Tighten SAM Ref/GetAtt validation using CFN schema primaryIdentifier and readOnlyProperties

Remove blanket permissive GetAtt for all AWS::Serverless:: types.
SAM types with CFN mappings now use the mapped type's readOnlyProperties
for GetAtt validation and primaryIdentifier for Ref validation.
Connector correctly errors on GetAtt since it has no primary resource.

Author: kddejong

docs/sam-schema-gaps.md

@@ -54,4 +54,5 @@ These SAM types don't have a clear 1:1 primary CFN resource mapping:
 
 - `AWS::Serverless::Connector` — Generates IAM policies, no primary resource
 
-GetAtt for these types remains permissive (accepts any attribute).
+GetAtt/Ref for Connector will error since it has no `readOnlyProperties` or
+`primaryIdentifier`. This is correct — you'd never `!Ref` or `!GetAtt` a Connector.

scripts/update_sam_schemas.py

@@ -276,7 +276,7 @@ def build_resource_schema(
         "properties": properties_schema.get("properties", {}),
     }
 
-    # Copy readOnlyProperties from the underlying CFN type
+    # Copy readOnlyProperties and primaryIdentifier from the underlying CFN type
     cfn_type = SAM_TO_CFN_TYPE.get(module_name)
     if cfn_type:
         try:
@@ -285,6 +285,9 @@ def build_resource_schema(
             cfn_schema = PROVIDER_SCHEMA_MANAGER.get_resource_schema(
                 "us-east-1", cfn_type
             )
+            pi = cfn_schema.schema.get("primaryIdentifier", [])
+            if pi:
+                schema["primaryIdentifier"] = pi
             ro_props = cfn_schema.schema.get("readOnlyProperties", [])
             if ro_props:
                 schema["readOnlyProperties"] = ro_props

src/cfnlint/data/schemas/providers/af_south_1.py

@@ -926,17 +926,17 @@
     "AWS::SecurityHub::ProductSubscription": "a6a7b09a786ba544",
     "AWS::SecurityHub::SecurityControl": "062ab72de4bbcd1d",
     "AWS::SecurityHub::Standard": "a9a57a7527f5aff5",
-    "AWS::Serverless::Api": "234f60c06f473450",
-    "AWS::Serverless::Application": "7d1c95a8b2f01e07",
-    "AWS::Serverless::CapacityProvider": "d3e92d066f69a0ff",
+    "AWS::Serverless::Api": "e6affacebe8b0c55",
+    "AWS::Serverless::Application": "f7ac4b0ebba84f8b",
+    "AWS::Serverless::CapacityProvider": "9642a84515d09fb5",
     "AWS::Serverless::Connector": "4bdbe0eeeeb859e5",
-    "AWS::Serverless::Function": "b6d9353bf9544213",
-    "AWS::Serverless::GraphQLApi": "dc4b31b5ee945bbc",
-    "AWS::Serverless::HttpApi": "db28952063f3fb37",
-    "AWS::Serverless::LayerVersion": "54a05d5150f92d6f",
-    "AWS::Serverless::SimpleTable": "274556bcca91c9c4",
-    "AWS::Serverless::StateMachine": "30679ac19f760f8c",
-    "AWS::Serverless::WebSocketApi": "8ef912f4a2e5f4b1",
+    "AWS::Serverless::Function": "554cec6192159770",
+    "AWS::Serverless::GraphQLApi": "2d654013ac11af44",
+    "AWS::Serverless::HttpApi": "9aebe136ff9b8f6d",
+    "AWS::Serverless::LayerVersion": "e6e17ee142ff4fb5",
+    "AWS::Serverless::SimpleTable": "318018ba3be5fbfc",
+    "AWS::Serverless::StateMachine": "cbe043b60e78821e",
+    "AWS::Serverless::WebSocketApi": "81e13008dbf1beb7",
     "AWS::ServiceCatalog::AcceptedPortfolioShare": "77373a56c0c4bd28",
     "AWS::ServiceCatalog::CloudFormationProduct": "662186534ff8e643",
     "AWS::ServiceCatalog::CloudFormationProvisionedProduct": "448a377417beb2e5",

