fix(glue): rename the Crawler DynamoDB scan members and the Iceberg table input to their SDK spellings

Both providers forwarded a CFn blob raw where the SDK model diverges, and the
AWS SDK v3 serializer drops unknown members, so the values silently never
reached AWS while the call reported success.

Crawler (#1391): the SDK DynamoDBTarget is a lowercase island in an otherwise
PascalCase model -- Path is PascalCase but the scan-tuning members are scanAll
and scanRate, while CFn spells them ScanAll / ScanRate. The target itself
survived (matched by Path); only the scan tuning was lost. Converted on create
and update, with the inverse applied in readCurrentState so drift no longer
reports a phantom ScanRate removal plus scanRate addition. The other seven
CrawlerTargets sub-types were audited against the SDK model and match CFn
key-for-key (MongoDBTarget.ScanAll IS PascalCase) -- recorded in a comment so
the audit is not repeated.

Table (#1390): CFn OpenTableFormatInput.IcebergInput.IcebergTableInput is the
SDK's IcebergInput.CreateIcebergTableInput, so the entire Iceberg table spec
(Location / Schema / PartitionSpec / WriteOrder / Properties) was discarded.
The renamed object's own members match CFn 1:1, so a single key rename suffices.
The stale "maps 1:1 to the SDK type (same PascalCase)" comment is corrected, as
is the vague UpdateTable claim next to it: UpdateTableRequest has no
OpenTableFormatInput member at all; it carries the different, update-only
UpdateOpenTableFormatInput shape that CFn does not model.

Closes #1391
Closes #1390

Author: go-to-k

src/provisioning/providers/glue-provider.ts

@@ -370,13 +370,16 @@ export class GlueProvider implements ResourceProvider {
 
     // `OpenTableFormatInput` (Apache Iceberg) is a top-level `CreateTableCommand`
     // param — a SIBLING of `TableInput`, NOT nested inside it. The CFn shape
-    // (`{ IcebergInput: { MetadataOperation, Version } }`) maps 1:1 to the SDK
-    // `OpenTableFormatInput` type (same PascalCase). Omit when absent.
+    // matches the SDK `OpenTableFormatInput` type key-for-key EXCEPT for
+    // `IcebergInput.IcebergTableInput`, which cdkd renames — see
+    // {@link toSdkOpenTableFormatInput}. Omit when absent.
     // Iceberg's `MetadataOperation: 'CREATE'` is a create-time directive, so it
-    // is intentionally wired on create only — `UpdateTableCommandInput` does not
-    // accept `OpenTableFormatInput` (verified against @aws-sdk/client-glue).
+    // is intentionally wired on create only — `UpdateTableCommandInput` has no
+    // `OpenTableFormatInput` member at all (it carries the different,
+    // update-only `UpdateOpenTableFormatInput` shape, which CFn does not model;
+    // verified against @aws-sdk/client-glue `UpdateTableRequest`).
     const openTableFormatInput = properties['OpenTableFormatInput'] as
-      | OpenTableFormatInput
+      | Record<string, unknown>
       | undefined;
 
