fix(idp_sdk): resolve headless deployment issues for GovCloud regions

Author: rstrahan

CHANGELOG.md

@@ -38,6 +38,8 @@ SPDX-License-Identifier: MIT-0
 
 ### Fixed
 
+- **Headless deployment fails with `ConfigurationPreset` AllowedValues error and `GraphQLApi.Arn` reference error** — Added `lending-package-sample-govcloud` to the base template AllowedValues and ConfigurationMap, and auto-detect GovCloud region (`us-gov-*`) for headless template transform instead of missing or hardcoded flag. Also added Discovery resources (BlueprintOptimization, MultiDocDiscovery, DiscoveryProcessor, etc.) to headless removal list to fix `GraphQLApi.Arn` unresolved reference error.
+
 - **`delete-documents` fails with DynamoDB errors** — Fixed two bugs in `get_documents_by_batch()`: (1) passing empty `ExpressionAttributeNames={}` when no status filter caused `ValidationException`, and (2) using low-level DynamoDB client type descriptors (`{"S": "..."}`) with the high-level Table resource caused `begins_with` operand type mismatch. Rewrote to use the high-level `Table.scan()` API with `boto3.dynamodb.conditions.Attr`.
 
 ## [0.5.4]

lib/idp_cli_pkg/idp_cli/cli.py

@@ -459,10 +459,11 @@ def deploy(
                 # Transform
                 headless_template = os.path.join(tmpdir, "idp-headless.yaml")
                 client_tmp = IDPClient(region=region)
+                is_govcloud = region and region.startswith("us-gov-")
                 transform_result = client_tmp.publish.transform_template_headless(
                     source_template=local_template,
                     output_path=headless_template,
-                    update_govcloud_config=True,
+                    update_govcloud_config=is_govcloud,
                 )
                 if not transform_result.success:
                     console.print(

lib/idp_sdk/idp_sdk/_core/template_transform.py

@@ -162,6 +162,23 @@ def __init__(self, verbose: bool = False):
             "DOCUMENTKB",
         }
 
+        self.discovery_resources: Set[str] = {
+            "DiscoveryBucket",
+            "DiscoveryBucketPolicy",
+            "DiscoveryDLQ",
+            "DiscoveryQueue",
+            "DiscoveryTrackingTable",
+            "DiscoveryProcessorFunction",
+            "DiscoveryProcessorFunctionLogGroup",
+            "BlueprintOptimizationFunction",
+            "BlueprintOptimizationFunctionLogGroup",
+            "MultiDocDiscoveryPrepareFunction",
+            "MultiDocDiscoveryPrepareFunctionLogGroup",
+            "MultiDocDiscoveryStateMachine",
+            "MultiDocDiscoveryStateMachineRole",
+            "MULTIDOCDISCOVERYSTACK",
+        }
+
         self.appsync_dependent_resources: Set[str] = {
             "StepFunctionSubscriptionPublisher",
             "StepFunctionSubscriptionPublisherLogGroup",
@@ -206,6 +223,8 @@ def __init__(self, verbose: bool = False):
             "ExternalMCPAgentsSecretConsoleURL",
             "MCPConnectorClientId",
             "MCPConnectorClientSecret",
+            "S3DiscoveryBucketName",
+            "S3DiscoveryBucketConsoleURL",
         }
 
         # ---- Conditions to remove ----
@@ -249,6 +268,7 @@ def all_resources_to_remove(self) -> Set[str]:
             | self.agent_resources
             | self.hitl_resources
             | self.kb_resources
+            | self.discovery_resources
         )
 
     # ---- Public API ----
@@ -729,6 +749,18 @@ def _clean_nested_stack_params(
             del stack_params["AppSyncApiArn"]
             logger.debug(f"Removed AppSyncApiArn parameter from {stack_name}")
 
+        # Remove Discovery-related parameters (resources removed in headless)
+        for param in [
+            "DiscoveryBucket",
+            "DiscoveryTrackingTable",
+            "DiscoveryBucketName",
+            "DiscoveryTrackingTableName",
+            "MultiDocDiscoveryStateMachineArn",
+        ]:
+            if param in stack_params:
+                del stack_params[param]
+                logger.debug(f"Removed {param} parameter from {stack_name}")
+
         # Remove dependencies on GraphQLApi
         stack_deps = resources[stack_name].get("DependsOn", [])
         if isinstance(stack_deps, list) and "GraphQLApi" in stack_deps:
@@ -803,6 +835,12 @@ def _clean_update_settings_values(self, template: Dict[str, Any]) -> None:
             del settings_kvp["AllowedSignUpEmailDomains"]
             logger.debug("Removed AllowedSignUpEmailDomains from UpdateSettingsValues")
 
+        # Remove Discovery-related settings (resources removed in headless)
+        for key in ["DiscoveryBucket"]:
+            if key in settings_kvp:
+                del settings_kvp[key]
+                logger.debug(f"Removed {key} from UpdateSettingsValues")
+
     def _clean_cloudfront_policy_statements(
         self, template: Dict[str, Any]
     ) -> Dict[str, Any]:

lib/idp_sdk/idp_sdk/operations/publish.py

@@ -149,11 +149,13 @@ def build(
 
             # Generate headless template if requested
             if headless:
+                is_govcloud = region and region.startswith("us-gov-")
                 headless_result = self.transform_template_headless(
                     source_template=template_path,
                     output_path=os.path.join(
                         source_dir, ".aws-sam", "idp-headless.yaml"
                     ),
+                    update_govcloud_config=is_govcloud,
                 )
                 if headless_result.success and headless_result.output_path:
                     headless_template_path = headless_result.output_path

template.yaml

@@ -47,6 +47,8 @@ Mappings:
       ConfigPath: "rule-validation"
     rule-extraction:
       ConfigPath: "rule-extraction"
+    lending-package-sample-govcloud:
+      ConfigPath: "lending-package-sample-govcloud"
 
 Parameters:
   # Authorization params
@@ -85,6 +87,7 @@ Parameters:
     Default: "lending-package-sample"
     AllowedValues:
       - "lending-package-sample"
+      - "lending-package-sample-govcloud"
       - "rvl-cdip"
       - "rvl-cdip-with-few-shot-examples"
       - "bank-statement-sample"