fix(cloudformation): apply in-place UpdateStack changes for common resource types (bug-hunt)

[vieiralucas]

Summary

CloudFormation UpdateStack silently discarded property changes for any resource type that had no arm in ResourceProvisioner::update_resource. The _ => None fallback made apply_resource_updates keep the old StackResource and still report UPDATE_COMPLETE, but the change never reached the owning service — so aws cloudformation update-stack / cdk deploy / sam deploy reported success while the resource silently retained its pre-update config (template-vs-live drift).

This adds in-place UPDATE arms for the common, freely-mutable types that were stuck in the silent bucket. Each arm applies the changed properties to the owning service's live state through the same persistence path the create arm / direct API handler uses, so the update actually persists and is reflected by the service's Get/Describe.

Update arms added (moved out of _ => None):

• AWS::SSM::Parameter — Value/Type/Description; rotates the old value into history + bumps version like PutParameter overwrite (GetParameter now returns the new value).
• AWS::Logs::LogGroup — RetentionInDays (+ KmsKeyId, LogGroupClass); omitting retention clears it, matching DeleteRetentionPolicy.
• AWS::Kinesis::Stream — RetentionPeriodHours, StreamMode, ShardCount (reshapes to the target uniform partition).
• AWS::Events::Rule — ScheduleExpression/State/Targets/EventPattern/Description/RoleArn.
• AWS::DynamoDB::Table — BillingMode/ProvisionedThroughput/GSI/OnDemandThroughput/DeletionProtection/TableClass/SSE.
• AWS::SNS::Subscription — FilterPolicy/FilterPolicyScope/RawMessageDelivery/RedrivePolicy/DeliveryPolicy/SubscriptionRoleArn.
• AWS::SecretsManager::Secret — Description/KmsKeyId; a changed SecretString stages a new AWSCURRENT version (demoting the old to AWSPREVIOUS) like PutSecretValue.
• AWS::Cognito::UserPool / AWS::Cognito::UserPoolClient — the update-without-replacement config subset.
• AWS::RDS::DBInstance — the ModifyDBInstance-mutable subset (class, storage, engine version, master password, backup retention, multi-AZ, deletion protection, IOPS, storage type, etc.).

Scope notes (no stubs — every arm really applies + persists):

• Replacement-only properties (key schema, protocol/endpoint on a subscription, secret Name, etc.) are intentionally left untouched — full replacement semantics are out of scope for this PR.
• The _ => None fallback is preserved for types not yet handled.
• Kinesis ShardCount reproduces the resulting open-shard partition, not the fine-grained closed-shard lineage the native UpdateShardCount common-refinement produces (noted in-code).

Docs: website/content/docs/services/cloudformation.md had no per-type update-support list (only a create-time backing list), so a paragraph documenting in-place UpdateStack fidelity was added next to the provisioner description. A one-line export (SsmParameterVersion) was added to fakecloud-ssm's public API so the CFN crate can construct a history entry.

Test plan

• cargo test -p fakecloud-cloudformation — 280 passed (10 new update_stack_applies_* tests, one per newly-handled type: create resource -> update-stack changing a supported property -> assert the owning service's live state reflects the new value).
• cargo build -p fakecloud --tests — clean.
• cargo clippy -p fakecloud-cloudformation -p fakecloud-ssm --all-targets -- -D warnings — clean.
• cargo fmt — applied.
• /code-review (medium) — no correctness bugs; only documented-intent fidelity trade-offs (desired-state handling of omitted Cognito props, SSM history growth, Kinesis reshard data redistribution).

---

Summary by cubic

Fixes UpdateStack silently ignoring property changes by applying in-place updates for common CFN resource types. Updates now persist to each service so their Get/Describe APIs reflect the new config.

• Bug Fixes
  • Added in-place UpdateStack support for: AWS::SSM::Parameter, AWS::Logs::LogGroup, AWS::Kinesis::Stream, AWS::Events::Rule, AWS::DynamoDB::Table, AWS::SNS::Subscription, AWS::SecretsManager::Secret, AWS::Cognito::UserPool, AWS::Cognito::UserPoolClient, AWS::RDS::DBInstance (Kinesis ShardCount reshapes to target open shards).
  • Preserved replacement-only semantics; unhandled types keep the existing fallback.
  • Docs updated to note in-place fidelity; exported SsmParameterVersion from fakecloud-ssm; added focused UpdateStack tests per type.

^{Written for commit 1c73a95. Summary will update on new commits.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.