Fix lab CLI lines and Python/Terraform snippets found by replaying every lab

dashboard/labs/apigateway_labs.py

@@ -112,7 +112,7 @@
         {
             'key': 'create-stage',
             'title': 'Create the default stage',
-            'command': 'aws apigatewayv2 create-stage --api-id <api-id> --stage-name $default --auto-deploy',
+            'command': 'aws apigatewayv2 create-stage --api-id <api-id> --stage-name \'$default\' --auto-deploy',
             'explanation': 'Publishes route changes automatically through the default HTTP API stage.',
         },
         {
@@ -436,7 +436,7 @@ def _run_apigw_create_route() -> dict[str, Any]:
 
 
 def _run_apigw_create_stage() -> dict[str, Any]:
-    command = 'aws apigatewayv2 create-stage --api-id <api-id> --stage-name $default --auto-deploy'
+    command = "aws apigatewayv2 create-stage --api-id <api-id> --stage-name '$default' --auto-deploy"
     started = time.perf_counter()
     api_id = _apigw_lambda_api_id()
     stage_verification = _verify_apigw_lambda_stage()

dashboard/labs/cloudwatch_logging_labs.py

@@ -181,8 +181,8 @@ def destination_policy(destination_arn: str) -> dict[str, Any]:
     f'aws s3api put-bucket-lifecycle-configuration --bucket {BUCKET} --lifecycle-configuration file://lifecycle.json\n'
     f'aws iam create-role --role-name {FIREHOSE_ROLE} --assume-role-policy-document file://firehose-trust.json\n'
     f'aws firehose create-delivery-stream --delivery-stream-name {ARCHIVE_STREAM} '
-    f'--extended-s3-destination-configuration RoleARN={FIREHOSE_ROLE_ARN},BucketARN=arn:aws:s3:::{BUCKET},'
-    f'Prefix={ARCHIVE_PREFIX},BufferingHints={{IntervalInSeconds={ARCHIVE_BUFFER_SECONDS},SizeInMBs=1}}\n'
+    f'--extended-s3-destination-configuration "RoleARN={FIREHOSE_ROLE_ARN},BucketARN=arn:aws:s3:::{BUCKET},'
+    f'Prefix={ARCHIVE_PREFIX},BufferingHints={{IntervalInSeconds={ARCHIVE_BUFFER_SECONDS},SizeInMBs=1}}"\n'
     + ''.join(
         f'aws logs put-subscription-filter --log-group-name {group} --filter-name {ARCHIVE_SUBSCRIPTION} '
         f'--filter-pattern "" --destination-arn {ARCHIVE_ARN} --role-arn {LOGS_ROLE_ARN}\n'

dashboard/labs/cloudwatch_observability_labs.py

@@ -193,7 +193,7 @@ def handler(event, context):
 )
 ALARM_COMMAND = (
     f'aws sns create-topic --name {TOPIC}\n'
-    f'aws sqs create-queue --queue-name {INBOX} --attributes file://inbox-policy.json\n'
+    f'aws sqs create-queue --queue-name {INBOX} --attributes file://inbox-attributes.json\n'
     f'aws sns subscribe --topic-arn {TOPIC_ARN} --protocol sqs --notification-endpoint {INBOX_ARN}\n'
     f'aws cloudwatch put-metric-alarm --alarm-name {ALARM} --namespace {NAMESPACE} --metric-name {ERRORS_METRIC} '
     f'--statistic Sum --period 60 --evaluation-periods 1 --threshold {ALARM_THRESHOLD} '
@@ -304,8 +304,8 @@ def handler(event, context):
                 'notification to the topic (Floci 2.3.0 ran no alarm actions, so nothing reached the queue). The step '
                 'checks the state and the configured actions, and reports whether the ALARM message arrived.'
             ),
-            'artifact_label': 'inbox-policy.json',
-            'artifact': json.dumps(INBOX_POLICY, indent=2),
+            'artifact_label': 'inbox-attributes.json',
+            'artifact': json.dumps({'Policy': json.dumps(INBOX_POLICY)}, indent=2),
         },
         {
             'key': 'dashboard',

