{"owner":"hashicorp","repo":"terraform-provider-aws","hasSkills":true,"totalSkillsCount":26,"totalTokensCount":13809,"categories":["anthropic-skill","root-instruction","copilot-instructions","plugin-manifest"],"hasMcp":false,"mcpConfig":null,"found":[".agents/skills/review-docs/SKILL.md",".agents/skills/fixdocs/SKILL.md",".agents/skills/new-list-resource/SKILL.md",".agents/skills/review-schema/SKILL.md",".agents/skills/review-helpers/SKILL.md",".agents/skills/review-identity/SKILL.md",".agents/skills/resource-identity/SKILL.md",".agents/skills/go-conventions/SKILL.md",".agents/skills/review-generated/SKILL.md",".agents/skills/review-pr/SKILL.md",".agents/skills/review-lifecycle/SKILL.md",".agents/skills/breaking-changes/SKILL.md",".agents/skills/review-tags/SKILL.md",".agents/skills/review-tests-helpers/SKILL.md",".agents/skills/review-tests/SKILL.md",".agents/skills/smarterr/SKILL.md",".copilot/skills/changelog/SKILL.md","AGENTS.md",".github/copilot-instructions.md",".bob/rules/00-overview.md","tools/literally/README.md","tools/makelign/README.md","internal/generate/servicepackages/README.md",".agents/skills/review-docs/references/import-section.md","tools/makelign/testdata/golden/docs/continuous-integration.md","tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md"],"skills":{".agents/skills/review-docs/SKILL.md":"---\nname: review-docs\ndescription: \"Review a Terraform AWS Provider PR's end-user documentation (website/docs/**/*.markdown): whether docs are needed, description openings, argument/attribute style, section structure, tags wording, code fences, and the Import + Identity Schema section. Use when reviewing documentation changes, or when a PR adds/changes a resource or data source and its docs should be checked.\"\n---\n\n\n\n\n# Review: End-User Documentation\n\nAssume the `@maintainer` persona. Scope: resource docs (`r/`), data source docs (`d/`), list resource docs (`list/`) under `website/docs/`, rendered at the Terraform Registry. Loaded from `review-pr`.\n\nAuthoritative reference: [docs/end-user-documentation.md](../../../docs/end-user-documentation.md). When this skill and that document disagree, the document wins. Do not review CHANGELOG updates.\n\n## Should the PR include docs?\n\n- If the PR adds or changes user-facing behavior (new resource/data source/attribute) but has no doc change, say what's missing.\n- If the PR removes behavior but leaves stale docs, say what to remove.\n- Review only the changed docs; don't review unchanged documentation except as needed for context.\n\n## Description openings\n\nThe single-line `description:` in frontmatter and the first paragraph after the H1 must use the verb for the doc type:\n\n| Doc type | Opening verb |\n|---|---|\n| Resource | `Manages …` |\n| Data source | `Provides details about …` |\n| List resource | `Lists …` |\n\nFlag openings like \"This resource…\", \"Use this resource…\", \"Allows you to…\", \"Resource for…\", or \"Terraform resource for…\".\n\n## Argument and attribute description style\n\n**Forbidden opening words**: `An`, `A`, `The`, `Defines`, `Indicates`, `Specifies`. Rewrite \"Indicates the amount of storage\" → \"Amount of storage.\" Always propose the corrected wording.\n\n**Don't spell out common abbreviations** (e.g. \"Amazon Resource Name (ARN)\" → \"ARN\"). See [Abbreviations](../../../docs/end-user-documentation.md#abbreviations) for the full list and rationale.\n\n**Boolean arguments** must start with `Whether to`:\n\n- ✓ `(Optional) Whether to enable logging.`\n- ✗ `(Optional) Enables logging.` / `(Optional) If true, enables logging.`\n\n**`(Required)` / `(Optional)` / `(Read-Only)`** are the only valid markers, capitalized in parentheses, immediately after the hyphen.\n\n**Examples use `example`, not `test`.** Flag any HCL block in docs that uses `\"test\"` as a resource label or `name = \"test\"`.\n\n## Section structure\n\nResource docs, in this order:\n\n1. `# Resource: `\n2. `## Example Usage` (with at least `### Basic Usage`)\n3. `## Argument Reference`\n4. `## Attribute Reference`\n5. `## Timeouts` *(only if the resource exposes timeouts)*\n6. `## Import` *(only for resources)*\n\nData source and list resource docs have only Example Usage, Argument Reference, and Attribute Reference.\n\n## Argument Reference\n\nRequired arguments come first, separated from optional by a header line. Alphabetize. Use these exact lead-ins:\n\n```\nThe following arguments are required:\n\n* `req_arg` - (Required) ...\n\nThe following arguments are optional:\n\n* `opt_arg` - (Optional) ...\n```\n\nIf there are no required arguments, drop the \"required\" subsection — don't write \"There are no required arguments.\"\n\nFor tagged resources, `tags` lives under optional arguments with this exact wording:\n\n```\n* `tags` - (Optional) Map of tags assigned to the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n```\n\n## Attribute Reference\n\nOpen with `This resource exports the following attributes in addition to the arguments above:` (substitute \"data source\" / \"list resource\"). Flag pages that re-document arguments here — only computed attributes belong. Alphabetize.\n\nFor tagged resources, `tags_all` has this exact wording:\n\n```\n* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).\n```\n\nFor tagged data sources, `tags` is a top-level computed attribute and there is no `tags_all`.\n\n## Code fences\n\nUse `terraform` for `.tf` blocks and `console` for shell examples. Flag `hcl` (use `terraform`) or unfenced shell commands.\n\n## Style points\n\n- Active voice, present tense. Don't document past or future behavior.\n- Single-line description in frontmatter — flag multi-paragraph descriptions.\n- Consistent terminology — match the AWS service's nouns; don't invent synonyms.\n\n## Import section & Identity Schema\n\nThe `## Import` section (resources only) and its `Identity Schema` subsection have a precise required structure. See [`references/import-section.md`](references/import-section.md) for the full checklist and load it when the PR touches a resource's Import section.\n",".agents/skills/fixdocs/SKILL.md":"---\nname: fixdocs\ndescription: \"Fix Terraform provider end user documentation issues detected by swissshepherd (ss). Removes an ignored target from the config, runs ss, validates findings, fixes the documentation, and commits.\"\n---\n\n\n\n\n# Skill: Fix End User Documentation With `swissshepherd`\n\nFix Terraform provider documentation issues by removing targets from the swissshepherd ignore list, validating findings against the schema, and correcting the documentation.\n\n## When to use\n\nTrigger this skill when the user:\n- Says \"fix docs\", \"fixdocs\", \"run swissshepherd\", \"run ss\", or similar\n- Asks to remove a target from the swissshepherd ignore list\n- Asks to fix documentation for a specific resource or data source\n- Provides swissshepherd output and asks to fix the findings\n\n## Inputs\n\nOptional:\n- A target name (e.g., `aws_s3_bucket`) or prefix (e.g., `aws_s3_`)\n- A type (`resource`, `data_source`, `ephemeral`, etc.)\n- Number of targets to process (default: 1)\n\nIf no target is specified, pick the next one from `ignore_targets` in `.ci/swissshepherd-weak.hcl`.\n\n## Procedure\n\n### Phase 1: Verify clean baseline\n\n```bash\nmake swissshepherd\n```\n\nThis MUST output \"All checks passed.\" before proceeding. If it doesn't, stop and tell the user the baseline is dirty.\n\n### Phase 2: Select and expose target\n\n1. Open `.ci/swissshepherd-weak.hcl`\n2. Find the target in an `ignore_targets` list (within a `check` block)\n3. Remove the target line from the list\n4. Run swissshepherd to see findings:\n\n```bash\nswissshepherd --config .ci/swissshepherd-weak.hcl --target --type \n```\n\nIf \"All checks passed\" — the target was already clean. Commit the config removal and move to the next target.\n\n### Phase 3: Validate findings\n\nFor each finding, determine if it's valid by checking the schema source of truth:\n\n- **Coverage errors** (\"not documented\", \"does not exist in schema\"): Read the resource's Go source (`internal/service//.go` or `*_data_source.go`) to confirm the attribute/block exists in the schema.\n- **Heading errors**: Check what the heading currently says vs what ss expects.\n- **Label errors**: Check if the attribute is Required, Optional, or Computed in the schema.\n- **Byline errors**: Compare against the expected bylines in the config.\n\nIf a finding appears to be a swissshepherd bug (schema says one thing, ss reports another), note it and skip — do NOT fix the doc incorrectly.\n\n### Phase 4: Fix the documentation\n\n**BOTH WARNINGS AND ERRORS** should be fixed!!\n\nOpen the doc file (path is in the ss output) and apply fixes:\n\n| Finding | Fix |\n|---------|-----|\n| \"block X is not documented\" | Add a `### \\`block_name\\` Block` section with its attributes listed |\n| \"attribute X should be documented in Attribute Reference\" | Add to Attribute Reference section |\n| \"attribute X should not appear in Argument Reference\" | Move from Arguments to Attributes |\n| \"documented attribute X does not exist in schema\" | Remove from docs (it's phantom) |\n| \"missing (Required) or (Optional) label\" | Add the correct label based on schema |\n| \"heading ... should be ...\" | Rename to the suggested heading |\n| \"byline does not match expected texts\" | Replace with a standard byline |\n| \"reference-style link definition\" | Convert `[ref]: url` to inline `[text](url)` |\n| \"avoid \\\"X\\\"; use \\\"Y\\\" instead\" (banned_glosses) | Replace the spelled-out phrase with its abbreviation. Never edit YAML frontmatter to do this — if the flagged text is in `subcategory`/`layout`/`page_title`/`description`, skip and report it instead. |\n\n#### Documentation style rules\n\nWhen adding or editing documentation:\n- Arguments: `* \\`name\\` - (Required) Description.` or `* \\`name\\` - (Optional) Description.`\n- Attributes: `* \\`name\\` - Description.` (no Required/Optional label)\n- Descriptions start with a verb or noun — never \"A \", \"An \", \"The \", \"Specifies \", \"Indicates \"\n- Don't spell out common abbreviations (e.g. ARN, KMS, VPC) — `swissshepherd`'s `banned_glosses` check enforces this; see [Abbreviations](../../../docs/end-user-documentation.md#abbreviations)\n- Boolean arguments: start with \"Whether to...\"\n- Keep alphabetical order within required/optional groups\n- Block sections use heading: `` ### `block_name` Block ``\n- Byline for arguments: \"The following arguments are required:\" / \"The following arguments are optional:\"\n- Byline for attributes: \"In addition to all arguments above, the following attributes are exported:\"\n\nAuthoritative reference: [docs/end-user-documentation.md](../../../docs/end-user-documentation.md). When this skill and that document disagree, the document wins.\n\n### Phase 5: Verify fix\n\n```bash\nswissshepherd --config .ci/swissshepherd-weak.hcl --target --type \n```\n\nMust output \"All checks passed.\" If not, iterate on remaining findings.\n\n### Phase 6: Full verification\n\n```bash\nmake swissshepherd\n```\n\nMust output \"All checks passed.\" to confirm no regressions.\n\n### Phase 7: Commit\n\nStage and commit:\n\n```bash\ngit add .ci/swissshepherd-weak.hcl website/docs/\ngit commit -m \": Fix documentation per swissshepherd\"\n```\n\nUse the resource name without the `aws_` prefix in the commit message scope when it matches a single service. For multi-target batches, use the service name.\n\n## Important constraints\n\n- **Schema is truth.** Never \"fix\" a finding by silencing it if the schema confirms the issue.\n- **One target per commit.** Each removed ignore target gets its own commit for clean git history.\n- **Always use `--config .ci/swissshepherd-weak.hcl`** — running without config produces 20,000+ findings.\n- **Check both check blocks.** A target may appear in `ignore_targets` under `check \"schema_docs\"` AND `check \"import_section\"` (or others). Remove from all.\n- **Don't touch `ignore_contents_check`** unless the user explicitly asks — those are structural exceptions.\n- **Preserve file structure.** Don't rewrite entire doc files. Make minimal, targeted edits.\n- **Nested blocks.** When ss reports \"block X.Y is not documented\", the doc needs a subsection under the parent block's section. Default to `` ### `y` Block `` (just the child name) nested contextually after the parent. If the child name collides with another block of the same name elsewhere in the file (e.g. the same nested block name reused under two different parents), use the dotted path instead: `` ### `x.y` Block ``, with a matching dotted anchor. There is no single correct form — prefer the shorter undotted name, but use dotted paths when needed to keep headings unique. Be consistent within a file: don't mix dotted and undotted for the same block across the doc.\n\n## Example session\n\nUser: \"fix docs for aws_s3_bucket_lifecycle_configuration\"\n\n1. Verify `make swissshepherd` passes\n2. Remove `aws_s3_bucket_lifecycle_configuration` from `ignore_targets` in the `schema_docs` check block\n3. Run `swissshepherd --config .ci/swissshepherd-weak.hcl --target aws_s3_bucket_lifecycle_configuration --type resource`\n4. See: `ERROR [schema_docs] ... block \"rule.filter\" is not documented`\n5. Check Go source — confirm `filter` block exists under `rule`\n6. Add `` ### `filter` Block `` section with its attributes\n7. Re-run ss — passes\n8. Run `make swissshepherd` — passes\n9. Commit\n",".agents/skills/new-list-resource/SKILL.md":"---\nname: new-list-resource\ndescription: \"Implement a new list resource in the Terraform AWS provider.\"\n---\n\n\n\n\n# Skill: New List Resource\n\nAssume the @maintainer persona.\n\nUse this skill to add new list resource.\n\nRefer to [docs/new-list-resource.md](../../../docs/add-a-new-list-resource.md) for instructions.\nThe task is complete when all list acceptance tests (`TestAcc{Resource}_List`) are passing.\n\n## When to use\n\nTrigger this skill when the user:\n\n- Says \"add a new list resource\", or similar.\n\n## Inputs\n\nRequired:\n\n- The target resource name (e.g. `aws_s3_bucket`).\n\nIf the user provides a human readable name (e.g. \"S3 Bucket\") rather than the Terraform resource, confirm the target resource before proceeding.\n",".agents/skills/review-schema/SKILL.md":"---\nname: review-schema\ndescription: \"Review Terraform AWS Provider Plugin Framework schema shape: model structs, Required/Optional/Computed combinations, plan modifiers (no ForceNew), nested-block custom types, validators, sensitive attributes, and timeouts. Use when reviewing a PR that changes resource or data-source schema in internal/service/**/*.go.\"\n---\n\n\n\n\n# Review: Schema & Resource Shape\n\nAssume the `@maintainer` persona. Scope: model struct, attributes, blocks, validators, plan modifiers, timeouts on non-test resource code. Loaded from `review-pr`.\n\n## Model struct\n\n```go\ntype fooResourceModel struct {\n framework.WithRegionModel // first field; omit for global services only\n // attributes...\n Timeouts timeouts.Value `tfsdk:\"timeouts\"` // only when a timeouts block is present\n}\n```\n\n- `framework.WithRegionModel` is the first embedded field for regional resources/data sources/list resources. Global services (CloudFront, IAM, Route 53 hosted zones, etc.) omit it and register with `inttypes.ResourceRegionDisabled()`.\n- `tfsdk` tags must match schema attribute names exactly (snake_case).\n- Use Plugin Framework types (`types.String`, etc.) and `fwtypes.ListNestedObjectValueOf[T]` for nested blocks.\n- Time fields use `timetypes.RFC3339`, never `types.String`.\n\n## Attribute rules\n\n- Attribute names are `snake_case`.\n- **Alphabetize** within `Attributes` and within `Blocks`. No blank lines between attributes.\n- Use `internal/names` constants (`names.AttrARN`, `names.AttrName`, `names.AttrTags`, `names.AttrTagsAll`, `names.AttrTimeouts`, etc.) instead of string literals when one exists.\n\n### Required / Optional / Computed\n\nOnly four valid combinations. Flag any other.\n\n| Required | Optional | Computed | When |\n|---|---|---|---|\n| ✓ | | | User must supply |\n| | ✓ | | User may supply; **never use `Default` here** |\n| | | ✓ | Read-only |\n| | ✓ | ✓ | User or provider supplies; required pairing for `Default` |\n\nPrefer `Optional + Computed` over `Optional + Default` when AWS supplies a server-side default.\n\n### `id` attribute\n\nPlugin Framework does **not** require an `id` attribute. Include `names.AttrID: framework.IDAttribute()` only when the AWS API returns an `Id` field. Flag schemas that include it on ARN-identified resources just by habit.\n\n## Plan modifiers (no `ForceNew`)\n\nPlugin Framework uses plan modifiers, not `ForceNew`. Flag any new Framework code that mentions `ForceNew`.\n\n- `stringplanmodifier.RequiresReplace()` — replaces `ForceNew: true`\n- `stringplanmodifier.UseStateForUnknown()` — keeps a computed value stable across plans\n\n## Validators replace `MaxItems`/`MinItems`\n\nUse `listvalidator.SizeAtMost(N)` / `SizeAtLeast(N)` (and `setvalidator` equivalents) on the block, not `MaxItems`/`MinItems` on the attribute. For a single nested object, combine `listvalidator.SizeAtMost(1)` with a list nested block.\n\n## Nested blocks need a custom type\n\n`schema.ListNestedBlock` requires `CustomType: fwtypes.NewListNestedObjectTypeOf[complexArgumentModel](ctx)`. The model field is `fwtypes.ListNestedObjectValueOf[complexArgumentModel]`. Flag nested blocks that omit `CustomType`.\n\nFor sets of strings, use `CustomType: fwtypes.SetOfStringType` with `fwtypes.SetValueOf[types.String]`.\n\nFor AWS API map blocks, the provider schema has no map-of-objects type — use `MapBlockKey`. Flag attempts to model AWS map blocks with `schema.MapAttribute`.\n\n## Sensitive attributes\n\nMark credentials, tokens, and write-only secrets `Sensitive: true`. Flag computed or required attributes that obviously hold secret material but aren't marked sensitive.\n\n## Timeouts\n\nResources with configurable timeouts use `timeouts.Block(ctx, timeouts.Opts{Create: true, Update: true, Delete: true})` and set defaults via `r.SetDefaultCreateTimeout` / `SetDefaultUpdateTimeout` / `SetDefaultDeleteTimeout` that reflect AWS API behavior — RDS Create can take 30–60 minutes; an EC2 SG takes seconds. Don't use arbitrary round numbers. Data sources and list resources do not expose configurable timeouts.\n",".agents/skills/review-helpers/SKILL.md":"---\nname: review-helpers\ndescription: \"Review Terraform AWS Provider helper code: finders, status functions, waiters, sweepers, data sources, and list resources. Use when reviewing a PR that changes non-test internal/service/**/*.go code for resource lookup, retry.StateChangeConf waiters, NewSweepResource sweepers, DataSourceWithModel data sources, or Framework/SDKv2 list resources.\"\n---\n\n\n\n\n# Review: Helpers, Sweepers, Data Sources, List Resources\n\nAssume the `@maintainer` persona. Scope: finders, status, waiters, sweepers, data sources, list resources. Loaded from `review-pr`.\n\n## Finders, status, waiters\n\n- Finder signature: `findByID(ctx context.Context, conn *.Client, id string) (*awstypes., error)`. Variants by ARN/Name use the same shape.\n- On `*awstypes.ResourceNotFoundException`, return `smarterr.NewError(&retry.NotFoundError{LastError: err})`.\n- Status function reuses the finder and returns `retry.StateRefreshFunc`. Design status so one function powers create, update, and delete waiters.\n- Waiters use `retry.StateChangeConf`. Created/updated waiters typically set `NotFoundChecks: 20` and `ContinuousTargetOccurence: 2`. Deleted waiters use empty `Target` with `Pending` covering deletion-in-progress states.\n- Prefer SDK-provided status constants (e.g. `awstypes.StatusInProgress`) over package-level string consts.\n- Finders and `ResName` constants referenced in tests must be re-exported via `exports_test.go`.\n\nFlag finders that return raw errors (must wrap with `smarterr.NewError`), status that duplicates finder logic, or hand-rolled polling loops in place of `retry.StateChangeConf`.\n\n## Sweepers\n\nEach new resource needs a sweeper. Iterate the SDK paginator, build via `framework.NewSweepResource(newResource, client, framework.NewAttribute(names.AttrID, aws.ToString(v.Id)))` (where `framework` is `internal/sweep/framework`), and register in the package's `sweep.go` with `awsv2.Register(\"aws__\", sweeps, ...optionalDeps)`. Pass multiple `framework.NewAttribute(...)` arguments for composite identity.\n\nFlag new resources without a sweeper, sweepers that don't propagate paginator errors via `smarterr.NewError`, and sweepers using import aliases other than `framework` for `internal/sweep/framework`.\n\n## Data sources\n\nData sources have only a `Read` method.\n\n- Use `framework.DataSourceWithModel[T]`.\n- Schema attributes are `Required` or `Optional` for search criteria; everything else is `Computed`.\n- Attributes that are `Required` on the corresponding resource are typically `Computed` on the data source unless they form lookup criteria.\n- No configurable timeouts.\n- Tagged data sources expose a single computed `tags` attribute (no `tags_all`).\n\n## List resources\n\nFramework path embeds the corresponding underlying resource. SDKv2 path uses `framework.ListResourceWithSDKv2Resource`.\n\nThe `List` method:\n\n1. Get the client.\n2. Fetch the config (only when the list takes query attributes such as a parent ID).\n3. Stream results from a paginated AWS List API.\n4. Set logging fields per item (typically the ARN) via `tflog.SetField(ctx, logging.ResourceAttributeKey(...), ...)`.\n5. Set identifying attributes for each result.\n6. Set `result.DisplayName` to a human-readable identifier (typically the resource name).\n\nThe listing helper uses an iterator over the SDK paginator:\n\n```go\nfunc lists(ctx context.Context, conn *.Client, input *.ListsInput) iter.Seq2[awstypes., error]\n```\n\nThe flatten function shared by Read and List lives in the resource file (`r.flatten` for Framework, `resourceFlatten` for SDKv2).\n\nFlag list resources that don't set `DisplayName`, that re-implement flatten logic instead of sharing with Read, or that omit the `tflog.SetField` per-item logging hook.\n",".agents/skills/review-identity/SKILL.md":"---\nname: review-identity\ndescription: \"Review Terraform AWS Provider Resource Identity: the identity-strategy annotations (@ArnIdentity, @SingletonIdentity, @IdentityAttribute), multi-attribute @ImportIDHandler parsers, and region opt-out for global services. Use when reviewing a PR that adds or changes identity annotations or import-ID parsing in internal/service/**/*.go.\"\n---\n\n\n\n\n# Review: Resource Identity\n\nAssume the `@maintainer` persona. Scope: identity declaration and import-ID parsers. Loaded from `review-pr`.\n\n## Identity strategy — exactly one per resource\n\nEvery new resource declares one identity strategy via comment annotations above the factory function. Flag missing identity annotations on new resources.