feat(stepfunctions): throw ValidationErrors instead of untyped errors (#34438)

### Issue

Relates to #32569

### Reason for this change

untyped Errors are not recommended

### Description of changes

`ValidationError`s everywhere

### Describe any new or updated permissions being added

None

### Description of how you validated changes

Existing tests. Exemptions granted as this is a refactor of existing code.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: mrgrain

packages/aws-cdk-lib/.eslintrc.js

@@ -32,8 +32,6 @@ const noThrowDefaultErrorNotYetSupported = [
   'aws-secretsmanager',
   'aws-servicecatalog',
   'aws-sns-subscriptions',
-  'aws-stepfunctions',
-  'aws-stepfunctions-tasks',
   'core',
   'custom-resources',
   'region-info',

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/apigateway/base.ts

@@ -2,6 +2,7 @@ import { Construct } from 'constructs';
 import { AuthType, CallApiGatewayEndpointBaseProps } from './base-types';
 import * as iam from '../../../aws-iam';
 import * as sfn from '../../../aws-stepfunctions';
+import { ValidationError } from '../../../core';
 import { integrationResourceArn, validatePatternSupported } from '../private/task-utils';
 
 /**
@@ -30,7 +31,7 @@ export abstract class CallApiGatewayEndpointBase extends sfn.TaskStateBase {
 
     if (this.integrationPattern === sfn.IntegrationPattern.WAIT_FOR_TASK_TOKEN) {
       if (!sfn.FieldUtils.containsTaskToken(this.baseProps.headers)) {
-        throw new Error('Task Token is required in `headers` for WAIT_FOR_TASK_TOKEN pattern. Use JsonPath.taskToken to set the token.');
+        throw new ValidationError('Task Token is required in `headers` for WAIT_FOR_TASK_TOKEN pattern. Use JsonPath.taskToken to set the token.', this);
       }
     }
   }

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/athena/start-query-execution.ts

@@ -4,6 +4,7 @@ import * as kms from '../../../aws-kms';
 import * as s3 from '../../../aws-s3';
 import * as sfn from '../../../aws-stepfunctions';
 import * as cdk from '../../../core';
+import { ValidationError } from '../../../core';
 import { integrationResourceArn, validatePatternSupported } from '../private/task-utils';
 
 interface AthenaStartQueryExecutionOptions {
@@ -117,23 +118,23 @@ export class AthenaStartQueryExecution extends sfn.TaskStateBase {
   private validateExecutionParameters(executionParameters?: string[]) {
     if (executionParameters === undefined || cdk.Token.isUnresolved(executionParameters)) return;
     if (executionParameters.length == 0) {
-      throw new Error('\'executionParameters\' must be a non-empty list');
+      throw new ValidationError('\'executionParameters\' must be a non-empty list', this);
     }
     const invalidExecutionParameters = executionParameters.some(p => p.length < 1 || p.length > 1024);
     if (invalidExecutionParameters) {
-      throw new Error('\'executionParameters\' items\'s length must be between 1 and 1024 characters');
+      throw new ValidationError('\'executionParameters\' items\'s length must be between 1 and 1024 characters', this);
     }
   }
 
   private validateMaxAgeInMinutes(resultReuseConfigurationMaxAge?: cdk.Duration) {
     if (resultReuseConfigurationMaxAge === undefined || cdk.Token.isUnresolved(resultReuseConfigurationMaxAge)) return;
     const maxAgeInMillis = resultReuseConfigurationMaxAge.toMilliseconds();
     if (maxAgeInMillis > 0 && maxAgeInMillis < cdk.Duration.minutes(1).toMilliseconds()) {
-      throw new Error(`resultReuseConfigurationMaxAge must be greater than or equal to 1 minute or be equal to 0, got ${maxAgeInMillis} ms`);
+      throw new ValidationError(`resultReuseConfigurationMaxAge must be greater than or equal to 1 minute or be equal to 0, got ${maxAgeInMillis} ms`, this);
     }
     const maxAgeInMinutes = resultReuseConfigurationMaxAge.toMinutes();
     if (maxAgeInMinutes > 10080) {
-      throw new Error(`resultReuseConfigurationMaxAge must either be 0 or between 1 and 10080 minutes, got ${maxAgeInMinutes}`);
+      throw new ValidationError(`resultReuseConfigurationMaxAge must either be 0 or between 1 and 10080 minutes, got ${maxAgeInMinutes}`, this);
     }
   }
 

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/aws-sdk/call-aws-service.ts