dashboard/labs/codepipeline_gates_labs.py

@@ -504,7 +504,7 @@ def queue_policy(queue_arn: str, rule_arn: str) -> dict[str, Any]:
 )
 REPORT_COMMAND = (
     f'aws codebuild create-report-group --name {REPORT_GROUP} --type TEST '
-    f'--export-config exportConfigType=S3,s3Destination={{bucket={ARTIFACT_BUCKET},path=reports,packaging=NONE}}\n'
+    f'--export-config "exportConfigType=S3,s3Destination={{bucket={ARTIFACT_BUCKET},path=reports,packaging=NONE}}"\n'
     f'aws codebuild list-reports-for-report-group --report-group-arn <arn>\n'
     'aws codebuild describe-test-cases --report-arn <report-arn>\n'
     f'aws s3 cp s3://{ARTIFACT_BUCKET}/{UNIT_PREFIX}/junit.xml -'

dashboard/labs/codepipeline_labs.py

@@ -154,8 +154,8 @@ def _trust(service: str) -> dict[str, Any]:
     f'aws codebuild create-project --name {PROJECT} --service-role {BUILD_ROLE} \\\n'
     f'  --source type=S3,location={BUCKET}/{SOURCE_KEY} \\\n'
     f'  --artifacts type=S3,location={BUCKET},path={ARTIFACT_PATH},namespaceType=BUILD_ID,name={ARTIFACT_NAME},packaging=ZIP \\\n'
-    f'  --environment type=LINUX_CONTAINER,computeType=BUILD_GENERAL1_SMALL,image={BUILD_IMAGE},'
-    f'environmentVariables=[{{name=STAGE,value={BUILD_STAGE}}}] \\\n'
+    f'  --environment "type=LINUX_CONTAINER,computeType=BUILD_GENERAL1_SMALL,image={BUILD_IMAGE},'
+    f'environmentVariables=[{{name=STAGE,value={BUILD_STAGE}}}]" \\\n'
     f'  --timeout-in-minutes {BUILD_TIMEOUT_MINUTES}'
 )
 FIRST_BUILD_COMMAND = (

dashboard/labs/costexplorer_labs.py

@@ -101,8 +101,8 @@
     f'aws sns create-topic --name {TOPIC}\n'
     f'aws budgets create-budget --account-id {ACCOUNT} --budget file://platform-budget.json '
     '--notifications-with-subscribers file://alerts.json   # ACTUAL > 80%, FORECASTED > 100%\n'
-    f'aws budgets create-budget --account-id {ACCOUNT} --budget BudgetName={RI_BUDGET},BudgetType=RI_UTILIZATION,'
-    'TimeUnit=MONTHLY,BudgetLimit={Amount=80,Unit=PERCENTAGE}'
+    f'aws budgets create-budget --account-id {ACCOUNT} --budget "BudgetName={RI_BUDGET},BudgetType=RI_UTILIZATION,'
+    'TimeUnit=MONTHLY,BudgetLimit={Amount=80,Unit=PERCENTAGE}"'
 )
 EXPLORER_COMMAND = (
     'aws ce get-cost-and-usage --time-period Start=<first-of-last-month>,End=<first-of-this-month> '

dashboard/labs/ec2_guided.py

@@ -76,7 +76,7 @@
             {
                 'key': 'verify-script-execution',
                 'title': 'Confirm initialization status',
-                'command': "aws ssm send-command --instance-ids <instance-id> --document-name AWS-RunShellScript --parameters commands='test -f /tmp/floci-userdata.txt && echo \"artifact-confirmed\"'",
+                'command': "aws ssm send-command --instance-ids <instance-id> --document-name AWS-RunShellScript --parameters 'commands=[\"test -f /tmp/floci-userdata.txt && echo artifact-confirmed\"]'",
                 'explanation': 'Validates file existence and execution completion.',
             },
         ],

dashboard/labs/ec2_performance_labs.py

@@ -250,15 +250,15 @@ def proxy_role_policy(secret_arn: str) -> dict[str, Any]:
     f'aws ssm send-command --document-name AWS-RunShellScript --instance-ids <id> '
     f'--parameters commands=["<start {WORKERS} workers; sample CPU time and throttling for 10 s>"]\n'
     f'aws cloudwatch put-metric-data --namespace {NAMESPACE} --metric-data '
-    f'MetricName={CPU_METRIC},Value=<percent>,Dimensions=[{{Name=InstanceId,Value=<id>}}] '
-    f'MetricName={THROTTLE_METRIC},Value=<periods>,Dimensions=[{{Name=InstanceId,Value=<id>}}]\n'
+    f'"MetricName={CPU_METRIC},Value=<percent>,Dimensions=[{{Name=InstanceId,Value=<id>}}]" '
+    f'"MetricName={THROTTLE_METRIC},Value=<periods>,Dimensions=[{{Name=InstanceId,Value=<id>}}]"\n'
     f'aws cloudwatch describe-alarms --alarm-names {CPU_ALARM}'
 )
 MEMORY_COMMAND = (
     f'aws ssm send-command --document-name AWS-RunShellScript --instance-ids <id> '
     f'--parameters commands=["<run the {REPORT_MIB} MiB report job; read oom_kill>"]\n'
     f'aws cloudwatch put-metric-data --namespace {NAMESPACE} --metric-data '
-    f'MetricName={OOM_METRIC},Value=1,Dimensions=[{{Name=InstanceId,Value=<id>}}]\n'
+    f'"MetricName={OOM_METRIC},Value=1,Dimensions=[{{Name=InstanceId,Value=<id>}}]"\n'
     f'aws cloudwatch describe-alarms --alarm-names {OOM_ALARM}'
 )
 RIGHT_SIZE_COMMAND = (

