Cfn-python-lint: Feature: Warning on substitions without !Sub

[fatbasstard]

cfn-lint version: 0.3.2

It's pretty annoying if you add a substition and forget the !Sub:

          - Effect: "Allow"
            Action:
              - "s3:ReplicateObject"
              - "s3:ReplicateDelete"
            Resource:
              - "arn:aws:s3:::mycompany-${Environment}-mybucketname/*"

I'm not 100% sure if a ${value} always must be a substitution, since Cfn accepts this as valid string. But this could be a valid rule to give you a warning about this. Either you're missing the !Sub or you picked a real annoying string to be used...

[fatbasstard]

Or this:

RoleName: !Sub "{AppGroup}-lambda" 🤦‍♂️ Result:

The specified value for roleName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_- (Service: AmazonIdentityManagement; Status Code: 400; Error Code: ValidationError; Request ID: 1216dccf-7ec7-11e8-9a0f-dfd814c0f8b0)
--

[cmmeyer]

It's also used a parameter expansion in bash, so this could reek havoc for folks with complex userdata scripts in their EC2 instances:
http://www.gnu.org/software/bash/manual/bash.html#Shell-Parameter-Expansion

[fatbasstard]

Totally agree, it's not as simple as it appears due to stuff like that. Just wanted to put it out there anyway to make it visible. These 2 cases literally took me 2 hours of my day that I could spend on more usefull things than waiting for CloudFormation deployments to break 😈

[cmmeyer]

I wonder if it makes sense to build a contextual for things like UserData where all bets are off -- I mean, there's nothing to stop you from injecting another CloudFormation template into a file via cfn-init in the EC2 metadata. What would THAT do to our linter?

[fatbasstard]

Which properties does this (the parameter extension) apply to? Because we could make it a rule and just skip properties like UserData... But check the rest 🤔

[cmmeyer]

Off hand, I'm thinking EC2 user data, Lambda function code blocks... others?

[fatbasstard]

Annndddd.... Hitting it again (a colleague this time):

Condition:
  ArnEquals:
    aws:SourceArn: !Sub "arn:aws:sns:${Region}:${AWS::AccountId}:{Environment}-${AppGroup}-XXXTopic"

[SanderKnape]

There might be another (partial) solution for this. For example, looking at the SNS resource (https://docs.aws.amazon.com/sns/latest/api/API_CreateTopic.html), a dollar sign is not allowed for the TopicName. That is something you can easily lint.

I can imagine that for many properties, a dollar sign is not an allowed character.

[kddejong]

This one is released now.