CreateIPSet marks IPAddressVersion Required: Yes in the API reference, but substrate
accepts a request that omits it and silently substitutes IPV4 (emulator/wafv2_plugin.go, the
createIPSet arm). #738 fixed the name substrate reads — the wrong one made a typed SDK's
IPV6 request fall through to that same default — but deliberately kept the default rather than
adding a refusal, because a missing-required-parameter refusal is a different class of defect and
needs its own error-code verification.
A caller that omits the parameter gets a successful IPv4 set where AWS refuses, so a test
exercising the validation branch of its own code cannot see the refusal.
What has to be decided
Which refusal AWS actually publishes. WAFv2's error list for CreateIPSet carries
WAFInvalidParameterException, WAFLimitsExceededException, WAFInternalErrorException,
WAFDuplicateItemException, WAFOptimisticLockException, WAFTagOperationException,
WAFTagOperationInternalErrorException, WAFSubscriptionNotFoundException and
WAFInvalidOperationException — but a required-member omission may be refused by the protocol
layer before the operation is reached, in which case the code and HTTP status come from the
serializer, not from the operation. That has to be checked against the reference before anything
is implemented, not guessed from a sibling operation.
The same question applies to the other required members on the operation (Name, Scope,
Addresses), and to whether an address that does not parse as CIDR for the declared version is
refused — so the answer is worth establishing once for the plugin rather than per parameter.
Acceptance criteria
Filed out of #738, which fixed the wire name only.
CreateIPSetmarksIPAddressVersionRequired: Yes in the API reference, but substrateaccepts a request that omits it and silently substitutes
IPV4(emulator/wafv2_plugin.go, thecreateIPSetarm). #738 fixed the name substrate reads — the wrong one made a typed SDK'sIPV6request fall through to that same default — but deliberately kept the default rather thanadding a refusal, because a missing-required-parameter refusal is a different class of defect and
needs its own error-code verification.
A caller that omits the parameter gets a successful IPv4 set where AWS refuses, so a test
exercising the validation branch of its own code cannot see the refusal.
What has to be decided
Which refusal AWS actually publishes. WAFv2's error list for
CreateIPSetcarriesWAFInvalidParameterException,WAFLimitsExceededException,WAFInternalErrorException,WAFDuplicateItemException,WAFOptimisticLockException,WAFTagOperationException,WAFTagOperationInternalErrorException,WAFSubscriptionNotFoundExceptionandWAFInvalidOperationException— but a required-member omission may be refused by the protocollayer before the operation is reached, in which case the code and HTTP status come from the
serializer, not from the operation. That has to be checked against the reference before anything
is implemented, not guessed from a sibling operation.
The same question applies to the other required members on the operation (
Name,Scope,Addresses), and to whether an address that does not parse as CIDR for the declared version isrefused — so the answer is worth establishing once for the plugin rather than per parameter.
Acceptance criteria
IPAddressVersionmatches the code and HTTP status the AWSreference publishes, with the source named in the commit message.
recorded with its reason.
docs/services.mdrecords whatever remains a deliberate divergence.Filed out of #738, which fixed the wire name only.