dashboard/labs/ecs_bluegreen_labs.py

@@ -298,7 +298,7 @@ def manifest(layer: bytes, config: bytes) -> str:
     f'aws ecs create-service --cluster {CLUSTER} --service-name {SERVICE_NAME} --task-definition {FAMILY}:1 '
     f'--desired-count {DESIRED_COUNT} --launch-type FARGATE --deployment-controller type=CODE_DEPLOY '
     f'--load-balancers targetGroupArn=<{BLUE_TG}>,containerName={CONTAINER},containerPort={CONTAINER_PORT} '
-    '--network-configuration awsvpcConfiguration={subnets=[<subnet-a>,<subnet-b>]}'
+    '--network-configuration "awsvpcConfiguration={subnets=[<subnet-a>,<subnet-b>]}"'
 )
 DEPLOYMENT_GROUP_COMMAND = (
     f'aws cloudwatch put-metric-alarm --alarm-name {ALARM} --namespace AWS/ApplicationELB '

dashboard/labs/eventbridge_application.py

@@ -172,20 +172,20 @@ def lambda_handler(event, context):
             'explanation': 'Transforms the processing payload, preserves the full audit envelope, and invokes the notification Lambda. Retry/DLQ fields show the AWS shape; current Floci executes transformation and delivery but does not enforce target retry/DLQ behavior.',
             'artifact_label': 'processing-target.json',
             'artifact': json.dumps(
-                {
+                [{
                     'Id': 'processing',
                     'Arn': QUEUE_ARNS[PROCESSING_QUEUE],
                     'InputTransformer': PROCESSING_TRANSFORMER,
                     'RetryPolicy': RETRY_POLICY,
                     'DeadLetterConfig': DEAD_LETTER_CONFIG,
-                },
+                }],
                 indent=2,
             ),
         },
         {
             'key': 'create-api',
             'title': 'Expose the producer through API Gateway',
-            'command': f'aws apigatewayv2 create-api --name {API_NAME} --protocol-type HTTP\naws apigatewayv2 create-integration --api-id <api-id> --integration-type AWS_PROXY --integration-uri {PRODUCER_FUNCTION_ARN} --payload-format-version 2.0\naws apigatewayv2 create-route --api-id <api-id> --route-key "{ROUTE_KEY}" --target integrations/<integration-id>\naws apigatewayv2 create-stage --api-id <api-id> --stage-name $default --auto-deploy',
+            'command': f'aws apigatewayv2 create-api --name {API_NAME} --protocol-type HTTP\naws apigatewayv2 create-integration --api-id <api-id> --integration-type AWS_PROXY --integration-uri {PRODUCER_FUNCTION_ARN} --payload-format-version 2.0\naws apigatewayv2 create-route --api-id <api-id> --route-key "{ROUTE_KEY}" --target integrations/<integration-id>\naws apigatewayv2 create-stage --api-id <api-id> --stage-name \'$default\' --auto-deploy',
             'explanation': 'Builds the HTTP entry point and Lambda proxy route.',
         },
         {

