the new email attachments path from this sweep
waleedlatif1 Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions apps/docs/content/docs/integrations/athena.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,10 @@ Start an SQL query execution in AWS Athena
| `executionParameters` | json | No | Values for ? placeholders in a parameterized query or EXECUTE statement, applied in order. Pass a JSON array of strings \(e.g. \["2024-01-01", "US"\]\); a plain comma-separated list is also accepted when no value contains a comma |
| `resultReuseEnabled` | boolean | No | Reuse a previous result of the same query instead of re-scanning data \(default: false\) |
| `resultReuseMaxAgeInMinutes` | number | No | Maximum age in minutes of a previous result eligible for reuse \(0-10080, default: 60\) |
| `encryptionOption` | string | No | Encryption for the query results in S3: SSE_S3, SSE_KMS, or CSE_KMS. Overridden when the workgroup enforces its own settings |
| `kmsKey` | string | No | KMS key ARN or ID used when encryptionOption is SSE_KMS or CSE_KMS |
| `expectedBucketOwner` | string | No | AWS account ID expected to own the output location bucket; the query fails if it does not |
| `clientRequestToken` | string | No | Idempotency token \(32-128 characters\). Repeating a request with the same token returns the original query execution instead of starting a new one |

#### Output

Expand Down Expand Up @@ -80,6 +84,14 @@ Get the status and details of an Athena query execution
| `queryQueueTimeInMillis` | number | Time the query spent in queue in milliseconds |
| `totalExecutionTimeInMillis` | number | Total execution time in milliseconds |
| `outputLocation` | string | S3 location of query results |
| `servicePreProcessingTimeInMillis` | number | Time Athena spent preprocessing the query before submitting it, in milliseconds |
| `serviceProcessingTimeInMillis` | number | Time Athena spent finalizing and publishing results after execution, in milliseconds |
| `dataManifestLocation` | string | S3 location of the manifest file listing files written by the query |
| `reusedPreviousResult` | boolean | Whether the query reused a previous result instead of scanning data |
| `athenaError` | json | Failure details for a FAILED query \(errorCategory: 1 system, 2 user, 3 other; errorType; retryable; errorMessage\) |
| `executionParameters` | array | Values supplied for the query's ? placeholders |
| `substatementType` | string | Kind of query statement that was run \(e.g., SELECT, INSERT, CREATE_TABLE\) |
| `engineVersion` | json | Engine version used \(selectedEngineVersion, effectiveEngineVersion\) |

</ReferenceDetails>

Expand All @@ -102,10 +114,10 @@ Retrieve the results of a completed Athena query execution

| Parameter | Type | Description |
| --------- | ---- | ----------- |
| `columns` | array | Column metadata \(name and type\) |
| `columns` | array | Column metadata \(name, type, label, precision, scale, nullable, caseSensitive\) |
| `rows` | array | Result rows as key-value objects |
| `nextToken` | string | Pagination token for next page of results |
| `updateCount` | number | Number of rows affected \(for INSERT/UPDATE statements\) |
| `updateCount` | number | Number of rows inserted or updated by a CREATE TABLE AS SELECT, INSERT INTO, or UPDATE statement |

</ReferenceDetails>

Expand Down Expand Up @@ -188,6 +200,14 @@ Get the status and details of up to 50 Athena query executions in one call
| ↳ `queryQueueTimeInMillis` | number | Time the query spent in queue in milliseconds |
| ↳ `totalExecutionTimeInMillis` | number | Total execution time in milliseconds |
| ↳ `outputLocation` | string | S3 location of query results |
| ↳ `servicePreProcessingTimeInMillis` | number | Time Athena spent preprocessing the query before submitting it, in milliseconds |
| ↳ `serviceProcessingTimeInMillis` | number | Time Athena spent finalizing and publishing results after execution, in milliseconds |
| ↳ `dataManifestLocation` | string | S3 location of the manifest file listing files written by the query |
| ↳ `reusedPreviousResult` | boolean | Whether the query reused a previous result instead of scanning data |
| ↳ `athenaError` | json | Failure details for a FAILED query \(errorCategory: 1 system, 2 user, 3 other; errorType; retryable; errorMessage\) |
| ↳ `executionParameters` | array | Values supplied for the query's ? placeholders |
| ↳ `substatementType` | string | Kind of query statement that was run \(e.g., SELECT, INSERT, CREATE_TABLE\) |
| ↳ `engineVersion` | json | Engine version used \(selectedEngineVersion, effectiveEngineVersion\) |
| `unprocessedQueryExecutionIds` | array | Query execution IDs that could not be retrieved, with error details |
| ↳ `queryExecutionId` | string | Query execution ID |
| ↳ `errorCode` | string | Error code |
Expand Down
23 changes: 19 additions & 4 deletions apps/docs/content/docs/integrations/cloudformation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ List and describe CloudFormation stacks