src/cfnlint/data/schemas/providers/ap_east_1.py

@@ -885,17 +885,17 @@
     "AWS::SecurityHub::ProductSubscription": "a6a7b09a786ba544",
     "AWS::SecurityHub::SecurityControl": "062ab72de4bbcd1d",
     "AWS::SecurityHub::Standard": "a9a57a7527f5aff5",
-    "AWS::Serverless::Api": "234f60c06f473450",
-    "AWS::Serverless::Application": "7d1c95a8b2f01e07",
-    "AWS::Serverless::CapacityProvider": "d3e92d066f69a0ff",
+    "AWS::Serverless::Api": "e6affacebe8b0c55",
+    "AWS::Serverless::Application": "f7ac4b0ebba84f8b",
+    "AWS::Serverless::CapacityProvider": "9642a84515d09fb5",
     "AWS::Serverless::Connector": "4bdbe0eeeeb859e5",
-    "AWS::Serverless::Function": "b6d9353bf9544213",
-    "AWS::Serverless::GraphQLApi": "dc4b31b5ee945bbc",
-    "AWS::Serverless::HttpApi": "db28952063f3fb37",
-    "AWS::Serverless::LayerVersion": "54a05d5150f92d6f",
-    "AWS::Serverless::SimpleTable": "274556bcca91c9c4",
-    "AWS::Serverless::StateMachine": "30679ac19f760f8c",
-    "AWS::Serverless::WebSocketApi": "8ef912f4a2e5f4b1",
+    "AWS::Serverless::Function": "554cec6192159770",
+    "AWS::Serverless::GraphQLApi": "2d654013ac11af44",
+    "AWS::Serverless::HttpApi": "9aebe136ff9b8f6d",
+    "AWS::Serverless::LayerVersion": "e6e17ee142ff4fb5",
+    "AWS::Serverless::SimpleTable": "318018ba3be5fbfc",
+    "AWS::Serverless::StateMachine": "cbe043b60e78821e",
+    "AWS::Serverless::WebSocketApi": "81e13008dbf1beb7",
     "AWS::ServiceCatalog::AcceptedPortfolioShare": "77373a56c0c4bd28",
     "AWS::ServiceCatalog::CloudFormationProduct": "662186534ff8e643",
     "AWS::ServiceCatalog::CloudFormationProvisionedProduct": "448a377417beb2e5",

src/cfnlint/data/schemas/providers/ap_east_2.py

@@ -630,17 +630,17 @@
     "AWS::SecurityHub::ProductSubscription": "a6a7b09a786ba544",
     "AWS::SecurityHub::SecurityControl": "062ab72de4bbcd1d",
     "AWS::SecurityHub::Standard": "a9a57a7527f5aff5",
-    "AWS::Serverless::Api": "234f60c06f473450",
-    "AWS::Serverless::Application": "7d1c95a8b2f01e07",
-    "AWS::Serverless::CapacityProvider": "d3e92d066f69a0ff",
+    "AWS::Serverless::Api": "e6affacebe8b0c55",
+    "AWS::Serverless::Application": "f7ac4b0ebba84f8b",
+    "AWS::Serverless::CapacityProvider": "9642a84515d09fb5",
     "AWS::Serverless::Connector": "4bdbe0eeeeb859e5",
-    "AWS::Serverless::Function": "b6d9353bf9544213",
-    "AWS::Serverless::GraphQLApi": "dc4b31b5ee945bbc",
-    "AWS::Serverless::HttpApi": "db28952063f3fb37",
-    "AWS::Serverless::LayerVersion": "54a05d5150f92d6f",
-    "AWS::Serverless::SimpleTable": "274556bcca91c9c4",
-    "AWS::Serverless::StateMachine": "30679ac19f760f8c",
-    "AWS::Serverless::WebSocketApi": "8ef912f4a2e5f4b1",
+    "AWS::Serverless::Function": "554cec6192159770",
+    "AWS::Serverless::GraphQLApi": "2d654013ac11af44",
+    "AWS::Serverless::HttpApi": "9aebe136ff9b8f6d",
+    "AWS::Serverless::LayerVersion": "e6e17ee142ff4fb5",
+    "AWS::Serverless::SimpleTable": "318018ba3be5fbfc",
+    "AWS::Serverless::StateMachine": "cbe043b60e78821e",
+    "AWS::Serverless::WebSocketApi": "81e13008dbf1beb7",
     "AWS::ServiceDiscovery::HttpNamespace": "986cb51cac464fe8",
     "AWS::ServiceDiscovery::Instance": "b4227e1dfa14a394",
     "AWS::ServiceDiscovery::PrivateDnsNamespace": "d78a2213969ef282",

