Remove SAM translator dependency, validate SAM templates via schemas

Replace the aws-sam-translator runtime dependency with direct JSON Schema
validation of SAM resource types. SAM templates are now validated against
schemas from the enhanced schemas service using the same provider schema
infrastructure as CloudFormation resources.

- Remove _sam.py transform module and aws-sam-translator dependency
- Add _sam_globals.py to merge Globals section into SAM resources
- Add E3724 rule for Globals section validation
- Add E3066 rule for SAM resource attributes (Connectors, IgnoreGlobals)
- Extend Lambda rules to also match AWS::Serverless::Function paths
- Treat SAM resources as module-like for sub-resource Ref/GetAtt wildcard
- Handle unresolvable schema pointers gracefully in GetAtt validation
- Inject SAM implicit resources (roles, versions, aliases, stages, etc.)

Fixes #4556

Author: kddejong

.github/workflows/maintenance-v1.yaml

@@ -20,16 +20,13 @@ jobs:
           python-version: 3.13
       - id: maintenance
         run: |
-          latest_sam_cli=`curl -s https://api.github.com/repos/aws/aws-sam-cli/releases/latest | jq -r .tag_name | cut -c 2-`
-          latest=`curl "https://pypi.org/pypi/aws-sam-cli/$latest_sam_cli/json" -s | jq -r '.info.requires_dist[] | select(contains("aws-sam-translator"))' | cut -c 21-`
-          sed -i -E "s/aws-sam-translator>=[0-9.]+/aws-sam-translator>=$latest/" requirements/base.txt
           pip install -e .
+          pip install -r requirements/dev.txt
           cfn-lint --update-iam-policies
           cfn-lint --update-specs --force
           scripts/update_specs_from_pricing.py
           scripts/update_schemas_from_aws_api.py
           cfn-lint --update-documentation
-          scripts/update_serverless_aws_policies.py
           echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

pyproject.toml

@@ -183,10 +183,6 @@ ignore_missing_imports = true
 module = "importlib_resources.*"
 ignore_missing_imports = true
 
-[[tool.mypy.overrides]]
-module = "samtranslator.*"
-ignore_missing_imports = true
-
 [[tool.mypy.overrides]]
 module = "sarif_om.*"
 ignore_missing_imports = true

requirements/base.txt

@@ -1,5 +1,4 @@
 pyyaml>=6.0.3
-aws-sam-translator>=1.111.0
 jsonpatch
 networkx>=2.4,<4
 sympy>=1.14.0

requirements/dev.txt

@@ -3,3 +3,4 @@ coverage>=7.2.1
 coverage[toml]
 pydot
 defusedxml
+boto3

scripts/update_serverless_aws_policies.py

@@ -198,6 +198,7 @@ def module_names(self) -> tuple[str, ...]:
             name
             for name, resource in self.resources.items()
             if resource.type.endswith("::MODULE")
+            or resource.type.startswith("AWS::Serverless::")
         )
 
     def evolve(self, **kwargs) -> "Context":
@@ -577,6 +578,136 @@ def _init_transforms(transforms: Any) -> Transforms:
     return Transforms([])
 