| Parameter | Type | Description |
| --------- | ---- | ----------- |
| `stacks` | array | List of CloudFormation stacks with status, outputs, and tags |
| `stacks` | array | List of CloudFormation stacks \(stackName, stackId, stackStatus, stackStatusReason, detailedStatus, creationTime, lastUpdatedTime, deletionTime, description, enableTerminationProtection, driftInformation, outputs \[\{outputKey, outputValue, description, exportName\}\], tags, parameters \[\{parameterKey, parameterValue, usePreviousValue, resolvedValue\}\], capabilities, changeSetId, roleArn, parentId, rootId, notificationArns, timeoutInMinutes, disableRollback, deletionMode, retainExceptOnCreate\) |

</ReferenceDetails>

Expand All @@ -58,6 +58,8 @@ Create a new CloudFormation stack from a template
| `tags` | json | No | Tags to apply to the stack and its resources \(e.g., \[\{"key": "env", "value": "prod"\}\]\) |
| `onFailure` | string | No | Action to take on creation failure: ROLLBACK \(default\), DELETE, or DO_NOTHING |
| `timeoutInMinutes` | number | No | Amount of time before the stack creation times out and rolls back |
| `roleArn` | string | No | ARN of an IAM service role CloudFormation assumes for stack operations \(defaults to the caller credentials or the role previously used for the stack\) |
| `enableTerminationProtection` | boolean | No | Whether to enable termination protection on the new stack \(default false\) |

#### Output

Expand All @@ -84,6 +86,7 @@ Update an existing CloudFormation stack with a new or previous template
| `parameters` | json | No | Template input parameters \(e.g., \[\{"parameterKey": "InstanceType", "parameterValue": "t3.micro"\}\]\) |
| `capabilities` | string | No | Comma-separated capabilities to acknowledge \(CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND\) |
| `tags` | json | No | Tags to apply to the stack and its resources \(e.g., \[\{"key": "env", "value": "prod"\}\]\) |
| `roleArn` | string | No | ARN of an IAM service role CloudFormation assumes for stack operations \(defaults to the caller credentials or the role previously used for the stack\) |

#### Output

Expand Down Expand Up @@ -155,6 +158,8 @@ Preview the changes a stack create or update would make before applying them
| `capabilities` | string | No | Comma-separated capabilities to acknowledge \(CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND\) |
| `changeSetType` | string | No | CREATE \(default, new stack\), UPDATE \(existing stack\), or IMPORT \(import existing resources\) |
| `description` | string | No | Description of the change set for reference |
| `tags` | json | No | Tags to apply to the stack and its resources when the change set executes \(e.g., \[\{"key": "env", "value": "prod"\}\]\) |
| `roleArn` | string | No | ARN of an IAM service role CloudFormation assumes for stack operations \(defaults to the caller credentials or the role previously used for the stack\) |

#### Output

Expand All @@ -178,6 +183,7 @@ View the resource changes a change set would make and its execution status
| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) |
| `changeSetName` | string | Yes | Name or ARN of the change set to describe |
| `stackName` | string | No | Name or ID of the stack the change set belongs to \(required if changeSetName is not an ARN\) |
| `nextToken` | string | No | Pagination token from a previous call to fetch the next page of changes |

#### Output

Expand All @@ -193,7 +199,16 @@ View the resource changes a change set would make and its execution status
| `statusReason` | string | Reason for the current status, particularly if failed |
| `creationTime` | number | Timestamp the change set was created |
| `capabilities` | array | Capabilities required to execute the change set |
| `changes` | array | List of resource changes \(action, logical/physical resource ID, resource type, replacement\) |
| `changes` | array | List of resource changes \(action, logicalResourceId, physicalResourceId, resourceType, replacement, type, policyAction, scope, changeSetId, details \[\{attribute, name, requiresRecreation, evaluation, changeSource, causingEntity\}\]\) |
| `parameters` | array | Stack parameters for the change set \(parameterKey, parameterValue, usePreviousValue, resolvedValue\) |
| `tags` | array | Tags associated with the change set \(key, value\) |
| `notificationArns` | array | SNS topic ARNs that receive stack event notifications |
| `includeNestedStacks` | boolean | Whether change sets were created for nested stacks |
| `parentChangeSetId` | string | ID of the parent change set, for nested change sets |
| `rootChangeSetId` | string | ID of the top-level change set, for nested change sets |
| `onStackFailure` | string | Behavior when stack operations fail \(DO_NOTHING, ROLLBACK, DELETE\) |
| `importExistingResources` | boolean | Whether the change set imports resources that already exist |
| `nextToken` | string | Pagination token for the next page of changes, if more remain |

