Parity grade: A · SDK aws-sdk-go-v2/service/cloudcontrol@v1.32.4 · last audited 2026-10-11 (d79e0612c)
| Metric | Value |
|---|---|
| PARITY entries audited | 8 (8 ok) |
| Feature families | 3 (3 ok) |
| Known gaps | 1 |
| Structural gaps (can't be emulated) | 3 |
| Deferred items | 0 |
| Resource leaks | clean |
- 25 types are delegated to real service backends (14 earlier + EC2 VPC/Subnet/SecurityGroup, ECS Cluster, ELBv2 TargetGroup, Route53 HostedZone, CloudWatch Alarm, Cognito UserPool, ApiGateway RestApi, EFS FileSystem, Glue Database; wiring in cli_cloudcontrol_handlers*.go); every other CloudFormation-provisionable AWS:: type (cfn_provisionable_types.json, ~410) is provisioned through the stack engine's own resource creators (cloudformation.CloudControlProvisioner; desired state kept in the resource store, so Get returns the submitted model and not backend-computed read-only properties), and with that wiring an AWS:: type outside the set answers UnsupportedActionException; non-AWS:: names still use the generic store. UpdateResource on a provisioned type is in-place only for Lambda Function, SQS Queue and StepFunctions StateMachine (the creators with updaters); any other changed property is NotUpdatableException (no create-only metadata to replace safely). Delegated updates apply mutable properties only and reject the rest; schema audit (2026-10-09) against the CloudFormation resource reference fixed (and since mapped: Subnet AvailabilityZoneId/Ipv6CidrBlock/Ipv6Native/EnableDns64/AssignIpv6AddressOnCreation with Ipv6CidrBlocks readback, RestApi Version, TargetGroup Targets/TargetGroupAttributes/TargetControlPort (create-only port), Route53 HostedZoneFeatures/QueryLoggingConfig, CloudWatch Alarm EvaluationWindow/WarmUpConfiguration, Cognito WebAuthn*/EnabledMfas/EmailAuthentication*/IssuerConfiguration/KeyConfiguration via SetUserPoolMfaConfig, EFS ReplicationConfiguration with exactly one destination) VPC read-only CidrBlockAssociations/Ipv6CidrBlocks, ECS ServiceConnectDefaults, TargetGroupName, Route53 VPCs updates, Cognito UserPoolTier/UserAttributeUpdateSettings (and the non-schema Id), RestApi SecurityPolicy/EndpointAccessMode, EFS FileSystemProtection/BypassPolicyLockoutSafetyCheck, Glue CatalogId required and no Tags; still unmapped: EC2 VPC IPAM, Subnet Ipv4/Ipv6 IPAM pool allocation, RestApi Body update/BodyS3Location/CloneFrom; CloudWatch Alarm EvaluationCriteria and EvaluationInterval are rejected (the cloudwatch backend has no PromQL alarm engine); SecretsManager GenerateSecretString is rejected. AWS::IAM::Policy is not delegated: it is an inline-policy attachment with no addressable resource (opaque Id, no read/list), so there is no honest Cloud Control identifier. Dashboard: the UI lists via ListResources(TypeName), which already includes delegated resources, but its type dropdown (ui/src/routes/cloudcontrol) is a fixed 7-type list and the unused InMemoryBackend.ListAllResources omits delegated types.
These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.
- TypeNotFoundException is unreachable: whether a TypeName is registered is an account-specific, mutable CloudFormation registry fact; any allowlist here would be incomplete and reject valid types (gopherstack-c9yf).
- TypeVersionId is accepted and ignored: there is no private-type-version registry to select between (gopherstack-xhu2t). chaos_coverage: # errors reachable via pkgs/chaos fault injection rather than backend logic — verified, not a gap
- The remaining 12 documented-but-unreachable exceptions from gopherstack-c9yf (ThrottlingException, ServiceLimitExceededException, HandlerFailureException, NotStabilizedException, NotUpdatableException, ResourceConflictException, PrivateTypeException, GeneralServiceException, NetworkFailureException, InvalidCredentialsException, HandlerInternalFailureException, ConcurrentOperationException) are ALREADY COVERED by pkgs/chaos, not a gap needing backend code. Verified concretely: Handler implements service.ChaosProvider (ChaosServiceName()=="cloudcontrol", ChaosOperations()==GetSupportedOperations(), ChaosRegions()), so it is enumerated by GET /_gopherstack/chaos/targets. The chaos middleware (pkgs/chaos/middleware.go) runs as global Echo middleware registered via registry.Use(chaos.Middleware(...)) (internal/app/cli.go:5754) OUTSIDE/BEFORE any service's own routing, and extracts service+operation from the same SigV4 Authorization header + X-Amz-Target header this service's own RouteMatcher/ExtractOperation already rely on (cloudcontrol is awsjson1.0 with X-Amz-Target: CloudApiService., so extractOperationFromRequest's X-Amz-Target-after-the-dot parsing resolves the exact operation name, e.g. "CreateResource") -- so a fault rule {service: "cloudcontrol", operation: "CreateResource", error: {code: "ThrottlingException", statusCode: 400}} deterministically short-circuits that op with an arbitrary injected Code+StatusCode (FaultError carries both, pkgs/chaos/fault_response.go) before this handler ever runs. Synthesizing these from backend state instead (e.g. fabricating a request-rate counter under a single coarse lock with no real concurrency contention) would be exactly the kind of invented signal this project's honesty rules forbid; fault injection is the correct, non-fabricated mechanism for exceptions AWS only returns under real infrastructure conditions this emulator doesn't have.