🐛 Fix SageMaker resource bugs; replace vpcSecurityGroups/vpcSubnets with vpc reference

- Replace vpcSecurityGroups/vpcSubnets typed lists with single vpc() aws.vpc
  reference on model, trainingJob, processingJob, and cluster resources
- Deprecate vpcConfig() dict fields in favor of vpc() reference
- Add init functions for domain and modelPackageGroup to fix cross-reference
  resolution from space, userProfile, and modelPackage resources
- Add missing tag filtering to getUserProfiles (was silently skipping filters)
- Remove privatePrimaryIp from clusterNode (not available from ListClusterNodes API)
- Fix cached errors becoming permanent in fetchDetails for cluster, featureGroup,
  modelPackage, modelPackageGroup, modelCard, space, and userProfile
- Bump provider version to 13.12.0
- Remove KSK and kustomize from spell check expect.txt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tas50

.github/actions/spelling/expect.txt

@@ -145,9 +145,7 @@ kerberoastable
 keyspace
 kqueue
 krbtgt
-KSK
 kustomization
-kustomize
 kubenet
 labelmatchstatement
 launchconfiguration

providers/aws/config/config.go

@@ -14,7 +14,7 @@ import (
 var Config = plugin.Provider{
 	Name:            "aws",
 	ID:              "go.mondoo.com/cnquery/v9/providers/aws",
-	Version:         "13.10.1",
+	Version:         "13.12.0",
 	ConnectionTypes: []string{provider.DefaultConnectionType, string(awsec2ebsconn.EBSConnectionType)},
 	Connectors: []plugin.Connector{
 		{

providers/aws/go.mod

@@ -79,7 +79,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/route53domains v1.34.19
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0
 	github.com/aws/aws-sdk-go-v2/service/s3control v1.69.0
-	github.com/aws/aws-sdk-go-v2/service/sagemaker v1.238.0
+	github.com/aws/aws-sdk-go-v2/service/sagemaker v1.239.0
 	github.com/aws/aws-sdk-go-v2/service/scheduler v1.17.22
 	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.5
 	github.com/aws/aws-sdk-go-v2/service/securityhub v1.68.3

providers/aws/go.sum

@@ -317,8 +317,8 @@ github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 h1:hlSuz394kV0vhv9drL5lhuEFbEOEP
 github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
 github.com/aws/aws-sdk-go-v2/service/s3control v1.69.0 h1:rJNPSXP9gjaHz+OCnmeYCpk28AJefgIHv52re9uHVok=
 github.com/aws/aws-sdk-go-v2/service/s3control v1.69.0/go.mod h1:uaFd207QRYURS41DhU0riuwnVm/EMKA1FDt9dvsvUUY=
-github.com/aws/aws-sdk-go-v2/service/sagemaker v1.238.0 h1:5jLvLVu20tlFgVOsX+ns4jNVzoUWP36AQc5sAvNJSMI=
-github.com/aws/aws-sdk-go-v2/service/sagemaker v1.238.0/go.mod h1:zsRrjJIfG9a9b3VRU+uPa3dX5fqgI+zKMXD4tbIlbdA=
+github.com/aws/aws-sdk-go-v2/service/sagemaker v1.239.0 h1:aIM4M5eVgODEoSmaUa7jT4PtI2HwsqSElVory6ug+ZM=
+github.com/aws/aws-sdk-go-v2/service/sagemaker v1.239.0/go.mod h1:zsRrjJIfG9a9b3VRU+uPa3dX5fqgI+zKMXD4tbIlbdA=
 github.com/aws/aws-sdk-go-v2/service/scheduler v1.17.22 h1:W6iJpVVBijigufAXBm8f9xoG8YvpKZv+rQaUC0bT4Tc=
 github.com/aws/aws-sdk-go-v2/service/scheduler v1.17.22/go.mod h1:bIL40EgncO7wiyLB3Od2CkxEbU/REwG16lncm7jGqNA=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.5 h1:z2ayoK3pOvf8ODj/vPR0FgAS5ONruBq0F94SRoW/BIU=

providers/aws/resources/aws.lr

@@ -1753,12 +1753,10 @@ private aws.sagemaker.model @defaults("arn name") {
   iamRole() aws.iam.role
   // Primary container definition
   primaryContainer() dict
-  // VPC configuration
+  // Deprecated: Use vpc instead. Raw VPC configuration dict
   vpcConfig() dict
-  // VPC security groups from VPC configuration
-  vpcSecurityGroups() []aws.ec2.securitygroup
-  // VPC subnets from VPC configuration
-  vpcSubnets() []aws.vpc.subnet
+  // VPC associated with this model
+  vpc() aws.vpc
 }
 
 // AWS SageMaker training job
@@ -1793,12 +1791,10 @@ private aws.sagemaker.trainingjob @defaults("arn name status") {
   failureReason() string
   // Billable time in seconds
   billableTimeInSeconds() int
-  // VPC configuration
+  // Deprecated: Use vpc instead. Raw VPC configuration dict
   vpcConfig() dict
-  // VPC security groups from VPC configuration
-  vpcSecurityGroups() []aws.ec2.securitygroup
-  // VPC subnets from VPC configuration
-  vpcSubnets() []aws.vpc.subnet
+  // VPC associated with this training job
+  vpc() aws.vpc
   // Output data configuration
   outputDataConfig() dict
   // Resource configuration (instanceType, instanceCount, volumeSizeInGB)
@@ -1835,12 +1831,10 @@ private aws.sagemaker.processingjob @defaults("arn name status") {
   enableNetworkIsolation() bool
   // Whether inter-container traffic encryption is enabled
   enableInterContainerTrafficEncryption() bool
-  // VPC configuration
+  // Deprecated: Use vpc instead. Raw VPC configuration dict
   vpcConfig() dict
-  // VPC security groups from VPC configuration
-  vpcSecurityGroups() []aws.ec2.securitygroup
-  // VPC subnets from VPC configuration
-  vpcSubnets() []aws.vpc.subnet
+  // VPC associated with this processing job
+  vpc() aws.vpc
   // Processing resources configuration
   processingResources() dict
   // Environment variables
@@ -1981,12 +1975,10 @@ private aws.sagemaker.cluster @defaults("arn name status") {
   instanceGroups() []dict
   // Orchestrator type (EKS or Slurm configuration)
   orchestrator() dict
-  // VPC configuration (security groups and subnets)
+  // Deprecated: Use vpc instead. Raw VPC configuration dict
   vpcConfig() dict
-  // VPC security groups from VPC configuration
-  vpcSecurityGroups() []aws.ec2.securitygroup
-  // VPC subnets from VPC configuration
-  vpcSubnets() []aws.vpc.subnet
+  // VPC associated with this cluster
+  vpc() aws.vpc
   // Node recovery mode
   nodeRecovery() string
   // Node provisioning mode
@@ -2013,8 +2005,6 @@ private aws.sagemaker.clusterNode @defaults("instanceId instanceGroupName instan
   launchTime time
   // Private DNS hostname of the node
   privateDnsHostname string
-  // Private primary IP address
-  privatePrimaryIp string
   // Region where the node exists
   region string
 }