feat(cloudfront): VPC origins + anycast + trust stores + resource policies (batch 6a)

[vieiralucas]

Summary

• Adds 18 CloudFront ops: 5 VPC origin, 5 anycast IP list, 5 trust store, 3 resource policy
• Brings CloudFront to 136/136 implemented ops with conformance + e2e coverage
• ETag/If-Match concurrency for VPC origins / anycast / trust stores; `EntityAlreadyExists` on duplicate name
• `IpCount` validated to AWS allowed values (3 or 21)
• `DeleteVpcOrigin` returns deleted resource + ETag (matches AWS)
• `UpdateTrustStore` accepts `httpPayload` `CaCertificatesBundleSource` body shape
• `PutResourcePolicy` returns `` 200 (SDK requires non-empty body)

Test plan

• 4 new e2e tests pass (`cargo test -p fakecloud-e2e --test cloudfront_extras`)
• 18 new conformance tests pass with real Smithy checksums (`cargo test -p fakecloud-conformance --test cloudfront_extras`)
• `cargo run -p fakecloud-conformance -- audit` reports `cloudfront: 136/136 implemented actions covered` and overall PASS for 2131 actions
• `cargo clippy --workspace --all-targets -- -D warnings` clean
• `cargo fmt --all`
• README + website service pages updated to reflect CloudFront 135 ops and Batch 6a status

---

Summary by cubic

Adds CloudFront VPC origins, anycast IP lists, trust stores, and resource policies with full CRUD and ETag/If-Match concurrency, completing CloudFront API coverage (136/136). Includes conformance + e2e tests and docs updates; total operations now 2,184.

• New Features

  • VPC Origins: Create/Get/Update/Delete/List; Delete returns the deleted resource + ETag; duplicate Name -> EntityAlreadyExists.
  • Anycast IP Lists: Create/Get/Update/Delete/List; IpCount must be 3 or 21; deterministic AnycastIps returned.
  • Trust Stores: Create/Get/Update/Delete/List; UpdateTrustStore accepts httpPayload CaCertificatesBundleSource; ETag/If-Match enforced.
  • Resource Policies: PutResourcePolicy/GetResourcePolicy/DeleteResourcePolicy; policy stored verbatim per ARN; PutResourcePolicy returns <PutResourcePolicyResult> 200.

• Bug Fixes

  • Anycast: UpdateAnycastIpList uses the correct request shape (no Name/IpCount); IpCount is immutable.
  • VPC Origins: UpdateVpcOrigin validates Name/Arn; ListVpcOrigins emits the resource ARN in <Arn>.
  • Trust Stores: create/update reject an empty CaCertificatesBundleSource union.
  • Shapes: OriginSslProtocols.Items is required.

^{Written for commit 7b1caf2. Summary will update on new commits.}

[codecov]

Codecov Report

❌ Patch coverage is 0.30166% with 661 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-cloudfront/src/extras_service.rs	0.00%	658 Missing ⚠️
crates/fakecloud-cloudfront/src/extras.rs	0.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

7 issues found across 10 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-cloudfront/src/extras.rs">

<violation number="1" location="crates/fakecloud-cloudfront/src/extras.rs:23">
P2: Make `Items` required in `OriginSslProtocols`; AWS expects it whenever this block is present.</violation>

<violation number="2" location="crates/fakecloud-cloudfront/src/extras.rs:23">
P2: Make the trust-store bundle source required instead of allowing an empty union.</violation>
</file>

<file name="website/content/docs/services/_index.md">

<violation number="1" location="website/content/docs/services/_index.md:10">
P3: Update the total operation count to match the service table; 2,131 is inconsistent with the rows below.</violation>
</file>

<file name="crates/fakecloud-cloudfront/src/extras_service.rs">

<violation number="1" location="crates/fakecloud-cloudfront/src/extras_service.rs:112">
P2: `update_vpc_origin` does not validate required `name`/`arn` fields before saving, so updates can store invalid VPC origin configs.</violation>

<violation number="2" location="crates/fakecloud-cloudfront/src/extras_service.rs:183">
P2: `list_vpc_origins` writes `<Arn>` from `config.arn` instead of the VPC origin resource ARN, so list output returns the wrong ARN field.</violation>

<violation number="3" location="crates/fakecloud-cloudfront/src/extras_service.rs:293">
P1: `update_anycast_ip_list` skips `IpCount` validation and does not rebuild `anycast_ips`, allowing invalid counts and mismatched response data.</violation>
</file>

<file name="crates/fakecloud-conformance/tests/cloudfront_extras.rs">

<violation number="1" location="crates/fakecloud-conformance/tests/cloudfront_extras.rs:168">
P2: Don't discard the UpdateAnycastIpList result; this test will pass even when the API returns an error.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Make the trust-store bundle source required instead of allowing an empty union.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/fakecloud-cloudfront/src/extras.rs, line 23:

<comment>Make the trust-store bundle source required instead of allowing an empty union.</comment>

<file context>
@@ -0,0 +1,149 @@
+    #[serde(rename = "HTTPSPort")]
+    pub https_port: i32,
+    pub origin_protocol_policy: String,
+    #[serde(default, skip_serializing_if = "skip_if_none")]
+    pub origin_ssl_protocols: Option<OriginSslProtocols>,
+}
</file context>

[cubic-dev-ai]

1 issue found across 6 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="README.md">

<violation number="1" location="README.md:51">
P3: The total operations count is wrong; it should match the table below.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-core/src/dispatch.rs">

<violation number="1" location="crates/fakecloud-core/src/dispatch.rs:696">
P1: Virtual-hosted bucket-root PUT (`PUT /`) is now misclassified as a streaming S3 object route, which bypasses the global body-size cap and can trigger unbounded in-memory buffering.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}