Fix lab CLI lines and Python/Terraform snippets found by replaying every lab - #82

Requested by Chris

What

I checked every lab's CLI, Python and Terraform snippets (120 labs, 810 steps) and fixed the bugs that would break for a learner who copies them.

How they were checked

• Every complete aws line went through the AWS CLI's own argument parser, and every lab command through bash quoting rules.
• Every step's file (artifact) was parsed as the CLI parameter it fills.
• Every boto3 snippet was run with botocore's parameter validation, and replayed live on a throwaway Floci 2.4.0.
• Every Terraform snippet passed terraform validate with AWS provider 6.72, then apply and destroy per step on a second throwaway Floci.

Lab command fixes

• Organizations create-policy was missing the required --description (SCPs and the tag policy).
• Unquoted shorthand with {a,b} was brace-expanded by the shell into two arguments. Affected: Lambda --environment, Firehose buffering hints, CodeBuild environment and report export, the RI budget, put-metric-data dimensions, ECS --network-configuration and SageMaker input channels.
• --stage-name $default was emptied by the shell. It now reads '$default'.
• The guided EC2 send-command used commands='… "…"', which the CLI rejects.
• The SQS batch files held {"Entries": [...]} and the EventBridge targets file held one object. --entries and --targets take the list itself.
• The SQS create-queue --attributes file was a bare policy. It is now an attributes map with Policy.

Snippet generator fixes (snippets.py)

• Python wraps calls the lab marks as failing ("refused", "denied", …Exception) in try/except ClientError, so the rest of the script still runs.
• CLI doubles now render as plain numbers. Before, they rendered as Decimal(...) with no import.
• Shortened (...) or placeholder shorthand keeps <placeholders> (numbers become named constants) and drops fragments that only half-parse, such as Entries=[{'ref': ...}].
• Terraform aws_flow_log uses log_destination, because provider 6 removed log_group_name.

New tests

• Every complete CLI line parses with the AWS CLI.
• Every lab command survives the shell.
• Every artifact fits its CLI parameter.
• Every boto3 snippet's literal values fit the API shapes and use only defined names.

Tests

• python manage.py test --noinput: 2,155 pass
• ruff check .: clean

🤖 Generated with Claude Code