     try {
@@ -386,7 +389,7 @@ export class GlueProvider implements ResourceProvider {
           DatabaseName: databaseName,
           TableInput: this.buildTableInput(tableInput, tableName),
           ...(openTableFormatInput !== undefined && {
-            OpenTableFormatInput: openTableFormatInput,
+            OpenTableFormatInput: toSdkOpenTableFormatInput(openTableFormatInput),
           }),
         })
       );
@@ -1434,6 +1437,39 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * Convert the CFn `AWS::Glue::Table.OpenTableFormatInput` blob to the SDK
+ * `OpenTableFormatInput` shape.
+ *
+ * Every key matches the SDK model except one: CFn's
+ * `IcebergInput.IcebergTableInput` is the SDK's
+ * `IcebergInput.CreateIcebergTableInput` (@aws-sdk/client-glue `models_1.d.ts`
+ * `IcebergInput`). The AWS SDK v3 serializer drops unknown members, so leaving
+ * the CFn spelling in place silently discarded the ENTIRE Iceberg table spec
+ * (`Location` / `Schema` / `PartitionSpec` / `WriteOrder` / `Properties`) while
+ * `CreateTable` still reported success. The renamed object's own members match
+ * CFn 1:1, so this is a single key rename.
+ *
+ * Non-object inputs (an unresolved intrinsic) pass through untouched so AWS
+ * surfaces the real validation error.
+ */
+function toSdkOpenTableFormatInput(input: Record<string, unknown>): OpenTableFormatInput {
+  const iceberg = input['IcebergInput'];
+  if (
+    typeof iceberg !== 'object' ||
+    iceberg === null ||
+    Array.isArray(iceberg) ||
+    !('IcebergTableInput' in iceberg)
+  ) {
+    return input as OpenTableFormatInput;
+  }
+  const { IcebergTableInput: icebergTableInput, ...rest } = iceberg as Record<string, unknown>;
+  return {
+    ...input,
+    IcebergInput: { ...rest, CreateIcebergTableInput: icebergTableInput },
+  } as OpenTableFormatInput;
+}
+
 /**
  * Build the SDK `EncryptionConfiguration` from the CFn-shape input
  * (`AWS::Glue::SecurityConfiguration.EncryptionConfiguration`). Each
@@ -2127,7 +2163,7 @@ export class GlueCrawlerProvider implements ResourceProvider {
         new CreateCrawlerCommand({
           Name: name,
           Role: role,
-          Targets: targets as CrawlerTargets,
+          Targets: toSdkCrawlerTargets(targets),
           ...buildCrawlerCommonFields(properties),
           ...(tags && { Tags: tags }),
         })
@@ -2159,7 +2195,7 @@ export class GlueCrawlerProvider implements ResourceProvider {
         Name: physicalId,
         ...(properties['Role'] !== undefined && { Role: properties['Role'] as string }),
         ...(properties['Targets'] !== undefined && {
-          Targets: properties['Targets'] as CrawlerTargets,
+          Targets: toSdkCrawlerTargets(properties['Targets'] as Record<string, unknown>),
         }),
         ...buildCrawlerCommonFields(properties),
       };
@@ -2303,7 +2339,11 @@ export class GlueCrawlerProvider implements ResourceProvider {
     const result: Record<string, unknown> = {
       Name: crawler.Name ?? physicalId,
       Role: crawler.Role ?? '',
-      Targets: crawler.Targets ? pickDefined(crawler.Targets as Record<string, unknown>) : {},
+      // SDK `DynamoDBTarget.{scanAll,scanRate}` -> the CFn `ScanAll` / `ScanRate`
+      // spelling recorded in state, so drift compares like with like.
+      Targets: crawler.Targets
+        ? toCfnCrawlerTargets(pickDefined(crawler.Targets as Record<string, unknown>))
+        : {},
       DatabaseName: crawler.DatabaseName ?? '',
       Description: crawler.Description ?? '',
       // CFn `Schedule` is the structured wrapper; reverse-map from the
@@ -2441,6 +2481,78 @@ function buildCrawlerCommonFields(p: Record<string, unknown>): Record<string, un
   return r;
 }
 
+/**
+ * CFn -> SDK key renames for `Targets.DynamoDBTargets[]`.
+ *
+ * The SDK's `DynamoDBTarget` is a lowercase island in an otherwise-PascalCase
+ * model: `Path` is PascalCase but the scan-tuning members are `scanAll` /
+ * `scanRate` (@aws-sdk/client-glue `models_0.d.ts` `DynamoDBTarget`), while CFn
+ * spells them `ScanAll` / `ScanRate`. The AWS SDK v3 serializer drops unknown
+ * members, so forwarding the CFn spelling silently loses the scan tuning while
+ * the target itself (matched by `Path`) still reaches AWS. Every other
+ * `CrawlerTargets` sub-type (`S3Target` / `JdbcTarget` / `MongoDBTarget` —
+ * whose own `ScanAll` IS PascalCase — `CatalogTarget` / `DeltaTarget` /
+ * `IcebergTarget` / `HudiTarget`) spells every member exactly as CFn does.
+ */
+const CFN_TO_SDK_DYNAMODB_TARGET_KEYS: Record<string, string> = {
+  ScanAll: 'scanAll',
+  ScanRate: 'scanRate',
+};
+
+const SDK_TO_CFN_DYNAMODB_TARGET_KEYS: Record<string, string> = {
+  scanAll: 'ScanAll',
+  scanRate: 'ScanRate',
+};
+
+/**
+ * Shallow-rename an object's keys per `renames`, leaving unlisted keys — and
+ * non-object values (an unresolved intrinsic) — untouched.
+ */
+function renameRecordKeys(entry: unknown, renames: Record<string, string>): unknown {
+  if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) return entry;
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(entry as Record<string, unknown>)) {
+    out[renames[k] ?? k] = v;
+  }
+  return out;
+}
+
+/**
+ * Apply `renames` to every element of `targets[key]` when that entry is an
+ * array, returning the original object untouched otherwise so a non-array value
+ * reaches AWS verbatim and surfaces the real validation error.
+ */
+function renameCrawlerTargetList(
+  targets: Record<string, unknown>,
+  key: string,
+  renames: Record<string, string>
+): Record<string, unknown> {
+  const list = targets[key];
+  if (!Array.isArray(list)) return targets;
+  return { ...targets, [key]: list.map((entry) => renameRecordKeys(entry, renames)) };
+}
+
+/**
+ * Convert the CFn `AWS::Glue::Crawler.Targets` blob to the SDK `CrawlerTargets`
+ * shape — see {@link CFN_TO_SDK_DYNAMODB_TARGET_KEYS} for the one divergence.
+ */
+function toSdkCrawlerTargets(targets: Record<string, unknown>): CrawlerTargets {
+  return renameCrawlerTargetList(
+    targets,
+    'DynamoDBTargets',
+    CFN_TO_SDK_DYNAMODB_TARGET_KEYS
+  ) as CrawlerTargets;
+}
+
+/**
+ * Inverse of {@link toSdkCrawlerTargets}: re-shape a `GetCrawler` `Targets`
+ * blob back into the CFn spelling so `cdkd drift` compares like with like
+ * instead of reporting a phantom `ScanRate` removal + `scanRate` addition.
+ */
+function toCfnCrawlerTargets(targets: Record<string, unknown>): Record<string, unknown> {
+  return renameCrawlerTargetList(targets, 'DynamoDBTargets', SDK_TO_CFN_DYNAMODB_TARGET_KEYS);
+}
+
 /**
  * SDK Provider for `AWS::Glue::Connection`.
  *

