Review Identity

Review: Resource Identity

Assume the @maintainer persona. Scope: identity declaration and import-ID parsers. Loaded from review-pr.

Identity strategy — exactly one per resource

Every new resource declares one identity strategy via comment annotations above the factory function. Flag missing identity annotations on new resources.

@IdentityAttribute supports keywords: optional, resourceAttributeName, testNotNull, valueType, and identityDuplicateAttributes.

Multi-attribute identity needs an ImportIDHandler

Parameterized identities with more than one attribute require both:

1. An // @ImportIDHandler("<typeName>") annotation (alongside the @IdentityAttribute annotations) referencing a type that satisfies inttypes.ImportIDParser.
2. The implementation:

type fooImportID struct{}

func (fooImportID) Parse(id string) (string, map[string]string, error) {
    // parse a separator-delimited string into named identity attributes
}

var _ inttypes.ImportIDParser = fooImportID{}

Flag multi-attribute identity resources that:

• Omit @ImportIDHandler — the generator's Validate() requires it for multiple parameterized identity and will error.
• Reference an @ImportIDHandler whose target type doesn't satisfy inttypes.ImportIDParser (the var _ inttypes.ImportIDParser = ...{} assertion catches this).
• Implement Parse without a clear error message describing the expected import-ID format on malformed input.

@ImportIDHandler is meaningful for parameterized identities with multiple attributes. Question its use on singleton or single-attribute parameterized resources.

Region opt-out for global services

Global services (CloudFront, IAM, Route 53 hosted zones, etc.) omit framework.WithRegionModel from the model and register with inttypes.ResourceRegionDisabled() in the service-package generator. Identity-Schema docs for these resources omit the region attribute.