\n\n| Strategy | Annotations | Use when |\n|---|---|---|\n| ARN | `// @ArnIdentity` (or `// @ArnIdentity(\"arn_attribute\")`) | AWS API uses the ARN as identifier |\n| Singleton | `// @SingletonIdentity` | One per region (or one per account for global services) |\n| Parameterized | one or more `// @IdentityAttribute(\"\")` | Composite or non-ARN identifier |\n\n`@IdentityAttribute` supports keywords: `optional`, `resourceAttributeName`, `testNotNull`, `valueType`, and `identityDuplicateAttributes`.\n\n## Multi-attribute identity needs an `ImportIDHandler`\n\nParameterized identities with more than one attribute require both:\n\n1. An `// @ImportIDHandler(\"\")` annotation (alongside the `@IdentityAttribute` annotations) referencing a type that satisfies `inttypes.ImportIDParser`.\n2. The implementation:\n\n```go\ntype fooImportID struct{}\n\nfunc (fooImportID) Parse(id string) (string, map[string]string, error) {\n // parse a separator-delimited string into named identity attributes\n}\n\nvar _ inttypes.ImportIDParser = fooImportID{}\n```\n\nFlag multi-attribute identity resources that:\n\n- Omit `@ImportIDHandler` — the generator's `Validate()` requires it for multiple parameterized identity and will error.\n- Reference an `@ImportIDHandler` whose target type doesn't satisfy `inttypes.ImportIDParser` (the `var _ inttypes.ImportIDParser = ...{}` assertion catches this).\n- Implement `Parse` without a clear error message describing the expected import-ID format on malformed input.\n\n`@ImportIDHandler` is meaningful for parameterized identities with multiple attributes. Question its use on singleton or single-attribute parameterized resources.\n\n## Region opt-out for global services\n\nGlobal services (CloudFront, IAM, Route 53 hosted zones, etc.) omit `framework.WithRegionModel` from the model and register with `inttypes.ResourceRegionDisabled()` in the service-package generator. Identity-Schema docs for these resources omit the `region` attribute.\n",".agents/skills/resource-identity/SKILL.md":"---\nname: resource-identity\ndescription: \"Add resource identity to a resource in the Terraform AWS provider.\"\n---\n\n\n\n\n# Skill: Add Resource Identity Support\n\nAssume the @maintainer persona.\n\nUse this skill to add resource identity to an existing resource, or when creating a net-new resource.\n\nRefer to [docs/resource-identity.md](../../../docs/resource-identity.md) for instructions.\nThe task is complete when all generated identity acceptance tests (`TestAcc{Resource}_Identity`) are passing.\n\n## When to use\n\nTrigger this skill when the user:\n\n- Says \"add resource identity support\", or similar while referring to a Terraform resource.\n\n## Inputs\n\nRequired:\n\n- The target resource name (e.g. `aws_s3_bucket`).\n\nIf the user provides a human readable name (e.g. \"S3 Bucket\") rather than the Terraform resource, confirm the target resource before proceeding.\n",".agents/skills/go-conventions/SKILL.md":"---\nname: go-conventions\ndescription: \"Fundamental Go conventions for the Terraform AWS provider. Use whenever writing or editing Go in internal/**/*.go (any resource, data source, ephemeral resource, action, test, or helper) before making the change, not only when asked about Go.\"\n---\n\n\n\n\n# Skill: Go Conventions\n\nThree forces pull this repository away from Go's conventions: existing code that violates them, human habits from other languages, and agent instincts trained on other ecosystems. Follow provider practice where it doesn't contradict this skill; where existing code violates this skill, it isn't precedent. Rationale and evidence: [docs/go-for-contributors.md](../../../docs/go-for-contributors.md).\n\n## Naming\n\n- Initialisms keep one case: `ID`, `ARN`, `API`, `VPC`, `KMS`, `URL`, `HTTP`. Write `applicationID`, never `applicationId`, `Arn`, or `Url`.\n- `MixedCaps`, not underscores: `maxRetries`, not `MAX_RETRIES`. Test names (`TestAccFoo_basic`) are the exception.\n- Getters drop `Get`: `Owner()`, not `GetOwner()`.\n- Short locals (`c`, `i`). Receivers are one or two letters, consistent across the type, never `this` or `self`.\n- Don't create packages named `util`, `common`, `misc`, `api`, `types`, or `interfaces`. If callers must alias your package, the name failed. (We ship `internal/types`, `internal/framework/types`, `internal/sdkv2/types`; these are known fails, not precedent.)\n\n## Comments\n\n- Names and structure first. A comment never compensates for code that is hard to read.\n- Delete a comment that restates the line, names the obvious operation, acts as an in-function section header, paraphrases the signature, teaches Go, or explains a name you should rename instead.\n- Keep comments that record constraints, invariants, surprising AWS behavior, or why an obvious approach was rejected.\n- Document every exported declaration: full sentence, begins with the name, ends with a period.\n\n## Organization: function, file, package\n\nThree units, three costs. A separately nameable concept does not earn a boundary.\n\n- **Function**: cheap. Create freely when it improves the code.\n- **File**: organization for humans. Default to editing an existing file; a new file creates no encapsulation, ownership, or API boundary.\n- **Package**: a real API and dependency boundary. Rare, and strongly justified.\n\nThen:\n\n- No `helpers.go`, `common.go`, or `utils.go`. Two or three callers, or \"separation of concerns,\" don't justify a new file.\n- No one-class-per-file or one-concern-per-file habits from Java or Python. Keep related code physically close.\n- Prefer growing an existing package. A healthy one holds several types, files, and responsibilities (`net/http`, `os`, `flag`).\n- If callers will almost always need the new package alongside its parent or neighbor, don't split it.\n- If implementation code routinely imports several sibling packages sharing a path prefix, those aren't meaningful boundaries.\n- If a split forces you to export what used to be unexported, the split is the mistake.\n\n## Abstraction\n\n- Stay concrete until multiple real uses demand otherwise. Similarity is evidence to examine, not an instruction to abstract.\n- Define interfaces where they're consumed, as small as the consumer needs. Never pair an interface with its implementation by default, and never add one so it \"could be mocked.\"\n- A little copying beats a little dependency. Modest duplication is better than an abstraction that obscures control flow.\n- Prefer functions and ordinary data structures over types, builders, managers, registries, and frameworks.\n\n## Control flow and errors\n\n- Linear and top-to-bottom. Handle the exceptional case early and return. No unnecessary `else`.\n- Errors are values: return them, wrap with useful context, inspect deliberately. No exception-like infrastructure or custom error hierarchies.\n- Error strings are lowercase and unpunctuated: `\"reading bucket policy\"`.\n- Never discard an error with `_`. Never panic for an ordinary failure.\n\n## Context\n\n- `ctx context.Context` is the first parameter, always.\n- Never store a `Context` in a struct field; pass it to each method that needs it.\n\n## Commit messages\n\n- Concise subject. Add a body only for intent or non-obvious constraints. A large mechanical change may need barely a word.\n\n## Above all: don't import other languages' architecture\n\nGo prefers concrete code, explicit control flow, locality, small consumer-driven interfaces, and modest repetition over abstraction, indirection, and machinery. When two implementations are equally correct, choose the one with fewer concepts. Absence of machinery is not unfinished work; the machinery is usually the defect.\n\nResist:\n\n- Generics to remove duplication. Use them when the problem itself is generic.\n- DI infrastructure. A function parameter or struct field already is dependency injection.\n- Redesigning production code to enable mocking.\n- Extracting tiny single-use helpers merely to shorten a function.\n- Wrapper types (`Config`, `Options`, `Manager`, `Result`) for tiny concepts. Leave a string a string.\n- Constructors where a useful zero value works.\n- map/filter/reduce pipelines, reflection, or functional composition where a plain loop reads directly.\n",".agents/skills/review-generated/SKILL.md":"---\nname: review-generated\ndescription: \"Review generated code in the Terraform AWS Provider (files ending in _gen.go produced by go generate). Use when a PR changes internal/service/**/*_gen.go — check whether the generator was run, whether the diff is plausible for the source change, and whether files were hand-edited. Do NOT apply hand-written-code rules to these files.\"\n---\n\n\n\n\n# Review: Generated Code\n\nAssume the `@maintainer` persona. Scope: files ending in `_gen.go`, produced by the code generators (`make gen`; templates and generator code live under `internal/generate/`). Common examples: `service_package_gen.go`, `tags_gen.go`, `service_endpoint_resolver_gen.go`, `*_identity_gen_test.go`, `*_tags_gen_test.go`. Loaded from `review-pr`.\n\n## What to review\n\n- Whether the file should exist at all — was the generator run after the source change that motivated it?\n- Diff plausibility — additions/removals match the source changes (a new resource added one annotation should produce a localized diff, not a wholesale rewrite of unrelated registrations).\n- Manual edits — almost always a mistake. The legitimate flow is: change the source (annotation, template, or generator code under `internal/generate/`) → regenerate (`make gen PKG=`, or the provider-wide `make gen` when the change is under `internal/generate/`) → commit the regenerated file. Flag PRs that modify `_gen.go` files without a corresponding source-side change.\n\n## What NOT to review\n\n- Style, naming, formatting, comment wording, import ordering, structural refactors. The generator owns these.\n- Suggested simplifications, \"extract helper\" suggestions, or any cleanup not reachable from the generator's templates.\n- Rules from `review-lifecycle`, `review-schema`, `review-helpers`, `review-identity`, or `review-tags`. Those target hand-written code.\n",".agents/skills/review-pr/SKILL.md":"---\nname: review-pr\ndescription: \"Review a Terraform AWS Provider pull request for correctness and conventions. Start here for any PR review: it holds the cross-cutting review principles and routes to scoped sub-skills (review-lifecycle, review-schema, review-helpers, review-identity, review-tags, review-generated, review-tests, review-tests-helpers, review-docs) based on which files the PR changes. Use when given a hashicorp/terraform-provider-aws PR URL and asked to review it.\"\n---\n\n\n\n\n# Skill: Review a Pull Request\n\nAssume the `@maintainer` persona.\n\nReview a GitHub Pull Request against the Terraform AWS Provider's conventions. This skill carries the cross-cutting principles and a routing table; load the scoped leaf skills for the file types the PR actually changes.\n\n## When to use\n\nTrigger this skill when the user:\n- Provides a `https://github.com/hashicorp/terraform-provider-aws/pull/` URL and asks for a review.\n- Says \"review PR\", \"review this pull request\", or similar, with a PR URL.\n\n## Inputs\n\nRequired:\n- A GitHub PR URL. Extract `` with the regex `/pull/(\\d+)`.\n\nIf the user provides only a PR number, ask for the full URL (or confirm the repo is `hashicorp/terraform-provider-aws`).\n\n## Procedure\n\n1. Fetch the PR's changed files and diff.\n2. Categorize each changed path against the routing table below.\n3. Load the matching leaf skill(s) and apply their rules to the changed lines only.\n4. Always consider compatibility (see below) and, when docs or a changelog are expected but missing, say so.\n5. Consolidate findings into a single review. Cite the rule and propose corrected code.\n\n## Cross-cutting principles\n\n**Compatibility is non-negotiable.** Changes must preserve Terraform state compatibility, upgrade behavior, import behavior, and existing user workflows. Schema changes that force replacement, rename attributes, or break state migration must be flagged unless explicitly justified. For a dedicated compatibility pass, use the `breaking-changes` skill. Do **not** rely on any `breaking-change` label.\n\n**Favor recent patterns; do not enforce legacy ones.** The provider has both modern (Plugin Framework) and legacy (Plugin SDKv2) code. New work follows recent patterns. Do not ask contributors to mimic legacy patterns just because nearby code uses them. When modifying an existing resource, keep the framework it already uses.\n\n**Go style.** Expect modern Go (1.26+): `slices`, `maps`, `cmp`, `iter`, `errors.Is`/`errors.As`, range-over-int/func. Prefer return-early. AWS SDK for Go v2 only. Detect AWS API exceptions with `errs.IsA[*awstypes.]` — never type assertions or `strings.Contains`.\n\n**Review tone.** Be specific, accurate, and to the point. Cite the rule and propose the corrected code. Prioritize correctness, design, and compatibility. Don't hand-author comments for mechanical issues that `make lint`, semgrep, or formatters already enforce — at most, note that automated checks will flag them. Spend the review on what tools can't catch: logic, AWS API usage, state and upgrade compatibility, and test coverage.\n\n## Routing table\n\n| Changed path | Concern | Leaf skill |\n|---|---|---|\n| `internal/service/**/*.go` (non-test) | CRUD, errors, AutoFlex | `review-lifecycle` |\n| `internal/service/**/*.go` (non-test) | Model/attrs/blocks/validators | `review-schema` |\n| `internal/service/**/*.go` (non-test) | Finders, waiters, sweepers, data sources, list resources | `review-helpers` |\n| `internal/service/**/*.go` (non-test) | Resource Identity | `review-identity` |\n| `internal/service/**/*.go` (non-test) | Tags | `review-tags` |\n| `internal/service/**/*_gen.go` | Generated code | `review-generated` |\n| `internal/service/**/*_test.go` | Acceptance/unit test basics | `review-tests` |\n| `internal/service/**/*_test.go` | Exists/Destroy, data source/list/unit tests | `review-tests-helpers` |\n| `website/docs/**/*.markdown` | End-user documentation | `review-docs` |\n\nMultiple leaves may apply to one file. The `internal/service/**/*.go` glob matches both production and test files; the non-test leaves generally don't apply to tests.\n\n## Broader context\n\nSee [`AGENTS.md`](../../../AGENTS.md) for personas, the skills registry, build/test commands, and the AI-usage policy.\n",".agents/skills/review-lifecycle/SKILL.md":"---\nname: review-lifecycle\ndescription: \"Review Terraform AWS Provider resource lifecycle: CRUD step order, smerr/smarterr error handling, and AutoFlex model-to-SDK conversion. Use when reviewing a PR that changes non-test resource logic in internal/service/**/*.go (Create/Read/Update/Delete, error wrapping, flex.Expand/Flatten/Diff).\"\n---\n\n\n\n\n# Review: Resource Lifecycle\n\nAssume the `@maintainer` persona. Scope: CRUD, errors, AutoFlex on non-test resource code (`internal/service/**/*.go`). Loaded from `review-pr`.\n\n## Registration annotations\n\nOne above each factory function. Flag missing annotations or factory-name/resource-name mismatches.\n\n| Construct | Annotation |\n|---|---|\n| Resource (Framework) | `// @FrameworkResource(\"aws__\", name=\"\")` |\n| Data source (Framework) | `// @FrameworkDataSource(\"aws__\", name=\"\")` |\n| List resource (Framework) | `// @FrameworkListResource(\"aws__\")` |\n| List resource (SDKv2) | `// @SDKListResource(\"aws__\")` |\n\n## Struct embeds\n\n```go\ntype fooResource struct {\n framework.ResourceWithModel[fooResourceModel]\n framework.WithTimeouts // only when a timeouts block is present\n framework.WithImportByIdentity // not WithImportByID for new resources\n}\n```\n\n- New resources use `framework.WithImportByIdentity`. Flag `framework.WithImportByID` on new resources.\n- Use `framework.ResourceWithModel[T]` (not `ResourceWithConfigure`).\n- Data sources: `framework.DataSourceWithModel[T]`.\n\n## CRUD step order\n\n**Create:** get client → fetch plan → `flex.Expand` → set tags via `input.Tags = getTagsIn(ctx)` for tagged resources → AWS Create call → `flex.Flatten` output back into the plan → wait → `resp.State.Set(ctx, plan)`. Flag Creates that don't read the output back into the plan — computed attributes stay unknown in state.\n\n**Read:** get client → fetch state → finder → on `retry.NotFound(err)`, append `fwdiag.NewResourceNotFoundWarningDiagnostic(err)`, call `resp.State.RemoveResource(ctx)`, return → flatten → `resp.State.Set`.\n\n**Update:** get client → fetch plan and state → `diff, d := flex.Diff(ctx, plan, state)` → gate on `diff.HasChanges()` → AWS modify → flatten output back into plan → wait → `resp.State.Set(ctx, &plan)`. Flag updates that always call the API without `HasChanges()`, or that re-fetch state after the modify.\n\nOmit Update when the API has no update, every attribute has `RequiresReplace()`, or Create is reused for modify.\n\n**Delete:** get client → fetch state → build input → AWS delete; silently swallow `errs.IsA[*awstypes.ResourceNotFoundException](err)` → wait.\n\n## Errors\n\nUse `smerr`/`smarterr`, never raw `resp.Diagnostics.AddError`.\n\n- Upstream diagnostics: `smerr.AddEnrich(ctx, &resp.Diagnostics, req.Plan.Get(ctx, &plan))` (not the deprecated `EnrichAppend`).\n- API errors: `smerr.AddError(ctx, &resp.Diagnostics, err, smerr.ID, plan.Name.String())`. Always pass `smerr.ID` with an identifier — `plan.Name` in Create, `state.ID` elsewhere.\n- Inside finders/waiters, wrap returned errors with `smarterr.NewError(err)`.\n- Detect AWS exceptions with `errs.IsA[*awstypes.](err)` — never type assertions, never `strings.Contains(err.Error(), ...)`.\n- Use `retry.NotFound(err)` for wrapped not-found from the finder layer.\n\nFlag raw `resp.Diagnostics.AddError`, type assertions on AWS errors, and string-based error matching.\n\n## AutoFlex\n\nUse `flex.Expand` / `flex.Flatten` for model ↔ SDK conversion. Manual per-field `aws.String` / `aws.ToString` is wrong in new Framework code.\n\n- `flex.WithFieldNamePrefix(\"\")` when AWS prefixes its fields (model `ID` ↔ SDK `ThingId`).\n- AWS plural collections become singular blocks (`Parameters` ↔ `parameter`).\n- AutoFlex does **not** copy tags through; see `review-tags`.\n- Update path: `flex.Diff(ctx, plan, state)` then `diff.HasChanges()`.\n",".agents/skills/breaking-changes/SKILL.md":"---\nname: breaking-changes\ndescription: \"Review a PR for possible breaking changes.\"\n---\n\n\n\n\n# Skill: Review PR For Breaking Changes\n\nAssume the @maintainer persona.\n\nDetermine whether a GitHub Pull Request makes a breaking change. If so provide feedback on reasons for the breaking change and possible next steps.\nIf the PR does not make any breaking changes, note that.\n\nDo NOT consider any `breaking-change` label applied to the PR.\n\nReview only the code changes included in the PR.\n\nAuthoritative reference: [docs/breaking-changes.md](../../../docs/breaking-changes.md). When this skill and that document disagree, the document wins.\n\n## When to use\n\nTrigger this skill when the user:\n- Provides a `https://github.com/hashicorp/terraform-provider-aws/pull/` URL and asks for a breaking change review.\n- Says \"review breaking change\", or similar, with a PR URL.\n\n## Inputs\n\nRequired:\n- A GitHub PR URL. Extract `` with the regex `/pull/(\\d+)`.\n\nIf the user provides only a PR number, ask for the full URL (or confirm the repo is `hashicorp/terraform-provider-aws`).\n",".agents/skills/review-tags/SKILL.md":"# review-tags\n\nPath: `.agents/skills/review-tags/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tags/SKILL.md)",".agents/skills/review-tests-helpers/SKILL.md":"# review-tests-helpers\n\nPath: `.agents/skills/review-tests-helpers/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests-helpers/SKILL.md)",".agents/skills/review-tests/SKILL.md":"# review-tests\n\nPath: `.agents/skills/review-tests/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests/SKILL.md)",".agents/skills/smarterr/SKILL.md":"# smarterr\n\nPath: `.agents/skills/smarterr/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/smarterr/SKILL.md)",".copilot/skills/changelog/SKILL.md":"# changelog\n\nPath: `.copilot/skills/changelog/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.copilot/skills/changelog/SKILL.md)","AGENTS.md":"# AI Agent Protocol & Instructions\n\nPath: `AGENTS.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/AGENTS.md)",".github/copilot-instructions.md":"# GitHub Copilot Instructions\n\nPath: `.github/copilot-instructions.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.github/copilot-instructions.md)",".bob/rules/00-overview.md":"# Rules Skill\n\nPath: `.bob/rules/00-overview.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.bob/rules/00-overview.md)","tools/literally/README.md":"# literally Documentation\n\nPath: `tools/literally/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/literally/README.md)","tools/makelign/README.md":"# makelign Documentation\n\nPath: `tools/makelign/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/README.md)","internal/generate/servicepackages/README.md":"# servicepackages Documentation\n\nPath: `internal/generate/servicepackages/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/internal/generate/servicepackages/README.md)",".agents/skills/review-docs/references/import-section.md":"# References Skill\n\nPath: `.agents/skills/review-docs/references/import-section.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-docs/references/import-section.md)","tools/makelign/testdata/golden/docs/continuous-integration.md":"# Docs Skill\n\nPath: `tools/makelign/testdata/golden/docs/continuous-integration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/continuous-integration.md)","tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md":"# Docs Skill\n\nPath: `tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md)"},"files":{".agents/skills/review-docs/SKILL.md":"---\nname: review-docs\ndescription: \"Review a Terraform AWS Provider PR's end-user documentation (website/docs/**/*.markdown): whether docs are needed, description openings, argument/attribute style, section structure, tags wording, code fences, and the Import + Identity Schema section. Use when reviewing documentation changes, or when a PR adds/changes a resource or data source and its docs should be checked.\"\n---\n\n\n\n\n# Review: End-User Documentation\n\nAssume the `@maintainer` persona. Scope: resource docs (`r/`), data source docs (`d/`), list resource docs (`list/`) under `website/docs/`, rendered at the Terraform Registry. Loaded from `review-pr`.\n\nAuthoritative reference: [docs/end-user-documentation.md](../../../docs/end-user-documentation.md). When this skill and that document disagree, the document wins. Do not review CHANGELOG updates.\n\n## Should the PR include docs?\n\n- If the PR adds or changes user-facing behavior (new resource/data source/attribute) but has no doc change, say what's missing.\n- If the PR removes behavior but leaves stale docs, say what to remove.