fix(aws/cloudformation): add missing region validation and client cleanup to create-stack

- Add validateAwsRegion refinement to create-stack contract (completes P2 fix from Greptile review)
- Wrap AWS SDK call in try/finally with client.destroy() (completes P2 fix from Greptile review)
- Aligns create-stack with the pattern used across all 7 other new CloudFormation routes

Co-authored-by: Waleed <waleedlatif1@users.noreply.github.com>

Author: cursoragent

apps/sim/app/api/tools/cloudformation/create-stack/route.ts

@@ -34,24 +34,28 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     logger.info(`Creating CloudFormation stack "${validatedData.stackName}"`)
 
-    const command = new CreateStackCommand({
-      StackName: validatedData.stackName,
-      TemplateBody: validatedData.templateBody,
-      Parameters: toStackParameters(validatedData.parameters),
-      Capabilities: parseCapabilities(validatedData.capabilities),
-      Tags: toStackTags(validatedData.tags),
-      OnFailure: validatedData.onFailure,
-      TimeoutInMinutes: validatedData.timeoutInMinutes,
-    })
+    try {
+      const command = new CreateStackCommand({
+        StackName: validatedData.stackName,
+        TemplateBody: validatedData.templateBody,
+        Parameters: toStackParameters(validatedData.parameters),
+        Capabilities: parseCapabilities(validatedData.capabilities),
+        Tags: toStackTags(validatedData.tags),
+        OnFailure: validatedData.onFailure,
+        TimeoutInMinutes: validatedData.timeoutInMinutes,
+      })
 
-    const response = await client.send(command)
+      const response = await client.send(command)
 
-    return NextResponse.json({
-      success: true,
-      output: {
-        stackId: response.StackId ?? '',
-      },
-    })
+      return NextResponse.json({
+        success: true,
+        output: {
+          stackId: response.StackId ?? '',
+        },
+      })
+    } finally {
+      client.destroy()
+    }
   } catch (error) {
     const errorMessage = getErrorMessage(error, 'Failed to create CloudFormation stack')
     logger.error('CreateStack failed', { error: errorMessage })

apps/sim/lib/api/contracts/tools/aws/cloudformation-create-stack.ts

@@ -5,9 +5,15 @@ import type {
   ContractJsonResponse,
 } from '@/lib/api/contracts/types'
 import { defineRouteContract } from '@/lib/api/contracts/types'
+import { validateAwsRegion } from '@/lib/core/security/input-validation'
 
 const CreateStackSchema = z.object({
-  region: z.string().min(1, 'AWS region is required'),
+  region: z
+    .string()
+    .min(1, 'AWS region is required')
+    .refine((v) => validateAwsRegion(v).isValid, {
+      message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)',
+    }),
   accessKeyId: z.string().min(1, 'AWS access key ID is required'),
   secretAccessKey: z.string().min(1, 'AWS secret access key is required'),
   stackName: z.string().min(1, 'Stack name is required'),