Performance problems with AWS::StepFunctions::StateMachine

[b01f6b82b8a347f6045406b8f31f239d]

cfn-lint Version
cfn-lint 1.18.4

Provide additional details e.g. code snippets. Be sure to remove any sensitive data.
Hi,
first of all sorry if this is the wrong issue type but I´m not quite sure about the problem at the moment.

We use cfn-lint in our CI/CD Pipeline to test CloudFormation templates. After an upgrade from version 0.8.x to 1.18.4 our lint job broke because cfn-lint took longer than 1 hour to lint the templates. The problematic templates only contain AWS::StepFunctions::StateMachine resources. It seems like cfn-lint takes extremely long to parse the DefinitionString's if they contain many intrinsic functions like "Ref", "FindInMap", "If". It takes so long, that I don't even know if it would actually finish execution. I let it ran locally for over an hour and it wouldn't proceed past the E1001 rule:

2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Starting match function for rule E3041 at 2025-01-06 16:13:04.160515
2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Complete match function for rule E3041 at 2025-01-06 16:13:04.160525.  Ran in 0:00:00.000010
2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Starting match function for rule E3023 at 2025-01-06 16:13:04.160540
2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Complete match function for rule E3023 at 2025-01-06 16:13:04.160550.  Ran in 0:00:00.000010
2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Starting match function for rule E3029 at 2025-01-06 16:13:04.160564
2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Complete match function for rule E3029 at 2025-01-06 16:13:04.160575.  Ran in 0:00:00.000011
2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Starting match function for rule E1005 at 2025-01-06 16:13:04.160589
2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Complete match function for rule E1005 at 2025-01-06 16:13:04.160599.  Ran in 0:00:00.000010
2025-01-06 16:13:04,160 - cfnlint.rules._rule - DEBUG - Starting match function for rule E1001 at 2025-01-06 16:13:04.160613

Because I couldn't understand what the problem is I cloned the cfn-lint repo and started to debug it.
So far I can only tell that at some point, this for loop: https://github.com/aws-cloudformation/cfn-lint/blob/main/src/cfnlint/rules/jsonschema/CfnLint.py#L33 won't proceed because cfn-lint tries to constantly resolve values: https://github.com/aws-cloudformation/cfn-lint/blob/main/src/cfnlint/jsonschema/validators.py#L172 and this goes on forever.

Unfortunately I´m not able to provide a CloudFormation template at the moment because it`s too big (1.4k loc) and contains too many sensitive data. I try to recreate a "not working" minimal example in the next few days but does someone has some guesses in the meantime what the problem could be?

Thank you!

[kddejong]

@b01f6b82b8a347f6045406b8f31f239d Can you see if the solution in #3717 helps your use case? Lots of if conditions are very possibly the issue here as we are trying to compute different scenarios to validate all those scenarios. If the number of scenarios are large, the equations can be slow. We try to minimize this by putting in max limits.

[b01f6b82b8a347f6045406b8f31f239d]

Unfortunately I didn't see any improvement.
One template took ~6min whether pycosat and/or a fixed seed was used or not. The other still didn't finish after a few hours.
But we only have like 7 If Statements which are not nested. Join, Ref and FindInMap on the other hand get used pretty extensively in the DefinitionString's.

I try to supply a "non working" example as soon as possible..

[kddejong]

Thanks. If needed we may have some options to exchange that template privately if that would help.

[b01f6b82b8a347f6045406b8f31f239d]

I think I have a non working template. If you don't mind I would still prefer to send it to you privately ^^

[kddejong]

You can email to [email protected]