\n- Review only the changed docs; don't review unchanged documentation except as needed for context.\n\n## Description openings\n\nThe single-line `description:` in frontmatter and the first paragraph after the H1 must use the verb for the doc type:\n\n| Doc type | Opening verb |\n|---|---|\n| Resource | `Manages …` |\n| Data source | `Provides details about …` |\n| List resource | `Lists …` |\n\nFlag openings like \"This resource…\", \"Use this resource…\", \"Allows you to…\", \"Resource for…\", or \"Terraform resource for…\".\n\n## Argument and attribute description style\n\n**Forbidden opening words**: `An`, `A`, `The`, `Defines`, `Indicates`, `Specifies`. Rewrite \"Indicates the amount of storage\" → \"Amount of storage.\" Always propose the corrected wording.\n\n**Don't spell out common abbreviations** (e.g. \"Amazon Resource Name (ARN)\" → \"ARN\"). See [Abbreviations](../../../docs/end-user-documentation.md#abbreviations) for the full list and rationale.\n\n**Boolean arguments** must start with `Whether to`:\n\n- ✓ `(Optional) Whether to enable logging.`\n- ✗ `(Optional) Enables logging.` / `(Optional) If true, enables logging.`\n\n**`(Required)` / `(Optional)` / `(Read-Only)`** are the only valid markers, capitalized in parentheses, immediately after the hyphen.\n\n**Examples use `example`, not `test`.** Flag any HCL block in docs that uses `\"test\"` as a resource label or `name = \"test\"`.\n\n## Section structure\n\nResource docs, in this order:\n\n1. `# Resource: `\n2. `## Example Usage` (with at least `### Basic Usage`)\n3. `## Argument Reference`\n4. `## Attribute Reference`\n5. `## Timeouts` *(only if the resource exposes timeouts)*\n6. `## Import` *(only for resources)*\n\nData source and list resource docs have only Example Usage, Argument Reference, and Attribute Reference.\n\n## Argument Reference\n\nRequired arguments come first, separated from optional by a header line. Alphabetize. Use these exact lead-ins:\n\n```\nThe following arguments are required:\n\n* `req_arg` - (Required) ...\n\nThe following arguments are optional:\n\n* `opt_arg` - (Optional) ...\n```\n\nIf there are no required arguments, drop the \"required\" subsection — don't write \"There are no required arguments.\"\n\nFor tagged resources, `tags` lives under optional arguments with this exact wording:\n\n```\n* `tags` - (Optional) Map of tags assigned to the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n```\n\n## Attribute Reference\n\nOpen with `This resource exports the following attributes in addition to the arguments above:` (substitute \"data source\" / \"list resource\"). Flag pages that re-document arguments here — only computed attributes belong. Alphabetize.\n\nFor tagged resources, `tags_all` has this exact wording:\n\n```\n* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).\n```\n\nFor tagged data sources, `tags` is a top-level computed attribute and there is no `tags_all`.\n\n## Code fences\n\nUse `terraform` for `.tf` blocks and `console` for shell examples. Flag `hcl` (use `terraform`) or unfenced shell commands.\n\n## Style points\n\n- Active voice, present tense. Don't document past or future behavior.\n- Single-line description in frontmatter — flag multi-paragraph descriptions.\n- Consistent terminology — match the AWS service's nouns; don't invent synonyms.\n\n## Import section & Identity Schema\n\nThe `## Import` section (resources only) and its `Identity Schema` subsection have a precise required structure. See [`references/import-section.md`](references/import-section.md) for the full checklist and load it when the PR touches a resource's Import section.\n",".agents/skills/fixdocs/SKILL.md":"---\nname: fixdocs\ndescription: \"Fix Terraform provider end user documentation issues detected by swissshepherd (ss). Removes an ignored target from the config, runs ss, validates findings, fixes the documentation, and commits.\"\n---\n\n\n\n\n# Skill: Fix End User Documentation With `swissshepherd`\n\nFix Terraform provider documentation issues by removing targets from the swissshepherd ignore list, validating findings against the schema, and correcting the documentation.\n\n## When to use\n\nTrigger this skill when the user:\n- Says \"fix docs\", \"fixdocs\", \"run swissshepherd\", \"run ss\", or similar\n- Asks to remove a target from the swissshepherd ignore list\n- Asks to fix documentation for a specific resource or data source\n- Provides swissshepherd output and asks to fix the findings\n\n## Inputs\n\nOptional:\n- A target name (e.g., `aws_s3_bucket`) or prefix (e.g., `aws_s3_`)\n- A type (`resource`, `data_source`, `ephemeral`, etc.)\n- Number of targets to process (default: 1)\n\nIf no target is specified, pick the next one from `ignore_targets` in `.ci/swissshepherd-weak.hcl`.\n\n## Procedure\n\n### Phase 1: Verify clean baseline\n\n```bash\nmake swissshepherd\n```\n\nThis MUST output \"All checks passed.\" before proceeding. If it doesn't, stop and tell the user the baseline is dirty.\n\n### Phase 2: Select and expose target\n\n1. Open `.ci/swissshepherd-weak.hcl`\n2. Find the target in an `ignore_targets` list (within a `check` block)\n3. Remove the target line from the list\n4. Run swissshepherd to see findings:\n\n```bash\nswissshepherd --config .ci/swissshepherd-weak.hcl --target --type \n```\n\nIf \"All checks passed\" — the target was already clean. Commit the config removal and move to the next target.\n\n### Phase 3: Validate findings\n\nFor each finding, determine if it's valid by checking the schema source of truth:\n\n- **Coverage errors** (\"not documented\", \"does not exist in schema\"): Read the resource's Go source (`internal/service//.go` or `*_data_source.go`) to confirm the attribute/block exists in the schema.\n- **Heading errors**: Check what the heading currently says vs what ss expects.\n- **Label errors**: Check if the attribute is Required, Optional, or Computed in the schema.\n- **Byline errors**: Compare against the expected bylines in the config.\n\nIf a finding appears to be a swissshepherd bug (schema says one thing, ss reports another), note it and skip — do NOT fix the doc incorrectly.\n\n### Phase 4: Fix the documentation\n\n**BOTH WARNINGS AND ERRORS** should be fixed!!\n\nOpen the doc file (path is in the ss output) and apply fixes:\n\n| Finding | Fix |\n|---------|-----|\n| \"block X is not documented\" | Add a `### \\`block_name\\` Block` section with its attributes listed |\n| \"attribute X should be documented in Attribute Reference\" | Add to Attribute Reference section |\n| \"attribute X should not appear in Argument Reference\" | Move from Arguments to Attributes |\n| \"documented attribute X does not exist in schema\" | Remove from docs (it's phantom) |\n| \"missing (Required) or (Optional) label\" | Add the correct label based on schema |\n| \"heading ... should be ...\" | Rename to the suggested heading |\n| \"byline does not match expected texts\" | Replace with a standard byline |\n| \"reference-style link definition\" | Convert `[ref]: url` to inline `[text](url)` |\n| \"avoid \\\"X\\\"; use \\\"Y\\\" instead\" (banned_glosses) | Replace the spelled-out phrase with its abbreviation. Never edit YAML frontmatter to do this — if the flagged text is in `subcategory`/`layout`/`page_title`/`description`, skip and report it instead. |\n\n#### Documentation style rules\n\nWhen adding or editing documentation:\n- Arguments: `* \\`name\\` - (Required) Description.` or `* \\`name\\` - (Optional) Description.`\n- Attributes: `* \\`name\\` - Description.` (no Required/Optional label)\n- Descriptions start with a verb or noun — never \"A \", \"An \", \"The \", \"Specifies \", \"Indicates \"\n- Don't spell out common abbreviations (e.g. ARN, KMS, VPC) — `swissshepherd`'s `banned_glosses` check enforces this; see [Abbreviations](../../../docs/end-user-documentation.md#abbreviations)\n- Boolean arguments: start with \"Whether to...\"\n- Keep alphabetical order within required/optional groups\n- Block sections use heading: `` ### `block_name` Block ``\n- Byline for arguments: \"The following arguments are required:\" / \"The following arguments are optional:\"\n- Byline for attributes: \"In addition to all arguments above, the following attributes are exported:\"\n\nAuthoritative reference: [docs/end-user-documentation.md](../../../docs/end-user-documentation.md). When this skill and that document disagree, the document wins.\n\n### Phase 5: Verify fix\n\n```bash\nswissshepherd --config .ci/swissshepherd-weak.hcl --target --type \n```\n\nMust output \"All checks passed.\" If not, iterate on remaining findings.\n\n### Phase 6: Full verification\n\n```bash\nmake swissshepherd\n```\n\nMust output \"All checks passed.\" to confirm no regressions.\n\n### Phase 7: Commit\n\nStage and commit:\n\n```bash\ngit add .ci/swissshepherd-weak.hcl website/docs/\ngit commit -m \": Fix documentation per swissshepherd\"\n```\n\nUse the resource name without the `aws_` prefix in the commit message scope when it matches a single service. For multi-target batches, use the service name.\n\n## Important constraints\n\n- **Schema is truth.** Never \"fix\" a finding by silencing it if the schema confirms the issue.\n- **One target per commit.** Each removed ignore target gets its own commit for clean git history.\n- **Always use `--config .ci/swissshepherd-weak.hcl`** — running without config produces 20,000+ findings.\n- **Check both check blocks.** A target may appear in `ignore_targets` under `check \"schema_docs\"` AND `check \"import_section\"` (or others). Remove from all.\n- **Don't touch `ignore_contents_check`** unless the user explicitly asks — those are structural exceptions.\n- **Preserve file structure.** Don't rewrite entire doc files. Make minimal, targeted edits.\n- **Nested blocks.** When ss reports \"block X.Y is not documented\", the doc needs a subsection under the parent block's section. Default to `` ### `y` Block `` (just the child name) nested contextually after the parent. If the child name collides with another block of the same name elsewhere in the file (e.g. the same nested block name reused under two different parents), use the dotted path instead: `` ### `x.y` Block ``, with a matching dotted anchor. There is no single correct form — prefer the shorter undotted name, but use dotted paths when needed to keep headings unique. Be consistent within a file: don't mix dotted and undotted for the same block across the doc.\n\n## Example session\n\nUser: \"fix docs for aws_s3_bucket_lifecycle_configuration\"\n\n1. Verify `make swissshepherd` passes\n2. Remove `aws_s3_bucket_lifecycle_configuration` from `ignore_targets` in the `schema_docs` check block\n3. Run `swissshepherd --config .ci/swissshepherd-weak.hcl --target aws_s3_bucket_lifecycle_configuration --type resource`\n4. See: `ERROR [schema_docs] ... block \"rule.filter\" is not documented`\n5. Check Go source — confirm `filter` block exists under `rule`\n6. Add `` ### `filter` Block `` section with its attributes\n7. Re-run ss — passes\n8. Run `make swissshepherd` — passes\n9. Commit\n",".agents/skills/new-list-resource/SKILL.md":"---\nname: new-list-resource\ndescription: \"Implement a new list resource in the Terraform AWS provider.\"\n---\n\n\n\n\n# Skill: New List Resource\n\nAssume the @maintainer persona.\n\nUse this skill to add new list resource.\n\nRefer to [docs/new-list-resource.md](../../../docs/add-a-new-list-resource.md) for instructions.\nThe task is complete when all list acceptance tests (`TestAcc{Resource}_List`) are passing.\n\n## When to use\n\nTrigger this skill when the user:\n\n- Says \"add a new list resource\", or similar.\n\n## Inputs\n\nRequired:\n\n- The target resource name (e.g. `aws_s3_bucket`).\n\nIf the user provides a human readable name (e.g. \"S3 Bucket\") rather than the Terraform resource, confirm the target resource before proceeding.\n",".agents/skills/review-schema/SKILL.md":"---\nname: review-schema\ndescription: \"Review Terraform AWS Provider Plugin Framework schema shape: model structs, Required/Optional/Computed combinations, plan modifiers (no ForceNew), nested-block custom types, validators, sensitive attributes, and timeouts. Use when reviewing a PR that changes resource or data-source schema in internal/service/**/*.go.\"\n---\n\n\n\n\n# Review: Schema & Resource Shape\n\nAssume the `@maintainer` persona. Scope: model struct, attributes, blocks, validators, plan modifiers, timeouts on non-test resource code. Loaded from `review-pr`.\n\n## Model struct\n\n```go\ntype fooResourceModel struct {\n framework.WithRegionModel // first field; omit for global services only\n // attributes...\n Timeouts timeouts.Value `tfsdk:\"timeouts\"` // only when a timeouts block is present\n}\n```\n\n- `framework.WithRegionModel` is the first embedded field for regional resources/data sources/list resources. Global services (CloudFront, IAM, Route 53 hosted zones, etc.) omit it and register with `inttypes.ResourceRegionDisabled()`.\n- `tfsdk` tags must match schema attribute names exactly (snake_case).\n- Use Plugin Framework types (`types.String`, etc.) and `fwtypes.ListNestedObjectValueOf[T]` for nested blocks.\n- Time fields use `timetypes.RFC3339`, never `types.String`.\n\n## Attribute rules\n\n- Attribute names are `snake_case`.\n- **Alphabetize** within `Attributes` and within `Blocks`. No blank lines between attributes.\n- Use `internal/names` constants (`names.AttrARN`, `names.AttrName`, `names.AttrTags`, `names.AttrTagsAll`, `names.AttrTimeouts`, etc.) instead of string literals when one exists.\n\n### Required / Optional / Computed\n\nOnly four valid combinations. Flag any other.\n\n| Required | Optional | Computed | When |\n|---|---|---|---|\n| ✓ | | | User must supply |\n| | ✓ | | User may supply; **never use `Default` here** |\n| | | ✓ | Read-only |\n| | ✓ | ✓ | User or provider supplies; required pairing for `Default` |\n\nPrefer `Optional + Computed` over `Optional + Default` when AWS supplies a server-side default.\n\n### `id` attribute\n\nPlugin Framework does **not** require an `id` attribute. Include `names.AttrID: framework.IDAttribute()` only when the AWS API returns an `Id` field. Flag schemas that include it on ARN-identified resources just by habit.\n\n## Plan modifiers (no `ForceNew`)\n\nPlugin Framework uses plan modifiers, not `ForceNew`. Flag any new Framework code that mentions `ForceNew`.\n\n- `stringplanmodifier.RequiresReplace()` — replaces `ForceNew: true`\n- `stringplanmodifier.UseStateForUnknown()` — keeps a computed value stable across plans\n\n## Validators replace `MaxItems`/`MinItems`\n\nUse `listvalidator.SizeAtMost(N)` / `SizeAtLeast(N)` (and `setvalidator` equivalents) on the block, not `MaxItems`/`MinItems` on the attribute. For a single nested object, combine `listvalidator.SizeAtMost(1)` with a list nested block.\n\n## Nested blocks need a custom type\n\n`schema.ListNestedBlock` requires `CustomType: fwtypes.NewListNestedObjectTypeOf[complexArgumentModel](ctx)`. The model field is `fwtypes.ListNestedObjectValueOf[complexArgumentModel]`. Flag nested blocks that omit `CustomType`.\n\nFor sets of strings, use `CustomType: fwtypes.SetOfStringType` with `fwtypes.SetValueOf[types.String]`.\n\nFor AWS API map blocks, the provider schema has no map-of-objects type — use `MapBlockKey`. Flag attempts to model AWS map blocks with `schema.MapAttribute`.\n\n## Sensitive attributes\n\nMark credentials, tokens, and write-only secrets `Sensitive: true`. Flag computed or required attributes that obviously hold secret material but aren't marked sensitive.\n\n## Timeouts\n\nResources with configurable timeouts use `timeouts.Block(ctx, timeouts.Opts{Create: true, Update: true, Delete: true})` and set defaults via `r.SetDefaultCreateTimeout` / `SetDefaultUpdateTimeout` / `SetDefaultDeleteTimeout` that reflect AWS API behavior — RDS Create can take 30–60 minutes; an EC2 SG takes seconds. Don't use arbitrary round numbers. Data sources and list resources do not expose configurable timeouts.\n",".agents/skills/review-helpers/SKILL.md":"---\nname: review-helpers\ndescription: \"Review Terraform AWS Provider helper code: finders, status functions, waiters, sweepers, data sources, and list resources. Use when reviewing a PR that changes non-test internal/service/**/*.go code for resource lookup, retry.StateChangeConf waiters, NewSweepResource sweepers, DataSourceWithModel data sources, or Framework/SDKv2 list resources.\"\n---\n\n\n\n\n# Review: Helpers, Sweepers, Data Sources, List Resources\n\nAssume the `@maintainer` persona. Scope: finders, status, waiters, sweepers, data sources, list resources. Loaded from `review-pr`.\n\n## Finders, status, waiters\n\n- Finder signature: `findByID(ctx context.Context, conn *.Client, id string) (*awstypes., error)`. Variants by ARN/Name use the same shape.\n- On `*awstypes.ResourceNotFoundException`, return `smarterr.NewError(&retry.NotFoundError{LastError: err})`.\n- Status function reuses the finder and returns `retry.StateRefreshFunc`. Design status so one function powers create, update, and delete waiters.\n- Waiters use `retry.StateChangeConf`. Created/updated waiters typically set `NotFoundChecks: 20` and `ContinuousTargetOccurence: 2`. Deleted waiters use empty `Target` with `Pending` covering deletion-in-progress states.\n- Prefer SDK-provided status constants (e.g. `awstypes.StatusInProgress`) over package-level string consts.\n- Finders and `ResName` constants referenced in tests must be re-exported via `exports_test.go`.\n\nFlag finders that return raw errors (must wrap with `smarterr.NewError`), status that duplicates finder logic, or hand-rolled polling loops in place of `retry.StateChangeConf`.\n\n## Sweepers\n\nEach new resource needs a sweeper. Iterate the SDK paginator, build via `framework.NewSweepResource(newResource, client, framework.NewAttribute(names.AttrID, aws.ToString(v.Id)))` (where `framework` is `internal/sweep/framework`), and register in the package's `sweep.go` with `awsv2.Register(\"aws__\", sweeps, ...optionalDeps)`. Pass multiple `framework.NewAttribute(...)` arguments for composite identity.\n\nFlag new resources without a sweeper, sweepers that don't propagate paginator errors via `smarterr.NewError`, and sweepers using import aliases other than `framework` for `internal/sweep/framework`.\n\n## Data sources\n\nData sources have only a `Read` method.\n\n- Use `framework.DataSourceWithModel[T]`.\n- Schema attributes are `Required` or `Optional` for search criteria; everything else is `Computed`.\n- Attributes that are `Required` on the corresponding resource are typically `Computed` on the data source unless they form lookup criteria.\n- No configurable timeouts.\n- Tagged data sources expose a single computed `tags` attribute (no `tags_all`).\n\n## List resources\n\nFramework path embeds the corresponding underlying resource. SDKv2 path uses `framework.ListResourceWithSDKv2Resource`.\n\nThe `List` method:\n\n1. Get the client.\n2. Fetch the config (only when the list takes query attributes such as a parent ID).\n3. Stream results from a paginated AWS List API.\n4. Set logging fields per item (typically the ARN) via `tflog.SetField(ctx, logging.ResourceAttributeKey(...), ...)`.\n5. Set identifying attributes for each result.\n6. Set `result.DisplayName` to a human-readable identifier (typically the resource name).\n\nThe listing helper uses an iterator over the SDK paginator:\n\n```go\nfunc lists(ctx context.Context, conn *.Client, input *.ListsInput) iter.Seq2[awstypes., error]\n```\n\nThe flatten function shared by Read and List lives in the resource file (`r.flatten` for Framework, `resourceFlatten` for SDKv2).\n\nFlag list resources that don't set `DisplayName`, that re-implement flatten logic instead of sharing with Read, or that omit the `tflog.SetField` per-item logging hook.\n",".agents/skills/review-identity/SKILL.md":"---\nname: review-identity\ndescription: \"Review Terraform AWS Provider Resource Identity: the identity-strategy annotations (@ArnIdentity, @SingletonIdentity, @IdentityAttribute), multi-attribute @ImportIDHandler parsers, and region opt-out for global services. Use when reviewing a PR that adds or changes identity annotations or import-ID parsing in internal/service/**/*.go.\"\n---\n\n\n\n\n# Review: Resource Identity\n\nAssume the `@maintainer` persona. Scope: identity declaration and import-ID parsers. Loaded from `review-pr`.\n\n## Identity strategy — exactly one per resource\n\nEvery new resource declares one identity strategy via comment annotations above the factory function. Flag missing identity annotations on new resources.\n\n| Strategy | Annotations | Use when |\n|---|---|---|\n| ARN | `// @ArnIdentity` (or `// @ArnIdentity(\"arn_attribute\")`) | AWS API uses the ARN as identifier |\n| Singleton | `// @SingletonIdentity` | One per region (or one per account for global services) |\n| Parameterized | one or more `// @IdentityAttribute(\"\")` | Composite or non-ARN identifier |\n\n`@IdentityAttribute` supports keywords: `optional`, `resourceAttributeName`, `testNotNull`, `valueType`, and `identityDuplicateAttributes`.\n\n## Multi-attribute identity needs an `ImportIDHandler`\n\nParameterized identities with more than one attribute require both:\n\n1. An `// @ImportIDHandler(\"\")` annotation (alongside the `@IdentityAttribute` annotations) referencing a type that satisfies `inttypes.ImportIDParser`.\n2. The implementation:\n\n```go\ntype fooImportID struct{}\n\nfunc (fooImportID) Parse(id string) (string, map[string]string, error) {\n // parse a separator-delimited string into named identity attributes\n}\n\nvar _ inttypes.ImportIDParser = fooImportID{}\n```\n\nFlag multi-attribute identity resources that:\n\n- Omit `@ImportIDHandler` — the generator's `Validate()` requires it for multiple parameterized identity and will error.\n- Reference an `@ImportIDHandler` whose target type doesn't satisfy `inttypes.ImportIDParser` (the `var _ inttypes.ImportIDParser = ...{}` assertion catches this).\n- Implement `Parse` without a clear error message describing the expected import-ID format on malformed input.\n\n`@ImportIDHandler` is meaningful for parameterized identities with multiple attributes. Question its use on singleton or single-attribute parameterized resources.\n\n## Region opt-out for global services\n\nGlobal services (CloudFront, IAM, Route 53 hosted zones, etc.) omit `framework.WithRegionModel` from the model and register with `inttypes.ResourceRegionDisabled()` in the service-package generator. Identity-Schema docs for these resources omit the `region` attribute.\n",".agents/skills/resource-identity/SKILL.md":"---\nname: resource-identity\ndescription: \"Add resource identity to a resource in the Terraform AWS provider.\"\n---\n\n\n\n\n# Skill: Add Resource Identity Support\n\nAssume the @maintainer persona.\n\nUse this skill to add resource identity to an existing resource, or when creating a net-new resource.\n\nRefer to [docs/resource-identity.md](../../../docs/resource-identity.md) for instructions.\nThe task is complete when all generated identity acceptance tests (`TestAcc{Resource}_Identity`) are passing.