@@ -1,7 +1,7 @@
 import { Construct } from 'constructs';
 import * as iam from '../../../aws-iam';
 import * as sfn from '../../../aws-stepfunctions';
-import { Token } from '../../../core';
+import { Token, ValidationError } from '../../../core';
 import { integrationResourceArn } from '../private/task-utils';
 
 interface CallAwsServiceOptions {
@@ -109,15 +109,15 @@ export class CallAwsService extends sfn.TaskStateBase {
     super(scope, id, props);
 
     if (this.props.integrationPattern === sfn.IntegrationPattern.RUN_JOB) {
-      throw new Error('The RUN_JOB integration pattern is not supported for CallAwsService');
+      throw new ValidationError('The RUN_JOB integration pattern is not supported for CallAwsService', this);
     }
     if (!Token.isUnresolved(this.props.action) && !this.props.action.startsWith(this.props.action[0]?.toLowerCase())) {
-      throw new Error(`action must be camelCase, got: ${this.props.action}`);
+      throw new ValidationError(`action must be camelCase, got: ${this.props.action}`, this);
     }
     if (this.props.parameters) {
       const invalidKeys = Object.keys(this.props.parameters).filter(key => !key.startsWith(key[0]?.toUpperCase()));
       if (invalidKeys.length) {
-        throw new Error(`parameter names must be PascalCase, got: ${invalidKeys.join(', ')}`);
+        throw new ValidationError(`parameter names must be PascalCase, got: ${invalidKeys.join(', ')}`, this);
       }
     }
 

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/batch/run-batch-job.ts

@@ -1,7 +1,7 @@
 import * as ec2 from '../../../aws-ec2';
 import * as iam from '../../../aws-iam';
 import * as sfn from '../../../aws-stepfunctions';
-import { Duration, Stack, withResolved } from '../../../core';
+import { Duration, Stack, UnscopedValidationError, withResolved } from '../../../core';
 import { getResourceArn } from '../resource-arn-suffix';
 
 /**
@@ -188,34 +188,34 @@ export class RunBatchJob implements sfn.IStepFunctionsTask {
     ];
 
     if (!supportedPatterns.includes(this.integrationPattern)) {
-      throw new Error(
+      throw new UnscopedValidationError(
         `Invalid Service Integration Pattern: ${this.integrationPattern} is not supported to call RunBatchJob.`,
       );
     }
 
     // validate arraySize limits
     withResolved(props.arraySize, (arraySize) => {
       if (arraySize !== undefined && (arraySize < 2 || arraySize > 10_000)) {
-        throw new Error(`arraySize must be between 2 and 10,000. Received ${arraySize}.`);
+        throw new UnscopedValidationError(`arraySize must be between 2 and 10,000. Received ${arraySize}.`);
       }
     });
 
     // validate dependency size
     if (props.dependsOn && props.dependsOn.length > 20) {
-      throw new Error(`dependencies must be 20 or less. Received ${props.dependsOn.length}.`);
+      throw new UnscopedValidationError(`dependencies must be 20 or less. Received ${props.dependsOn.length}.`);
     }
 
     // validate attempts
     withResolved(props.attempts, (attempts) => {
       if (attempts !== undefined && (attempts < 1 || attempts > 10)) {
-        throw new Error(`attempts must be between 1 and 10. Received ${attempts}.`);
+        throw new UnscopedValidationError(`attempts must be between 1 and 10. Received ${attempts}.`);
       }
     });
 
     // validate timeout
     props.timeout !== undefined && withResolved(props.timeout.toSeconds(), (timeout) => {
       if (timeout < 60) {
-        throw new Error(`timeout must be greater than 60 seconds. Received ${timeout} seconds.`);
+        throw new UnscopedValidationError(`timeout must be greater than 60 seconds. Received ${timeout} seconds.`);
       }
     });
 
@@ -224,7 +224,7 @@ export class RunBatchJob implements sfn.IStepFunctionsTask {
     if (props.containerOverrides?.environment) {
       Object.keys(props.containerOverrides.environment).forEach(key => {
         if (key.match(/^AWS_BATCH/)) {
-          throw new Error(
+          throw new UnscopedValidationError(
             `Invalid environment variable name: ${key}. Environment variable names starting with 'AWS_BATCH' are reserved.`,
           );
         }

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/batch/submit-job.ts

@@ -2,7 +2,7 @@ import { Construct } from 'constructs';
 import * as ec2 from '../../../aws-ec2';
 import * as iam from '../../../aws-iam';
 import * as sfn from '../../../aws-stepfunctions';
-import { Size, Stack, withResolved } from '../../../core';
+import { Size, Stack, ValidationError, withResolved } from '../../../core';
 import { integrationResourceArn, isJsonPathOrJsonataExpression, validatePatternSupported } from '../private/task-utils';
 