src/cfnlint/data/schemas/providers/ap_northeast_1.py

@@ -1360,17 +1360,17 @@
     "AWS::SecurityLake::DataLake": "3b4f02ea01647d04",
     "AWS::SecurityLake::Subscriber": "d19c32e17f36619f",
     "AWS::SecurityLake::SubscriberNotification": "ef5a3a84d2557a3e",
-    "AWS::Serverless::Api": "234f60c06f473450",
-    "AWS::Serverless::Application": "7d1c95a8b2f01e07",
-    "AWS::Serverless::CapacityProvider": "d3e92d066f69a0ff",
+    "AWS::Serverless::Api": "e6affacebe8b0c55",
+    "AWS::Serverless::Application": "f7ac4b0ebba84f8b",
+    "AWS::Serverless::CapacityProvider": "9642a84515d09fb5",
     "AWS::Serverless::Connector": "4bdbe0eeeeb859e5",
-    "AWS::Serverless::Function": "b6d9353bf9544213",
-    "AWS::Serverless::GraphQLApi": "dc4b31b5ee945bbc",
-    "AWS::Serverless::HttpApi": "db28952063f3fb37",
-    "AWS::Serverless::LayerVersion": "54a05d5150f92d6f",
-    "AWS::Serverless::SimpleTable": "274556bcca91c9c4",
-    "AWS::Serverless::StateMachine": "30679ac19f760f8c",
-    "AWS::Serverless::WebSocketApi": "8ef912f4a2e5f4b1",
+    "AWS::Serverless::Function": "554cec6192159770",
+    "AWS::Serverless::GraphQLApi": "2d654013ac11af44",
+    "AWS::Serverless::HttpApi": "9aebe136ff9b8f6d",
+    "AWS::Serverless::LayerVersion": "e6e17ee142ff4fb5",
+    "AWS::Serverless::SimpleTable": "318018ba3be5fbfc",
+    "AWS::Serverless::StateMachine": "cbe043b60e78821e",
+    "AWS::Serverless::WebSocketApi": "81e13008dbf1beb7",
     "AWS::ServiceCatalog::AcceptedPortfolioShare": "aabf5162cee03316",
     "AWS::ServiceCatalog::CloudFormationProduct": "662186534ff8e643",
     "AWS::ServiceCatalog::CloudFormationProvisionedProduct": "448a377417beb2e5",

