aws-cloudformation / cfn-lint

CloudFormation Linter
MIT No Attribution
2.4k stars 577 forks source link

Incorrect tag validation for AWS::Glue::Job resources in cfn-lint 1.4.0 #3433

Closed idwagner closed 5 days ago

idwagner commented 5 days ago

CloudFormation Lint Version

1.4.0

What operating system are you using?

linux

Describe the bug

The cloudformation docs for AWS::Glue::Job are incorrect with respect to tagging. The docs tags as an array of Key/Value dicts, but cloudformation actually expects Tags to be a dictionary of key/values.

In 1.3.7, cfn-lint does not throw an error when you use the correct dictionary tags (maybe it ignores it?) In 1.4.0 a template will error out with: E3012 {'tag1': 'value2', 'tag2': 'value1'} is not of type 'array'

Expected behavior

Should validate the reproduction template without errors on the reproduction template. This validates correctly in 1.3.7

Reproduction template

This representation of tags is deployable with cloudformation:

---
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  GlueJob:
      Type: 'AWS::Glue::Job'
      Properties:
        GlueVersion: 4.0
        Role: redacted
        Tags:
          tag1: value2
          tag2: value1
        Connections:
           Connections:
            - redacted
        Description: redacted
        SecurityConfiguration: redacted
        Command:
          Name: redcated
          PythonVersion: 3
          ScriptLocation: redacted
        ExecutionProperty:
          MaxConcurrentRuns: 1
        MaxRetries: 0
        WorkerType: G.1X
        Timeout: 60
        NumberOfWorkers: 2
        Name: redacted
kddejong commented 5 days ago

In v0 the spec for these are written as

"Tags": {
     "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-glue-job.html#cfn-glue-job-tags",
     "PrimitiveType": "Json",
     "Required": false,
     "UpdateType": "Mutable"
    },

Patching them to be in the schemas

{
   "format": "json",
   "type": [
    "object",
    "string"
   ]
  }

Also communicating with the docs team if we can get there description fixed.