\n\n## When to use\n\nTrigger this skill when the user:\n\n- Says \"add resource identity support\", or similar while referring to a Terraform resource.\n\n## Inputs\n\nRequired:\n\n- The target resource name (e.g. `aws_s3_bucket`).\n\nIf the user provides a human readable name (e.g. \"S3 Bucket\") rather than the Terraform resource, confirm the target resource before proceeding.\n",".agents/skills/go-conventions/SKILL.md":"---\nname: go-conventions\ndescription: \"Fundamental Go conventions for the Terraform AWS provider. Use whenever writing or editing Go in internal/**/*.go (any resource, data source, ephemeral resource, action, test, or helper) before making the change, not only when asked about Go.\"\n---\n\n\n\n\n# Skill: Go Conventions\n\nThree forces pull this repository away from Go's conventions: existing code that violates them, human habits from other languages, and agent instincts trained on other ecosystems. Follow provider practice where it doesn't contradict this skill; where existing code violates this skill, it isn't precedent. Rationale and evidence: [docs/go-for-contributors.md](../../../docs/go-for-contributors.md).\n\n## Naming\n\n- Initialisms keep one case: `ID`, `ARN`, `API`, `VPC`, `KMS`, `URL`, `HTTP`. Write `applicationID`, never `applicationId`, `Arn`, or `Url`.\n- `MixedCaps`, not underscores: `maxRetries`, not `MAX_RETRIES`. Test names (`TestAccFoo_basic`) are the exception.\n- Getters drop `Get`: `Owner()`, not `GetOwner()`.\n- Short locals (`c`, `i`). Receivers are one or two letters, consistent across the type, never `this` or `self`.\n- Don't create packages named `util`, `common`, `misc`, `api`, `types`, or `interfaces`. If callers must alias your package, the name failed. (We ship `internal/types`, `internal/framework/types`, `internal/sdkv2/types`; these are known fails, not precedent.)\n\n## Comments\n\n- Names and structure first. A comment never compensates for code that is hard to read.\n- Delete a comment that restates the line, names the obvious operation, acts as an in-function section header, paraphrases the signature, teaches Go, or explains a name you should rename instead.\n- Keep comments that record constraints, invariants, surprising AWS behavior, or why an obvious approach was rejected.\n- Document every exported declaration: full sentence, begins with the name, ends with a period.\n\n## Organization: function, file, package\n\nThree units, three costs. A separately nameable concept does not earn a boundary.\n\n- **Function**: cheap. Create freely when it improves the code.\n- **File**: organization for humans. Default to editing an existing file; a new file creates no encapsulation, ownership, or API boundary.\n- **Package**: a real API and dependency boundary. Rare, and strongly justified.\n\nThen:\n\n- No `helpers.go`, `common.go`, or `utils.go`. Two or three callers, or \"separation of concerns,\" don't justify a new file.\n- No one-class-per-file or one-concern-per-file habits from Java or Python. Keep related code physically close.\n- Prefer growing an existing package. A healthy one holds several types, files, and responsibilities (`net/http`, `os`, `flag`).\n- If callers will almost always need the new package alongside its parent or neighbor, don't split it.\n- If implementation code routinely imports several sibling packages sharing a path prefix, those aren't meaningful boundaries.\n- If a split forces you to export what used to be unexported, the split is the mistake.\n\n## Abstraction\n\n- Stay concrete until multiple real uses demand otherwise. Similarity is evidence to examine, not an instruction to abstract.\n- Define interfaces where they're consumed, as small as the consumer needs. Never pair an interface with its implementation by default, and never add one so it \"could be mocked.\"\n- A little copying beats a little dependency. Modest duplication is better than an abstraction that obscures control flow.\n- Prefer functions and ordinary data structures over types, builders, managers, registries, and frameworks.\n\n## Control flow and errors\n\n- Linear and top-to-bottom. Handle the exceptional case early and return. No unnecessary `else`.\n- Errors are values: return them, wrap with useful context, inspect deliberately. No exception-like infrastructure or custom error hierarchies.\n- Error strings are lowercase and unpunctuated: `\"reading bucket policy\"`.\n- Never discard an error with `_`. Never panic for an ordinary failure.\n\n## Context\n\n- `ctx context.Context` is the first parameter, always.\n- Never store a `Context` in a struct field; pass it to each method that needs it.\n\n## Commit messages\n\n- Concise subject. Add a body only for intent or non-obvious constraints. A large mechanical change may need barely a word.\n\n## Above all: don't import other languages' architecture\n\nGo prefers concrete code, explicit control flow, locality, small consumer-driven interfaces, and modest repetition over abstraction, indirection, and machinery. When two implementations are equally correct, choose the one with fewer concepts. Absence of machinery is not unfinished work; the machinery is usually the defect.\n\nResist:\n\n- Generics to remove duplication. Use them when the problem itself is generic.\n- DI infrastructure. A function parameter or struct field already is dependency injection.\n- Redesigning production code to enable mocking.\n- Extracting tiny single-use helpers merely to shorten a function.\n- Wrapper types (`Config`, `Options`, `Manager`, `Result`) for tiny concepts. Leave a string a string.\n- Constructors where a useful zero value works.\n- map/filter/reduce pipelines, reflection, or functional composition where a plain loop reads directly.\n",".agents/skills/review-generated/SKILL.md":"---\nname: review-generated\ndescription: \"Review generated code in the Terraform AWS Provider (files ending in _gen.go produced by go generate). Use when a PR changes internal/service/**/*_gen.go — check whether the generator was run, whether the diff is plausible for the source change, and whether files were hand-edited. Do NOT apply hand-written-code rules to these files.\"\n---\n\n\n\n\n# Review: Generated Code\n\nAssume the `@maintainer` persona. Scope: files ending in `_gen.go`, produced by the code generators (`make gen`; templates and generator code live under `internal/generate/`). Common examples: `service_package_gen.go`, `tags_gen.go`, `service_endpoint_resolver_gen.go`, `*_identity_gen_test.go`, `*_tags_gen_test.go`. Loaded from `review-pr`.\n\n## What to review\n\n- Whether the file should exist at all — was the generator run after the source change that motivated it?\n- Diff plausibility — additions/removals match the source changes (a new resource added one annotation should produce a localized diff, not a wholesale rewrite of unrelated registrations).\n- Manual edits — almost always a mistake. The legitimate flow is: change the source (annotation, template, or generator code under `internal/generate/`) → regenerate (`make gen PKG=`, or the provider-wide `make gen` when the change is under `internal/generate/`) → commit the regenerated file. Flag PRs that modify `_gen.go` files without a corresponding source-side change.\n\n## What NOT to review\n\n- Style, naming, formatting, comment wording, import ordering, structural refactors. The generator owns these.\n- Suggested simplifications, \"extract helper\" suggestions, or any cleanup not reachable from the generator's templates.\n- Rules from `review-lifecycle`, `review-schema`, `review-helpers`, `review-identity`, or `review-tags`. Those target hand-written code.\n",".agents/skills/review-pr/SKILL.md":"---\nname: review-pr\ndescription: \"Review a Terraform AWS Provider pull request for correctness and conventions. Start here for any PR review: it holds the cross-cutting review principles and routes to scoped sub-skills (review-lifecycle, review-schema, review-helpers, review-identity, review-tags, review-generated, review-tests, review-tests-helpers, review-docs) based on which files the PR changes. Use when given a hashicorp/terraform-provider-aws PR URL and asked to review it.\"\n---\n\n\n\n\n# Skill: Review a Pull Request\n\nAssume the `@maintainer` persona.\n\nReview a GitHub Pull Request against the Terraform AWS Provider's conventions. This skill carries the cross-cutting principles and a routing table; load the scoped leaf skills for the file types the PR actually changes.\n\n## When to use\n\nTrigger this skill when the user:\n- Provides a `https://github.com/hashicorp/terraform-provider-aws/pull/` URL and asks for a review.\n- Says \"review PR\", \"review this pull request\", or similar, with a PR URL.\n\n## Inputs\n\nRequired:\n- A GitHub PR URL. Extract `` with the regex `/pull/(\\d+)`.\n\nIf the user provides only a PR number, ask for the full URL (or confirm the repo is `hashicorp/terraform-provider-aws`).\n\n## Procedure\n\n1. Fetch the PR's changed files and diff.\n2. Categorize each changed path against the routing table below.\n3. Load the matching leaf skill(s) and apply their rules to the changed lines only.\n4. Always consider compatibility (see below) and, when docs or a changelog are expected but missing, say so.\n5. Consolidate findings into a single review. Cite the rule and propose corrected code.\n\n## Cross-cutting principles\n\n**Compatibility is non-negotiable.** Changes must preserve Terraform state compatibility, upgrade behavior, import behavior, and existing user workflows. Schema changes that force replacement, rename attributes, or break state migration must be flagged unless explicitly justified. For a dedicated compatibility pass, use the `breaking-changes` skill. Do **not** rely on any `breaking-change` label.\n\n**Favor recent patterns; do not enforce legacy ones.** The provider has both modern (Plugin Framework) and legacy (Plugin SDKv2) code. New work follows recent patterns. Do not ask contributors to mimic legacy patterns just because nearby code uses them. When modifying an existing resource, keep the framework it already uses.\n\n**Go style.** Expect modern Go (1.26+): `slices`, `maps`, `cmp`, `iter`, `errors.Is`/`errors.As`, range-over-int/func. Prefer return-early. AWS SDK for Go v2 only. Detect AWS API exceptions with `errs.IsA[*awstypes.]` — never type assertions or `strings.Contains`.\n\n**Review tone.** Be specific, accurate, and to the point. Cite the rule and propose the corrected code. Prioritize correctness, design, and compatibility. Don't hand-author comments for mechanical issues that `make lint`, semgrep, or formatters already enforce — at most, note that automated checks will flag them. Spend the review on what tools can't catch: logic, AWS API usage, state and upgrade compatibility, and test coverage.\n\n## Routing table\n\n| Changed path | Concern | Leaf skill |\n|---|---|---|\n| `internal/service/**/*.go` (non-test) | CRUD, errors, AutoFlex | `review-lifecycle` |\n| `internal/service/**/*.go` (non-test) | Model/attrs/blocks/validators | `review-schema` |\n| `internal/service/**/*.go` (non-test) | Finders, waiters, sweepers, data sources, list resources | `review-helpers` |\n| `internal/service/**/*.go` (non-test) | Resource Identity | `review-identity` |\n| `internal/service/**/*.go` (non-test) | Tags | `review-tags` |\n| `internal/service/**/*_gen.go` | Generated code | `review-generated` |\n| `internal/service/**/*_test.go` | Acceptance/unit test basics | `review-tests` |\n| `internal/service/**/*_test.go` | Exists/Destroy, data source/list/unit tests | `review-tests-helpers` |\n| `website/docs/**/*.markdown` | End-user documentation | `review-docs` |\n\nMultiple leaves may apply to one file. The `internal/service/**/*.go` glob matches both production and test files; the non-test leaves generally don't apply to tests.\n\n## Broader context\n\nSee [`AGENTS.md`](../../../AGENTS.md) for personas, the skills registry, build/test commands, and the AI-usage policy.\n",".agents/skills/review-lifecycle/SKILL.md":"---\nname: review-lifecycle\ndescription: \"Review Terraform AWS Provider resource lifecycle: CRUD step order, smerr/smarterr error handling, and AutoFlex model-to-SDK conversion. Use when reviewing a PR that changes non-test resource logic in internal/service/**/*.go (Create/Read/Update/Delete, error wrapping, flex.Expand/Flatten/Diff).\"\n---\n\n\n\n\n# Review: Resource Lifecycle\n\nAssume the `@maintainer` persona. Scope: CRUD, errors, AutoFlex on non-test resource code (`internal/service/**/*.go`). Loaded from `review-pr`.\n\n## Registration annotations\n\nOne above each factory function. Flag missing annotations or factory-name/resource-name mismatches.\n\n| Construct | Annotation |\n|---|---|\n| Resource (Framework) | `// @FrameworkResource(\"aws__\", name=\"\")` |\n| Data source (Framework) | `// @FrameworkDataSource(\"aws__\", name=\"\")` |\n| List resource (Framework) | `// @FrameworkListResource(\"aws__\")` |\n| List resource (SDKv2) | `// @SDKListResource(\"aws__\")` |\n\n## Struct embeds\n\n```go\ntype fooResource struct {\n framework.ResourceWithModel[fooResourceModel]\n framework.WithTimeouts // only when a timeouts block is present\n framework.WithImportByIdentity // not WithImportByID for new resources\n}\n```\n\n- New resources use `framework.WithImportByIdentity`. Flag `framework.WithImportByID` on new resources.\n- Use `framework.ResourceWithModel[T]` (not `ResourceWithConfigure`).\n- Data sources: `framework.DataSourceWithModel[T]`.\n\n## CRUD step order\n\n**Create:** get client → fetch plan → `flex.Expand` → set tags via `input.Tags = getTagsIn(ctx)` for tagged resources → AWS Create call → `flex.Flatten` output back into the plan → wait → `resp.State.Set(ctx, plan)`. Flag Creates that don't read the output back into the plan — computed attributes stay unknown in state.\n\n**Read:** get client → fetch state → finder → on `retry.NotFound(err)`, append `fwdiag.NewResourceNotFoundWarningDiagnostic(err)`, call `resp.State.RemoveResource(ctx)`, return → flatten → `resp.State.Set`.\n\n**Update:** get client → fetch plan and state → `diff, d := flex.Diff(ctx, plan, state)` → gate on `diff.HasChanges()` → AWS modify → flatten output back into plan → wait → `resp.State.Set(ctx, &plan)`. Flag updates that always call the API without `HasChanges()`, or that re-fetch state after the modify.\n\nOmit Update when the API has no update, every attribute has `RequiresReplace()`, or Create is reused for modify.\n\n**Delete:** get client → fetch state → build input → AWS delete; silently swallow `errs.IsA[*awstypes.ResourceNotFoundException](err)` → wait.\n\n## Errors\n\nUse `smerr`/`smarterr`, never raw `resp.Diagnostics.AddError`.\n\n- Upstream diagnostics: `smerr.AddEnrich(ctx, &resp.Diagnostics, req.Plan.Get(ctx, &plan))` (not the deprecated `EnrichAppend`).\n- API errors: `smerr.AddError(ctx, &resp.Diagnostics, err, smerr.ID, plan.Name.String())`. Always pass `smerr.ID` with an identifier — `plan.Name` in Create, `state.ID` elsewhere.\n- Inside finders/waiters, wrap returned errors with `smarterr.NewError(err)`.\n- Detect AWS exceptions with `errs.IsA[*awstypes.](err)` — never type assertions, never `strings.Contains(err.Error(), ...)`.\n- Use `retry.NotFound(err)` for wrapped not-found from the finder layer.\n\nFlag raw `resp.Diagnostics.AddError`, type assertions on AWS errors, and string-based error matching.\n\n## AutoFlex\n\nUse `flex.Expand` / `flex.Flatten` for model ↔ SDK conversion. Manual per-field `aws.String` / `aws.ToString` is wrong in new Framework code.\n\n- `flex.WithFieldNamePrefix(\"\")` when AWS prefixes its fields (model `ID` ↔ SDK `ThingId`).\n- AWS plural collections become singular blocks (`Parameters` ↔ `parameter`).\n- AutoFlex does **not** copy tags through; see `review-tags`.\n- Update path: `flex.Diff(ctx, plan, state)` then `diff.HasChanges()`.\n",".agents/skills/breaking-changes/SKILL.md":"---\nname: breaking-changes\ndescription: \"Review a PR for possible breaking changes.\"\n---\n\n\n\n\n# Skill: Review PR For Breaking Changes\n\nAssume the @maintainer persona.\n\nDetermine whether a GitHub Pull Request makes a breaking change. If so provide feedback on reasons for the breaking change and possible next steps.\nIf the PR does not make any breaking changes, note that.\n\nDo NOT consider any `breaking-change` label applied to the PR.\n\nReview only the code changes included in the PR.\n\nAuthoritative reference: [docs/breaking-changes.md](../../../docs/breaking-changes.md). When this skill and that document disagree, the document wins.\n\n## When to use\n\nTrigger this skill when the user:\n- Provides a `https://github.com/hashicorp/terraform-provider-aws/pull/` URL and asks for a breaking change review.\n- Says \"review breaking change\", or similar, with a PR URL.\n\n## Inputs\n\nRequired:\n- A GitHub PR URL. Extract `` with the regex `/pull/(\\d+)`.\n\nIf the user provides only a PR number, ask for the full URL (or confirm the repo is `hashicorp/terraform-provider-aws`).\n",".agents/skills/review-tags/SKILL.md":"# review-tags\n\nPath: `.agents/skills/review-tags/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tags/SKILL.md)",".agents/skills/review-tests-helpers/SKILL.md":"# review-tests-helpers\n\nPath: `.agents/skills/review-tests-helpers/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests-helpers/SKILL.md)",".agents/skills/review-tests/SKILL.md":"# review-tests\n\nPath: `.agents/skills/review-tests/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests/SKILL.md)",".agents/skills/smarterr/SKILL.md":"# smarterr\n\nPath: `.agents/skills/smarterr/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/smarterr/SKILL.md)",".copilot/skills/changelog/SKILL.md":"# changelog\n\nPath: `.copilot/skills/changelog/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.copilot/skills/changelog/SKILL.md)","AGENTS.md":"# AI Agent Protocol & Instructions\n\nPath: `AGENTS.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/AGENTS.md)",".github/copilot-instructions.md":"# GitHub Copilot Instructions\n\nPath: `.github/copilot-instructions.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.github/copilot-instructions.md)",".bob/rules/00-overview.md":"# Rules Skill\n\nPath: `.bob/rules/00-overview.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.bob/rules/00-overview.md)","tools/literally/README.md":"# literally Documentation\n\nPath: `tools/literally/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/literally/README.md)","tools/makelign/README.md":"# makelign Documentation\n\nPath: `tools/makelign/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/README.md)","internal/generate/servicepackages/README.md":"# servicepackages Documentation\n\nPath: `internal/generate/servicepackages/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/internal/generate/servicepackages/README.md)",".agents/skills/review-docs/references/import-section.md":"# References Skill\n\nPath: `.agents/skills/review-docs/references/import-section.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-docs/references/import-section.md)","tools/makelign/testdata/golden/docs/continuous-integration.md":"# Docs Skill\n\nPath: `tools/makelign/testdata/golden/docs/continuous-integration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/continuous-integration.md)","tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md":"# Docs Skill\n\nPath: `tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md)"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/AGENTS.md","title":"AI Agent Protocol & Instructions","category":"root-instruction","format":"markdown","content":"# AI Agent Protocol & Instructions\n\nPath: `AGENTS.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/AGENTS.md)","tokens":300,"sizeBytes":166},{"name":"SKILL.md","path":".agents/skills/breaking-changes/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/breaking-changes/SKILL.md","title":"breaking-changes","category":"anthropic-skill","format":"markdown","content":"---\nname: breaking-changes\ndescription: \"Review a PR for possible breaking changes.\"\n---\n\n\n\n\n# Skill: Review PR For Breaking Changes\n\nAssume the @maintainer persona.\n\nDetermine whether a GitHub Pull Request makes a breaking change. If so provide feedback on reasons for the breaking change and possible next steps.\nIf the PR does not make any breaking changes, note that.\n\nDo NOT consider any `breaking-change` label applied to the PR.\n\nReview only the code changes included in the PR.\n\nAuthoritative reference: [docs/breaking-changes.md](../../../docs/breaking-changes.md). When this skill and that document disagree, the document wins.\n\n## When to use\n\nTrigger this skill when the user:\n- Provides a `https://github.com/hashicorp/terraform-provider-aws/pull/` URL and asks for a breaking change review.\n- Says \"review breaking change\", or similar, with a PR URL.\n\n## Inputs\n\nRequired:\n- A GitHub PR URL. Extract `` with the regex `/pull/(\\d+)`.\n\nIf the user provides only a PR number, ask for the full URL (or confirm the repo is `hashicorp/terraform-provider-aws`).\n","frontmatter":{"name":"breaking-changes","description":"Review a PR for possible breaking changes."},"isInternal":false,"tokens":272,"sizeBytes":1163},{"name":"SKILL.md","path":".agents/skills/fixdocs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/fixdocs/SKILL.md","title":"fixdocs","category":"anthropic-skill","format":"markdown","content":"---\nname: fixdocs\ndescription: \"Fix Terraform provider end user documentation issues detected by swissshepherd (ss). Removes an ignored target from the config, runs ss, validates findings, fixes the documentation, and commits.\"\n---\n\n\n\n\n# Skill: Fix End User Documentation With `swissshepherd`\n\nFix Terraform provider documentation issues by removing targets from the swissshepherd ignore list, validating findings against the schema, and correcting the documentation.\n\n## When to use\n\nTrigger this skill when the user:\n- Says \"fix docs\", \"fixdocs\", \"run swissshepherd\", \"run ss\", or similar\n- Asks to remove a target from the swissshepherd ignore list\n- Asks to fix documentation for a specific resource or data source\n- Provides swissshepherd output and asks to fix the findings\n\n## Inputs\n\nOptional:\n- A target name (e.g., `aws_s3_bucket`) or prefix (e.g., `aws_s3_`)\n- A type (`resource`, `data_source`, `ephemeral`, etc.)\n- Number of targets to process (default: 1)\n\nIf no target is specified, pick the next one from `ignore_targets` in `.ci/swissshepherd-weak.hcl`.\n\n## Procedure\n\n### Phase 1: Verify clean baseline\n\n```bash\nmake swissshepherd\n```\n\nThis MUST output \"All checks passed.\" before proceeding. If it doesn't, stop and tell the user the baseline is dirty.\n\n### Phase 2: Select and expose target\n\n1. Open `.ci/swissshepherd-weak.hcl`\n2. Find the target in an `ignore_targets` list (within a `check` block)\n3. Remove the target line from the list\n4. Run swissshepherd to see findings:\n\n```bash\nswissshepherd --config .ci/swissshepherd-weak.hcl --target --type \n```\n\nIf \"All checks passed\" — the target was already clean. Commit the config removal and move to the next target.