src/cfnlint/data/schemas/providers/ap_northeast_2.py

@@ -1280,17 +1280,17 @@
     "AWS::SecurityLake::DataLake": "3b4f02ea01647d04",
     "AWS::SecurityLake::Subscriber": "d19c32e17f36619f",
     "AWS::SecurityLake::SubscriberNotification": "ef5a3a84d2557a3e",
-    "AWS::Serverless::Api": "234f60c06f473450",
-    "AWS::Serverless::Application": "7d1c95a8b2f01e07",
-    "AWS::Serverless::CapacityProvider": "d3e92d066f69a0ff",
+    "AWS::Serverless::Api": "e6affacebe8b0c55",
+    "AWS::Serverless::Application": "f7ac4b0ebba84f8b",
+    "AWS::Serverless::CapacityProvider": "9642a84515d09fb5",
     "AWS::Serverless::Connector": "4bdbe0eeeeb859e5",
-    "AWS::Serverless::Function": "b6d9353bf9544213",
-    "AWS::Serverless::GraphQLApi": "dc4b31b5ee945bbc",
-    "AWS::Serverless::HttpApi": "db28952063f3fb37",
-    "AWS::Serverless::LayerVersion": "54a05d5150f92d6f",
-    "AWS::Serverless::SimpleTable": "274556bcca91c9c4",
-    "AWS::Serverless::StateMachine": "30679ac19f760f8c",
-    "AWS::Serverless::WebSocketApi": "8ef912f4a2e5f4b1",
+    "AWS::Serverless::Function": "554cec6192159770",
+    "AWS::Serverless::GraphQLApi": "2d654013ac11af44",
+    "AWS::Serverless::HttpApi": "9aebe136ff9b8f6d",
+    "AWS::Serverless::LayerVersion": "e6e17ee142ff4fb5",
+    "AWS::Serverless::SimpleTable": "318018ba3be5fbfc",
+    "AWS::Serverless::StateMachine": "cbe043b60e78821e",
+    "AWS::Serverless::WebSocketApi": "81e13008dbf1beb7",
     "AWS::ServiceCatalog::AcceptedPortfolioShare": "aabf5162cee03316",
     "AWS::ServiceCatalog::CloudFormationProduct": "662186534ff8e643",
     "AWS::ServiceCatalog::CloudFormationProvisionedProduct": "448a377417beb2e5",

src/cfnlint/data/schemas/providers/ap_northeast_3.py

@@ -952,17 +952,17 @@
     "AWS::SecurityLake::DataLake": "3b4f02ea01647d04",
     "AWS::SecurityLake::Subscriber": "d19c32e17f36619f",
     "AWS::SecurityLake::SubscriberNotification": "ef5a3a84d2557a3e",
-    "AWS::Serverless::Api": "234f60c06f473450",
-    "AWS::Serverless::Application": "7d1c95a8b2f01e07",
-    "AWS::Serverless::CapacityProvider": "d3e92d066f69a0ff",
+    "AWS::Serverless::Api": "e6affacebe8b0c55",
+    "AWS::Serverless::Application": "f7ac4b0ebba84f8b",
+    "AWS::Serverless::CapacityProvider": "9642a84515d09fb5",
     "AWS::Serverless::Connector": "4bdbe0eeeeb859e5",
-    "AWS::Serverless::Function": "b6d9353bf9544213",
-    "AWS::Serverless::GraphQLApi": "dc4b31b5ee945bbc",
-    "AWS::Serverless::HttpApi": "db28952063f3fb37",
-    "AWS::Serverless::LayerVersion": "54a05d5150f92d6f",
-    "AWS::Serverless::SimpleTable": "274556bcca91c9c4",
-    "AWS::Serverless::StateMachine": "30679ac19f760f8c",
-    "AWS::Serverless::WebSocketApi": "8ef912f4a2e5f4b1",
+    "AWS::Serverless::Function": "554cec6192159770",
+    "AWS::Serverless::GraphQLApi": "2d654013ac11af44",
+    "AWS::Serverless::HttpApi": "9aebe136ff9b8f6d",
+    "AWS::Serverless::LayerVersion": "e6e17ee142ff4fb5",
+    "AWS::Serverless::SimpleTable": "318018ba3be5fbfc",
+    "AWS::Serverless::StateMachine": "cbe043b60e78821e",
+    "AWS::Serverless::WebSocketApi": "81e13008dbf1beb7",
     "AWS::ServiceCatalog::AcceptedPortfolioShare": "77373a56c0c4bd28",
     "AWS::ServiceCatalog::CloudFormationProduct": "662186534ff8e643",
     "AWS::ServiceCatalog::CloudFormationProvisionedProduct": "448a377417beb2e5",

