CloudFormation Registry resource schema support (--registry-schemas) #1732

PatMyron · 2020-10-08T20:56:46Z

CloudFormation Registry announcement
Resource Schema repo

import boto3
for page in boto3.client('cloudformation').get_paginator('list_types').paginate():
    for resource_type in page['TypeSummaries']:
        with open(resource_type['TypeName'].replace("::", "-").lower() + '.json', 'w') as f:
            print(boto3.client('cloudformation').describe_type(Arn=resource_type['TypeArn'])['Schema'], file=f)

https://aws.amazon.com/blogs/aws/cloudformation-update-cli-third-party-resource-support-registry/ https://github.com/aws-cloudformation/aws-cloudformation-resource-schema/ https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-type-schemas.html

… types

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-condition.html

https://github.com/aws-cloudformation/cfn-python-lint/blob/master/docs/getting_started/rules.md#create-new-rule

johnttompkins · 2020-10-20T19:43:46Z

src/cfnlint/rules/resources/ResourceSchema.py

+
+    def match(self, cfn):
+        matches = []
+        for resource_schema in [os.path.basename(f) for f in glob('src/cfnlint/data/ResourceSchemas/*.json')]:


so this would assume all the potential schemas are downloaded?

Yeah, wrote list-types / describe-type script to make it easy, but don't think it makes sense to call every runtime due to

credentials and networking requirements

ability to provide additional resource schemas

kddejong

I'm still not sure the standard jsonschema packages are going to fit the CloudFormation functionality. We can expand the schema from the registry to support the intrinsic functions when we read them but the possibilities are massive.

kddejong · 2020-11-16T18:10:24Z

src/cfnlint/rules/resources/ResourceSchema.py

+import os
+import re
+from glob import glob
+from jsonschema import validate, ValidationError


One of the big problems we are going to have with using this package is handling Fn::If or other intrinsic functions. Either way we are going to have to handle it outside of the schema validation which we have logic to handle or we are going to have to rewrite these validation functions that this package provides to handle these things differently.

kddejong · 2020-11-16T18:17:10Z

src/cfnlint/rules/resources/ResourceSchema.py

+            resource_type = load_resource(ResourceSchemas, resource_schema)['typeName']
+            for resource_name, resource_values in cfn.get_resources([resource_type]).items():
+                properties = resource_values.get('Properties', {})
+                if not re.match(REGEX_DYN_REF, str(properties)) and not any(x in str(properties) for x in PSEUDOPARAMS + UNCONVERTED_SUFFIXES) and FN_PREFIX not in str(properties):


Looks like this says ignore intrinsic function errors but doesn't handle more complex Fn::If scenarios.

ResourceName: Type: AWS::CloudFormation::StackSet Properties: Fn::If: - ConditionName - PropertiesScenarioTrue - PropertiesScenarioFalse

We basically don't get a failure even though there could be one in the provided scenario.

src/cfnlint/rules/resources/ResourceSchema.py

https://github.com/aws-cloudformation/cfn-python-lint/blob/master/docs/getting_started/rules.md#rule-matches

src/cfnlint/rules/resources/ResourceSchema.py

README.md

kddejong · 2020-12-01T21:06:53Z

src/cfnlint/core.py

@@ -39,7 +40,7 @@ class UnexpectedRuleException(CfnLintExitException):
    """When processing a rule fails in an unexpected way"""


-def run_cli(filename, template, rules, regions, override_spec, build_graph, mandatory_rules=None):
+def run_cli(filename, template, rules, regions, override_spec, build_graph, registry_schemas, mandatory_rules=None):


outside packages shouldn't be using run_cli by any concerns with the ordering here? I've been adding parameters and setting a default value to keep some backwards compatibility.

only found this from searching: https://github.com/Cloudzero/samwise/blob/793463e0774f9d1c702f4252377f19fa3408a558/samwise/__main__.py#L129 which looks already broken from #1411
cc @silvexis

have generally been debating compatibility for reliance on undocumented internal functions/variables

kddejong

Few changes but looks good to me

PatMyron · 2020-12-05T00:20:15Z

Example messages:

[cfn-lint] E3000 'RequiredEnumProperty' is a required property
[cfn-lint] E3000 Additional properties are not allowed ('InvalidProperty' was unexpected)
[cfn-lint] E3000 'string' is not of type 'integer'
[cfn-lint] E3000 200 is greater than the maximum of 100
[cfn-lint] E3000 -1 is less than the minimum of 0
[cfn-lint] E3000 'd' is not one of ['a', 'b', 'c']
[cfn-lint] E3000 'name' does not match 'arn:.*'

schema/template

{
  "typeName" : "Third::Party::Type",
  "description" : "",
  "additionalProperties" : false,
  "properties" : {
    "RequiredEnumProperty" : {
      "type" : "string",
      "enum": [
        "a",
        "b",
        "c"
      ]
    },
    "PatternProperty" : {
      "type" : "string",
      "pattern": "arn:.*"
    },
    "RangeProperty" : {
      "type": "integer",
      "minimum": 0,
      "maximum": 100
    }
  },
  "required" : ["RequiredEnumProperty"],
  "primaryIdentifier" : [ "/properties/RequiredEnumProperty" ]
}

Resources:
  ResourceMissingRequiredProperty:
    Type: Third::Party::Type
  ResourceMissingRequiredProperty2:
    Type: Third::Party::Type
    Properties:
      RangeProperty: 50
  ResourceWithInvalidProperty:
    Type: Third::Party::Type
    Properties:
      RequiredEnumProperty: required
      RangeProperty: 50
      InvalidProperty: invalid
  ResourceWithWrongPrimitiveType:
    Type: Third::Party::Type
    Properties:
      RequiredEnumProperty: a
      RangeProperty: string
  ResourceWithValueOutsideMinMaxRange:
    Type: Third::Party::Type
    Properties:
      RequiredEnumProperty: a
      RangeProperty: 200
  ResourceWithValueOutsideMinMaxRange2:
    Type: Third::Party::Type
    Properties:
      RequiredEnumProperty: a
      RangeProperty: -1
  ResourceWithInvalidValue:
    Type: Third::Party::Type
    Properties:
      RequiredEnumProperty: d
      RangeProperty: 50
  ResourceWithInvalidPattern:
    Type: Third::Party::Type
    Properties:
      RequiredEnumProperty: a
      PatternProperty: name
  ValidResource:
    Type: Third::Party::Type
    Properties:
      RequiredEnumProperty: a
      RangeProperty: 50
  ResourceWithUnresolvableSyntax:
    Type: Third::Party::Type
    Properties:
      RequiredEnumProperty: !Ref ValidResource
      RangeProperty: '{{resolve:secretsmanager:secret:secret:secret}}'

jasonmimick · 2020-12-16T19:07:00Z

Need to add this new parameter to the config file json schema:
cfnlint/data/CfnLintCli/config/schema.json
needs

...
 "ignore_templates": {
  79       "description": "Templates to ignore",
  80       "items": {
  81         "type": "string"
  82       },
  83       "type": "array"
  84     },
  85     "registry_schemas": {
  86       "description": "one or more directories of CloudFormation Registry Resource Schemas",
  87       "items": {
  88         "type": "string"
  89       },
  90       "type": "array"
  91     }

PatMyron added 16 commits October 8, 2020 13:53

__init__.py

bef33b5

remove print statement

a4bae45

adding resource schema constraint for testing

7e84e41

jsonschema validation

d980723

jsonschema.ValidationError -> RuleMatch format

44bc4c0

generalizing beyond one resource type

2d5a274

update E3001 Invalid or unsupported type to include Registry resource…

60f0a9e

… types

handling dynamic references

8cb475a

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html

handling psuedoparameters

334b54a

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html

handling intrinsic functions

6c0b32b

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference.html

handling intrinsic functions without intrinsic function prefix

714d807

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-condition.html

pylint

f7d7ade

rule metadata

5c82758

https://github.com/aws-cloudformation/cfn-python-lint/blob/master/docs/getting_started/rules.md#create-new-rule

removing resource schema used for testing

6a3951a

renaming directory to ResourceSchemas

1f6db95

PatMyron marked this pull request as ready for review October 19, 2020 20:50

PatMyron requested a review from kddejong October 19, 2020 21:40

johnttompkins reviewed Oct 20, 2020

View reviewed changes

benbridts mentioned this pull request Oct 30, 2020

Add warning for singleton resource types (AWS::ApiGateway::Account) #1757

Open

kddejong reviewed Nov 16, 2020

View reviewed changes

src/cfnlint/rules/resources/ResourceSchema.py Outdated Show resolved Hide resolved

adding Properties to RuleMatch path

e0a039d

https://github.com/aws-cloudformation/cfn-python-lint/blob/master/docs/getting_started/rules.md#rule-matches

PatMyron mentioned this pull request Nov 30, 2020

Better module support #1811

Open

PatMyron added 4 commits November 30, 2020 22:45

removing docstrings, typo

0258254

renaming directory to RegistrySchemas

3281ba6

switching from reading from directory to reading from variable

90dc2ae

--registry-schemas CLI argument

758dd5f

PatMyron force-pushed the schemas branch from 87ce1d0 to 758dd5f Compare December 1, 2020 06:54