dashboard/labs/iam_organizations_labs.py

@@ -119,7 +119,8 @@
     f'aws organizations create-account --account-name {name} --email {info["email"]}   # then move-account to {info["ou"]}'
     for name, info in ACCOUNTS.items())
 SCP_COMMAND = '\n'.join(
-    f'aws organizations create-policy --type SERVICE_CONTROL_POLICY --name {name} --content file://{name}.json\n'
+    f'aws organizations create-policy --type SERVICE_CONTROL_POLICY --name {name} '
+    f'--description "{info["description"]}" --content file://{name}.json\n'
     f'aws organizations attach-policy --policy-id <{name}-id> --target-id <{info["target"]}-id>'
     for name, info in SCPS.items())
 EVAL_COMMAND = (
@@ -129,7 +130,8 @@
 )
 TAG_COMMAND = (
     'aws organizations enable-policy-type --root-id <root-id> --policy-type TAG_POLICY\n'
-    f'aws organizations create-policy --type TAG_POLICY --name {TAG_POLICY} --content file://cost-center.json\n'
+    f'aws organizations create-policy --type TAG_POLICY --name {TAG_POLICY} --description "CostCenter tag values" '
+    '--content file://cost-center.json\n'
     f'aws organizations attach-policy --policy-id <{TAG_POLICY}-id> --target-id <root-id>\n'
     f'aws organizations describe-effective-policy --policy-type TAG_POLICY --target-id <{PROD_ACCOUNT}-id>'
 )

dashboard/labs/lambda_labs.py

@@ -327,7 +327,7 @@ def lambda_handler(event, context):
         {
             'key': 'create-function',
             'title': 'Create the config reader function',
-            'command': f'aws lambda create-function --function-name {LAMBDA_CONFIG_FUNCTION_NAME} --runtime {LAMBDA_RUNTIME} --role {LAMBDA_CONFIG_ROLE_ARN} --handler {LAMBDA_HANDLER} --zip-file fileb://function.zip --environment Variables={{PARAMETER_NAME={LAMBDA_CONFIG_PARAMETER_NAME},SECRET_ID={LAMBDA_CONFIG_SECRET_NAME}}}',
+            'command': f'aws lambda create-function --function-name {LAMBDA_CONFIG_FUNCTION_NAME} --runtime {LAMBDA_RUNTIME} --role {LAMBDA_CONFIG_ROLE_ARN} --handler {LAMBDA_HANDLER} --zip-file fileb://function.zip --environment "Variables={{PARAMETER_NAME={LAMBDA_CONFIG_PARAMETER_NAME},SECRET_ID={LAMBDA_CONFIG_SECRET_NAME}}}"',
             'explanation': 'Packages a handler that reads SSM and Secrets Manager at invocation time.',
             'artifact_label': 'handler.py',
             'artifact': LAMBDA_CONFIG_HANDLER_SOURCE,
@@ -1151,7 +1151,7 @@ def _run_lambda_config_create_function() -> dict[str, Any]:
         f'aws lambda create-function --function-name {LAMBDA_CONFIG_FUNCTION_NAME} '
         f'--runtime {LAMBDA_RUNTIME} --role {LAMBDA_CONFIG_ROLE_ARN} '
         f'--handler {LAMBDA_HANDLER} --zip-file fileb://function.zip '
-        f'--environment Variables={{PARAMETER_NAME={LAMBDA_CONFIG_PARAMETER_NAME},SECRET_ID={LAMBDA_CONFIG_SECRET_NAME}}}'
+        f'--environment "Variables={{PARAMETER_NAME={LAMBDA_CONFIG_PARAMETER_NAME},SECRET_ID={LAMBDA_CONFIG_SECRET_NAME}}}"'
     )
     started = time.perf_counter()
     environment = {

dashboard/labs/sagemaker_labs.py

@@ -122,8 +122,8 @@
     f'  --algorithm-specification TrainingImage={TRAIN_IMAGE},TrainingInputMode=File,'
     'ContainerEntrypoint=python,/opt/ml/input/data/code/train.py \\\n'
     '  --hyper-parameters epochs=5,learning_rate=0.1,model_version=1 \\\n'
-    f'  --input-data-config ChannelName=train,DataSource={{S3DataSource={{S3DataType=S3Prefix,S3Uri=s3://{BUCKET}/train/}}}} '
-    f'ChannelName=code,DataSource={{S3DataSource={{S3DataType=S3Prefix,S3Uri=s3://{BUCKET}/code/}}}} \\\n'
+    f'  --input-data-config "ChannelName=train,DataSource={{S3DataSource={{S3DataType=S3Prefix,S3Uri=s3://{BUCKET}/train/}}}}" '
+    f'"ChannelName=code,DataSource={{S3DataSource={{S3DataType=S3Prefix,S3Uri=s3://{BUCKET}/code/}}}}" \\\n'
     f'  --output-data-config S3OutputPath=s3://{BUCKET}/models/ \\\n'
     f'  --resource-config InstanceType={INSTANCE_TYPE},InstanceCount=1,VolumeSizeInGB=5 '
     '--stopping-condition MaxRuntimeInSeconds=600\n'