src/cfnlint/data/schemas/providers/ap_south_1.py

@@ -1275,17 +1275,17 @@
     "AWS::SecurityLake::DataLake": "3b4f02ea01647d04",
     "AWS::SecurityLake::Subscriber": "d19c32e17f36619f",
     "AWS::SecurityLake::SubscriberNotification": "ef5a3a84d2557a3e",
-    "AWS::Serverless::Api": "234f60c06f473450",
-    "AWS::Serverless::Application": "7d1c95a8b2f01e07",
-    "AWS::Serverless::CapacityProvider": "d3e92d066f69a0ff",
+    "AWS::Serverless::Api": "e6affacebe8b0c55",
+    "AWS::Serverless::Application": "f7ac4b0ebba84f8b",
+    "AWS::Serverless::CapacityProvider": "9642a84515d09fb5",
     "AWS::Serverless::Connector": "4bdbe0eeeeb859e5",
-    "AWS::Serverless::Function": "b6d9353bf9544213",
-    "AWS::Serverless::GraphQLApi": "dc4b31b5ee945bbc",
-    "AWS::Serverless::HttpApi": "db28952063f3fb37",
-    "AWS::Serverless::LayerVersion": "54a05d5150f92d6f",
-    "AWS::Serverless::SimpleTable": "274556bcca91c9c4",
-    "AWS::Serverless::StateMachine": "30679ac19f760f8c",
-    "AWS::Serverless::WebSocketApi": "8ef912f4a2e5f4b1",
+    "AWS::Serverless::Function": "554cec6192159770",
+    "AWS::Serverless::GraphQLApi": "2d654013ac11af44",
+    "AWS::Serverless::HttpApi": "9aebe136ff9b8f6d",
+    "AWS::Serverless::LayerVersion": "e6e17ee142ff4fb5",
+    "AWS::Serverless::SimpleTable": "318018ba3be5fbfc",
+    "AWS::Serverless::StateMachine": "cbe043b60e78821e",
+    "AWS::Serverless::WebSocketApi": "81e13008dbf1beb7",
     "AWS::ServiceCatalog::AcceptedPortfolioShare": "aabf5162cee03316",
     "AWS::ServiceCatalog::CloudFormationProduct": "662186534ff8e643",
     "AWS::ServiceCatalog::CloudFormationProvisionedProduct": "448a377417beb2e5",

src/cfnlint/data/schemas/providers/ap_south_2.py

@@ -795,17 +795,17 @@
     "AWS::SecurityHub::ProductSubscription": "a6a7b09a786ba544",
     "AWS::SecurityHub::SecurityControl": "062ab72de4bbcd1d",
     "AWS::SecurityHub::Standard": "a9a57a7527f5aff5",
-    "AWS::Serverless::Api": "234f60c06f473450",
-    "AWS::Serverless::Application": "7d1c95a8b2f01e07",
-    "AWS::Serverless::CapacityProvider": "d3e92d066f69a0ff",
+    "AWS::Serverless::Api": "e6affacebe8b0c55",
+    "AWS::Serverless::Application": "f7ac4b0ebba84f8b",
+    "AWS::Serverless::CapacityProvider": "9642a84515d09fb5",
     "AWS::Serverless::Connector": "4bdbe0eeeeb859e5",
-    "AWS::Serverless::Function": "b6d9353bf9544213",
-    "AWS::Serverless::GraphQLApi": "dc4b31b5ee945bbc",
-    "AWS::Serverless::HttpApi": "db28952063f3fb37",
-    "AWS::Serverless::LayerVersion": "54a05d5150f92d6f",
-    "AWS::Serverless::SimpleTable": "274556bcca91c9c4",
-    "AWS::Serverless::StateMachine": "30679ac19f760f8c",
-    "AWS::Serverless::WebSocketApi": "8ef912f4a2e5f4b1",
+    "AWS::Serverless::Function": "554cec6192159770",
+    "AWS::Serverless::GraphQLApi": "2d654013ac11af44",
+    "AWS::Serverless::HttpApi": "9aebe136ff9b8f6d",
+    "AWS::Serverless::LayerVersion": "e6e17ee142ff4fb5",
+    "AWS::Serverless::SimpleTable": "318018ba3be5fbfc",
+    "AWS::Serverless::StateMachine": "cbe043b60e78821e",
+    "AWS::Serverless::WebSocketApi": "81e13008dbf1beb7",
     "AWS::ServiceCatalog::AcceptedPortfolioShare": "77373a56c0c4bd28",
     "AWS::ServiceCatalog::CloudFormationProduct": "662186534ff8e643",
     "AWS::ServiceCatalog::CloudFormationProvisionedProduct": "448a377417beb2e5",