Nested stack checks and Parameter

[gbudge]

Hi All,

I've tried to find these answers myself and asked a few of the GPT tools out there but can't really conclude for sure.

1. Can cfn-lint check nested stacks beyond just that the filename exists? I'm specifically thinking check that the parameters passed by the parent stack into the nested stack are correct. i.e.

• The parent stack doesn't pass a parameter that is not listed in the nested stack
• The parent stack doesn't omit a parameter required by the nested stack.
• The parameter values passed in by the parent stack are valid against the AllowedValues, AllowedPattern, MinLength, MaxLength, MinValue, MaxValue.
• The parameter values passed in by the parent stack match the Type in the nested stack... at least for String, Number, List and CommaDelimitedList.

2. Does cfn-lint have the ability to read a parameter override file and use it the validate the stack parameters & values the same way described above?

3. Are there any reasons why someone couldn't create rules for this sort of thing or add a new CLI parameter for the json parameter overrides file? I'm thinking here about the way cfn-lint is written, blocking opinions from the repo owners, etc.

[farski]

There would need to be some way to hint to cfn-lint what local file should be used as the template for the nested stack, since there's no real connection between local file structure of templates and the relationship of stacks. The TemplateURL of a stack resource is always a full S3 URL, not a relative path that could, even by default, be assumed to be the same as the local file system.

[gbudge]

True though that’s a different feature / problem to solve… mapping S3 URL to a local file path. I was thinking using comment hints similar to Hadolint.

I am not an regex expert but something like this…

eg.
For a block of text:

# cfn-lint scope=block action=regex command=“s|\!Sub \”https.*/|\”./|g”

For a whole Resource:

# cfn-lint scope=Resource=MyNestedStack action=regex command=“s|\!Sub \”https.*/|\”./|g”

etc.

[farski]

Comment hinting is what has come up in previous discussions around this sort of functionality, The practicality of implementing that generally starts to break down pretty quick, though. For example, what happens when the nested stack's template isn't available on the local file system at all? Or what if it's dynamically generated? cfn-lint needs to be consistent and predictable, so would it throw errors for every template it can't find? Or only throw errors when it can find a template and silently fail when it can't? Is it an error to pass an arbitrary Ref to a nested parameter with AllowedValues, or does there then also need to be a way to hint the values that the Ref can be? While it's possible to come up with answers to those issues, and there's an inclination to say something like, "ok there are edge cases, but why not have a sensible convention for the standard case," what you'll find with these sorts of build and deployment systems is that every one looks a little bit different. Which is not to say I'm against the idea – it's something that could have saved me loads of time. It's not that it can't be done, it's just a hard problem to solve.

[gbudge]

You do make some valid points.

I would argue that shouldn't lead to wholesale avoidance of the idea, when you could start out with limited use cases, see how they go in the wild and take it from there?

If it was implemented similar to the user custom rules, it's not all on the cfn-lint devs to take advantage of it.

The community will either use it or not.

[kddejong]

This rule tries to validate parameters to a nested template but @farski is correct. The big problem here is that we need to have a location to find the file. We don't try to read templates from S3/HTTPS but if you are using the CloudFormation package command the TemplateURL is a local path and we can do the validation.