chore: ensure that error codes are string literals

We have concerns that future maintainers may accidentally pass message
strings with interpolated variables where error codes are expected.

To prevent that, introduce a new type `LiteralString`, with only
possible way of obtaining one:

```ts
const x: LiteralString = lit`this does not have variables`;
```

Any attempt to use variables inside this string throws an error
at runtime, so code that does that can never execute.

Then update all locations in which we expect error codes to
take `LiteralString`s.

Author: rix0rrr

packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.client-vpn-endpoint-client-route-enforcement.ts

@@ -1,5 +1,6 @@
 import type { StackProps } from 'aws-cdk-lib';
 import { App, RemovalPolicy, Stack, UnscopedValidationError } from 'aws-cdk-lib';
+import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 import * as acm from 'aws-cdk-lib/aws-certificatemanager';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as logs from 'aws-cdk-lib/aws-logs';
@@ -12,9 +13,9 @@ import type { Construct } from 'constructs';
  * to validate the domain identity.
  */
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new UnscopedValidationError('HostedZoneIdRequired', 'For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
+if (!hostedZoneId) throw new UnscopedValidationError(lit`HostedZoneIdRequired`, 'For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new UnscopedValidationError('HostedZoneNameRequired', 'For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
+if (!hostedZoneName) throw new UnscopedValidationError(lit`HostedZoneNameRequired`, 'For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 
 interface TestStackProps extends StackProps {
   hostedZoneId: string;

packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.client-vpn-endpoint-disconnect-on-session-timeout.ts

@@ -1,5 +1,6 @@
 import type { StackProps } from 'aws-cdk-lib';
 import { App, RemovalPolicy, Stack, UnscopedValidationError } from 'aws-cdk-lib';
+import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 import * as acm from 'aws-cdk-lib/aws-certificatemanager';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as logs from 'aws-cdk-lib/aws-logs';
@@ -12,9 +13,9 @@ import type { Construct } from 'constructs';
  * to validate the domain identity.
  */
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new UnscopedValidationError('HostedZoneIdRequired', 'For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
+if (!hostedZoneId) throw new UnscopedValidationError(lit`HostedZoneIdRequired`, 'For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new UnscopedValidationError('HostedZoneNameRequired', 'For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
+if (!hostedZoneName) throw new UnscopedValidationError(lit`HostedZoneNameRequired`, 'For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 
 interface TestStackProps extends StackProps {
   hostedZoneId: string;

packages/@aws-cdk-testing/framework-integ/test/core/test/tree-metadata.test.ts

@@ -7,6 +7,7 @@ import { Construct } from 'constructs';
 import * as cxschema from 'aws-cdk-lib/cloud-assembly-schema';
 import type { TreeInspector } from 'aws-cdk-lib';
 import { App, AssumptionError, CfnParameter, CfnResource, Lazy, Stack } from 'aws-cdk-lib';
+import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 import type { ForestFile, TreeFile } from 'aws-cdk-lib/core/lib/private/tree-metadata';
 
 abstract class AbstractCfnResource extends CfnResource {
@@ -466,7 +467,7 @@ describe('tree metadata', () => {
   test('failing nodes', () => {
     class MyCfnResource extends CfnResource {
       public inspect(_: TreeInspector) {
-        throw new AssumptionError('ForcedInspectError', 'Forcing an inspect error');
+        throw new AssumptionError(lit`ForcedInspectError`, 'Forcing an inspect error');
       }
     }
 

packages/@aws-cdk/aws-amplify-alpha/lib/app.ts

@@ -12,6 +12,7 @@ import { Branch } from './branch';
 import type { DomainOptions } from './domain';
 import { Domain } from './domain';
 import { renderEnvironmentVariables, isServerSideRendered } from './utils';
+import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 
 /**
  * An Amplify Console application
@@ -276,7 +277,7 @@ export class App extends Resource implements IApp, iam.IGrantable {
 
     if (props.computeRole) {
       if (!isSSR) {
-        throw new ValidationError('InvalidComputeRolePlatform', '`computeRole` can only be specified for `Platform.WEB_COMPUTE` or `Platform.WEB_DYNAMIC`.', this);
+        throw new ValidationError(lit`InvalidComputeRolePlatform`, '`computeRole` can only be specified for `Platform.WEB_COMPUTE` or `Platform.WEB_DYNAMIC`.', this);
       }
       computedRole = props.computeRole;
     } else if (isSSR) {
@@ -611,15 +612,15 @@ export interface CustomResponseHeader {
 function renderCustomResponseHeaders(customHeaders: CustomResponseHeader[], scope: IConstruct): string {
   // Defensive assertion - should never happen due to call site validation
   if (customHeaders.length === 0) {
-    throw new ValidationError('EmptyCustomResponseHeaders', 'renderCustomResponseHeaders called with empty array', scope);
+    throw new ValidationError(lit`EmptyCustomResponseHeaders`, 'renderCustomResponseHeaders called with empty array', scope);
   }
 
   const hasAppRoot = customHeaders[0].appRoot !== undefined;
   const yaml = [hasAppRoot ? 'applications:' : 'customHeaders:'];
 