\n\n### Phase 3: Validate findings\n\nFor each finding, determine if it's valid by checking the schema source of truth:\n\n- **Coverage errors** (\"not documented\", \"does not exist in schema\"): Read the resource's Go source (`internal/service//.go` or `*_data_source.go`) to confirm the attribute/block exists in the schema.\n- **Heading errors**: Check what the heading currently says vs what ss expects.\n- **Label errors**: Check if the attribute is Required, Optional, or Computed in the schema.\n- **Byline errors**: Compare against the expected bylines in the config.\n\nIf a finding appears to be a swissshepherd bug (schema says one thing, ss reports another), note it and skip — do NOT fix the doc incorrectly.\n\n### Phase 4: Fix the documentation\n\n**BOTH WARNINGS AND ERRORS** should be fixed!!\n\nOpen the doc file (path is in the ss output) and apply fixes:\n\n| Finding | Fix |\n|---------|-----|\n| \"block X is not documented\" | Add a `### \\`block_name\\` Block` section with its attributes listed |\n| \"attribute X should be documented in Attribute Reference\" | Add to Attribute Reference section |\n| \"attribute X should not appear in Argument Reference\" | Move from Arguments to Attributes |\n| \"documented attribute X does not exist in schema\" | Remove from docs (it's phantom) |\n| \"missing (Required) or (Optional) label\" | Add the correct label based on schema |\n| \"heading ... should be ...\" | Rename to the suggested heading |\n| \"byline does not match expected texts\" | Replace with a standard byline |\n| \"reference-style link definition\" | Convert `[ref]: url` to inline `[text](url)` |\n| \"avoid \\\"X\\\"; use \\\"Y\\\" instead\" (banned_glosses) | Replace the spelled-out phrase with its abbreviation. Never edit YAML frontmatter to do this — if the flagged text is in `subcategory`/`layout`/`page_title`/`description`, skip and report it instead. |\n\n#### Documentation style rules\n\nWhen adding or editing documentation:\n- Arguments: `* \\`name\\` - (Required) Description.` or `* \\`name\\` - (Optional) Description.`\n- Attributes: `* \\`name\\` - Description.` (no Required/Optional label)\n- Descriptions start with a verb or noun — never \"A \", \"An \", \"The \", \"Specifies \", \"Indicates \"\n- Don't spell out common abbreviations (e.g. ARN, KMS, VPC) — `swissshepherd`'s `banned_glosses` check enforces this; see [Abbreviations](../../../docs/end-user-documentation.md#abbreviations)\n- Boolean arguments: start with \"Whether to...\"\n- Keep alphabetical order within required/optional groups\n- Block sections use heading: `` ### `block_name` Block ``\n- Byline for arguments: \"The following arguments are required:\" / \"The following arguments are optional:\"\n- Byline for attributes: \"In addition to all arguments above, the following attributes are exported:\"\n\nAuthoritative reference: [docs/end-user-documentation.md](../../../docs/end-user-documentation.md). When this skill and that document disagree, the document wins.\n\n### Phase 5: Verify fix\n\n```bash\nswissshepherd --config .ci/swissshepherd-weak.hcl --target --type \n```\n\nMust output \"All checks passed.\" If not, iterate on remaining findings.\n\n### Phase 6: Full verification\n\n```bash\nmake swissshepherd\n```\n\nMust output \"All checks passed.\" to confirm no regressions.\n\n### Phase 7: Commit\n\nStage and commit:\n\n```bash\ngit add .ci/swissshepherd-weak.hcl website/docs/\ngit commit -m \": Fix documentation per swissshepherd\"\n```\n\nUse the resource name without the `aws_` prefix in the commit message scope when it matches a single service. For multi-target batches, use the service name.\n\n## Important constraints\n\n- **Schema is truth.** Never \"fix\" a finding by silencing it if the schema confirms the issue.\n- **One target per commit.** Each removed ignore target gets its own commit for clean git history.\n- **Always use `--config .ci/swissshepherd-weak.hcl`** — running without config produces 20,000+ findings.\n- **Check both check blocks.** A target may appear in `ignore_targets` under `check \"schema_docs\"` AND `check \"import_section\"` (or others). Remove from all.\n- **Don't touch `ignore_contents_check`** unless the user explicitly asks — those are structural exceptions.\n- **Preserve file structure.** Don't rewrite entire doc files. Make minimal, targeted edits.\n- **Nested blocks.** When ss reports \"block X.Y is not documented\", the doc needs a subsection under the parent block's section. Default to `` ### `y` Block `` (just the child name) nested contextually after the parent. If the child name collides with another block of the same name elsewhere in the file (e.g. the same nested block name reused under two different parents), use the dotted path instead: `` ### `x.y` Block ``, with a matching dotted anchor. There is no single correct form — prefer the shorter undotted name, but use dotted paths when needed to keep headings unique. Be consistent within a file: don't mix dotted and undotted for the same block across the doc.\n\n## Example session\n\nUser: \"fix docs for aws_s3_bucket_lifecycle_configuration\"\n\n1. Verify `make swissshepherd` passes\n2. Remove `aws_s3_bucket_lifecycle_configuration` from `ignore_targets` in the `schema_docs` check block\n3. Run `swissshepherd --config .ci/swissshepherd-weak.hcl --target aws_s3_bucket_lifecycle_configuration --type resource`\n4. See: `ERROR [schema_docs] ... block \"rule.filter\" is not documented`\n5. Check Go source — confirm `filter` block exists under `rule`\n6. Add `` ### `filter` Block `` section with its attributes\n7. Re-run ss — passes\n8. Run `make swissshepherd` — passes\n9. Commit\n","frontmatter":{"name":"fixdocs","description":"Fix Terraform provider end user documentation issues detected by swissshepherd (ss). Removes an ignored target from the config, runs ss, validates findings, fixes the documentation, and commits."},"isInternal":false,"tokens":1808,"sizeBytes":7352},{"name":"SKILL.md","path":".agents/skills/go-conventions/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/go-conventions/SKILL.md","title":"go-conventions","category":"anthropic-skill","format":"markdown","content":"---\nname: go-conventions\ndescription: \"Fundamental Go conventions for the Terraform AWS provider. Use whenever writing or editing Go in internal/**/*.go (any resource, data source, ephemeral resource, action, test, or helper) before making the change, not only when asked about Go.\"\n---\n\n\n\n\n# Skill: Go Conventions\n\nThree forces pull this repository away from Go's conventions: existing code that violates them, human habits from other languages, and agent instincts trained on other ecosystems. Follow provider practice where it doesn't contradict this skill; where existing code violates this skill, it isn't precedent. Rationale and evidence: [docs/go-for-contributors.md](../../../docs/go-for-contributors.md).\n\n## Naming\n\n- Initialisms keep one case: `ID`, `ARN`, `API`, `VPC`, `KMS`, `URL`, `HTTP`. Write `applicationID`, never `applicationId`, `Arn`, or `Url`.\n- `MixedCaps`, not underscores: `maxRetries`, not `MAX_RETRIES`. Test names (`TestAccFoo_basic`) are the exception.\n- Getters drop `Get`: `Owner()`, not `GetOwner()`.\n- Short locals (`c`, `i`). Receivers are one or two letters, consistent across the type, never `this` or `self`.\n- Don't create packages named `util`, `common`, `misc`, `api`, `types`, or `interfaces`. If callers must alias your package, the name failed. (We ship `internal/types`, `internal/framework/types`, `internal/sdkv2/types`; these are known fails, not precedent.)\n\n## Comments\n\n- Names and structure first. A comment never compensates for code that is hard to read.\n- Delete a comment that restates the line, names the obvious operation, acts as an in-function section header, paraphrases the signature, teaches Go, or explains a name you should rename instead.\n- Keep comments that record constraints, invariants, surprising AWS behavior, or why an obvious approach was rejected.\n- Document every exported declaration: full sentence, begins with the name, ends with a period.\n\n## Organization: function, file, package\n\nThree units, three costs. A separately nameable concept does not earn a boundary.\n\n- **Function**: cheap. Create freely when it improves the code.\n- **File**: organization for humans. Default to editing an existing file; a new file creates no encapsulation, ownership, or API boundary.\n- **Package**: a real API and dependency boundary. Rare, and strongly justified.\n\nThen:\n\n- No `helpers.go`, `common.go`, or `utils.go`. Two or three callers, or \"separation of concerns,\" don't justify a new file.\n- No one-class-per-file or one-concern-per-file habits from Java or Python. Keep related code physically close.\n- Prefer growing an existing package. A healthy one holds several types, files, and responsibilities (`net/http`, `os`, `flag`).\n- If callers will almost always need the new package alongside its parent or neighbor, don't split it.\n- If implementation code routinely imports several sibling packages sharing a path prefix, those aren't meaningful boundaries.\n- If a split forces you to export what used to be unexported, the split is the mistake.\n\n## Abstraction\n\n- Stay concrete until multiple real uses demand otherwise. Similarity is evidence to examine, not an instruction to abstract.\n- Define interfaces where they're consumed, as small as the consumer needs. Never pair an interface with its implementation by default, and never add one so it \"could be mocked.\"\n- A little copying beats a little dependency. Modest duplication is better than an abstraction that obscures control flow.\n- Prefer functions and ordinary data structures over types, builders, managers, registries, and frameworks.\n\n## Control flow and errors\n\n- Linear and top-to-bottom. Handle the exceptional case early and return. No unnecessary `else`.\n- Errors are values: return them, wrap with useful context, inspect deliberately. No exception-like infrastructure or custom error hierarchies.\n- Error strings are lowercase and unpunctuated: `\"reading bucket policy\"`.\n- Never discard an error with `_`. Never panic for an ordinary failure.\n\n## Context\n\n- `ctx context.Context` is the first parameter, always.\n- Never store a `Context` in a struct field; pass it to each method that needs it.\n\n## Commit messages\n\n- Concise subject. Add a body only for intent or non-obvious constraints. A large mechanical change may need barely a word.\n\n## Above all: don't import other languages' architecture\n\nGo prefers concrete code, explicit control flow, locality, small consumer-driven interfaces, and modest repetition over abstraction, indirection, and machinery. When two implementations are equally correct, choose the one with fewer concepts. Absence of machinery is not unfinished work; the machinery is usually the defect.\n\nResist:\n\n- Generics to remove duplication. Use them when the problem itself is generic.\n- DI infrastructure. A function parameter or struct field already is dependency injection.\n- Redesigning production code to enable mocking.\n- Extracting tiny single-use helpers merely to shorten a function.\n- Wrapper types (`Config`, `Options`, `Manager`, `Result`) for tiny concepts. Leave a string a string.\n- Constructors where a useful zero value works.\n- map/filter/reduce pipelines, reflection, or functional composition where a plain loop reads directly.\n","frontmatter":{"name":"go-conventions","description":"Fundamental Go conventions for the Terraform AWS provider. Use whenever writing or editing Go in internal/**/*.go (any resource, data source, ephemeral resource, action, test, or helper) before making the change, not only when asked about Go."},"isInternal":false,"tokens":1138,"sizeBytes":5304},{"name":"SKILL.md","path":".agents/skills/new-list-resource/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/new-list-resource/SKILL.md","title":"new-list-resource","category":"anthropic-skill","format":"markdown","content":"---\nname: new-list-resource\ndescription: \"Implement a new list resource in the Terraform AWS provider.\"\n---\n\n\n\n\n# Skill: New List Resource\n\nAssume the @maintainer persona.\n\nUse this skill to add new list resource.\n\nRefer to [docs/new-list-resource.md](../../../docs/add-a-new-list-resource.md) for instructions.\nThe task is complete when all list acceptance tests (`TestAcc{Resource}_List`) are passing.\n\n## When to use\n\nTrigger this skill when the user:\n\n- Says \"add a new list resource\", or similar.\n\n## Inputs\n\nRequired:\n\n- The target resource name (e.g. `aws_s3_bucket`).\n\nIf the user provides a human readable name (e.g. \"S3 Bucket\") rather than the Terraform resource, confirm the target resource before proceeding.\n","frontmatter":{"name":"new-list-resource","description":"Implement a new list resource in the Terraform AWS provider."},"isInternal":false,"tokens":188,"sizeBytes":802},{"name":"SKILL.md","path":".agents/skills/resource-identity/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/resource-identity/SKILL.md","title":"resource-identity","category":"anthropic-skill","format":"markdown","content":"---\nname: resource-identity\ndescription: \"Add resource identity to a resource in the Terraform AWS provider.\"\n---\n\n\n\n\n# Skill: Add Resource Identity Support\n\nAssume the @maintainer persona.\n\nUse this skill to add resource identity to an existing resource, or when creating a net-new resource.\n\nRefer to [docs/resource-identity.md](../../../docs/resource-identity.md) for instructions.\nThe task is complete when all generated identity acceptance tests (`TestAcc{Resource}_Identity`) are passing.\n\n## When to use\n\nTrigger this skill when the user:\n\n- Says \"add resource identity support\", or similar while referring to a Terraform resource.\n\n## Inputs\n\nRequired:\n\n- The target resource name (e.g. `aws_s3_bucket`).\n\nIf the user provides a human readable name (e.g. \"S3 Bucket\") rather than the Terraform resource, confirm the target resource before proceeding.\n","frontmatter":{"name":"resource-identity","description":"Add resource identity to a resource in the Terraform AWS provider."},"isInternal":false,"tokens":206,"sizeBytes":939},{"name":"import-section.md","path":".agents/skills/review-docs/references/import-section.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-docs/references/import-section.md","title":"References Skill","category":"anthropic-skill","format":"markdown","content":"# References Skill\n\nPath: `.agents/skills/review-docs/references/import-section.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-docs/references/import-section.md)","tokens":300,"sizeBytes":242},{"name":"SKILL.md","path":".agents/skills/review-docs/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-docs/SKILL.md","title":"review-docs","category":"anthropic-skill","format":"markdown","content":"---\nname: review-docs\ndescription: \"Review a Terraform AWS Provider PR's end-user documentation (website/docs/**/*.markdown): whether docs are needed, description openings, argument/attribute style, section structure, tags wording, code fences, and the Import + Identity Schema section. Use when reviewing documentation changes, or when a PR adds/changes a resource or data source and its docs should be checked.\"\n---\n\n\n\n\n# Review: End-User Documentation\n\nAssume the `@maintainer` persona. Scope: resource docs (`r/`), data source docs (`d/`), list resource docs (`list/`) under `website/docs/`, rendered at the Terraform Registry. Loaded from `review-pr`.\n\nAuthoritative reference: [docs/end-user-documentation.md](../../../docs/end-user-documentation.md). When this skill and that document disagree, the document wins. Do not review CHANGELOG updates.\n\n## Should the PR include docs?\n\n- If the PR adds or changes user-facing behavior (new resource/data source/attribute) but has no doc change, say what's missing.\n- If the PR removes behavior but leaves stale docs, say what to remove.\n- Review only the changed docs; don't review unchanged documentation except as needed for context.\n\n## Description openings\n\nThe single-line `description:` in frontmatter and the first paragraph after the H1 must use the verb for the doc type:\n\n| Doc type | Opening verb |\n|---|---|\n| Resource | `Manages …` |\n| Data source | `Provides details about …` |\n| List resource | `Lists …` |\n\nFlag openings like \"This resource…\", \"Use this resource…\", \"Allows you to…\", \"Resource for…\", or \"Terraform resource for…\".\n\n## Argument and attribute description style\n\n**Forbidden opening words**: `An`, `A`, `The`, `Defines`, `Indicates`, `Specifies`. Rewrite \"Indicates the amount of storage\" → \"Amount of storage.\" Always propose the corrected wording.\n\n**Don't spell out common abbreviations** (e.g. \"Amazon Resource Name (ARN)\" → \"ARN\"). See [Abbreviations](../../../docs/end-user-documentation.md#abbreviations) for the full list and rationale.\n\n**Boolean arguments** must start with `Whether to`:\n\n- ✓ `(Optional) Whether to enable logging.`\n- ✗ `(Optional) Enables logging.` / `(Optional) If true, enables logging.`\n\n**`(Required)` / `(Optional)` / `(Read-Only)`** are the only valid markers, capitalized in parentheses, immediately after the hyphen.\n\n**Examples use `example`, not `test`.** Flag any HCL block in docs that uses `\"test\"` as a resource label or `name = \"test\"`.\n\n## Section structure\n\nResource docs, in this order:\n\n1. `# Resource: `\n2. `## Example Usage` (with at least `### Basic Usage`)\n3. `## Argument Reference`\n4. `## Attribute Reference`\n5. `## Timeouts` *(only if the resource exposes timeouts)*\n6. `## Import` *(only for resources)*\n\nData source and list resource docs have only Example Usage, Argument Reference, and Attribute Reference.\n\n## Argument Reference\n\nRequired arguments come first, separated from optional by a header line. Alphabetize. Use these exact lead-ins:\n\n```\nThe following arguments are required:\n\n* `req_arg` - (Required) ...\n\nThe following arguments are optional:\n\n* `opt_arg` - (Optional) ...\n```\n\nIf there are no required arguments, drop the \"required\" subsection — don't write \"There are no required arguments.\"\n\nFor tagged resources, `tags` lives under optional arguments with this exact wording:\n\n```\n* `tags` - (Optional) Map of tags assigned to the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n```\n\n## Attribute Reference\n\nOpen with `This resource exports the following attributes in addition to the arguments above:` (substitute \"data source\" / \"list resource\"). Flag pages that re-document arguments here — only computed attributes belong. Alphabetize.\n\nFor tagged resources, `tags_all` has this exact wording:\n\n```\n* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).\n```\n\nFor tagged data sources, `tags` is a top-level computed attribute and there is no `tags_all`.\n\n## Code fences\n\nUse `terraform` for `.tf` blocks and `console` for shell examples. Flag `hcl` (use `terraform`) or unfenced shell commands.\n\n## Style points\n\n- Active voice, present tense. Don't document past or future behavior.\n- Single-line description in frontmatter — flag multi-paragraph descriptions.\n- Consistent terminology — match the AWS service's nouns; don't invent synonyms.\n\n## Import section & Identity Schema\n\nThe `## Import` section (resources only) and its `Identity Schema` subsection have a precise required structure. See [`references/import-section.md`](references/import-section.md) for the full checklist and load it when the PR touches a resource's Import section.\n","frontmatter":{"name":"review-docs","description":"Review a Terraform AWS Provider PR's end-user documentation (website/docs/**/*.markdown): whether docs are needed, description openings, argument/attribute style, section structure, tags wording, code fences, and the Import + Identity Schema section. Use when reviewing documentation changes, or when a PR adds/changes a resource or data source and its docs should be checked."},"isInternal":false,"tokens":1131,"sizeBytes":5094},{"name":"SKILL.md","path":".agents/skills/review-generated/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-generated/SKILL.md","title":"review-generated","category":"anthropic-skill","format":"markdown","content":"---\nname: review-generated\ndescription: \"Review generated code in the Terraform AWS Provider (files ending in _gen.go produced by go generate). Use when a PR changes internal/service/**/*_gen.go — check whether the generator was run, whether the diff is plausible for the source change, and whether files were hand-edited. Do NOT apply hand-written-code rules to these files.\"\n---\n\n\n\n\n# Review: Generated Code\n\nAssume the `@maintainer` persona. Scope: files ending in `_gen.go`, produced by the code generators (`make gen`; templates and generator code live under `internal/generate/`). Common examples: `service_package_gen.go`, `tags_gen.go`, `service_endpoint_resolver_gen.go`, `*_identity_gen_test.go`, `*_tags_gen_test.go`. Loaded from `review-pr`.\n\n## What to review\n\n- Whether the file should exist at all — was the generator run after the source change that motivated it?\n- Diff plausibility — additions/removals match the source changes (a new resource added one annotation should produce a localized diff, not a wholesale rewrite of unrelated registrations).\n- Manual edits — almost always a mistake. The legitimate flow is: change the source (annotation, template, or generator code under `internal/generate/`) → regenerate (`make gen PKG=`, or the provider-wide `make gen` when the change is under `internal/generate/`) → commit the regenerated file. Flag PRs that modify `_gen.go` files without a corresponding source-side change.\n\n## What NOT to review\n\n- Style, naming, formatting, comment wording, import ordering, structural refactors. The generator owns these.\n- Suggested simplifications, \"extract helper\" suggestions, or any cleanup not reachable from the generator's templates.\n- Rules from `review-lifecycle`, `review-schema`, `review-helpers`, `review-identity`, or `review-tags`. Those target hand-written code.\n","frontmatter":{"name":"review-generated","description":"Review generated code in the Terraform AWS Provider (files ending in _gen.go produced by go generate). Use when a PR changes internal/service/**/*_gen.go — check whether the generator was run, whether the diff is plausible for the source change, and whether files were hand-edited. Do NOT apply hand-written-code rules to these files."},"isInternal":false,"tokens":421,"sizeBytes":1937},{"name":"SKILL.md","path":".agents/skills/review-helpers/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-helpers/SKILL.md","title":"review-helpers","category":"anthropic-skill","format":"markdown","content":"---\nname: review-helpers\ndescription: \"Review Terraform AWS Provider helper code: finders, status functions, waiters, sweepers, data sources, and list resources. Use when reviewing a PR that changes non-test internal/service/**/*.go code for resource lookup, retry.StateChangeConf waiters, NewSweepResource sweepers, DataSourceWithModel data sources, or Framework/SDKv2 list resources.