feat(elbv2): listeners + rules + certificates (Batch 3)

[vieiralucas]

Summary

Batch 3 of the ELBv2 rollout — completes the request-routing surface (listeners attach to LBs; rules route requests to target groups).

14 new ops: CreateListener, DescribeListeners, ModifyListener, DeleteListener, DescribeListenerAttributes, ModifyListenerAttributes, AddListenerCertificates, RemoveListenerCertificates, DescribeListenerCertificates, CreateRule, DescribeRules, ModifyRule, DeleteRule, SetRulePriorities.

• CreateListener validates referenced target groups exist and marks them attached to the LB (LoadBalancerArns is now populated for every TG used as a default action target — needed for Batch 5's auto-register flow).
• Default actions parsing covers forward (single TG and multi-TG ForwardConfig), redirect, fixed-response.
• CreateRule validates priority is a positive integer and is unique per-listener; same-priority returns PriorityInUse matching AWS.
• Rule conditions parse path-pattern, host-header, http-header, http-request-method, source-ip configs.
• DeleteListener cascades to rules; DeleteLoadBalancer already cascaded to listeners + rules in Batch 1.

This is Batch 3 of 6. Stack: PR #746 (Batch 1, merged) -> PR #747 (Batch 2, in CI) -> this PR -> Batch 4 (LB attrs + trust stores + capacity) -> Batch 5 (real HTTP routing + ECS auto-register) -> Batch 6 (final docs).

Test plan

• cargo test -p fakecloud-conformance --test elbv2 — 35 tests pass (12 + 9 + 14)
• cargo clippy --workspace --all-targets -- -D warnings clean (Batch 3 crate)
• cargo fmt --all -- --check clean
• Smithy checksums computed against current AWS models

---

Summary by cubic

Adds ELBv2 target groups + targets + health and listeners + rules + certificates to complete request routing and health reporting. ELBv2 now exposes 35 operations with stricter validation, cascading deletes, and updated docs/tests.

• New Features

  • Target groups + targets + health (9 ops): create/describe/modify/delete TGs, register/deregister targets, describe target health, modify/describe TG attributes. Idempotent create, default TG attributes match AWS, TargetType validation, and DeleteTargetGroup is blocked when referenced by listeners or rules (incl. ForwardConfig).
  • Listeners, rules, certificates (14 ops): create/describe/modify/delete listeners; describe/modify listener attributes; add/remove/describe listener certificates; create/describe/modify/delete rules; set rule priorities. Default actions support forward (single + ForwardConfig), redirect, fixed-response; referenced target groups are validated and default-action TGs are attached to the LB; rule priorities are per-listener unique; supported conditions: path-pattern, host-header, http-header, http-request-method, source-ip; DeleteListener cascades to rules.
  • Conformance/docs: 35 ELBv2 conformance tests pass; README and website/static/llms.txt updated with 35 ops.

• Bug Fixes

  • Enforced CreateRule priority > 0 and validated rule action target groups exist (both top-level and in ForwardConfig).
  • DeleteTargetGroup also rejects when a rule action’s ForwardConfig references the TG.
  • DescribeTargetGroups now emits Matcher.GrpcCode when present.
  • Unit test now uses a synthetic action name to assert the ActionNotImplemented path without coupling to implemented ops.

^{Written for commit ded1216. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-elbv2/src/service.rs">

<violation number="1" location="crates/fakecloud-elbv2/src/service.rs:1189">
P1: DeleteTargetGroup misses rule ForwardConfig references, allowing deletion of in-use target groups.</violation>

<violation number="2" location="crates/fakecloud-elbv2/src/service.rs:1619">
P2: Priority validation accepts zero/negative values even though this path requires a positive integer.</violation>

<violation number="3" location="crates/fakecloud-elbv2/src/service.rs:1628">
P1: CreateRule does not validate action target-group references, so rules can persist ARNs for missing target groups.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: CreateRule does not validate action target-group references, so rules can persist ARNs for missing target groups.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-elbv2/src/service.rs, line 1628:

<comment>CreateRule does not validate action target-group references, so rules can persist ARNs for missing target groups.</comment>

<file context>
@@ -923,6 +969,1396 @@ impl Elbv2Service {
+        if conditions.is_empty() {
+            return Err(invalid_param("Conditions is required"));
+        }
+        let actions = parse_actions(req, "Actions");
+        if actions.is_empty() {
+            return Err(invalid_param("Actions is required"));
</file context>

[cubic-dev-ai]

P1: DeleteTargetGroup misses rule ForwardConfig references, allowing deletion of in-use target groups.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-elbv2/src/service.rs, line 1189:

<comment>DeleteTargetGroup misses rule ForwardConfig references, allowing deletion of in-use target groups.</comment>

<file context>
@@ -923,6 +969,1396 @@ impl Elbv2Service {
+                        .map(|f| f.target_groups.iter().any(|t| t.target_group_arn == arn))
+                        .unwrap_or(false)
+                })
+        }) || st.rules.values().any(|r| {
+            r.actions
+                .iter()
</file context>

Suggested change

	}) || st.rules.values().any(|r| {
	r.actions
	.iter()
	.any(|a| a.target_group_arn.as_deref() == Some(arn.as_str()))
	});
	}) || st.rules.values().any(|r| {
	r.actions
	.iter()
	.any(|a| a.target_group_arn.as_deref() == Some(arn.as_str()))
	|| r.actions.iter().any(|a| {
	a.forward
	.as_ref()
	.map(|f| f.target_groups.iter().any(|t| t.target_group_arn == arn))
	.unwrap_or(false)
	})
	});

[cubic-dev-ai]

P2: Priority validation accepts zero/negative values even though this path requires a positive integer.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-elbv2/src/service.rs, line 1619:

<comment>Priority validation accepts zero/negative values even though this path requires a positive integer.</comment>

<file context>
@@ -923,6 +969,1396 @@ impl Elbv2Service {
+    fn create_rule(&self, req: &AwsRequest) -> Result<AwsResponse, AwsServiceError> {
+        let listener_arn = required_query_param(req, "ListenerArn")?;
+        let priority = required_query_param(req, "Priority")?;
+        if priority.parse::<i32>().is_err() {
+            return Err(invalid_param(format!(
+                "Priority must be a positive integer, got '{priority}'"
</file context>

Suggested change

	if priority.parse::<i32>().is_err() {
	if priority.parse::<i32>().ok().filter(|p| *p > 0).is_none() {

[codecov]

Codecov Report

❌ Patch coverage is 0.08045% with 1242 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-elbv2/src/service.rs	0.08%	1242 Missing ⚠️

📢 Thoughts on this report? Let us know!