second first commit

2026-09-22 08:57:00 -04:00
parent e88d7e2ff3
commit 0aef7fb2d8
4766 changed files with 1236986 additions and 0 deletions
@@ -0,0 +1,69 @@
+# Registry for the service-matrix presence check (tools/docs/check_service_matrix.py).
+#
+# Every descriptor("externalKey", "configKey", ...) registered in
+# core/common/ResolvedServiceCatalog.java must resolve to a row in the Service Matrix
+# table in docs/services/index.md, keyed by the .md filename its row links to (no
+# extension, no #anchor). A key resolves one of three ways:
+#
+#   1. exact match  - externalKey literally equals a documented filename. No entry
+#                      needed in this file; most services work this way.
+#   2. aliases       - externalKey differs from the filename that documents it, because
+#                      it's an AWS SigV4 signing-name quirk (`kafka` -> msk.md) or a
+#                      facet folded into another service's page (`ec2messages` -> ssm.md).
+#   3. deferred      - genuinely undocumented today, tracked with a reason. A NEW
+#                      descriptor key that is neither an exact match, an alias target,
+#                      nor listed here fails `check_service_matrix.py --strict`.
+#
+# The reverse direction is checked too: every docs/services/*.md page must be linked
+# from a matrix row unless its slug is listed under `facet_pages:` (a page that
+# documents a facet of another service and deliberately has no row of its own).
+
+aliases:
+  apigateway: api-gateway               # "API Gateway v1" row title
+  apigatewayv2: api-gateway             # v2 facet, documented at api-gateway.md#v2
+  aps: managed-prometheus               # AMP's SigV4 signing name is "aps"
+  kafka: msk                            # MSK's SigV4 signing name is "kafka"
+  mq: amazonmq                          # Amazon MQ's SigV4 signing name is "mq"
+  signin: iam                           # AWS Sign-In facet, at iam.md#aws-sign-in-login-credentials
+  sso: ssoadmin                         # descriptor("sso") is the Identity Center admin API; ssoadmin.md is its page
+  sso-oidc: ssooidc                     # IAM Identity Center OIDC REST API
+  events: eventbridge
+  servicediscovery: cloudmap            # Cloud Map's SigV4 signing name
+  elasticmapreduce: emr                 # EMR's SigV4 signing name
+  logs: cloudwatch                      # CloudWatch Logs facet, at cloudwatch.md
+  monitoring: cloudwatch                # CloudWatch Metrics facet, at cloudwatch.md#metrics
+  secretsmanager: secrets-manager
+  codeguru-reviewer: codegurureviewer   # SigV4 signing name is hyphenated; the doc slug is not
+  cognito-identity: cognitoidentity     # SigV4 signing name is hyphenated; the doc slug is not
+  app-integrations: appintegrations     # SigV4 signing name is hyphenated; the doc slug is not
+  servicecatalog: service-catalog
+  cognito-idp: cognito                  # Cognito's SigV4 signing name
+  states: step-functions                # Step Functions' SigV4 signing name
+  email: ses                            # SES's SigV4 signing name
+  es: opensearch                        # OpenSearch's SigV4 signing name (legacy Elasticsearch)
+  appconfigdata: appconfig              # data-plane facet, at appconfig.md#data-plane
+  tagging: resource-groups-tagging      # Resource Groups Tagging API's SigV4 signing name
+  elasticloadbalancing: elb             # ELB v2's SigV4 signing name
+  elb: elb-classic                      # Classic (2012-06-01) key; the v2 page is elb.md
+  application-autoscaling: applicationautoscaling
+  elasticbeanstalk: elastic-beanstalk
+  ec2messages: ssm                      # SSM Messages facet, documented alongside ssm.md
+  iotdata: iot                          # IoT Data row shares iot.md with IoT Core
+  resource-explorer-2: resource-explorer # API version suffix; the page is resource-explorer.md
+  bedrock-agentcore-control: bedrock-agentcore  # control plane owns the page; the data-plane row is the facet
+
+# A NEW switch/REST descriptor not listed here and not resolvable via an alias fails
+# `--strict`. Every entry MUST carry a `by:` expiry date (ISO, YYYY-MM-DD): once that
+# date passes, `--strict` fails for it exactly as if it were never listed, even though
+# the entry is still physically present in this file. This is deliberate - an
+# unbounded deferred list is a silent, permanent bypass of the whole check, which is
+# how Bedrock AgentCore (#2316) shipped a working service that stayed off the matrix
+# for five days with nothing red anywhere. An expiring entry forces a human to either
+# add the row or come back and renew the date with a fresh justification; it can never
+# just be forgotten. Remove an entry outright once the referenced PR merges and the
+# row lands - don't wait for it to expire.
+deferred: []
+
+# docs/services pages that intentionally have no Service Matrix row of their own.
+facet_pages:
+  - cloudwatch-metric-filters-verification