Verified CDK, Pulumi and SDK examples, with the server fixes they needed

[drk1rd]

Closes #99, closes #100, closes #101

Verified commands

Each run against a fresh homecloud serve (temp data dir, free ports) built from this branch, with credentials from homecloud aws-env.

CDK (examples/cdk/basic, CDK CLI 2.1145.0, aws-cdk-lib 2.273.0), server with --tls-self-signed:

• npx cdk bootstrap (default modern template, unchanged)
• npx cdk deploy --require-approval never, then aws sqs send-message -> function logs order received in its custom log group and the item lands in DynamoDB; aws s3 cp into the bucket
• npx cdk diff (change-set diff, no differences) and a second cdk deploy (no changes)
• npx cdk destroy --force after emptying the versioned bucket; stack, function, queue, table, log group gone

Pulumi (examples/pulumi/basic, Pulumi 3.268.0, @pulumi/aws 7.50.0, PULUMI_BACKEND_URL=file://...), over HTTP and over HTTPS:

• pulumi up, message round trip through SQS -> Lambda (nodejs24.x) -> DynamoDB, aws logs tail
• pulumi preview --expect-no-changes, pulumi refresh (no changes), pulumi preview --expect-no-changes
• pulumi destroy leaves the account empty
• also with an explicit aws:endpoints block instead of AWS_ENDPOINT_URL (needs sts, s3control and aws:skipCredentialsValidation, documented)

SDKs (examples/sdk): STS get-caller-identity, S3 create/put/get/delete, SQS create/send/receive/delete, DynamoDB create (waiter)/put/get/delete

• JavaScript v3 3.1151.0 (node index.mjs), HTTP and HTTPS
• Go v2 1.47.3 / s3 1.114.3 (go run .), HTTP and HTTPS
• Java v2 2.55.16 (mvn compile exec:java, Java 17), HTTP and HTTPS (trust store)

Go tests run locally with Docker (DOCKER_HOST set): awsapi, iam, lambda, cfn, cloudwatch, runtime, dockertest, server all pass; go vet ./... clean.

Server fixes found on the way

• IAM: AWSCloudFormationReadOnlyAccess managed policy was missing (cdk bootstrap attaches it).
• IAM: policy, group and instance profile names may be 128 characters, as in AWS (cdk bootstrap uses a 72-character inline policy name).
• IAM: aws:ResourceAccount condition key is now set; the bootstrap publishing roles were denied their own staging bucket.
• Lambda: LoggingConfig (log group, Text/JSON, levels) over the AWS API and CloudFormation (CDK logGroup, Terraform/Pulumi loggingConfig); it was silently ignored. JSON format sets AWS_LAMBDA_LOG_FORMAT/AWS_LAMBDA_LOG_LEVEL for the runtime.
• Lambda: runtimes nodejs24.x, python3.14, java25.
• CloudFormation: DeleteChangeSet of a nonexistent change set name succeeds when the stack exists (as in AWS); cdk diff fell back to a template diff without it.
• awsJson: responses carry X-Amz-Crc32; the Go v2 SDK logged a checksum warning on every DynamoDB call.
• TLS: the --tls-self-signed certificate covers *.localhost / *.<public-host>, so S3 Control (<account>.localhost, used by the Terraform/Pulumi providers) verifies over HTTPS; Pulumi hung retrying before.
• Isolation: CloudWatch Logs/metrics and the Lambda startup reaper used every managed container on the Docker host; on a host shared with test runs, log groups of other accounts were listed and the reaper removed other accounts' Lambda containers. They now use only this installation's containers.

Not working / limits (documented)

• CDK needs HomeCloud served over HTTPS: the bootstrap bucket policy denies aws:SecureTransport=false, and HomeCloud enforces it.
• CDK constructs that need CloudFormation custom resources (autoDeleteObjects, BucketDeployment, logRetention) do not deploy; custom resources are not implemented.
• CDK zip/container image assets are not covered by the example (only inline code).
• JSON log format: platform START/END/REPORT lines stay text.
• README "Works with" is updated; the website table (pages/index.html) is left for the release that ships these fixes.

[cloudflare-workers-and-pages]

Deploying homecloud with    Cloudflare Pages

Latest commit:	de53d85
Status:	✅  Deploy successful!
Preview URL:	https://3ecea58d.homecloud.pages.dev
Branch Preview URL:	https://iac-examples.homecloud.pages.dev

View logs

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 35 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fcd54004-808a-4313-8a72-48b93ed8af48

📥 Commits

Reviewing files that changed from the base of the PR and between 16e0b5f and de53d85.

⛔ Files ignored due to path filters: 1

• examples/sdk/go/go.sum is excluded by !**/*.sum

📒 Files selected for processing: 45

• CHANGELOG.md
• README.md
• cli/internal/awsapi/awsapi.go
• cli/internal/awsapi/crc32_test.go
• cli/internal/dockertest/dockertest_test.go
• cli/internal/runtime/docker.go
• cli/internal/server/tls.go
• cli/internal/server/tls_test.go
• cli/internal/svc/cfn/aws.go
• cli/internal/svc/cfn/aws_test.go
• cli/internal/svc/cfn/awstypes_lambda.go
• cli/internal/svc/cfn/awstypes_lambda_test.go
• cli/internal/svc/cfn/awstypes_update.go
• cli/internal/svc/cloudwatch/logs.go
• cli/internal/svc/cloudwatch/metrics.go
• cli/internal/svc/iam/iam.go
• cli/internal/svc/iam/policy.go
• cli/internal/svc/iam/policy_test.go
• cli/internal/svc/iam/resourceaccount_test.go
• cli/internal/svc/iam/roles.go
• cli/internal/svc/lambda/aws.go
• cli/internal/svc/lambda/engine.go
• cli/internal/svc/lambda/lambda.go
• cli/internal/svc/lambda/lambda_test.go
• cli/internal/svc/lambda/runtimes.go
• docs/aws-compat.md
• examples/.gitignore
• examples/cdk/basic/README.md
• examples/cdk/basic/bin/app.ts
• examples/cdk/basic/cdk.json
• examples/cdk/basic/lib/stack.ts
• examples/cdk/basic/package.json
• examples/cdk/basic/tsconfig.json
• examples/pulumi/basic/Pulumi.yaml
• examples/pulumi/basic/README.md
• examples/pulumi/basic/index.ts
• examples/pulumi/basic/package.json
• examples/pulumi/basic/tsconfig.json
• examples/sdk/README.md
• examples/sdk/go/go.mod
• examples/sdk/go/main.go
• examples/sdk/java/pom.xml
• examples/sdk/java/src/main/java/Example.java
• examples/sdk/javascript/index.mjs
• examples/sdk/javascript/package.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}