(aws-bedrock): CfnGuardrail does not validate denied-topic name/definition length at synth - 200-char definition fails mid-deploy

Describe the bug

A denied topic's definition is capped at 200 characters and its name at 100 (per the Bedrock guardrails denied-topics docs and the GuardrailTopic API reference). Neither limit is expressed in the CfnGuardrail L1 types or validated at synthesis, so an over-length definition synthesises cleanly and fails part-way through deploy:

Resource handler returned message: "One or more of your guardrail topic
definitions exceeds the maximum allowed length. Shorten your topic definitions
or update your guardrail topic policy configuration to support longer
definitions."

Two costs:

1. The message names the limit but not the offending topic. With several topics configured, you compare lengths by hand.

2. It is discovered after the change set has begun applying, so the stack rolls back and the cycle is minutes rather than seconds.

This is the same class of issue as other CDK length-limit validation gaps that have been accepted and fixed — e.g. #11504 (CloudFront Origin ID 128-char), #2230 (artifact names 100-char), #24325 (GlobalAccelerator name 64-char).

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

Validate at synthesis, as the CDK does for many other constrained fields, naming the offending topic and its actual length. For example:

Guardrail topic "medical-advice" has a 235-character definition; the limit is 200.
Move detail into `examples`, which are counted separately.

Failing synth-time validation, document the limits in the property JSDoc so they are visible at the point of use.

Current Behavior

topicPolicyConfig.topicsConfig[].definition over 200 characters (or name over 100) passes cdk synth without warning, then produces a CREATE_FAILED / rollback during deploy with the generic message above (no topic named).

Reproduction Steps

1. Any recent aws-cdk-lib.

2. Create a CfnGuardrail whose topicPolicyConfig.topicsConfig[].definition exceeds 200 characters.

3. cdk synth — succeeds.

4. cdk deploy — CREATE_FAILED part-way through, stack rolls back.

Possible Solution

Add synth-time validation on CfnGuardrail denied-topic name (≤100) and definition (≤200), raising an error that names the topic and its actual length. If L1 validation is undesirable, at minimum document both limits in the property JSDoc.

Additional Information/Context

examples are counted separately from the definition, so detail that will not fit in 200 characters can go there without loss — worth surfacing in the validation message.

• Verified: the 200/100 limits (Bedrock denied-topics docs + GuardrailTopic API reference); that synth passes and deploy fails with the quoted message.

AWS CDK Library version (aws-cdk-lib)

2.265.0

AWS CDK CLI version

2.1136.0

Node.js Version

v22.12.0

OS

MacOS 26.6.2

Language

TypeScript

Language Version

TypeScript 5.9.3

Other information

No response