 /**
@@ -210,19 +210,19 @@ export class BatchSubmitJob extends sfn.TaskStateBase {
     // validate arraySize limits
     withResolved(props.arraySize, (arraySize) => {
       if (arraySize !== undefined && (arraySize < 2 || arraySize > 10_000)) {
-        throw new Error(`arraySize must be between 2 and 10,000. Received ${arraySize}.`);
+        throw new ValidationError(`arraySize must be between 2 and 10,000. Received ${arraySize}.`, this);
       }
     });
 
     // validate dependency size
     if (props.dependsOn && props.dependsOn.length > 20) {
-      throw new Error(`dependencies must be 20 or less. Received ${props.dependsOn.length}.`);
+      throw new ValidationError(`dependencies must be 20 or less. Received ${props.dependsOn.length}.`, this);
     }
 
     // validate attempts
     withResolved(props.attempts, (attempts) => {
       if (attempts !== undefined && (attempts < 1 || attempts > 10)) {
-        throw new Error(`attempts must be between 1 and 10. Received ${attempts}.`);
+        throw new ValidationError(`attempts must be between 1 and 10. Received ${attempts}.`, this);
       }
     });
 
@@ -232,7 +232,7 @@ export class BatchSubmitJob extends sfn.TaskStateBase {
       props.taskTimeout?.seconds, (timeout, taskTimeout) => {
         const definedTimeout = timeout ?? taskTimeout;
         if (definedTimeout && definedTimeout < 60) {
-          throw new Error(`attempt duration must be greater than 60 seconds. Received ${definedTimeout} seconds.`);
+          throw new ValidationError(`attempt duration must be greater than 60 seconds. Received ${definedTimeout} seconds.`, this);
         }
       });
 
@@ -241,8 +241,8 @@ export class BatchSubmitJob extends sfn.TaskStateBase {
     if (props.containerOverrides?.environment) {
       Object.keys(props.containerOverrides.environment).forEach(key => {
         if (key.match(/^AWS_BATCH/)) {
-          throw new Error(
-            `Invalid environment variable name: ${key}. Environment variable names starting with 'AWS_BATCH' are reserved.`,
+          throw new ValidationError(
+            `Invalid environment variable name: ${key}. Environment variable names starting with 'AWS_BATCH' are reserved.`, this,
           );
         }
       });
@@ -382,14 +382,14 @@ export class BatchSubmitJob extends sfn.TaskStateBase {
     if (tags === undefined) return;
     const tagEntries = Object.entries(tags);
     if (tagEntries.length > 50) {
-      throw new Error(`Maximum tag number of entries is 50. Received ${tagEntries.length}.`);
+      throw new ValidationError(`Maximum tag number of entries is 50. Received ${tagEntries.length}.`, this);
     }
     for (const [key, value] of tagEntries) {
       if (key.length < 1 || key.length > 128) {
-        throw new Error(`Tag key size must be between 1 and 128, but got ${key.length}.`);
+        throw new ValidationError(`Tag key size must be between 1 and 128, but got ${key.length}.`, this);
       }
       if (value.length > 256) {
-        throw new Error(`Tag value maximum size is 256, but got ${value.length}.`);
+        throw new ValidationError(`Tag value maximum size is 256, but got ${value.length}.`, this);
       }
     }
   }

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/guardrail.ts

@@ -1,4 +1,4 @@
-import { Arn, ArnFormat, Token } from '../../../core';
+import { Arn, ArnFormat, Token, UnscopedValidationError } from '../../../core';
 
 /**
  * Guradrail settings for BedrockInvokeModel
@@ -13,7 +13,7 @@ export class Guardrail {
   public static enable(identifier: string, version: number): Guardrail {
     if (!Token.isUnresolved(version)) {
       if (version < 1 || version > 99999999) {
-        throw new Error(`\`version\` must be between 1 and 99999999, got ${version}.`);
+        throw new UnscopedValidationError(`\`version\` must be between 1 and 99999999, got ${version}.`);
       }
     }
     return new Guardrail(identifier, version.toString());
@@ -39,7 +39,7 @@ export class Guardrail {
       if (guardrailIdentifier.startsWith('arn:')) {
         const arn = Arn.split(guardrailIdentifier, ArnFormat.SLASH_RESOURCE_NAME);
         if (!arn.resourceName) {
-          throw new Error(`Invalid ARN format. The ARN of Guradrail should have the format: \`arn:<partition>:bedrock:<region>:<account-id>:guardrail/<guardrail-name>\`, got ${guardrailIdentifier}.`);
+          throw new UnscopedValidationError(`Invalid ARN format. The ARN of Guradrail should have the format: \`arn:<partition>:bedrock:<region>:<account-id>:guardrail/<guardrail-name>\`, got ${guardrailIdentifier}.`);
         }
         gurdrailId = arn.resourceName;
       } else {
@@ -48,11 +48,11 @@ export class Guardrail {
 
