search

aws-cloudformation / cfn-lint

CloudFormation Linter
MIT No Attribution
2.43k stars 586 forks source link

Multiple resources of the same type with duplicate primaryIdentifiers #1326

Closed ohshazbot closed 2 months ago

ohshazbot commented 4 years ago

*cfn-lint version: 0.26.0

Description of issue. In a copy paste error, I ended up creating a 2nd iam policy attached to a role that had a different cfn logical name, but the same PolicyName. When this deployed, it caused one of the policies to not be created (due to name collision). It would have been super nice had the linter detected that I was attempting to create multiple policies with the same name for the same role.

PatMyron commented 4 years ago

Love this rule idea and think it's generalizable beyond this specific resource type: https://github.com/aws-cloudformation/cfn-lint/pull/3023

silvax commented 3 years ago

This wold be really helpful also to detect duplicate Config Rules when deploying either via CloudFormation or Conformance Packs. Some rule templates or conformance packs can have 100's resources and that could lead to duplication of rules. We could use the linter to detect those duplicate rules and make those templates more efficient.

rmcdonough commented 3 years ago

+1 on this! Would make detecting duplicate Config rules much easier.

kddejong commented 3 years ago

For the Config rule request.

Want to make sure we are focused on the right spot. You are talking about the source properties correct? We would be making sure that the combination of Owner and SourceIdentifier is unique?

Source: 
  Owner: AWS
  SourceIdentifier: "REQUIRED_TAGS"

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-config-configrule-source.html

kddejong commented 3 years ago

@PatMyron for the original request. Would we use the primaryIdentifier property and determine if that is unique across the template.

silvax commented 3 years ago

Correct @kddejong that will allow us to detect if in a single template there are 2 of the same exact rule. We just want to soft warn on it. There are use cases where that is valid in most cases we are seeing that customers are deploying the same rule twice. WE would like to help them detect that.