diff --git a/test/ModularPipelines.AmazonWebServices.UnitTests/AwsEnumBoundaryTests.cs b/test/ModularPipelines.AmazonWebServices.UnitTests/AwsEnumBoundaryTests.cs
new file mode 100644
index 00000000000..7dbcae8edbf
--- /dev/null
+++ b/test/ModularPipelines.AmazonWebServices.UnitTests/AwsEnumBoundaryTests.cs
@@ -0,0 +1,27 @@
+using ModularPipelines.AmazonWebServices.Options;
+using static ModularPipelines.TestHelpers.OptionsRenderingTestHelper;
+
+namespace ModularPipelines.AmazonWebServices.UnitTests;
+
+public class AwsEnumBoundaryTests
+{
+    [Test]
+    [Arguments("Policy")]
+    [Arguments("DeliveryPolicy")]
+    [Arguments("FifoThroughputScope")]
+    public async Task Sns_Attribute_Names_Render_As_Required_Strings(string attributeName)
+    {
+        const string topicArn = "arn:aws:sns:us-east-1:123456789012:example";
+        var arguments = BuildArguments(new AwsSnsSetTopicAttributesOptions(topicArn, attributeName));
+
+        await AssertArguments(arguments, ["--topic-arn", topicArn, "--attribute-name", attributeName]);
+    }
+
+    [Test]
+    public async Task Single_Vpn_Type_Renders_As_String()
+    {
+        var arguments = BuildArguments(new AwsEc2CreateVpnGatewayOptions("ipsec.1"));
+
+        await AssertArguments(arguments, ["--type", "ipsec.1"]);
+    }
+}
diff --git a/test/ModularPipelines.AmazonWebServices.UnitTests/AwsRequiredCollectionTests.cs b/test/ModularPipelines.AmazonWebServices.UnitTests/AwsRequiredCollectionTests.cs
new file mode 100644
index 00000000000..9d8ae6ec338
--- /dev/null
+++ b/test/ModularPipelines.AmazonWebServices.UnitTests/AwsRequiredCollectionTests.cs
@@ -0,0 +1,67 @@
+using System.ComponentModel.DataAnnotations;
+using ModularPipelines.AmazonWebServices.Enums;
+using ModularPipelines.AmazonWebServices.Options;
+using static ModularPipelines.TestHelpers.OptionsRenderingTestHelper;
+
+namespace ModularPipelines.AmazonWebServices.UnitTests;
+
+public class AwsRequiredCollectionTests
+{
+    [Test]
+    [Arguments(false)]
+    [Arguments(true)]
+    public async Task Network_Acl_Operations_Render_Both_Directions(bool egress)
+    {
+        AwsOptions[] operations =
+        [
+            new AwsEc2CreateNetworkAclEntryOptions("acl-example", 100, "6", AwsEc2CreateNetworkAclEntryRuleAction.Allow, egress),
+            new AwsEc2DeleteNetworkAclEntryOptions("acl-example", 100, egress),
+            new AwsEc2ReplaceNetworkAclEntryOptions("acl-example", 100, "6", AwsEc2ReplaceNetworkAclEntryRuleAction.Allow, egress),
+        ];
+        foreach (var options in operations)
+        {
+            var errors = new List<ValidationResult>();
+            await Assert.That(Validator.TryValidateObject(options, new ValidationContext(options), errors, true)).IsTrue();
+            var arguments = BuildArguments(options);
+            await Assert.That(arguments.Contains(egress ? "--egress" : "--ingress")).IsTrue();
+            await Assert.That(arguments.Contains(egress ? "--ingress" : "--egress")).IsFalse();
+        }
+    }
+
+    [Test]
+    [Arguments("")]
+    [Arguments(" \t\r\n")]
+    public async Task Alternate_Input_Factories_Reject_Blank_Json(string input)
+    {
+        await Assert.That(() => AwsEc2TerminateInstancesOptions.FromCliInputJson(input))
+            .Throws<ArgumentException>();
+        await Assert.That(() => AwsEc2CreateKeyPairOptions.FromCliInputJson(input))
+            .Throws<ArgumentException>();
+        await Assert.That(() => AwsAutoscalingSetInstanceProtectionOptions.FromCliInputJson(input))
+            .Throws<ArgumentException>();
+    }
+
+    [Test]
+    public async Task Required_Strings_Reject_Null()
+    {
+        await Assert.That(() => new AwsEc2CreateKeyPairOptions(null!))
+            .Throws<ArgumentNullException>();
+        await Assert.That(() => new AwsAutoscalingSetInstanceProtectionOptions(["i-example"], null!, true))
+            .Throws<ArgumentNullException>();
+    }
+
+    [Test]
+    public async Task InstanceIds_Reject_A_Collection_Containing_Only_Null()
+    {
+        await Assert.That(() => new AwsEc2TerminateInstancesOptions([null!]))
+            .Throws<ArgumentException>();
+    }
+
+    [Test]
+    public async Task InstanceIds_Render_The_NonNull_Values()
+    {
+        var arguments = BuildArguments(new AwsEc2TerminateInstancesOptions([null!, "i-example"]));
+
+        await AssertArguments(arguments, ["--instance-ids", "i-example"]);
+    }
+}