tests/unit/provisioning/glue-crawler-roundtrip.test.ts

@@ -112,6 +112,33 @@ describe('GlueCrawlerProvider', () => {
     expect(call![0].input).toMatchObject({ Schedule: 'cron(0 0 * * ? *)' });
   });
 
+  it('create() lower-cases DynamoDBTargets ScanAll / ScanRate for the SDK (#1391)', async () => {
+    // The SDK's DynamoDBTarget is a lowercase island: `Path` is PascalCase but
+    // the scan-tuning members are `scanAll` / `scanRate`. Forwarding the CFn
+    // spelling silently dropped both (the target itself survived via `Path`).
+    await provider.create('L', 'AWS::Glue::Crawler', {
+      Name: 'my-crawler',
+      Role: 'arn:aws:iam::123456789012:role/GlueCrawlerRole',
+      Targets: {
+        DynamoDBTargets: [
+          { Path: 'my-table', ScanAll: true, ScanRate: 0.5 },
+          { Path: 'other-table' },
+        ],
+        // Sibling sub-types spell every member exactly as CFn does — including
+        // MongoDBTarget's own PascalCase `ScanAll` — so they pass through.
+        S3Targets: [{ Path: 's3://my-bucket/data' }],
+        MongoDBTargets: [{ ConnectionName: 'mongo', Path: 'db/coll', ScanAll: true }],
+      },
+    });
+
+    const call = mockSend.mock.calls.find((c) => c[0] instanceof CreateCrawlerCommand);
+    expect(call![0].input.Targets).toEqual({
+      DynamoDBTargets: [{ Path: 'my-table', scanAll: true, scanRate: 0.5 }, { Path: 'other-table' }],
+      S3Targets: [{ Path: 's3://my-bucket/data' }],
+      MongoDBTargets: [{ ConnectionName: 'mongo', Path: 'db/coll', ScanAll: true }],
+    });
+  });
+
   it('create() fails when Role is missing', async () => {
     await expect(
       provider.create('L', 'AWS::Glue::Crawler', {
@@ -157,6 +184,23 @@ describe('GlueCrawlerProvider', () => {
     });
   });
 
+  it('update() lower-cases DynamoDBTargets ScanAll / ScanRate for the SDK (#1391)', async () => {
+    await provider.update(
+      'L',
+      'my-crawler',
+      'AWS::Glue::Crawler',
+      {
+        Targets: { DynamoDBTargets: [{ Path: 'my-table', ScanAll: false, ScanRate: 1.5 }] },
+      },
+      {}
+    );
+
+    const call = mockSend.mock.calls.find((c) => c[0] instanceof UpdateCrawlerCommand);
+    expect(call![0].input.Targets).toEqual({
+      DynamoDBTargets: [{ Path: 'my-table', scanAll: false, scanRate: 1.5 }],
+    });
+  });
+
   it('update() reconciles Tag diff via TagResource + UntagResource when tags change', async () => {
     await provider.update(
       'L',
@@ -302,6 +346,36 @@ describe('GlueCrawlerProvider', () => {
     });
   });
 