       const guardrailPattern = /^[a-z0-9]+$/;
       if (!guardrailPattern.test(gurdrailId)) {
-        throw new Error(`The id of Guardrail must contain only lowercase letters and numbers, got ${gurdrailId}.`);
+        throw new UnscopedValidationError(`The id of Guardrail must contain only lowercase letters and numbers, got ${gurdrailId}.`);
       }
 
       if (guardrailIdentifier.length > 2048) {
-        throw new Error(`\`guardrailIdentifier\` length must be between 0 and 2048, got ${guardrailIdentifier.length}.`);
+        throw new UnscopedValidationError(`\`guardrailIdentifier\` length must be between 0 and 2048, got ${guardrailIdentifier.length}.`);
       }
     }
   }

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/invoke-model.ts

@@ -4,7 +4,7 @@ import * as bedrock from '../../../aws-bedrock';
 import * as iam from '../../../aws-iam';
 import * as s3 from '../../../aws-s3';
 import * as sfn from '../../../aws-stepfunctions';
-import { Annotations, Stack, FeatureFlags } from '../../../core';
+import { Annotations, Stack, FeatureFlags, ValidationError } from '../../../core';
 import * as cxapi from '../../../cx-api';
 import { integrationResourceArn, validatePatternSupported } from '../private/task-utils';
 
@@ -203,22 +203,22 @@ export class BedrockInvokeModel extends sfn.TaskStateBase {
     }
 
     if (isBodySpecified && isInputSpecified) {
-      throw new Error('Either `body` or `input` must be specified, but not both.');
+      throw new ValidationError('Either `body` or `input` must be specified, but not both.', this);
     }
     if (!isBodySpecified && !isInputSpecified) {
-      throw new Error('Either `body` or `input` must be specified.');
+      throw new ValidationError('Either `body` or `input` must be specified.', this);
     }
     if (props.input?.s3Location?.objectVersion !== undefined) {
-      throw new Error('Input S3 object version is not supported.');
+      throw new ValidationError('Input S3 object version is not supported.', this);
     }
     if (props.output?.s3Location?.objectVersion !== undefined) {
-      throw new Error('Output S3 object version is not supported.');
+      throw new ValidationError('Output S3 object version is not supported.', this);
     }
     if (props.input?.s3InputUri && props.input.s3Location || props.output?.s3OutputUri && props.output.s3Location) {
-      throw new Error('Either specify S3 Uri or S3 location, but not both.');
+      throw new ValidationError('Either specify S3 Uri or S3 location, but not both.', this);
     }
     if (useNewS3UriParamsForTask && (props.input?.s3InputUri === '' || props.output?.s3OutputUri === '')) {
-      throw new Error('S3 Uri cannot be an empty string');
+      throw new ValidationError('S3 Uri cannot be an empty string', this);
     }
 
     // Warning to let users know about the newly introduced props

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/codebuild/start-build-batch.ts

@@ -124,7 +124,7 @@ export class CodeBuildStartBuildBatch extends sfn.TaskStateBase {
         ];
         break;
       default:
-        throw new Error(`Unsupported integration pattern: ${this.integrationPattern}`);
+        throw new cdk.ValidationError(`Unsupported integration pattern: ${this.integrationPattern}`, this);
     }
 
     return policyStatements;

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/dynamodb/private/utils.ts

@@ -1,4 +1,5 @@
 import * as sfn from '../../../../aws-stepfunctions';
+import { UnscopedValidationError } from '../../../../core';
 import { integrationResourceArn } from '../../private/task-utils';
 import { DynamoAttributeValue } from '../shared-types';
 
@@ -25,12 +26,12 @@ export function transformAttributeValueMap(attrMap?: { [key: string]: DynamoAttr
 
 export function validateJsonPath(value: string) {
   if (!value.startsWith('$')) {
-    throw new Error("Data JSON path values must either be exactly equal to '$' or start with '$.'");
+    throw new UnscopedValidationError("Data JSON path values must either be exactly equal to '$' or start with '$.'");
   }
 }
 
 export function validateJsonata(value: string) {
   if (!value.startsWith('{%') || !value.endsWith('%}')) {
-    throw new Error("Data JSONata expression values must either be exactly start with '{%' and end with '%}'");
+    throw new UnscopedValidationError("Data JSONata expression values must either be exactly start with '{%' and end with '%}'");
   }
 }