</ReferenceDetails>

Expand Down Expand Up @@ -306,7 +321,7 @@ Get the event history for a CloudFormation stack

| Parameter | Type | Description |
| --------- | ---- | ----------- |
| `events` | array | List of stack events with resource status and timestamps |
| `events` | array | List of stack events \(stackId, eventId, stackName, operationId, logicalResourceId, physicalResourceId, resourceType, resourceStatus, resourceStatusReason, detailedStatus, resourceProperties, clientRequestToken, hookType, hookStatus, hookStatusReason, hookInvocationPoint, hookFailureMode, timestamp\) |

</ReferenceDetails>

Expand Down Expand Up @@ -352,7 +367,7 @@ Get a summary of a template or deployed stack: resource types, required capabili
| Parameter | Type | Description |
| --------- | ---- | ----------- |
| `description` | string | Template description |
| `parameters` | array | Template parameters with types, defaults, and descriptions |
| `parameters` | array | Template parameters \(parameterKey, defaultValue, parameterType, noEcho, description, allowedValues\) |
| `capabilities` | array | Required capabilities \(e.g., CAPABILITY_IAM\) |
| `capabilitiesReason` | string | Reason capabilities are required |
| `resourceTypes` | array | AWS resource types declared in the template \(e.g., AWS::S3::Bucket\) |
Expand Down
35 changes: 35 additions & 0 deletions apps/docs/content/docs/integrations/cloudwatch.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ Run a CloudWatch Log Insights query against one or more log groups
| ↳ `recordsMatched` | number | Number of log records that matched the query |
| ↳ `recordsScanned` | number | Total log records scanned |
| `status` | string | Query completion status \(Complete, Failed, Cancelled, or Timeout\) |
| `queryId` | string | ID of the Logs Insights query |

</ReferenceDetails>

Expand All @@ -69,6 +70,7 @@ Search log events across all streams in a log group by filter pattern and time r
| `endTime` | number | No | End time as Unix epoch seconds |
| `startFromHead` | boolean | No | Return the earliest matching events first instead of the latest |
| `limit` | number | No | Maximum number of events to return |
| `nextToken` | string | No | Pagination token from a previous call to continue where it stopped |

#### Output

Expand All @@ -79,6 +81,8 @@ Search log events across all streams in a log group by filter pattern and time r
| ↳ `timestamp` | number | Event timestamp in epoch milliseconds |
| ↳ `message` | string | Log event message |
| ↳ `ingestionTime` | number | Ingestion time in epoch milliseconds |
| ↳ `eventId` | string | Unique ID of the log event |
| `nextToken` | string | Token to fetch the next page of matching events, if more remain |

</ReferenceDetails>

Expand Down Expand Up @@ -125,6 +129,7 @@ Retrieve log events from a specific CloudWatch log stream
| `startTime` | number | No | Start time as Unix epoch seconds |
| `endTime` | number | No | End time as Unix epoch seconds |
| `limit` | number | No | Maximum number of events to return |
| `nextToken` | string | No | Token from a previous call \(nextForwardToken or nextBackwardToken\) to page through the stream |

#### Output

Expand All @@ -134,6 +139,8 @@ Retrieve log events from a specific CloudWatch log stream
| ↳ `timestamp` | number | Event timestamp in epoch milliseconds |
| ↳ `message` | string | Log event message |
| ↳ `ingestionTime` | number | Ingestion time in epoch milliseconds |
| `nextForwardToken` | string | Token for the next, newer page of events \(returns the same token when the end of the stream is reached\) |
| `nextBackwardToken` | string | Token for the previous, older page of events |