\"\n---\n\n\n\n\n# Review: Helpers, Sweepers, Data Sources, List Resources\n\nAssume the `@maintainer` persona. Scope: finders, status, waiters, sweepers, data sources, list resources. Loaded from `review-pr`.\n\n## Finders, status, waiters\n\n- Finder signature: `findByID(ctx context.Context, conn *.Client, id string) (*awstypes., error)`. Variants by ARN/Name use the same shape.\n- On `*awstypes.ResourceNotFoundException`, return `smarterr.NewError(&retry.NotFoundError{LastError: err})`.\n- Status function reuses the finder and returns `retry.StateRefreshFunc`. Design status so one function powers create, update, and delete waiters.\n- Waiters use `retry.StateChangeConf`. Created/updated waiters typically set `NotFoundChecks: 20` and `ContinuousTargetOccurence: 2`. Deleted waiters use empty `Target` with `Pending` covering deletion-in-progress states.\n- Prefer SDK-provided status constants (e.g. `awstypes.StatusInProgress`) over package-level string consts.\n- Finders and `ResName` constants referenced in tests must be re-exported via `exports_test.go`.\n\nFlag finders that return raw errors (must wrap with `smarterr.NewError`), status that duplicates finder logic, or hand-rolled polling loops in place of `retry.StateChangeConf`.\n\n## Sweepers\n\nEach new resource needs a sweeper. Iterate the SDK paginator, build via `framework.NewSweepResource(newResource, client, framework.NewAttribute(names.AttrID, aws.ToString(v.Id)))` (where `framework` is `internal/sweep/framework`), and register in the package's `sweep.go` with `awsv2.Register(\"aws__\", sweeps, ...optionalDeps)`. Pass multiple `framework.NewAttribute(...)` arguments for composite identity.\n\nFlag new resources without a sweeper, sweepers that don't propagate paginator errors via `smarterr.NewError`, and sweepers using import aliases other than `framework` for `internal/sweep/framework`.\n\n## Data sources\n\nData sources have only a `Read` method.\n\n- Use `framework.DataSourceWithModel[T]`.\n- Schema attributes are `Required` or `Optional` for search criteria; everything else is `Computed`.\n- Attributes that are `Required` on the corresponding resource are typically `Computed` on the data source unless they form lookup criteria.\n- No configurable timeouts.\n- Tagged data sources expose a single computed `tags` attribute (no `tags_all`).\n\n## List resources\n\nFramework path embeds the corresponding underlying resource. SDKv2 path uses `framework.ListResourceWithSDKv2Resource`.\n\nThe `List` method:\n\n1. Get the client.\n2. Fetch the config (only when the list takes query attributes such as a parent ID).\n3. Stream results from a paginated AWS List API.\n4. Set logging fields per item (typically the ARN) via `tflog.SetField(ctx, logging.ResourceAttributeKey(...), ...)`.\n5. Set identifying attributes for each result.\n6. Set `result.DisplayName` to a human-readable identifier (typically the resource name).\n\nThe listing helper uses an iterator over the SDK paginator:\n\n```go\nfunc lists(ctx context.Context, conn *.Client, input *.ListsInput) iter.Seq2[awstypes., error]\n```\n\nThe flatten function shared by Read and List lives in the resource file (`r.flatten` for Framework, `resourceFlatten` for SDKv2).\n\nFlag list resources that don't set `DisplayName`, that re-implement flatten logic instead of sharing with Read, or that omit the `tflog.SetField` per-item logging hook.\n","frontmatter":{"name":"review-helpers","description":"Review Terraform AWS Provider helper code: finders, status functions, waiters, sweepers, data sources, and list resources. Use when reviewing a PR that changes non-test internal/service/**/*.go code for resource lookup, retry.StateChangeConf waiters, NewSweepResource sweepers, DataSourceWithModel data sources, or Framework/SDKv2 list resources."},"isInternal":false,"tokens":911,"sizeBytes":3911},{"name":"SKILL.md","path":".agents/skills/review-identity/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-identity/SKILL.md","title":"review-identity","category":"anthropic-skill","format":"markdown","content":"---\nname: review-identity\ndescription: \"Review Terraform AWS Provider Resource Identity: the identity-strategy annotations (@ArnIdentity, @SingletonIdentity, @IdentityAttribute), multi-attribute @ImportIDHandler parsers, and region opt-out for global services. Use when reviewing a PR that adds or changes identity annotations or import-ID parsing in internal/service/**/*.go.\"\n---\n\n\n\n\n# Review: Resource Identity\n\nAssume the `@maintainer` persona. Scope: identity declaration and import-ID parsers. Loaded from `review-pr`.\n\n## Identity strategy — exactly one per resource\n\nEvery new resource declares one identity strategy via comment annotations above the factory function. Flag missing identity annotations on new resources.\n\n| Strategy | Annotations | Use when |\n|---|---|---|\n| ARN | `// @ArnIdentity` (or `// @ArnIdentity(\"arn_attribute\")`) | AWS API uses the ARN as identifier |\n| Singleton | `// @SingletonIdentity` | One per region (or one per account for global services) |\n| Parameterized | one or more `// @IdentityAttribute(\"\")` | Composite or non-ARN identifier |\n\n`@IdentityAttribute` supports keywords: `optional`, `resourceAttributeName`, `testNotNull`, `valueType`, and `identityDuplicateAttributes`.\n\n## Multi-attribute identity needs an `ImportIDHandler`\n\nParameterized identities with more than one attribute require both:\n\n1. An `// @ImportIDHandler(\"\")` annotation (alongside the `@IdentityAttribute` annotations) referencing a type that satisfies `inttypes.ImportIDParser`.\n2. The implementation:\n\n```go\ntype fooImportID struct{}\n\nfunc (fooImportID) Parse(id string) (string, map[string]string, error) {\n // parse a separator-delimited string into named identity attributes\n}\n\nvar _ inttypes.ImportIDParser = fooImportID{}\n```\n\nFlag multi-attribute identity resources that:\n\n- Omit `@ImportIDHandler` — the generator's `Validate()` requires it for multiple parameterized identity and will error.\n- Reference an `@ImportIDHandler` whose target type doesn't satisfy `inttypes.ImportIDParser` (the `var _ inttypes.ImportIDParser = ...{}` assertion catches this).\n- Implement `Parse` without a clear error message describing the expected import-ID format on malformed input.\n\n`@ImportIDHandler` is meaningful for parameterized identities with multiple attributes. Question its use on singleton or single-attribute parameterized resources.\n\n## Region opt-out for global services\n\nGlobal services (CloudFront, IAM, Route 53 hosted zones, etc.) omit `framework.WithRegionModel` from the model and register with `inttypes.ResourceRegionDisabled()` in the service-package generator. Identity-Schema docs for these resources omit the `region` attribute.\n","frontmatter":{"name":"review-identity","description":"Review Terraform AWS Provider Resource Identity: the identity-strategy annotations (@ArnIdentity, @SingletonIdentity, @IdentityAttribute), multi-attribute @ImportIDHandler parsers, and region opt-out for global services. Use when reviewing a PR that adds or changes identity annotations or import-ID parsing in internal/service/**/*.go."},"isInternal":false,"tokens":594,"sizeBytes":2772},{"name":"SKILL.md","path":".agents/skills/review-lifecycle/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-lifecycle/SKILL.md","title":"review-lifecycle","category":"anthropic-skill","format":"markdown","content":"---\nname: review-lifecycle\ndescription: \"Review Terraform AWS Provider resource lifecycle: CRUD step order, smerr/smarterr error handling, and AutoFlex model-to-SDK conversion. Use when reviewing a PR that changes non-test resource logic in internal/service/**/*.go (Create/Read/Update/Delete, error wrapping, flex.Expand/Flatten/Diff).\"\n---\n\n\n\n\n# Review: Resource Lifecycle\n\nAssume the `@maintainer` persona. Scope: CRUD, errors, AutoFlex on non-test resource code (`internal/service/**/*.go`). Loaded from `review-pr`.\n\n## Registration annotations\n\nOne above each factory function. Flag missing annotations or factory-name/resource-name mismatches.\n\n| Construct | Annotation |\n|---|---|\n| Resource (Framework) | `// @FrameworkResource(\"aws__\", name=\"\")` |\n| Data source (Framework) | `// @FrameworkDataSource(\"aws__\", name=\"\")` |\n| List resource (Framework) | `// @FrameworkListResource(\"aws__\")` |\n| List resource (SDKv2) | `// @SDKListResource(\"aws__\")` |\n\n## Struct embeds\n\n```go\ntype fooResource struct {\n framework.ResourceWithModel[fooResourceModel]\n framework.WithTimeouts // only when a timeouts block is present\n framework.WithImportByIdentity // not WithImportByID for new resources\n}\n```\n\n- New resources use `framework.WithImportByIdentity`. Flag `framework.WithImportByID` on new resources.\n- Use `framework.ResourceWithModel[T]` (not `ResourceWithConfigure`).\n- Data sources: `framework.DataSourceWithModel[T]`.\n\n## CRUD step order\n\n**Create:** get client → fetch plan → `flex.Expand` → set tags via `input.Tags = getTagsIn(ctx)` for tagged resources → AWS Create call → `flex.Flatten` output back into the plan → wait → `resp.State.Set(ctx, plan)`. Flag Creates that don't read the output back into the plan — computed attributes stay unknown in state.\n\n**Read:** get client → fetch state → finder → on `retry.NotFound(err)`, append `fwdiag.NewResourceNotFoundWarningDiagnostic(err)`, call `resp.State.RemoveResource(ctx)`, return → flatten → `resp.State.Set`.\n\n**Update:** get client → fetch plan and state → `diff, d := flex.Diff(ctx, plan, state)` → gate on `diff.HasChanges()` → AWS modify → flatten output back into plan → wait → `resp.State.Set(ctx, &plan)`. Flag updates that always call the API without `HasChanges()`, or that re-fetch state after the modify.\n\nOmit Update when the API has no update, every attribute has `RequiresReplace()`, or Create is reused for modify.\n\n**Delete:** get client → fetch state → build input → AWS delete; silently swallow `errs.IsA[*awstypes.ResourceNotFoundException](err)` → wait.\n\n## Errors\n\nUse `smerr`/`smarterr`, never raw `resp.Diagnostics.AddError`.\n\n- Upstream diagnostics: `smerr.AddEnrich(ctx, &resp.Diagnostics, req.Plan.Get(ctx, &plan))` (not the deprecated `EnrichAppend`).\n- API errors: `smerr.AddError(ctx, &resp.Diagnostics, err, smerr.ID, plan.Name.String())`. Always pass `smerr.ID` with an identifier — `plan.Name` in Create, `state.ID` elsewhere.\n- Inside finders/waiters, wrap returned errors with `smarterr.NewError(err)`.\n- Detect AWS exceptions with `errs.IsA[*awstypes.](err)` — never type assertions, never `strings.Contains(err.Error(), ...)`.\n- Use `retry.NotFound(err)` for wrapped not-found from the finder layer.\n\nFlag raw `resp.Diagnostics.AddError`, type assertions on AWS errors, and string-based error matching.\n\n## AutoFlex\n\nUse `flex.Expand` / `flex.Flatten` for model ↔ SDK conversion. Manual per-field `aws.String` / `aws.ToString` is wrong in new Framework code.\n\n- `flex.WithFieldNamePrefix(\"\")` when AWS prefixes its fields (model `ID` ↔ SDK `ThingId`).\n- AWS plural collections become singular blocks (`Parameters` ↔ `parameter`).\n- AutoFlex does **not** copy tags through; see `review-tags`.\n- Update path: `flex.Diff(ctx, plan, state)` then `diff.HasChanges()`.\n","frontmatter":{"name":"review-lifecycle","description":"Review Terraform AWS Provider resource lifecycle: CRUD step order, smerr/smarterr error handling, and AutoFlex model-to-SDK conversion. Use when reviewing a PR that changes non-test resource logic in internal/service/**/*.go (Create/Read/Update/Delete, error wrapping, flex.Expand/Flatten/Diff)."},"isInternal":false,"tokens":966,"sizeBytes":4015},{"name":"SKILL.md","path":".agents/skills/review-pr/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-pr/SKILL.md","title":"review-pr","category":"anthropic-skill","format":"markdown","content":"---\nname: review-pr\ndescription: \"Review a Terraform AWS Provider pull request for correctness and conventions. Start here for any PR review: it holds the cross-cutting review principles and routes to scoped sub-skills (review-lifecycle, review-schema, review-helpers, review-identity, review-tags, review-generated, review-tests, review-tests-helpers, review-docs) based on which files the PR changes. Use when given a hashicorp/terraform-provider-aws PR URL and asked to review it.\"\n---\n\n\n\n\n# Skill: Review a Pull Request\n\nAssume the `@maintainer` persona.\n\nReview a GitHub Pull Request against the Terraform AWS Provider's conventions. This skill carries the cross-cutting principles and a routing table; load the scoped leaf skills for the file types the PR actually changes.\n\n## When to use\n\nTrigger this skill when the user:\n- Provides a `https://github.com/hashicorp/terraform-provider-aws/pull/` URL and asks for a review.\n- Says \"review PR\", \"review this pull request\", or similar, with a PR URL.\n\n## Inputs\n\nRequired:\n- A GitHub PR URL. Extract `` with the regex `/pull/(\\d+)`.\n\nIf the user provides only a PR number, ask for the full URL (or confirm the repo is `hashicorp/terraform-provider-aws`).\n\n## Procedure\n\n1. Fetch the PR's changed files and diff.\n2. Categorize each changed path against the routing table below.\n3. Load the matching leaf skill(s) and apply their rules to the changed lines only.\n4. Always consider compatibility (see below) and, when docs or a changelog are expected but missing, say so.\n5. Consolidate findings into a single review. Cite the rule and propose corrected code.\n\n## Cross-cutting principles\n\n**Compatibility is non-negotiable.** Changes must preserve Terraform state compatibility, upgrade behavior, import behavior, and existing user workflows. Schema changes that force replacement, rename attributes, or break state migration must be flagged unless explicitly justified. For a dedicated compatibility pass, use the `breaking-changes` skill. Do **not** rely on any `breaking-change` label.\n\n**Favor recent patterns; do not enforce legacy ones.** The provider has both modern (Plugin Framework) and legacy (Plugin SDKv2) code. New work follows recent patterns. Do not ask contributors to mimic legacy patterns just because nearby code uses them. When modifying an existing resource, keep the framework it already uses.\n\n**Go style.** Expect modern Go (1.26+): `slices`, `maps`, `cmp`, `iter`, `errors.Is`/`errors.As`, range-over-int/func. Prefer return-early. AWS SDK for Go v2 only. Detect AWS API exceptions with `errs.IsA[*awstypes.]` — never type assertions or `strings.Contains`.\n\n**Review tone.** Be specific, accurate, and to the point. Cite the rule and propose the corrected code. Prioritize correctness, design, and compatibility. Don't hand-author comments for mechanical issues that `make lint`, semgrep, or formatters already enforce — at most, note that automated checks will flag them. Spend the review on what tools can't catch: logic, AWS API usage, state and upgrade compatibility, and test coverage.\n\n## Routing table\n\n| Changed path | Concern | Leaf skill |\n|---|---|---|\n| `internal/service/**/*.go` (non-test) | CRUD, errors, AutoFlex | `review-lifecycle` |\n| `internal/service/**/*.go` (non-test) | Model/attrs/blocks/validators | `review-schema` |\n| `internal/service/**/*.go` (non-test) | Finders, waiters, sweepers, data sources, list resources | `review-helpers` |\n| `internal/service/**/*.go` (non-test) | Resource Identity | `review-identity` |\n| `internal/service/**/*.go` (non-test) | Tags | `review-tags` |\n| `internal/service/**/*_gen.go` | Generated code | `review-generated` |\n| `internal/service/**/*_test.go` | Acceptance/unit test basics | `review-tests` |\n| `internal/service/**/*_test.go` | Exists/Destroy, data source/list/unit tests | `review-tests-helpers` |\n| `website/docs/**/*.markdown` | End-user documentation | `review-docs` |\n\nMultiple leaves may apply to one file. The `internal/service/**/*.go` glob matches both production and test files; the non-test leaves generally don't apply to tests.\n\n## Broader context\n\nSee [`AGENTS.md`](../../../AGENTS.md) for personas, the skills registry, build/test commands, and the AI-usage policy.\n","frontmatter":{"name":"review-pr","description":"Review a Terraform AWS Provider pull request for correctness and conventions. Start here for any PR review: it holds the cross-cutting review principles and routes to scoped sub-skills (review-lifecycle, review-schema, review-helpers, review-identity, review-tags, review-generated, review-tests, review-tests-helpers, review-docs) based on which files the PR changes. Use when given a hashicorp/terraform-provider-aws PR URL and asked to review it."},"isInternal":false,"tokens":1017,"sizeBytes":4345},{"name":"SKILL.md","path":".agents/skills/review-schema/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-schema/SKILL.md","title":"review-schema","category":"anthropic-skill","format":"markdown","content":"---\nname: review-schema\ndescription: \"Review Terraform AWS Provider Plugin Framework schema shape: model structs, Required/Optional/Computed combinations, plan modifiers (no ForceNew), nested-block custom types, validators, sensitive attributes, and timeouts. Use when reviewing a PR that changes resource or data-source schema in internal/service/**/*.go.\"\n---\n\n\n\n\n# Review: Schema & Resource Shape\n\nAssume the `@maintainer` persona. Scope: model struct, attributes, blocks, validators, plan modifiers, timeouts on non-test resource code. Loaded from `review-pr`.\n\n## Model struct\n\n```go\ntype fooResourceModel struct {\n framework.WithRegionModel // first field; omit for global services only\n // attributes...\n Timeouts timeouts.Value `tfsdk:\"timeouts\"` // only when a timeouts block is present\n}\n```\n\n- `framework.WithRegionModel` is the first embedded field for regional resources/data sources/list resources. Global services (CloudFront, IAM, Route 53 hosted zones, etc.) omit it and register with `inttypes.ResourceRegionDisabled()`.\n- `tfsdk` tags must match schema attribute names exactly (snake_case).\n- Use Plugin Framework types (`types.String`, etc.) and `fwtypes.ListNestedObjectValueOf[T]` for nested blocks.\n- Time fields use `timetypes.RFC3339`, never `types.String`.\n\n## Attribute rules\n\n- Attribute names are `snake_case`.\n- **Alphabetize** within `Attributes` and within `Blocks`. No blank lines between attributes.\n- Use `internal/names` constants (`names.AttrARN`, `names.AttrName`, `names.AttrTags`, `names.AttrTagsAll`, `names.AttrTimeouts`, etc.) instead of string literals when one exists.\n\n### Required / Optional / Computed\n\nOnly four valid combinations. Flag any other.\n\n| Required | Optional | Computed | When |\n|---|---|---|---|\n| ✓ | | | User must supply |\n| | ✓ | | User may supply; **never use `Default` here** |\n| | | ✓ | Read-only |\n| | ✓ | ✓ | User or provider supplies; required pairing for `Default` |\n\nPrefer `Optional + Computed` over `Optional + Default` when AWS supplies a server-side default.\n\n### `id` attribute\n\nPlugin Framework does **not** require an `id` attribute. Include `names.AttrID: framework.IDAttribute()` only when the AWS API returns an `Id` field. Flag schemas that include it on ARN-identified resources just by habit.\n\n## Plan modifiers (no `ForceNew`)\n\nPlugin Framework uses plan modifiers, not `ForceNew`. Flag any new Framework code that mentions `ForceNew`.\n\n- `stringplanmodifier.RequiresReplace()` — replaces `ForceNew: true`\n- `stringplanmodifier.UseStateForUnknown()` — keeps a computed value stable across plans\n\n## Validators replace `MaxItems`/`MinItems`\n\nUse `listvalidator.SizeAtMost(N)` / `SizeAtLeast(N)` (and `setvalidator` equivalents) on the block, not `MaxItems`/`MinItems` on the attribute. For a single nested object, combine `listvalidator.SizeAtMost(1)` with a list nested block.\n\n## Nested blocks need a custom type\n\n`schema.ListNestedBlock` requires `CustomType: fwtypes.NewListNestedObjectTypeOf[complexArgumentModel](ctx)`. The model field is `fwtypes.ListNestedObjectValueOf[complexArgumentModel]`. Flag nested blocks that omit `CustomType`.\n\nFor sets of strings, use `CustomType: fwtypes.SetOfStringType` with `fwtypes.SetValueOf[types.String]`.\n\nFor AWS API map blocks, the provider schema has no map-of-objects type — use `MapBlockKey`. Flag attempts to model AWS map blocks with `schema.MapAttribute`.\n\n## Sensitive attributes\n\nMark credentials, tokens, and write-only secrets `Sensitive: true`. Flag computed or required attributes that obviously hold secret material but aren't marked sensitive.\n\n## Timeouts\n\nResources with configurable timeouts use `timeouts.Block(ctx, timeouts.Opts{Create: true, Update: true, Delete: true})` and set defaults via `r.SetDefaultCreateTimeout` / `SetDefaultUpdateTimeout` / `SetDefaultDeleteTimeout` that reflect AWS API behavior — RDS Create can take 30–60 minutes; an EC2 SG takes seconds. Don't use arbitrary round numbers. Data sources and list resources do not expose configurable timeouts.\n","frontmatter":{"name":"review-schema","description":"Review Terraform AWS Provider Plugin Framework schema shape: model structs, Required/Optional/Computed combinations, plan modifiers (no ForceNew), nested-block custom types, validators, sensitive attributes, and timeouts. Use when reviewing a PR that changes resource or data-source schema in internal/service/**/*.go."},"isInternal":false,"tokens":957,"sizeBytes":4136},{"name":"SKILL.md","path":".agents/skills/review-tags/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tags/SKILL.md","title":"review-tags","category":"anthropic-skill","format":"markdown","content":"# review-tags\n\nPath: `.agents/skills/review-tags/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tags/SKILL.md)","tokens":300,"sizeBytes":197},{"name":"SKILL.md","path":".agents/skills/review-tests-helpers/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests-helpers/SKILL.md","title":"review-tests-helpers","category":"anthropic-skill","format":"markdown","content":"# review-tests-helpers\n\nPath: `.agents/skills/review-tests-helpers/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests-helpers/SKILL.md)","tokens":300,"sizeBytes":224},{"name":"SKILL.md","path":".agents/skills/review-tests/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests/SKILL.md","title":"review-tests","category":"anthropic-skill","format":"markdown","content":"# review-tests\n\nPath: `.agents/skills/review-tests/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests/SKILL.md)","tokens":300,"sizeBytes":200},{"name":"SKILL.md","path":".agents/skills/smarterr/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/smarterr/SKILL.md","title":"smarterr","category":"anthropic-skill","format":"markdown","content":"# smarterr\n\nPath: `.agents/skills/smarterr/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/smarterr/SKILL.md)","tokens":300,"sizeBytes":188},{"name":"00-overview.md","path":".bob/rules/00-overview.