+  it('readCurrentState() reverse-maps SDK DynamoDBTargets scanAll / scanRate to the CFn spelling (#1391)', async () => {
+    mockSend.mockImplementation((cmd) => {
+      if (cmd instanceof GetCrawlerCommand) {
+        return Promise.resolve({
+          Crawler: {
+            Name: 'my-crawler',
+            Targets: {
+              DynamoDBTargets: [{ Path: 'my-table', scanAll: true, scanRate: 0.5 }],
+              S3Targets: [{ Path: 's3://my-bucket/data' }],
+            },
+          },
+        });
+      }
+      if (cmd instanceof GetTagsCommand) {
+        return Promise.resolve({ Tags: {} });
+      }
+      return Promise.resolve({});
+    });
+
+    const result = await provider.readCurrentState('my-crawler', 'L', 'AWS::Glue::Crawler');
+    // Without the reverse map the state-recorded PascalCase keys would read as
+    // removed and the SDK's lowercase keys as added — phantom drift on every run.
+    expect(result).toMatchObject({
+      Targets: {
+        DynamoDBTargets: [{ Path: 'my-table', ScanAll: true, ScanRate: 0.5 }],
+        S3Targets: [{ Path: 's3://my-bucket/data' }],
+      },
+    });
+  });
+
   it('readCurrentState() returns undefined when crawler does not exist', async () => {
     const { EntityNotFoundException } = await import('@aws-sdk/client-glue');
     mockSend.mockRejectedValueOnce(

tests/unit/provisioning/glue-provider-roundtrip.test.ts

@@ -293,6 +293,66 @@ describe('GlueProvider read-update round-trip', () => {
     expect(input.TableInput.Name).toBe('events_iceberg');
   });
 
+  it('AWS::Glue::Table — create() renames IcebergInput.IcebergTableInput to the SDK CreateIcebergTableInput (#1390)', async () => {
+    // CFn spells the nested table spec `IcebergTableInput`; the SDK's
+    // `IcebergInput` member is `CreateIcebergTableInput`. The SDK serializer
+    // drops unknown members, so without the rename the whole Iceberg table
+    // spec vanished while CreateTable still reported success.
+    mockSend.mockResolvedValueOnce({});
+
+    const icebergTableInput = {
+      Location: 's3://b/iceberg/events/',
+      Schema: {
+        Fields: [{ Id: 1, Name: 'event_id', Type: 'string', Required: true }],
+        IdentifierFieldIds: [1],
+      },
+      PartitionSpec: {
+        Fields: [{ SourceId: 1, Transform: 'identity', Name: 'event_id' }],
+      },
+      Properties: { 'write.format.default': 'parquet' },
+    };
+
+    await provider.create('L', 'AWS::Glue::Table', {
+      DatabaseName: 'mydb',
+      OpenTableFormatInput: {
+        IcebergInput: {
+          MetadataOperation: 'CREATE',
+          Version: '2',
+          IcebergTableInput: icebergTableInput,
+        },
+      },
+      TableInput: { Name: 'events_iceberg', TableType: 'EXTERNAL_TABLE' },
+    });
+
+    const createCall = mockSend.mock.calls.find((c) => c[0] instanceof CreateTableCommand);
+    const input = createCall![0].input as { OpenTableFormatInput: Record<string, unknown> };
+    expect(input.OpenTableFormatInput).toEqual({
+      IcebergInput: {
+        MetadataOperation: 'CREATE',
+        Version: '2',
+        // Renamed key; the nested members match CFn 1:1 and stay untouched.
+        CreateIcebergTableInput: icebergTableInput,
+      },
+    });
+    expect('IcebergTableInput' in (input.OpenTableFormatInput['IcebergInput'] as object)).toBe(
+      false
+    );
+  });
+
+  it('AWS::Glue::Table — create() leaves an IcebergInput without IcebergTableInput untouched', async () => {
+    mockSend.mockResolvedValueOnce({});
+
+    await provider.create('L', 'AWS::Glue::Table', {
+      DatabaseName: 'mydb',
+      OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } },
+      TableInput: { Name: 'events_iceberg' },
+    });
+
+    const createCall = mockSend.mock.calls.find((c) => c[0] instanceof CreateTableCommand);
+    const input = createCall![0].input as { OpenTableFormatInput: Record<string, unknown> };
+    expect(input.OpenTableFormatInput).toEqual({ IcebergInput: { MetadataOperation: 'CREATE' } });
+  });
+
   it('AWS::Glue::Table — create() omits OpenTableFormatInput when absent (omit-when-absent)', async () => {
     mockSend.mockResolvedValueOnce({});