</ReferenceDetails>

Expand Down Expand Up @@ -234,6 +241,8 @@ Get statistics for a CloudWatch metric over a time range
| `period` | number | Yes | Granularity in seconds \(e.g., 60, 300, 3600\) |
| `statistics` | array | Yes | Statistics to retrieve \(Average, Sum, Minimum, Maximum, SampleCount\) |
| `dimensions` | string | No | Dimensions as JSON \(e.g., \{"InstanceId": "i-1234"\}\) |
| `extendedStatistics` | array | No | Percentile statistics to retrieve \(e.g., \["p99", "p95"\]\). AWS accepts either Statistics or ExtendedStatistics, so when set these are requested instead of statistics |
| `unit` | string | No | Only return data reported with this unit \(e.g., Percent, Milliseconds\). Omit to return all units |

#### Output

Expand All @@ -248,6 +257,7 @@ Get statistics for a CloudWatch metric over a time range
| ↳ `maximum` | number | Maximum statistic value |
| ↳ `sampleCount` | number | Sample count statistic value |
| ↳ `unit` | string | Unit of the metric |
| ↳ `extendedStatistics` | json | Percentile values keyed by statistic \(e.g., \{"p99": 120.5\}\) |

</ReferenceDetails>

Expand Down Expand Up @@ -296,6 +306,7 @@ List and filter CloudWatch alarms
| `stateValue` | string | No | Filter by alarm state \(OK, ALARM, INSUFFICIENT_DATA\) |
| `alarmType` | string | No | Filter by alarm type \(MetricAlarm, CompositeAlarm\) |
| `limit` | number | No | Maximum number of alarms to return |
| `nextToken` | string | No | Pagination token from a previous call |

#### Output

Expand All @@ -309,7 +320,29 @@ List and filter CloudWatch alarms
| ↳ `metricName` | string | Metric name \(MetricAlarm only\) |
| ↳ `namespace` | string | Metric namespace \(MetricAlarm only\) |
| ↳ `threshold` | number | Threshold value \(MetricAlarm only\) |
| ↳ `comparisonOperator` | string | Comparison operator \(MetricAlarm only\) |
| ↳ `evaluationPeriods` | number | Number of periods evaluated \(MetricAlarm only\) |
| ↳ `stateUpdatedTimestamp` | number | Epoch ms when state last changed |
| ↳ `alarmType` | string | MetricAlarm or CompositeAlarm |
| ↳ `alarmDescription` | string | Alarm description |
| ↳ `actionsEnabled` | boolean | Whether actions run on state changes |
| ↳ `alarmActions` | array | ARNs of actions run on ALARM |
| ↳ `okActions` | array | ARNs of actions run on OK |
| ↳ `insufficientDataActions` | array | ARNs of actions run on INSUFFICIENT_DATA |
| ↳ `stateReasonData` | string | Machine-readable JSON explaining the state |
| ↳ `stateTransitionedTimestamp` | number | Epoch ms when the state value last changed |
| ↳ `alarmConfigurationUpdatedTimestamp` | number | Epoch ms when the alarm configuration last changed |
| ↳ `statistic` | string | Statistic evaluated \(MetricAlarm only\) |
| ↳ `extendedStatistic` | string | Percentile statistic evaluated \(MetricAlarm only\) |
| ↳ `dimensions` | array | Metric dimensions as \{name, value\} \(MetricAlarm only\) |
| ↳ `period` | number | Evaluation period in seconds \(MetricAlarm only\) |
| ↳ `unit` | string | Metric unit \(MetricAlarm only\) |
| ↳ `datapointsToAlarm` | number | Breaching datapoints needed to alarm \(MetricAlarm only\) |
| ↳ `treatMissingData` | string | How missing data is treated \(MetricAlarm only\) |
| ↳ `thresholdMetricId` | string | ID of the metric-math threshold query \(anomaly detection alarms\) |
| ↳ `metrics` | array | Metric-math queries \[\{id, expression, label, returnData, period, accountId, metricStat\}\] \(MetricAlarm only\) |
| ↳ `alarmRule` | string | Rule expression \(CompositeAlarm only\) |
| `nextToken` | string | Pagination token for the next page of alarms |

</ReferenceDetails>

Expand Down Expand Up @@ -341,6 +374,8 @@ Retrieve state-change and configuration history for CloudWatch alarms
| ↳ `timestamp` | number | Epoch ms when the history item occurred |
| ↳ `historyItemType` | string | ConfigurationUpdate, StateUpdate, Action, or contributor variants |
| ↳ `historySummary` | string | Human-readable summary of the event |
| ↳ `historyData` | string | JSON string with event details \(e.g., old and new state with reason data for StateUpdate\) |
| ↳ `alarmContributorId` | string | ID of the alarm contributor, for contributor history items |

</ReferenceDetails>

Expand Down
Loading
Loading