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.bob/rules/00-overview.md","title":"Rules Skill","category":"anthropic-skill","format":"markdown","content":"# Rules Skill\n\nPath: `.bob/rules/00-overview.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.bob/rules/00-overview.md)","tokens":300,"sizeBytes":177},{"name":"SKILL.md","path":".copilot/skills/changelog/SKILL.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.copilot/skills/changelog/SKILL.md","title":"changelog","category":"anthropic-skill","format":"markdown","content":"# changelog\n\nPath: `.copilot/skills/changelog/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.copilot/skills/changelog/SKILL.md)","tokens":300,"sizeBytes":193},{"name":"continuous-integration.md","path":"tools/makelign/testdata/golden/docs/continuous-integration.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/continuous-integration.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# Docs Skill\n\nPath: `tools/makelign/testdata/golden/docs/continuous-integration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/continuous-integration.md)","tokens":300,"sizeBytes":248},{"name":"makefile-cheat-sheet.md","path":"tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md","title":"Docs Skill","category":"anthropic-skill","format":"markdown","content":"# Docs Skill\n\nPath: `tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md)","tokens":300,"sizeBytes":244},{"name":"copilot-instructions.md","path":".github/copilot-instructions.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.github/copilot-instructions.md","title":"GitHub Copilot Instructions","category":"copilot-instructions","format":"markdown","content":"# GitHub Copilot Instructions\n\nPath: `.github/copilot-instructions.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.github/copilot-instructions.md)","tokens":300,"sizeBytes":205},{"name":"README.md","path":"internal/generate/servicepackages/README.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/internal/generate/servicepackages/README.md","title":"servicepackages Documentation","category":"plugin-manifest","format":"markdown","content":"# servicepackages Documentation\n\nPath: `internal/generate/servicepackages/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/internal/generate/servicepackages/README.md)","tokens":300,"sizeBytes":231},{"name":"README.md","path":"tools/literally/README.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/literally/README.md","title":"literally Documentation","category":"plugin-manifest","format":"markdown","content":"# literally Documentation\n\nPath: `tools/literally/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/literally/README.md)","tokens":300,"sizeBytes":189},{"name":"README.md","path":"tools/makelign/README.md","rawUrl":"https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/README.md","title":"makelign Documentation","category":"plugin-manifest","format":"markdown","content":"# makelign Documentation\n\nPath: `tools/makelign/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/README.md)","tokens":300,"sizeBytes":186}],"systemPromptSnippet":"\n\n# AI Agent Protocol & Instructions\n\nPath: `AGENTS.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/AGENTS.md)\n\n\n---\nname: breaking-changes\ndescription: \"Review a PR for possible breaking changes.\"\n---\n\n\n\n\n# Skill: Review PR For Breaking Changes\n\nAssume the @maintainer persona.\n\nDetermine whether a GitHub Pull Request makes a breaking change. If so provide feedback on reasons for the breaking change and possible next steps.\nIf the PR does not make any breaking changes, note that.\n\nDo NOT consider any `breaking-change` label applied to the PR.\n\nReview only the code changes included in the PR.\n\nAuthoritative reference: [docs/breaking-changes.md](../../../docs/breaking-changes.md). When this skill and that document disagree, the document wins.\n\n## When to use\n\nTrigger this skill when the user:\n- Provides a `https://github.com/hashicorp/terraform-provider-aws/pull/` URL and asks for a breaking change review.\n- Says \"review breaking change\", or similar, with a PR URL.\n\n## Inputs\n\nRequired:\n- A GitHub PR URL. Extract `` with the regex `/pull/(\\d+)`.\n\nIf the user provides only a PR number, ask for the full URL (or confirm the repo is `hashicorp/terraform-provider-aws`).\n\n\n---\nname: fixdocs\ndescription: \"Fix Terraform provider end user documentation issues detected by swissshepherd (ss). Removes an ignored target from the config, runs ss, validates findings, fixes the documentation, and commits.\"\n---\n\n\n\n\n# Skill: Fix End User Documentation With `swissshepherd`\n\nFix Terraform provider documentation issues by removing targets from the swissshepherd ignore list, validating findings against the schema, and correcting the documentation.\n\n## When to use\n\nTrigger this skill when the user:\n- Says \"fix docs\", \"fixdocs\", \"run swissshepherd\", \"run ss\", or similar\n- Asks to remove a target from the swissshepherd ignore list\n- Asks to fix documentation for a specific resource or data source\n- Provides swissshepherd output and asks to fix the findings\n\n## Inputs\n\nOptional:\n- A target name (e.g., `aws_s3_bucket`) or prefix (e.g., `aws_s3_`)\n- A type (`resource`, `data_source`, `ephemeral`, etc.)\n- Number of targets to process (default: 1)\n\nIf no target is specified, pick the next one from `ignore_targets` in `.ci/swissshepherd-weak.hcl`.\n\n## Procedure\n\n### Phase 1: Verify clean baseline\n\n```bash\nmake swissshepherd\n```\n\nThis MUST output \"All checks passed.\" before proceeding. If it doesn't, stop and tell the user the baseline is dirty.\n\n### Phase 2: Select and expose target\n\n1. Open `.ci/swissshepherd-weak.hcl`\n2. Find the target in an `ignore_targets` list (within a `check` block)\n3. Remove the target line from the list\n4. Run swissshepherd to see findings:\n\n```bash\nswissshepherd --config .ci/swissshepherd-weak.hcl --target --type \n```\n\nIf \"All checks passed\" — the target was already clean. Commit the config removal and move to the next target.\n\n### Phase 3: Validate findings\n\nFor each finding, determine if it's valid by checking the schema source of truth:\n\n- **Coverage errors** (\"not documented\", \"does not exist in schema\"): Read the resource's Go source (`internal/service//.go` or `*_data_source.go`) to confirm the attribute/block exists in the schema.\n- **Heading errors**: Check what the heading currently says vs what ss expects.\n- **Label errors**: Check if the attribute is Required, Optional, or Computed in the schema.\n- **Byline errors**: Compare against the expected bylines in the config.\n\nIf a finding appears to be a swissshepherd bug (schema says one thing, ss reports another), note it and skip — do NOT fix the doc incorrectly.\n\n### Phase 4: Fix the documentation\n\n**BOTH WARNINGS AND ERRORS** should be fixed!!\n\nOpen the doc file (path is in the ss output) and apply fixes:\n\n| Finding | Fix |\n|---------|-----|\n| \"block X is not documented\" | Add a `### \\`block_name\\` Block` section with its attributes listed |\n| \"attribute X should be documented in Attribute Reference\" | Add to Attribute Reference section |\n| \"attribute X should not appear in Argument Reference\" | Move from Arguments to Attributes |\n| \"documented attribute X does not exist in schema\" | Remove from docs (it's phantom) |\n| \"missing (Required) or (Optional) label\" | Add the correct label based on schema |\n| \"heading ... should be ...\" | Rename to the suggested heading |\n| \"byline does not match expected texts\" | Replace with a standard byline |\n| \"reference-style link definition\" | Convert `[ref]: url` to inline `[text](url)` |\n| \"avoid \\\"X\\\"; use \\\"Y\\\" instead\" (banned_glosses) | Replace the spelled-out phrase with its abbreviation. Never edit YAML frontmatter to do this — if the flagged text is in `subcategory`/`layout`/`page_title`/`description`, skip and report it instead. |\n\n#### Documentation style rules\n\nWhen adding or editing documentation:\n- Arguments: `* \\`name\\` - (Required) Description.` or `* \\`name\\` - (Optional) Description.`\n- Attributes: `* \\`name\\` - Description.` (no Required/Optional label)\n- Descriptions start with a verb or noun — never \"A \", \"An \", \"The \", \"Specifies \", \"Indicates \"\n- Don't spell out common abbreviations (e.g. ARN, KMS, VPC) — `swissshepherd`'s `banned_glosses` check enforces this; see [Abbreviations](../../../docs/end-user-documentation.md#abbreviations)\n- Boolean arguments: start with \"Whether to...\"\n- Keep alphabetical order within required/optional groups\n- Block sections use heading: `` ### `block_name` Block ``\n- Byline for arguments: \"The following arguments are required:\" / \"The following arguments are optional:\"\n- Byline for attributes: \"In addition to all arguments above, the following attributes are exported:\"\n\nAuthoritative reference: [docs/end-user-documentation.md](../../../docs/end-user-documentation.md). When this skill and that document disagree, the document wins.\n\n### Phase 5: Verify fix\n\n```bash\nswissshepherd --config .ci/swissshepherd-weak.hcl --target --type \n```\n\nMust output \"All checks passed.\" If not, iterate on remaining findings.\n\n### Phase 6: Full verification\n\n```bash\nmake swissshepherd\n```\n\nMust output \"All checks passed.\" to confirm no regressions.\n\n### Phase 7: Commit\n\nStage and commit:\n\n```bash\ngit add .ci/swissshepherd-weak.hcl website/docs/\ngit commit -m \": Fix documentation per swissshepherd\"\n```\n\nUse the resource name without the `aws_` prefix in the commit message scope when it matches a single service. For multi-target batches, use the service name.\n\n## Important constraints\n\n- **Schema is truth.** Never \"fix\" a finding by silencing it if the schema confirms the issue.\n- **One target per commit.** Each removed ignore target gets its own commit for clean git history.\n- **Always use `--config .ci/swissshepherd-weak.hcl`** — running without config produces 20,000+ findings.\n- **Check both check blocks.** A target may appear in `ignore_targets` under `check \"schema_docs\"` AND `check \"import_section\"` (or others). Remove from all.\n- **Don't touch `ignore_contents_check`** unless the user explicitly asks — those are structural exceptions.\n- **Preserve file structure.** Don't rewrite entire doc files. Make minimal, targeted edits.\n- **Nested blocks.** When ss reports \"block X.Y is not documented\", the doc needs a subsection under the parent block's section. Default to `` ### `y` Block `` (just the child name) nested contextually after the parent. If the child name collides with another block of the same name elsewhere in the file (e.g. the same nested block name reused under two different parents), use the dotted path instead: `` ### `x.y` Block ``, with a matching dotted anchor. There is no single correct form — prefer the shorter undotted name, but use dotted paths when needed to keep headings unique. Be consistent within a file: don't mix dotted and undotted for the same block across the doc.\n\n## Example session\n\nUser: \"fix docs for aws_s3_bucket_lifecycle_configuration\"\n\n1. Verify `make swissshepherd` passes\n2. Remove `aws_s3_bucket_lifecycle_configuration` from `ignore_targets` in the `schema_docs` check block\n3. Run `swissshepherd --config .ci/swissshepherd-weak.hcl --target aws_s3_bucket_lifecycle_configuration --type resource`\n4. See: `ERROR [schema_docs] ... block \"rule.filter\" is not documented`\n5. Check Go source — confirm `filter` block exists under `rule`\n6. Add `` ### `filter` Block `` section with its attributes\n7. Re-run ss — passes\n8. Run `make swissshepherd` — passes\n9. Commit\n\n\n---\nname: go-conventions\ndescription: \"Fundamental Go conventions for the Terraform AWS provider. Use whenever writing or editing Go in internal/**/*.go (any resource, data source, ephemeral resource, action, test, or helper) before making the change, not only when asked about Go.\"\n---\n\n\n\n\n# Skill: Go Conventions\n\nThree forces pull this repository away from Go's conventions: existing code that violates them, human habits from other languages, and agent instincts trained on other ecosystems. Follow provider practice where it doesn't contradict this skill; where existing code violates this skill, it isn't precedent. Rationale and evidence: [docs/go-for-contributors.md](../../../docs/go-for-contributors.md).\n\n## Naming\n\n- Initialisms keep one case: `ID`, `ARN`, `API`, `VPC`, `KMS`, `URL`, `HTTP`. Write `applicationID`, never `applicationId`, `Arn`, or `Url`.\n- `MixedCaps`, not underscores: `maxRetries`, not `MAX_RETRIES`. Test names (`TestAccFoo_basic`) are the exception.\n- Getters drop `Get`: `Owner()`, not `GetOwner()`.\n- Short locals (`c`, `i`). Receivers are one or two letters, consistent across the type, never `this` or `self`.\n- Don't create packages named `util`, `common`, `misc`, `api`, `types`, or `interfaces`. If callers must alias your package, the name failed. (We ship `internal/types`, `internal/framework/types`, `internal/sdkv2/types`; these are known fails, not precedent.)\n\n## Comments\n\n- Names and structure first. A comment never compensates for code that is hard to read.\n- Delete a comment that restates the line, names the obvious operation, acts as an in-function section header, paraphrases the signature, teaches Go, or explains a name you should rename instead.\n- Keep comments that record constraints, invariants, surprising AWS behavior, or why an obvious approach was rejected.\n- Document every exported declaration: full sentence, begins with the name, ends with a period.\n\n## Organization: function, file, package\n\nThree units, three costs. A separately nameable concept does not earn a boundary.\n\n- **Function**: cheap. Create freely when it improves the code.\n- **File**: organization for humans. Default to editing an existing file; a new file creates no encapsulation, ownership, or API boundary.\n- **Package**: a real API and dependency boundary. Rare, and strongly justified.\n\nThen:\n\n- No `helpers.go`, `common.go`, or `utils.go`. Two or three callers, or \"separation of concerns,\" don't justify a new file.\n- No one-class-per-file or one-concern-per-file habits from Java or Python. Keep related code physically close.\n- Prefer growing an existing package. A healthy one holds several types, files, and responsibilities (`net/http`, `os`, `flag`).\n- If callers will almost always need the new package alongside its parent or neighbor, don't split it.\n- If implementation code routinely imports several sibling packages sharing a path prefix, those aren't meaningful boundaries.\n- If a split forces you to export what used to be unexported, the split is the mistake.\n\n## Abstraction\n\n- Stay concrete until multiple real uses demand otherwise. Similarity is evidence to examine, not an instruction to abstract.\n- Define interfaces where they're consumed, as small as the consumer needs. Never pair an interface with its implementation by default, and never add one so it \"could be mocked.\"\n- A little copying beats a little dependency. Modest duplication is better than an abstraction that obscures control flow.\n- Prefer functions and ordinary data structures over types, builders, managers, registries, and frameworks.\n\n## Control flow and errors\n\n- Linear and top-to-bottom. Handle the exceptional case early and return. No unnecessary `else`.\n- Errors are values: return them, wrap with useful context, inspect deliberately. No exception-like infrastructure or custom error hierarchies.\n- Error strings are lowercase and unpunctuated: `\"reading bucket policy\"`.\n- Never discard an error with `_`. Never panic for an ordinary failure.\n\n## Context\n\n- `ctx context.Context` is the first parameter, always.\n- Never store a `Context` in a struct field; pass it to each method that needs it.\n\n## Commit messages\n\n- Concise subject. Add a body only for intent or non-obvious constraints. A large mechanical change may need barely a word.\n\n## Above all: don't import other languages' architecture\n\nGo prefers concrete code, explicit control flow, locality, small consumer-driven interfaces, and modest repetition over abstraction, indirection, and machinery. When two implementations are equally correct, choose the one with fewer concepts. Absence of machinery is not unfinished work; the machinery is usually the defect.\n\nResist:\n\n- Generics to remove duplication. Use them when the problem itself is generic.\n- DI infrastructure. A function parameter or struct field already is dependency injection.\n- Redesigning production code to enable mocking.\n- Extracting tiny single-use helpers merely to shorten a function.\n- Wrapper types (`Config`, `Options`, `Manager`, `Result`) for tiny concepts. Leave a string a string.\n- Constructors where a useful zero value works.\n- map/filter/reduce pipelines, reflection, or functional composition where a plain loop reads directly.\n\n\n---\nname: new-list-resource\ndescription: \"Implement a new list resource in the Terraform AWS provider.\"\n---\n\n\n\n\n# Skill: New List Resource\n\nAssume the @maintainer persona.\n\nUse this skill to add new list resource.\n\nRefer to [docs/new-list-resource.md](../../../docs/add-a-new-list-resource.md) for instructions.\nThe task is complete when all list acceptance tests (`TestAcc{Resource}_List`) are passing.\n\n## When to use\n\nTrigger this skill when the user:\n\n- Says \"add a new list resource\", or similar.\n\n## Inputs\n\nRequired:\n\n- The target resource name (e.g. `aws_s3_bucket`).\n\nIf the user provides a human readable name (e.g. \"S3 Bucket\") rather than the Terraform resource, confirm the target resource before proceeding.\n\n\n---\nname: resource-identity\ndescription: \"Add resource identity to a resource in the Terraform AWS provider.\"\n---\n\n\n\n\n# Skill: Add Resource Identity Support\n\nAssume the @maintainer persona.\n\nUse this skill to add resource identity to an existing resource, or when creating a net-new resource.\n\nRefer to [docs/resource-identity.md](../../../docs/resource-identity.md) for instructions.\nThe task is complete when all generated identity acceptance tests (`TestAcc{Resource}_Identity`) are passing.\n\n## When to use\n\nTrigger this skill when the user:\n\n- Says \"add resource identity support\", or similar while referring to a Terraform resource.\n\n## Inputs\n\nRequired:\n\n- The target resource name (e.g. `aws_s3_bucket`).\n\nIf the user provides a human readable name (e.g. \"S3 Bucket\") rather than the Terraform resource, confirm the target resource before proceeding.\n\n\n# References Skill\n\nPath: `.agents/skills/review-docs/references/import-section.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-docs/references/import-section.md)\n\n\n---\nname: review-docs\ndescription: \"Review a Terraform AWS Provider PR's end-user documentation (website/docs/**/*.markdown): whether docs are needed, description openings, argument/attribute style, section structure, tags wording, code fences, and the Import + Identity Schema section. Use when reviewing documentation changes, or when a PR adds/changes a resource or data source and its docs should be checked.\"\n---\n\n\n\n\n# Review: End-User Documentation\n\nAssume the `@maintainer` persona. Scope: resource docs (`r/`), data source docs (`d/`), list resource docs (`list/`) under `website/docs/`, rendered at the Terraform Registry. Loaded from `review-pr`.\n\nAuthoritative reference: [docs/end-user-documentation.md](../../../docs/end-user-documentation.md). When this skill and that document disagree, the document wins. Do not review CHANGELOG updates.\n\n## Should the PR include docs?\n\n- If the PR adds or changes user-facing behavior (new resource/data source/attribute) but has no doc change, say what's missing.\n- If the PR removes behavior but leaves stale docs, say what to remove.\n- Review only the changed docs; don't review unchanged documentation except as needed for context.\n\n## Description openings\n\nThe single-line `description:` in frontmatter and the first paragraph after the H1 must use the verb for the doc type:\n\n| Doc type | Opening verb |\n|---|---|\n| Resource | `Manages …` |\n| Data source | `Provides details about …` |\n| List resource | `Lists …` |\n\nFlag openings like \"This resource…\", \"Use this resource…\", \"Allows you to…\", \"Resource for…\", or \"Terraform resource for…\".\n\n## Argument and attribute description style\n\n**Forbidden opening words**: `An`, `A`, `The`, `Defines`, `Indicates`, `Specifies`. Rewrite \"Indicates the amount of storage\" → \"Amount of storage.\" Always propose the corrected wording.\n\n**Don't spell out common abbreviations** (e.g. \"Amazon Resource Name (ARN)\" → \"ARN\"). See [Abbreviations](../../../docs/end-user-documentation.md#abbreviations) for the full list and rationale.\n\n**Boolean arguments** must start with `Whether to`:\n\n- ✓ `(Optional) Whether to enable logging.`\n- ✗ `(Optional) Enables logging.` / `(Optional) If true, enables logging.`\n\n**`(Required)` / `(Optional)` / `(Read-Only)`** are the only valid markers, capitalized in parentheses, immediately after the hyphen.\n\n**Examples use `example`, not `test`.** Flag any HCL block in docs that uses `\"test\"` as a resource label or `name = \"test\"`.\n\n## Section structure\n\nResource docs, in this order:\n\n1. `# Resource: `\n2. `## Example Usage` (with at least `### Basic Usage`)\n3. `## Argument Reference`\n4. `## Attribute Reference`\n5. `## Timeouts` *(only if the resource exposes timeouts)*\n6. `## Import` *(only for resources)*\n\nData source and list resource docs have only Example Usage, Argument Reference, and Attribute Reference.\n\n## Argument Reference\n\nRequired arguments come first, separated from optional by a header line. Alphabetize. Use these exact lead-ins:\n\n```\nThe following arguments are required:\n\n* `req_arg` - (Required) ...\n\nThe following arguments are optional:\n\n* `opt_arg` - (Optional) ...\n```\n\nIf there are no required arguments, drop the \"required\" subsection — don't write \"There are no required arguments.\"\n\nFor tagged resources, `tags` lives under optional arguments with this exact wording:\n\n```\n* `tags` - (Optional) Map of tags assigned to the resource. If configured with a provider [`default_tags` configuration block](/docs/providers/aws/index.html#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.\n```\n\n## Attribute Reference\n\nOpen with `This resource exports the following attributes in addition to the arguments above:` (substitute \"data source\" / \"list resource\"). Flag pages that re-document arguments here — only computed attributes belong. Alphabetize.\n\nFor tagged resources, `tags_all` has this exact wording:\n\n```\n* `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block).\n```\n\nFor tagged data sources, `tags` is a top-level computed attribute and there is no `tags_all`.