kddejong
commented
3 months ago If I create a registry document like
{
"typeName": "ASRS::EC2::EC2::MODULE",
"description": "A fun little resource",
"additionalProperties": false,
"properties": {
"name": {
"type" : "string"
},
"instanceType": {
"type" : "string"
},
"imageID": {
"type" : "string"
},
"subnetID": {
"type" : "string"
},
"securityGroupIDs": {
"format": "AWS::EC2::SecurityGroup.Ids",
"insertionOrder": false,
"items": {
"format": "AWS::EC2::SecurityGroup.GroupId",
"type": "string"
},
"type": "array",
"uniqueItems": false
},
"numberOfAdditionalVolumes": {
"type" : "integer"
},
"volume2Size": {
"type" : "integer"
}
},
"primaryIdentifier": []
}I should be able to do
cfn-lint -s path/to/folder/with/schema/files -- template.yaml
This will output:
1020 'baselineSecurityGroupID' is not one of ['instance', 'devTeamSecurityGroup', 'AWS::AccountId', 'AWS::NoValue', 'AWS::NotificationARNs', 'AWS::Partition', 'AWS::Region', 'AWS::StackId', 'AWS::StackName', 'AWS::URLSuffix']
local/issue/3472/template.yaml:9:7
E1150 'asdfasdfasdfasdf' is not a 'AWS::EC2::SecurityGroup.GroupId'
local/issue/3472/template.yaml:10:11
randybasrs
cfn-lint: 1.5.0 operation system: AWS serverless & Windows 11
This EC2 module seems to lint successfully no matter how I alter the schema for the code module or add patches to the override_spec. The one thing I was able to get to lint properly was the primaryIdentifier as was discussed in #3446 , thank you again!
The 2 basic changes I'm looking to apply are a regex validation of {resolveEC2ImageID:.+} to the imageID similar to what I was doing in #3460 for the regular AWS::EC2::Instance resource type and to validate the securityGroupIDs as valid IDs or dynamic references like a regular EC2 instance.
This is the whole test template; the baselineSecurityGroupID !Ref is not valid in the above template and should fail validation due to the references being invalid. asdfasdfasdfasdf should also fail validation according to the schemas/override_specs I've tried to supply. the SSM resolution and the devTeamSecurityGroup !Ref should both pass validation, again like a normal EC2 instance.
I am trying to use the Amazon provided schema as a reference for my changes, but in #3446 it was mentioned that the module validation is minimal by design. Here's the part of that schema I've been trying to insert into the code module schema or use in the override spec for patching (adding/removing the property/parameter, etc). I did update the casing from below to match the casing on the code module in both the schema and the template as shown above.
So I suppose the question is: can I achieve the type of validation I'm looking for with code modules to ensure our developers are providing valid inputs? I do plan to add other validation like the length of the name etc, but I figure if I can get these 2 properties to lint the rest should be easy to add.