 
+def _inject(
+    resources: dict[str, Resource], logical_id: str, resource_type: str
+) -> None:
+    """Add a synthetic resource if it doesn't already exist."""
+    if logical_id not in resources:
+        try:
+            resources[logical_id] = Resource({"Type": resource_type})
+        except ValueError:
+            pass
+
+
+def _inject_sam_implicit_resources(
+    template_resources: Any, resources: dict[str, Resource]
+) -> None:
+    """Add synthetic resources for SAM implicit APIs and generated roles.
+
+    SAM auto-generates these when Functions have Api/HttpApi events
+    without explicit RestApiId/ApiId references, and IAM Roles when
+    no explicit Role property is set.
+    """
+    if not isinstance(template_resources, dict):
+        return
+
+    needs_rest_api = False
+    needs_http_api = False
+
+    for resource_id, resource in template_resources.items():
+        if not isinstance(resource, dict):
+            continue
+        resource_type = resource.get("Type")
+        props = resource.get("Properties", {})
+        if not isinstance(props, dict):
+            props = {}
+
+        # SAM Functions/StateMachines without explicit Role get a generated Role
+        if resource_type in (
+            "AWS::Serverless::Function",
+            "AWS::Serverless::StateMachine",
+        ):
+            if "Role" not in props:
+                _inject(resources, f"{resource_id}Role", "AWS::IAM::Role")
+
+        if resource_type == "AWS::Serverless::Function":
+            # Version/Alias when AutoPublishAlias or DeploymentPreference
+            has_alias = "AutoPublishAlias" in props or "DeploymentPreference" in props
+            if has_alias:
+                for suffix, rtype in (
+                    (f"{resource_id}.Version", "AWS::Lambda::Version"),
+                    (f"{resource_id}.Alias", "AWS::Lambda::Alias"),
+                ):
+                    if suffix not in resources:
+                        try:
+                            resources[suffix] = Resource({"Type": rtype})
+                        except ValueError:
+                            pass
+
+            # Url when FunctionUrlConfig is set
+            if "FunctionUrlConfig" in props:
+                _inject(resources, f"{resource_id}Url", "AWS::Lambda::Url")
+
+            # DeploymentPreference generates CodeDeploy resources
+            dp = props.get("DeploymentPreference", {})
+            if isinstance(dp, dict) and dp.get("Enabled", True):
+                _inject(
+                    resources,
+                    "ServerlessDeploymentApplication",
+                    "AWS::CodeDeploy::Application",
+                )
+                _inject(
+                    resources,
+                    f"{resource_id}DeploymentGroup",
+                    "AWS::CodeDeploy::DeploymentGroup",
+                )
+                if "Role" not in dp:
+                    _inject(resources, "CodeDeployServiceRole", "AWS::IAM::Role")
+
+            # Per-event permissions and implicit API detection
+            events = props.get("Events", {})
+            if isinstance(events, dict):
+                for event_name, event in events.items():
+                    if not isinstance(event, dict):
+                        continue
+                    _inject(
+                        resources,
+                        f"{resource_id}{event_name}Permission",
+                        "AWS::Lambda::Permission",
+                    )
+                    event_type = event.get("Type")
+                    if event_type == "Api":
+                        event_props = event.get("Properties", {})
+                        if (
+                            not isinstance(event_props, dict)
+                            or "RestApiId" not in event_props
+                        ):
+                            needs_rest_api = True
+                    elif event_type == "HttpApi":
+                        event_props = event.get("Properties", {})
+                        if (
+                            not isinstance(event_props, dict)
+                            or "ApiId" not in event_props
+                        ):
+                            needs_http_api = True
+
+        if resource_type == "AWS::Serverless::Api":
+            _inject(resources, f"{resource_id}Stage", "AWS::ApiGateway::Stage")
+            if "Domain" in props:
+                _inject(
+                    resources,
+                    f"{resource_id}DomainName",
+                    "AWS::ApiGateway::DomainName",
+                )
+            if "Auth" in props:
+                _inject(
+                    resources,
+                    f"{resource_id}UsagePlan",
+                    "AWS::ApiGateway::UsagePlan",
+                )
+
+        if resource_type == "AWS::Serverless::HttpApi":
+            _inject(resources, f"{resource_id}Stage", "AWS::ApiGatewayV2::Stage")
+
+    if needs_rest_api:
+        _inject(resources, "ServerlessRestApi", "AWS::Serverless::Api")
+        _inject(resources, "ServerlessRestApiStage", "AWS::ApiGateway::Stage")
+
+    if needs_http_api:
+        _inject(resources, "ServerlessHttpApi", "AWS::Serverless::HttpApi")
+        _inject(resources, "ServerlessHttpApiStage", "AWS::ApiGatewayV2::Stage")
+
+
 def create_context_for_template(
     cfn: Template,
 ) -> "Context":
@@ -592,6 +723,13 @@ def create_context_for_template(
     except (ValueError, AttributeError):
         pass
 
+    # Inject synthetic resources for SAM implicit APIs.
+    # When a SAM Function has an Api event without an explicit RestApiId,
+    # SAM generates "ServerlessRestApi" (AWS::Serverless::Api).
+    # Similarly for HttpApi events -> "ServerlessHttpApi".
+    if cfn.has_serverless_transform():
+        _inject_sam_implicit_resources(cfn.template.get("Resources", {}), resources)
+
     transforms = _init_transforms(cfn.template.get("Transform", []))
 
     try: