fix(discovery): drop SecretTargetAttachment discovery and the $LATEST version pseudo-entry

CHANGELOG.md

@@ -134,14 +134,14 @@ Requires formae >= 0.89.0.
   operation, so it retries them instead of failing the resource. Faults that
   will not clear — access denied, an unusable secret, a rejected statement —
   stay terminal, keep their diagnosis, and never start a wait.
-- Discovery for eight more resource types whose CloudControl list support was
+- Discovery for seven more resource types whose CloudControl list support was
   verified against the type registry and a live account: `AWS::IAM::User`,
   `AWS::IAM::VirtualMFADevice`, `AWS::ECS::CapacityProvider`,
   `AWS::RDS::CustomDBEngineVersion`, `AWS::S3::AccessGrantsInstance`,
-  `AWS::SecretsManager::SecretTargetAttachment`, `AWS::Lambda::Permission`
-  (scoped per function), and `AWS::ElasticLoadBalancingV2::ListenerRule`
-  (scoped per listener). Live resources of these types now appear in
-  inventory and can be brought under management.
+  `AWS::Lambda::Permission` (scoped per function), and
+  `AWS::ElasticLoadBalancingV2::ListenerRule` (scoped per listener). Live
+  resources of these types now appear in inventory and can be brought under
+  management.
 - Discovery for `AWS::ApiGateway::Resource`, `AWS::ApiGateway::Method`, and
   `AWS::CloudFront::Distribution`, and extract for
   `AWS::CloudFront::Distribution`. Live API Gateway resources and methods and
@@ -398,6 +398,11 @@ Requires formae >= 0.89.0.
 
 ### Fixed
 
+- `AWS::Lambda::Version` discovery now surfaces published versions. The list
+  post-filter compared the parent function's name against the ARN form
+  CloudControl echoes back, dropping every listed version, so version
+  discovery silently found nothing.
+
 - `AWS::Lambda::Permission` discovery now finds permissions attached to a
   published version or an alias, not only those on the bare function. Lambda
   keeps a separate resource policy per qualifier and the CloudControl list

aws.go

@@ -139,6 +139,11 @@ var discoveryListExclusions = map[string]func(nativeID string) bool{
 	"AWS::KMS::Alias": func(id string) bool {
 		return strings.HasPrefix(id, "alias/aws/")
 	},
+	// CloudControl's version list includes the $LATEST pseudo-version, which
+	// is not a published version and whose read always fails.
+	"AWS::Lambda::Version": func(id string) bool {
+		return strings.HasSuffix(id, ":$LATEST")
+	},
 }
 
 // LabelConfig returns the label extraction configuration for discovered AWS resources.

aws_test.go

@@ -166,6 +166,12 @@ func TestDiscoveryListExclusions(t *testing.T) {
 		assert.False(t, excluded("alias/awsome-key"))
 	})
 
+	t.Run("excludes the $LATEST pseudo-version and keeps published versions", func(t *testing.T) {
+		excluded := discoveryListExclusions["AWS::Lambda::Version"]
+		assert.True(t, excluded("arn:aws:lambda:us-east-1:111122223333:function:my-function:$LATEST"))
+		assert.False(t, excluded("arn:aws:lambda:us-east-1:111122223333:function:my-function:3"))
+	})
+
 	t.Run("has no exclusion for other types", func(t *testing.T) {
 		assert.Nil(t, discoveryListExclusions["AWS::S3::Bucket"])
 	})

schema/pkl/secretsmanager/secrettargetattachment.pkl

@@ -14,6 +14,7 @@ const type = "AWS::SecretsManager::SecretTargetAttachment"
 @aws.ResourceHint {
     type = module.type
     identifier = "Id"
+    discoverable = false // CloudControl's list returns every secret in the account rather than actual attachments, and reads of those ids fail
     extractable = true
 }
 open class SecretTargetAttachment extends formae.Resource {