   for (const customHeader of customHeaders) {
     if ((customHeader.appRoot !== undefined) !== hasAppRoot) {
-      throw new ValidationError('InconsistentAppRoot', 'appRoot must be either be present or absent across all custom response headers', scope);
+      throw new ValidationError(lit`InconsistentAppRoot`, 'appRoot must be either be present or absent across all custom response headers', scope);
     }
 
     const baseIndentation = ' '.repeat(hasAppRoot ? 6 : 2);

packages/@aws-cdk/aws-amplify-alpha/lib/branch.ts

@@ -21,6 +21,7 @@ import { App } from './app';
 import type { BasicAuth } from './basic-auth';
 import { renderEnvironmentVariables, isServerSideRendered } from './utils';
 import { AssetDeploymentIsCompleteFunction, AssetDeploymentOnEventFunction } from '../custom-resource-handlers/dist/aws-amplify-alpha/asset-deployment-provider.generated';
+import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 
 /**
  * A branch
@@ -200,7 +201,7 @@ export class Branch extends Resource implements IBranch {
       const isSSR = isServerSideRendered(platform);
 
       if (props.computeRole && !isSSR) {
-        throw new ValidationError('InvalidBranchComputeRolePlatform', '`computeRole` can only be specified for branches of apps with `Platform.WEB_COMPUTE` or `Platform.WEB_DYNAMIC`.', this);
+        throw new ValidationError(lit`InvalidBranchComputeRolePlatform`, '`computeRole` can only be specified for branches of apps with `Platform.WEB_COMPUTE` or `Platform.WEB_DYNAMIC`.', this);
       }
     }
 

packages/@aws-cdk/aws-amplify-alpha/lib/domain.ts

@@ -8,6 +8,7 @@ import { propertyInjectable } from 'aws-cdk-lib/core/lib/prop-injectable';
 import type { Construct } from 'constructs';
 import type { IApp } from './app';
 import type { IBranch } from './branch';
+import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 
 /**
  * Options to add a domain to an application
@@ -139,10 +140,10 @@ export class Domain extends Resource {
 
     const domainName = props.domainName || id;
     if (!Token.isUnresolved(domainName) && domainName.length > 255) {
-      throw new ValidationError('DomainNameTooLong', `Domain name must be 255 characters or less, got: ${domainName.length} characters.`, this);
+      throw new ValidationError(lit`DomainNameTooLong`, `Domain name must be 255 characters or less, got: ${domainName.length} characters.`, this);
     }
     if (!Token.isUnresolved(domainName) && !/^(((?!-)[A-Za-z0-9-]{0,62}[A-Za-z0-9])\.)+((?!-)[A-Za-z0-9-]{1,62}[A-Za-z0-9])(\.)?$/.test(domainName)) {
-      throw new ValidationError('InvalidDomainName', `Domain name must be a valid hostname, got: ${domainName}.`, this);
+      throw new ValidationError(lit`InvalidDomainName`, `Domain name must be a valid hostname, got: ${domainName}.`, this);
     }
 
     const domain = new CfnDomain(this, 'Resource', {

packages/@aws-cdk/aws-apprunner-alpha/lib/auto-scaling-configuration.ts

@@ -3,6 +3,7 @@ import * as cdk from 'aws-cdk-lib/core';
 import { addConstructMetadata } from 'aws-cdk-lib/core/lib/metadata-resource';
 import { propertyInjectable } from 'aws-cdk-lib/core/lib/prop-injectable';
 import type { Construct } from 'constructs';
+import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 
 /**
  * Properties of the App Runner Auto Scaling Configuration.
@@ -123,7 +124,7 @@ export class AutoScalingConfiguration extends cdk.Resource implements IAutoScali
     const resourceParts = cdk.Fn.split('/', autoScalingConfigurationArn);
 
     if (!resourceParts || resourceParts.length < 3) {
-      throw new cdk.UnscopedValidationError('UnexpectedArnFormat', `Unexpected ARN format: ${autoScalingConfigurationArn}.`);
+      throw new cdk.UnscopedValidationError(lit`UnexpectedArnFormat`, `Unexpected ARN format: ${autoScalingConfigurationArn}.`);
     }
 
     const autoScalingConfigurationName = cdk.Fn.select(0, resourceParts);
@@ -181,13 +182,13 @@ export class AutoScalingConfiguration extends cdk.Resource implements IAutoScali
     if (props.autoScalingConfigurationName !== undefined && !cdk.Token.isUnresolved(props.autoScalingConfigurationName)) {
       if (props.autoScalingConfigurationName.length < 4 || props.autoScalingConfigurationName.length > 32) {
         throw new cdk.ValidationError(
-          'InvalidAutoScalingConfigurationNameLength', `\`autoScalingConfigurationName\` must be between 4 and 32 characters, got: ${props.autoScalingConfigurationName.length} characters.`, this,
+          lit`InvalidAutoScalingConfigurationNameLength`, `\`autoScalingConfigurationName\` must be between 4 and 32 characters, got: ${props.autoScalingConfigurationName.length} characters.`, this,
         );
       }
 
