SAM transform silently drops unrecognized CodeUri/ContentUri sub-properties despite schema declaring additionalProperties: false

[Yoshiki0705]

Description

Unrecognized sub-properties of CodeUri (on AWS::Serverless::Function) and ContentUri (on AWS::Serverless::LayerVersion) are discarded during the SAM transform without any error or warning. sam validate, sam validate --lint, and the transform itself all report success, and the generated AWS::Lambda::Function Code property simply omits the property.

This is a validation gap rather than a missing feature: definitions.CodeUri in the SAM schema already declares "additionalProperties": false, so the schema does describe these as invalid. Nothing enforces it at transform time.

The practical consequence is that a typo or a wrong-but-plausible property name is indistinguishable from a correctly applied setting. There is no signal anywhere in the workflow.

A concrete case where this is easy to hit: the CloudFormation property is named S3ObjectStorageMode, while the SAM property added in #3959 is named StorageMode. Reaching for the CloudFormation name inside CodeUri is a natural mistake, and it fails silently.

Steps to reproduce

template.yaml — note S3ObjectStorageMode, which is not a valid CodeUri sub-property:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  Fn:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri:
        Bucket: somebucket
        Key: somekey
        Version: '1'
        S3ObjectStorageMode: REFERENCE
      Handler: hello.handler
      Runtime: python3.12

$ sam validate --template template.yaml
/tmp/samtest/template.yaml is a valid SAM Template. This is according to basic SAM Validation, for additional validation, please run with "--lint" option

$ sam validate --lint --template template.yaml
/tmp/samtest/template.yaml is a valid SAM Template

Running the transform directly to inspect the output, rather than inferring it from a deployment:

from samtranslator.parser.parser import Parser
from samtranslator.translator.translator import Translator

template = {
    "AWSTemplateFormatVersion": "2010-09-09",
    "Transform": "AWS::Serverless-2016-10-31",
    "Resources": {
        "Fn": {
            "Type": "AWS::Serverless::Function",
            "Properties": {
                "CodeUri": {
                    "Bucket": "somebucket",
                    "Key": "somekey",
                    "Version": "1",
                    "S3ObjectStorageMode": "REFERENCE",
                },
                "Handler": "hello.handler",
                "Runtime": "python3.12",
            },
        }
    },
}

out = Translator(managed_policy_map={}, sam_parser=Parser()).translate(
    sam_template=template, parameter_values={}
)
print(out["Resources"]["Fn"]["Properties"]["Code"])

Observed result

The transform completes successfully with no error and no warning. The unrecognized property is absent from the output:

{'S3Bucket': 'somebucket', 'S3Key': 'somekey', 'S3ObjectVersion': '1'}

The same silent-drop behaviour occurs for any unrecognized key. Three variants tested against aws-sam-translator 1.111.0, all producing the identical Code above with no diagnostic:

CodeUri contains	Transform result	Present in output
S3ObjectStorageMode: REFERENCE	succeeded, no warning	no
StorageMode: REFERENCE	succeeded, no warning	no
TotallyMadeUpProperty: whatever	succeeded, no warning	no

The StorageMode row is expected on 1.111.0, since #3959 merged on 2026-07-20 and the most recent release (1.111.0) was published 2026-07-02. It is included to show that the drop is not specific to genuinely invalid names — before a property is released, the valid spelling behaves identically to a typo, with nothing to distinguish them.

Expected result

An unrecognized sub-property of CodeUri or ContentUri should produce a validation error, consistent with "additionalProperties": false already present in the schema. Failing that, a warning naming the ignored property would at least make the behaviour discoverable.

Erroring on unknown properties is the more useful behaviour here, because these properties change deployment semantics. Silently ignoring StorageMode means a function intended to reference an object in place is instead created with a copy, and nothing surfaces the difference.

I appreciate this may be a deliberate compatibility decision, in which case documenting it, or surfacing it under --lint, would still close the discoverability gap.

Additional environment details

1. OS: macOS (Apple silicon)
2. sam --version: SAM CLI, version 1.162.1
3. aws-sam-translator: 1.111.0 (current release on PyPI at the time of testing)
4. AWS region: not applicable, reproduced entirely at template transform time with no deployment