Cfn-python-lint: Check ImportValue refers to a real import

[adamchainz]

cfn-lint version: (cfn-lint --version) 0.6.1

Description of issue.

Made a mistake in a template typo'ing an import name, had to go through a full deploy/error/fix cycle to figure this out. It would be nice if cfn-lint would check all my (non-templated) imports actually exist on my account, although this might be disruptive when working on multiple templates at once and one imports the export of another.

[hoegertn]

This would tie the template to a specific account. I think templates are meant to be account agnostic and should not be validated against a real account.

[adamchainz]

Okay, my use case is against the one account. Perhaps a flag to enable checks like this would be acceptable?

[rjlohan]

This is worth thinking about, but the main issue I see is that such a linting rule is actually runtime-dependent. That is; if you lint a template and it tells you that an Import exists in your account, but the Exporting stack is deleted before you provision this template, you'll still hit the runtime issue.

I think linter design shouldn't bleed into runtime diagnostics.

From the service side, this is an improvement we can look to make to improve fail-fast validation, though I think we'd need to account for nested stack cases, where a parent stack may expect an Import, which is Exported by one of the child stacks (though this is not advised in general) in which case the Import won't exist when the parent stack _starts_ to provision, but will be available when needed.

[adamchainz]

Fair enough, I understand if you choose to close this issue. My environment is more constrained so could add an internal custom check for it.

a parent stack may expect an Import, which is Exported by one of the child stacks

Didn't realize this would even be possible! 🔃

[rjlohan]

Didn't realize this would even be possible!

Yeah I'm pretty sure bad things happen. 😆

[fatbasstard]

What makes it more complex is that the linter is completely "standalone". It does not need AWS tools, Boto or any actions. It's a static file analysis tool. Adding a feature to actually connect to AWS accounts is not that "easy".

[cmmeyer]

At this time, this enhancement collides with the design goal of keeping the linter as self-contained as possible. That's not to stop you from writing it as a custom rule though and integrating it locally.