Merge branch 'master' into schemas

8504bf1

PatMyron requested review from miparnisari and rjlohan December 1, 2020 18:32

pylint

3fea969

PatMyron changed the title ~~CloudFormation Registry resource schema support~~ CloudFormation Registry resource schema support (--registry-schemas) Dec 1, 2020

miparnisari reviewed Dec 1, 2020

View reviewed changes

src/cfnlint/rules/resources/ResourceSchema.py Show resolved Hide resolved

PatMyron and others added 2 commits December 1, 2020 11:54

comment explaining CloudFormation template syntax being ignored

82a5381

Merge branch 'master' into schemas

2d65480

kddejong reviewed Dec 1, 2020

View reviewed changes

README.md Show resolved Hide resolved

kddejong reviewed Dec 1, 2020

View reviewed changes

kddejong requested changes Dec 1, 2020

View reviewed changes

Merge branch 'master' into schemas

64e4b96

PatMyron merged commit b04bd09 into master Dec 2, 2020

PatMyron deleted the schemas branch December 2, 2020 20:52

PatMyron linked an issue Dec 2, 2020 that may be closed by this pull request

Support registry resource schemas #1277

Closed

PatMyron mentioned this pull request Dec 9, 2020

Call cfn-lint for module fragments aws-cloudformation/cloudformation-cli#644

Merged

This was referenced Jan 12, 2021

Get value constraints from AWS registry types #1867

Merged

Add registry schemas to config file support #1836

Merged

PatMyron mentioned this pull request Mar 11, 2021

E3001 Invalid or unsupported Type AWSQS::Kubernetes::Helm for resource #1932

Closed

PatMyron mentioned this pull request Jun 25, 2021

catch common resource schema issues in cfn validate aws-cloudformation/cloudformation-cli#785

Merged

PatMyron mentioned this pull request Sep 28, 2021

Autocompletion / links on hover for Registry types aws-cloudformation/cfn-lint-visual-studio-code#199

Closed

PatMyron mentioned this pull request Oct 13, 2021

Autocompletion / links on hover for Registry types aws-cloudformation/cfn-lint-visual-studio-code#200

Merged

7 tasks

PatMyron mentioned this pull request Aug 5, 2022

E3001 Invalid or unsupported Type Datadog::Monitors::Monitor for resource DatadogMonitorResource in us-east-1 #2321

Closed

iainelder mentioned this pull request Jul 13, 2023

How do I validate properties with a custom schema? #2794

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CloudFormation Registry resource schema support (--registry-schemas) #1732

CloudFormation Registry resource schema support (--registry-schemas) #1732

PatMyron commented Oct 8, 2020 •

edited

Loading

johnttompkins Oct 20, 2020

PatMyron Oct 20, 2020 •

edited

Loading

kddejong left a comment

kddejong Nov 16, 2020

kddejong Nov 16, 2020 •

edited by PatMyron

Loading

kddejong Dec 1, 2020

PatMyron Dec 1, 2020

PatMyron Dec 1, 2020 •

edited

Loading

kddejong left a comment

PatMyron commented Dec 5, 2020

jasonmimick commented Dec 16, 2020

CloudFormation Registry resource schema support (--registry-schemas) #1732

CloudFormation Registry resource schema support (--registry-schemas) #1732

Conversation

PatMyron commented Oct 8, 2020 • edited Loading

johnttompkins Oct 20, 2020

Choose a reason for hiding this comment

PatMyron Oct 20, 2020 • edited Loading

Choose a reason for hiding this comment

kddejong left a comment

Choose a reason for hiding this comment

kddejong Nov 16, 2020

Choose a reason for hiding this comment

kddejong Nov 16, 2020 • edited by PatMyron Loading

Choose a reason for hiding this comment

kddejong Dec 1, 2020

Choose a reason for hiding this comment

PatMyron Dec 1, 2020

Choose a reason for hiding this comment

PatMyron Dec 1, 2020 • edited Loading

Choose a reason for hiding this comment

kddejong left a comment

Choose a reason for hiding this comment

PatMyron commented Dec 5, 2020

jasonmimick commented Dec 16, 2020

PatMyron commented Oct 8, 2020 •

edited

Loading

PatMyron Oct 20, 2020 •

edited

Loading

kddejong Nov 16, 2020 •

edited by PatMyron

Loading

PatMyron Dec 1, 2020 •

edited

Loading