\n\n## Code fences\n\nUse `terraform` for `.tf` blocks and `console` for shell examples. Flag `hcl` (use `terraform`) or unfenced shell commands.\n\n## Style points\n\n- Active voice, present tense. Don't document past or future behavior.\n- Single-line description in frontmatter — flag multi-paragraph descriptions.\n- Consistent terminology — match the AWS service's nouns; don't invent synonyms.\n\n## Import section & Identity Schema\n\nThe `## Import` section (resources only) and its `Identity Schema` subsection have a precise required structure. See [`references/import-section.md`](references/import-section.md) for the full checklist and load it when the PR touches a resource's Import section.\n\n\n---\nname: review-generated\ndescription: \"Review generated code in the Terraform AWS Provider (files ending in _gen.go produced by go generate). Use when a PR changes internal/service/**/*_gen.go — check whether the generator was run, whether the diff is plausible for the source change, and whether files were hand-edited. Do NOT apply hand-written-code rules to these files.\"\n---\n\n\n\n\n# Review: Generated Code\n\nAssume the `@maintainer` persona. Scope: files ending in `_gen.go`, produced by the code generators (`make gen`; templates and generator code live under `internal/generate/`). Common examples: `service_package_gen.go`, `tags_gen.go`, `service_endpoint_resolver_gen.go`, `*_identity_gen_test.go`, `*_tags_gen_test.go`. Loaded from `review-pr`.\n\n## What to review\n\n- Whether the file should exist at all — was the generator run after the source change that motivated it?\n- Diff plausibility — additions/removals match the source changes (a new resource added one annotation should produce a localized diff, not a wholesale rewrite of unrelated registrations).\n- Manual edits — almost always a mistake. The legitimate flow is: change the source (annotation, template, or generator code under `internal/generate/`) → regenerate (`make gen PKG=`, or the provider-wide `make gen` when the change is under `internal/generate/`) → commit the regenerated file. Flag PRs that modify `_gen.go` files without a corresponding source-side change.\n\n## What NOT to review\n\n- Style, naming, formatting, comment wording, import ordering, structural refactors. The generator owns these.\n- Suggested simplifications, \"extract helper\" suggestions, or any cleanup not reachable from the generator's templates.\n- Rules from `review-lifecycle`, `review-schema`, `review-helpers`, `review-identity`, or `review-tags`. Those target hand-written code.\n\n\n---\nname: review-helpers\ndescription: \"Review Terraform AWS Provider helper code: finders, status functions, waiters, sweepers, data sources, and list resources. Use when reviewing a PR that changes non-test internal/service/**/*.go code for resource lookup, retry.StateChangeConf waiters, NewSweepResource sweepers, DataSourceWithModel data sources, or Framework/SDKv2 list resources.\"\n---\n\n\n\n\n# Review: Helpers, Sweepers, Data Sources, List Resources\n\nAssume the `@maintainer` persona. Scope: finders, status, waiters, sweepers, data sources, list resources. Loaded from `review-pr`.\n\n## Finders, status, waiters\n\n- Finder signature: `findByID(ctx context.Context, conn *.Client, id string) (*awstypes., error)`. Variants by ARN/Name use the same shape.\n- On `*awstypes.ResourceNotFoundException`, return `smarterr.NewError(&retry.NotFoundError{LastError: err})`.\n- Status function reuses the finder and returns `retry.StateRefreshFunc`. Design status so one function powers create, update, and delete waiters.\n- Waiters use `retry.StateChangeConf`. Created/updated waiters typically set `NotFoundChecks: 20` and `ContinuousTargetOccurence: 2`. Deleted waiters use empty `Target` with `Pending` covering deletion-in-progress states.\n- Prefer SDK-provided status constants (e.g. `awstypes.StatusInProgress`) over package-level string consts.\n- Finders and `ResName` constants referenced in tests must be re-exported via `exports_test.go`.\n\nFlag finders that return raw errors (must wrap with `smarterr.NewError`), status that duplicates finder logic, or hand-rolled polling loops in place of `retry.StateChangeConf`.\n\n## Sweepers\n\nEach new resource needs a sweeper. Iterate the SDK paginator, build via `framework.NewSweepResource(newResource, client, framework.NewAttribute(names.AttrID, aws.ToString(v.Id)))` (where `framework` is `internal/sweep/framework`), and register in the package's `sweep.go` with `awsv2.Register(\"aws__\", sweeps, ...optionalDeps)`. Pass multiple `framework.NewAttribute(...)` arguments for composite identity.\n\nFlag new resources without a sweeper, sweepers that don't propagate paginator errors via `smarterr.NewError`, and sweepers using import aliases other than `framework` for `internal/sweep/framework`.\n\n## Data sources\n\nData sources have only a `Read` method.\n\n- Use `framework.DataSourceWithModel[T]`.\n- Schema attributes are `Required` or `Optional` for search criteria; everything else is `Computed`.\n- Attributes that are `Required` on the corresponding resource are typically `Computed` on the data source unless they form lookup criteria.\n- No configurable timeouts.\n- Tagged data sources expose a single computed `tags` attribute (no `tags_all`).\n\n## List resources\n\nFramework path embeds the corresponding underlying resource. SDKv2 path uses `framework.ListResourceWithSDKv2Resource`.\n\nThe `List` method:\n\n1. Get the client.\n2. Fetch the config (only when the list takes query attributes such as a parent ID).\n3. Stream results from a paginated AWS List API.\n4. Set logging fields per item (typically the ARN) via `tflog.SetField(ctx, logging.ResourceAttributeKey(...), ...)`.\n5. Set identifying attributes for each result.\n6. Set `result.DisplayName` to a human-readable identifier (typically the resource name).\n\nThe listing helper uses an iterator over the SDK paginator:\n\n```go\nfunc lists(ctx context.Context, conn *.Client, input *.ListsInput) iter.Seq2[awstypes., error]\n```\n\nThe flatten function shared by Read and List lives in the resource file (`r.flatten` for Framework, `resourceFlatten` for SDKv2).\n\nFlag list resources that don't set `DisplayName`, that re-implement flatten logic instead of sharing with Read, or that omit the `tflog.SetField` per-item logging hook.\n\n\n---\nname: review-identity\ndescription: \"Review Terraform AWS Provider Resource Identity: the identity-strategy annotations (@ArnIdentity, @SingletonIdentity, @IdentityAttribute), multi-attribute @ImportIDHandler parsers, and region opt-out for global services. Use when reviewing a PR that adds or changes identity annotations or import-ID parsing in internal/service/**/*.go.\"\n---\n\n\n\n\n# Review: Resource Identity\n\nAssume the `@maintainer` persona. Scope: identity declaration and import-ID parsers. Loaded from `review-pr`.\n\n## Identity strategy — exactly one per resource\n\nEvery new resource declares one identity strategy via comment annotations above the factory function. Flag missing identity annotations on new resources.\n\n| Strategy | Annotations | Use when |\n|---|---|---|\n| ARN | `// @ArnIdentity` (or `// @ArnIdentity(\"arn_attribute\")`) | AWS API uses the ARN as identifier |\n| Singleton | `// @SingletonIdentity` | One per region (or one per account for global services) |\n| Parameterized | one or more `// @IdentityAttribute(\"\")` | Composite or non-ARN identifier |\n\n`@IdentityAttribute` supports keywords: `optional`, `resourceAttributeName`, `testNotNull`, `valueType`, and `identityDuplicateAttributes`.\n\n## Multi-attribute identity needs an `ImportIDHandler`\n\nParameterized identities with more than one attribute require both:\n\n1. An `// @ImportIDHandler(\"\")` annotation (alongside the `@IdentityAttribute` annotations) referencing a type that satisfies `inttypes.ImportIDParser`.\n2. The implementation:\n\n```go\ntype fooImportID struct{}\n\nfunc (fooImportID) Parse(id string) (string, map[string]string, error) {\n // parse a separator-delimited string into named identity attributes\n}\n\nvar _ inttypes.ImportIDParser = fooImportID{}\n```\n\nFlag multi-attribute identity resources that:\n\n- Omit `@ImportIDHandler` — the generator's `Validate()` requires it for multiple parameterized identity and will error.\n- Reference an `@ImportIDHandler` whose target type doesn't satisfy `inttypes.ImportIDParser` (the `var _ inttypes.ImportIDParser = ...{}` assertion catches this).\n- Implement `Parse` without a clear error message describing the expected import-ID format on malformed input.\n\n`@ImportIDHandler` is meaningful for parameterized identities with multiple attributes. Question its use on singleton or single-attribute parameterized resources.\n\n## Region opt-out for global services\n\nGlobal services (CloudFront, IAM, Route 53 hosted zones, etc.) omit `framework.WithRegionModel` from the model and register with `inttypes.ResourceRegionDisabled()` in the service-package generator. Identity-Schema docs for these resources omit the `region` attribute.\n\n\n---\nname: review-lifecycle\ndescription: \"Review Terraform AWS Provider resource lifecycle: CRUD step order, smerr/smarterr error handling, and AutoFlex model-to-SDK conversion. Use when reviewing a PR that changes non-test resource logic in internal/service/**/*.go (Create/Read/Update/Delete, error wrapping, flex.Expand/Flatten/Diff).\"\n---\n\n\n\n\n# Review: Resource Lifecycle\n\nAssume the `@maintainer` persona. Scope: CRUD, errors, AutoFlex on non-test resource code (`internal/service/**/*.go`). Loaded from `review-pr`.\n\n## Registration annotations\n\nOne above each factory function. Flag missing annotations or factory-name/resource-name mismatches.\n\n| Construct | Annotation |\n|---|---|\n| Resource (Framework) | `// @FrameworkResource(\"aws__\", name=\"\")` |\n| Data source (Framework) | `// @FrameworkDataSource(\"aws__\", name=\"\")` |\n| List resource (Framework) | `// @FrameworkListResource(\"aws__\")` |\n| List resource (SDKv2) | `// @SDKListResource(\"aws__\")` |\n\n## Struct embeds\n\n```go\ntype fooResource struct {\n framework.ResourceWithModel[fooResourceModel]\n framework.WithTimeouts // only when a timeouts block is present\n framework.WithImportByIdentity // not WithImportByID for new resources\n}\n```\n\n- New resources use `framework.WithImportByIdentity`. Flag `framework.WithImportByID` on new resources.\n- Use `framework.ResourceWithModel[T]` (not `ResourceWithConfigure`).\n- Data sources: `framework.DataSourceWithModel[T]`.\n\n## CRUD step order\n\n**Create:** get client → fetch plan → `flex.Expand` → set tags via `input.Tags = getTagsIn(ctx)` for tagged resources → AWS Create call → `flex.Flatten` output back into the plan → wait → `resp.State.Set(ctx, plan)`. Flag Creates that don't read the output back into the plan — computed attributes stay unknown in state.\n\n**Read:** get client → fetch state → finder → on `retry.NotFound(err)`, append `fwdiag.NewResourceNotFoundWarningDiagnostic(err)`, call `resp.State.RemoveResource(ctx)`, return → flatten → `resp.State.Set`.\n\n**Update:** get client → fetch plan and state → `diff, d := flex.Diff(ctx, plan, state)` → gate on `diff.HasChanges()` → AWS modify → flatten output back into plan → wait → `resp.State.Set(ctx, &plan)`. Flag updates that always call the API without `HasChanges()`, or that re-fetch state after the modify.\n\nOmit Update when the API has no update, every attribute has `RequiresReplace()`, or Create is reused for modify.\n\n**Delete:** get client → fetch state → build input → AWS delete; silently swallow `errs.IsA[*awstypes.ResourceNotFoundException](err)` → wait.\n\n## Errors\n\nUse `smerr`/`smarterr`, never raw `resp.Diagnostics.AddError`.\n\n- Upstream diagnostics: `smerr.AddEnrich(ctx, &resp.Diagnostics, req.Plan.Get(ctx, &plan))` (not the deprecated `EnrichAppend`).\n- API errors: `smerr.AddError(ctx, &resp.Diagnostics, err, smerr.ID, plan.Name.String())`. Always pass `smerr.ID` with an identifier — `plan.Name` in Create, `state.ID` elsewhere.\n- Inside finders/waiters, wrap returned errors with `smarterr.NewError(err)`.\n- Detect AWS exceptions with `errs.IsA[*awstypes.](err)` — never type assertions, never `strings.Contains(err.Error(), ...)`.\n- Use `retry.NotFound(err)` for wrapped not-found from the finder layer.\n\nFlag raw `resp.Diagnostics.AddError`, type assertions on AWS errors, and string-based error matching.\n\n## AutoFlex\n\nUse `flex.Expand` / `flex.Flatten` for model ↔ SDK conversion. Manual per-field `aws.String` / `aws.ToString` is wrong in new Framework code.\n\n- `flex.WithFieldNamePrefix(\"\")` when AWS prefixes its fields (model `ID` ↔ SDK `ThingId`).\n- AWS plural collections become singular blocks (`Parameters` ↔ `parameter`).\n- AutoFlex does **not** copy tags through; see `review-tags`.\n- Update path: `flex.Diff(ctx, plan, state)` then `diff.HasChanges()`.\n\n\n---\nname: review-pr\ndescription: \"Review a Terraform AWS Provider pull request for correctness and conventions. Start here for any PR review: it holds the cross-cutting review principles and routes to scoped sub-skills (review-lifecycle, review-schema, review-helpers, review-identity, review-tags, review-generated, review-tests, review-tests-helpers, review-docs) based on which files the PR changes. Use when given a hashicorp/terraform-provider-aws PR URL and asked to review it.\"\n---\n\n\n\n\n# Skill: Review a Pull Request\n\nAssume the `@maintainer` persona.\n\nReview a GitHub Pull Request against the Terraform AWS Provider's conventions. This skill carries the cross-cutting principles and a routing table; load the scoped leaf skills for the file types the PR actually changes.\n\n## When to use\n\nTrigger this skill when the user:\n- Provides a `https://github.com/hashicorp/terraform-provider-aws/pull/` URL and asks for a review.\n- Says \"review PR\", \"review this pull request\", or similar, with a PR URL.\n\n## Inputs\n\nRequired:\n- A GitHub PR URL. Extract `` with the regex `/pull/(\\d+)`.\n\nIf the user provides only a PR number, ask for the full URL (or confirm the repo is `hashicorp/terraform-provider-aws`).\n\n## Procedure\n\n1. Fetch the PR's changed files and diff.\n2. Categorize each changed path against the routing table below.\n3. Load the matching leaf skill(s) and apply their rules to the changed lines only.\n4. Always consider compatibility (see below) and, when docs or a changelog are expected but missing, say so.\n5. Consolidate findings into a single review. Cite the rule and propose corrected code.\n\n## Cross-cutting principles\n\n**Compatibility is non-negotiable.** Changes must preserve Terraform state compatibility, upgrade behavior, import behavior, and existing user workflows. Schema changes that force replacement, rename attributes, or break state migration must be flagged unless explicitly justified. For a dedicated compatibility pass, use the `breaking-changes` skill. Do **not** rely on any `breaking-change` label.\n\n**Favor recent patterns; do not enforce legacy ones.** The provider has both modern (Plugin Framework) and legacy (Plugin SDKv2) code. New work follows recent patterns. Do not ask contributors to mimic legacy patterns just because nearby code uses them. When modifying an existing resource, keep the framework it already uses.\n\n**Go style.** Expect modern Go (1.26+): `slices`, `maps`, `cmp`, `iter`, `errors.Is`/`errors.As`, range-over-int/func. Prefer return-early. AWS SDK for Go v2 only. Detect AWS API exceptions with `errs.IsA[*awstypes.]` — never type assertions or `strings.Contains`.\n\n**Review tone.** Be specific, accurate, and to the point. Cite the rule and propose the corrected code. Prioritize correctness, design, and compatibility. Don't hand-author comments for mechanical issues that `make lint`, semgrep, or formatters already enforce — at most, note that automated checks will flag them. Spend the review on what tools can't catch: logic, AWS API usage, state and upgrade compatibility, and test coverage.\n\n## Routing table\n\n| Changed path | Concern | Leaf skill |\n|---|---|---|\n| `internal/service/**/*.go` (non-test) | CRUD, errors, AutoFlex | `review-lifecycle` |\n| `internal/service/**/*.go` (non-test) | Model/attrs/blocks/validators | `review-schema` |\n| `internal/service/**/*.go` (non-test) | Finders, waiters, sweepers, data sources, list resources | `review-helpers` |\n| `internal/service/**/*.go` (non-test) | Resource Identity | `review-identity` |\n| `internal/service/**/*.go` (non-test) | Tags | `review-tags` |\n| `internal/service/**/*_gen.go` | Generated code | `review-generated` |\n| `internal/service/**/*_test.go` | Acceptance/unit test basics | `review-tests` |\n| `internal/service/**/*_test.go` | Exists/Destroy, data source/list/unit tests | `review-tests-helpers` |\n| `website/docs/**/*.markdown` | End-user documentation | `review-docs` |\n\nMultiple leaves may apply to one file. The `internal/service/**/*.go` glob matches both production and test files; the non-test leaves generally don't apply to tests.\n\n## Broader context\n\nSee [`AGENTS.md`](../../../AGENTS.md) for personas, the skills registry, build/test commands, and the AI-usage policy.\n\n\n---\nname: review-schema\ndescription: \"Review Terraform AWS Provider Plugin Framework schema shape: model structs, Required/Optional/Computed combinations, plan modifiers (no ForceNew), nested-block custom types, validators, sensitive attributes, and timeouts. Use when reviewing a PR that changes resource or data-source schema in internal/service/**/*.go.\"\n---\n\n\n\n\n# Review: Schema & Resource Shape\n\nAssume the `@maintainer` persona. Scope: model struct, attributes, blocks, validators, plan modifiers, timeouts on non-test resource code. Loaded from `review-pr`.\n\n## Model struct\n\n```go\ntype fooResourceModel struct {\n framework.WithRegionModel // first field; omit for global services only\n // attributes...\n Timeouts timeouts.Value `tfsdk:\"timeouts\"` // only when a timeouts block is present\n}\n```\n\n- `framework.WithRegionModel` is the first embedded field for regional resources/data sources/list resources. Global services (CloudFront, IAM, Route 53 hosted zones, etc.) omit it and register with `inttypes.ResourceRegionDisabled()`.\n- `tfsdk` tags must match schema attribute names exactly (snake_case).\n- Use Plugin Framework types (`types.String`, etc.) and `fwtypes.ListNestedObjectValueOf[T]` for nested blocks.\n- Time fields use `timetypes.RFC3339`, never `types.String`.\n\n## Attribute rules\n\n- Attribute names are `snake_case`.\n- **Alphabetize** within `Attributes` and within `Blocks`. No blank lines between attributes.\n- Use `internal/names` constants (`names.AttrARN`, `names.AttrName`, `names.AttrTags`, `names.AttrTagsAll`, `names.AttrTimeouts`, etc.) instead of string literals when one exists.\n\n### Required / Optional / Computed\n\nOnly four valid combinations. Flag any other.\n\n| Required | Optional | Computed | When |\n|---|---|---|---|\n| ✓ | | | User must supply |\n| | ✓ | | User may supply; **never use `Default` here** |\n| | | ✓ | Read-only |\n| | ✓ | ✓ | User or provider supplies; required pairing for `Default` |\n\nPrefer `Optional + Computed` over `Optional + Default` when AWS supplies a server-side default.\n\n### `id` attribute\n\nPlugin Framework does **not** require an `id` attribute. Include `names.AttrID: framework.IDAttribute()` only when the AWS API returns an `Id` field. Flag schemas that include it on ARN-identified resources just by habit.\n\n## Plan modifiers (no `ForceNew`)\n\nPlugin Framework uses plan modifiers, not `ForceNew`. Flag any new Framework code that mentions `ForceNew`.\n\n- `stringplanmodifier.RequiresReplace()` — replaces `ForceNew: true`\n- `stringplanmodifier.UseStateForUnknown()` — keeps a computed value stable across plans\n\n## Validators replace `MaxItems`/`MinItems`\n\nUse `listvalidator.SizeAtMost(N)` / `SizeAtLeast(N)` (and `setvalidator` equivalents) on the block, not `MaxItems`/`MinItems` on the attribute. For a single nested object, combine `listvalidator.SizeAtMost(1)` with a list nested block.\n\n## Nested blocks need a custom type\n\n`schema.ListNestedBlock` requires `CustomType: fwtypes.NewListNestedObjectTypeOf[complexArgumentModel](ctx)`. The model field is `fwtypes.ListNestedObjectValueOf[complexArgumentModel]`. Flag nested blocks that omit `CustomType`.\n\nFor sets of strings, use `CustomType: fwtypes.SetOfStringType` with `fwtypes.SetValueOf[types.String]`.\n\nFor AWS API map blocks, the provider schema has no map-of-objects type — use `MapBlockKey`. Flag attempts to model AWS map blocks with `schema.MapAttribute`.\n\n## Sensitive attributes\n\nMark credentials, tokens, and write-only secrets `Sensitive: true`. Flag computed or required attributes that obviously hold secret material but aren't marked sensitive.\n\n## Timeouts\n\nResources with configurable timeouts use `timeouts.Block(ctx, timeouts.Opts{Create: true, Update: true, Delete: true})` and set defaults via `r.SetDefaultCreateTimeout` / `SetDefaultUpdateTimeout` / `SetDefaultDeleteTimeout` that reflect AWS API behavior — RDS Create can take 30–60 minutes; an EC2 SG takes seconds. Don't use arbitrary round numbers. Data sources and list resources do not expose configurable timeouts.\n\n\n# review-tags\n\nPath: `.agents/skills/review-tags/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tags/SKILL.md)\n\n\n# review-tests-helpers\n\nPath: `.agents/skills/review-tests-helpers/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests-helpers/SKILL.md)\n\n\n# review-tests\n\nPath: `.agents/skills/review-tests/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/review-tests/SKILL.md)\n\n\n# smarterr\n\nPath: `.agents/skills/smarterr/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.agents/skills/smarterr/SKILL.md)\n\n\n# Rules Skill\n\nPath: `.bob/rules/00-overview.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.bob/rules/00-overview.md)\n\n\n# changelog\n\nPath: `.copilot/skills/changelog/SKILL.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.copilot/skills/changelog/SKILL.md)\n\n\n# Docs Skill\n\nPath: `tools/makelign/testdata/golden/docs/continuous-integration.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/continuous-integration.md)\n\n\n# Docs Skill\n\nPath: `tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/testdata/golden/docs/makefile-cheat-sheet.md)\n\n\n# GitHub Copilot Instructions\n\nPath: `.github/copilot-instructions.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/.github/copilot-instructions.md)\n\n\n# servicepackages Documentation\n\nPath: `internal/generate/servicepackages/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/internal/generate/servicepackages/README.md)\n\n\n# literally Documentation\n\nPath: `tools/literally/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/literally/README.md)\n\n\n# makelign Documentation\n\nPath: `tools/makelign/README.md`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/hashicorp/terraform-provider-aws/HEAD/tools/makelign/README.md)\n"}