Your export now catches breaks CloudFormation can't see

A template can deploy perfectly and still not run. A Step Functions definition that references a Lambda name that doesn't exist, or a function reading from an encrypted bucket without permission to use the encryption key — CloudFormation accepts both, and the failure only shows up when your workflow actually executes. This release teaches the findings engine to catch that class before you export.

Step Functions definitions are now checked against the real deploy-time names of the Lambdas you've connected: a name that matches nothing is flagged as an error with the valid names listed, and a connected function your definition never calls gets a warning. Functions that live outside your stack are recognized by their real resource ID or ARN, so hybrid setups aren't flagged falsely.

Key permissions now follow your encryption. When a function uses a bucket, secret, queue, topic, or stream encrypted with one of your customer-managed keys — or an instance, Glue job, Redshift cluster, or Firehose delivery uses an encrypted bucket or stream — the matching key permissions are added automatically, scoped to that exact key. And a customer-managed key connected to an alarm-notification topic now carries the service permissions CloudWatch, EventBridge, and Budgets need to publish through it — so encrypted alerting actually alerts.

The SQS-to-Lambda timing rule is enforced now, too. A queue must hide a message for at least six times the function's timeout, or the same message can be processed twice — so the properties panel now rejects any change that would break the rule, and offers a one-click fix that adjusts the connected resource instead.

Fixes & improvements

• •Connections always respond: every attempt to wire two services now either creates the connection or tells you why it didn't. Wires also meet their connection points precisely, even when several share one point.
• •Services are selected the moment you drop them on the canvas, with your panel layout left as you had it.
• •SNS topics gained an email subscription field, the sender-name property is now clearly labeled so it can't be mistaken for the node's name, and the post-export "check your email" step only appears when your template actually creates an email subscription.
• •Naming a table, topic, or queue explicitly now warns you when the name drops the project-and-environment prefix — the prefix is what keeps your dev and prod deployments from colliding.
• •The post-export checklist now adapts to your template: it lists any placeholder values to fill in before uploading, reminds you about the IAM acknowledgment checkbox the console requires, and flags certificate validation when your stack will wait on it.