       if (!/^[A-Za-z0-9][A-Za-z0-9\-_]*$/.test(props.autoScalingConfigurationName)) {
         throw new cdk.ValidationError(
-          'InvalidAutoScalingConfigurationNameFormat', `\`autoScalingConfigurationName\` must start with an alphanumeric character and contain only alphanumeric characters, hyphens, or underscores after that, got: ${props.autoScalingConfigurationName}.`, this,
+          lit`InvalidAutoScalingConfigurationNameFormat`, `\`autoScalingConfigurationName\` must start with an alphanumeric character and contain only alphanumeric characters, hyphens, or underscores after that, got: ${props.autoScalingConfigurationName}.`, this,
         );
       }
     }
@@ -197,19 +198,19 @@ export class AutoScalingConfiguration extends cdk.Resource implements IAutoScali
     const isMaxConcurrencyDefined = typeof props.maxConcurrency === 'number';
 
     if (isMinSizeDefined && (props.minSize < 1 || props.minSize > 25)) {
-      throw new cdk.ValidationError('InvalidMinSize', `minSize must be between 1 and 25, got ${props.minSize}.`, this);
+      throw new cdk.ValidationError(lit`InvalidMinSize`, `minSize must be between 1 and 25, got ${props.minSize}.`, this);
     }
 
     if (isMaxSizeDefined && (props.maxSize < 1 || props.maxSize > 25)) {
-      throw new cdk.ValidationError('InvalidMaxSize', `maxSize must be between 1 and 25, got ${props.maxSize}.`, this);
+      throw new cdk.ValidationError(lit`InvalidMaxSize`, `maxSize must be between 1 and 25, got ${props.maxSize}.`, this);
     }
 
     if (isMinSizeDefined && isMaxSizeDefined && !(props.minSize < props.maxSize)) {
-      throw new cdk.ValidationError('MaxSizeMustBeGreaterThanMinSize', 'maxSize must be greater than minSize.', this);
+      throw new cdk.ValidationError(lit`MaxSizeMustBeGreaterThanMinSize`, 'maxSize must be greater than minSize.', this);
     }
 
     if (isMaxConcurrencyDefined && (props.maxConcurrency < 1 || props.maxConcurrency > 200)) {
-      throw new cdk.ValidationError('InvalidMaxConcurrency', `maxConcurrency must be between 1 and 200, got ${props.maxConcurrency}.`, this);
+      throw new cdk.ValidationError(lit`InvalidMaxConcurrency`, `maxConcurrency must be between 1 and 200, got ${props.maxConcurrency}.`, this);
     }
   }
 }

packages/@aws-cdk/aws-apprunner-alpha/lib/observability-configuration.ts

@@ -3,6 +3,7 @@ import * as cdk from 'aws-cdk-lib/core';
 import { addConstructMetadata } from 'aws-cdk-lib/core/lib/metadata-resource';
 import { propertyInjectable } from 'aws-cdk-lib/core/lib/prop-injectable';
 import type { Construct } from 'constructs';
+import { lit } from 'aws-cdk-lib/core/lib/helpers-internal';
 
 /**
  * The implementation provider chosen for tracing App Runner services
@@ -109,7 +110,7 @@ export class ObservabilityConfiguration extends cdk.Resource implements IObserva
     const resourceParts = cdk.Fn.split('/', observabilityConfigurationArn);
 
     if (!resourceParts || resourceParts.length < 3) {
-      throw new cdk.UnscopedValidationError('UnexpectedArnFormat', `Unexpected ARN format: ${observabilityConfigurationArn}.`);
+      throw new cdk.UnscopedValidationError(lit`UnexpectedArnFormat`, `Unexpected ARN format: ${observabilityConfigurationArn}.`);
     }
 
     const observabilityConfigurationName = cdk.Fn.select(0, resourceParts);
@@ -152,14 +153,14 @@ export class ObservabilityConfiguration extends cdk.Resource implements IObserva
     if (props.observabilityConfigurationName !== undefined && !cdk.Token.isUnresolved(props.observabilityConfigurationName)) {
       if (props.observabilityConfigurationName.length < 4 || props.observabilityConfigurationName.length > 32) {
         throw new cdk.ValidationError(
-          'InvalidObservabilityConfigurationNameLength',
+          lit`InvalidObservabilityConfigurationNameLength`,
           `\`observabilityConfigurationName\` must be between 4 and 32 characters, got: ${props.observabilityConfigurationName.length} characters.`, this,
         );
       }
 
       if (!/^[A-Za-z0-9][A-Za-z0-9\-_]*$/.test(props.observabilityConfigurationName)) {
         throw new cdk.ValidationError(
-          'InvalidObservabilityConfigurationNameFormat',
+          lit`InvalidObservabilityConfigurationNameFormat`,
           `\`observabilityConfigurationName\` must start with an alphanumeric character and contain only alphanumeric characters, hyphens, or underscores after that, got: ${props.observabilityConfigurationName}.`, this,
         );
       }