fix: reject invalid WebFunction and NetworkConnector inputs; Ref the WebFunction for revision and endpoint FunctionName

[seshubaws]

Issue #, if available

Description of changes

Fixes from a bug bash of AWS::Serverless::WebFunction with network connectors. Invalid inputs that crashed the transform, or passed and failed later at deploy, now raise InvalidDocumentException with a clear message.

Crashes

• is_intrinsic() with a non-string single key (intrinsics.py). This was reached from WebFunction EnvironmentVariables, RevisionWeights and ReplicaRegions (for example {1: a}). The helper is shared, so every caller is fixed.
• ReplicaRegions.IncludeRegions / ExcludeRegions that aren't lists. Scalars raised TypeError, and a string gave a misleading "Unknown region key" error.
• Unrecognized ReplicaRegions keys of mixed types (sorted() TypeError).
• Non-string EnvironmentVariables keys and RevisionWeights revision IDs.
• Non-string property names under Properties (Resource.from_dict, affects every SAM resource).
• Non-string Globals section names.
• A null or non-object template (Parser.validate_datatypes).

WebFunction EgressNetworkConnectorArn

• A Ref or Fn::GetAtt on a network connector in the same template must use LatestVersionArn. Ref and Arn return the unversioned ARN, which only failed at deploy, and other attributes were accepted silently. The error points to !GetAtt <Connector>.LatestVersionArn.
• Non-string literals (for example an integer) are rejected. The error now includes the expected ARN format and the value given.

NetworkConnector error messages

• Invalid ComputeTypes entries (for example [5]) and VpcConfig.NetworkProtocol values (IPv6, ipv4, 4) now list the allowed values instead of "value is not a valid dict".

bin/sam-translate.py

• Exits 1 on an invalid template, and no longer logs a generator object.

WebFunction revision and endpoint FunctionName (partially reverts an earlier workaround)

• The revision and endpoint now always Ref the AWS::Lambda::WebFunction (its ARN), even when FunctionName is set, like AWS::Lambda::Version does. Renaming the function in a template then only changes the WebFunction, and the revision and endpoint follow.
• The earlier code repeated the name in all three resources to work around a service bug where an ARN FunctionName could be created but not deleted. That bug is fixed.
• The AuthType casing fix and the name runtime attribute from the workaround are unchanged.
• The FunctionName description in sam-docs.json now says the revision and endpoint use Ref.

Not changed: checking that a referenced connector's ComputeTypes includes WebFunction, empty SubnetIds/SecurityGroupIds, the $LATEST qualifier, whole-list !Ref for list properties, ComputeTypes in Globals, and the recursion limit on self-referencing YAML aliases or very deep intrinsics.

Description of how you validated changes

• New error tests: error_webfunction_egress_network_connector_reference, error_webfunction_invalid_property_types, error_network_connector_non_string_compute_type, error_globals_non_string_section. Updated error_network_connector_invalid_protocol. Added unit tests for is_intrinsic, the parser, and valid and invalid connector references (Ref, Arn, unknown attributes).
• pytest tests: 4809 passed, 95.5% coverage.
• Deployed with the public AWS::Lambda::WebFunction* types in us-east-2:
  • Without FunctionName: create, update with new code (revision replaced) and stack delete all succeeded.
  • With FunctionName: create, then renaming only FunctionName replaced the function, revision and endpoint and deleted the old ones, then stack delete succeeded. black, ruff, mypy --strict, the JSON and YAML format checks, and the schema gate pass.

Checklist

• Review the generative AI contribution guidelines
• Adheres to the development guidelines
• Add/update transform tests
  • Using correct values
  • Using wrong values
• Add/update integration tests

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[aws-sam-tooling-bot]

Code Review Results

Reviewed: a130d8b..2c794f8
Files: 28
Comments: 1