Support JSON-string formatted objects about cloudformation-guard HOT 3 CLOSED

That's also good. Semantically, it might make the most sense to get rid of periods altogether for that part. So AssumeRolePolicyDocument|Statement.*.Principal.Service.* would effectively mean "Take the payload inside the AssumeRolePolicyDocument field and parse it, then descend the parsed structure". That prevents the need to do look-back when it encounters the |.

Sounds like we're close enough in agreement to start hashing out an implementation, at least.

from cloudformation-guard.

This is, of course, a function of using parsers for the language the template is written in. A less elegant but valid rule to check what you're specifying would be to treat it as a literal:

AWS::IAM::Role AssumeRolePolicyDocument == {  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Service": [          "lambda.amazonaws.com"        ]      }    }  ]}

(The above is the cfn-guard-rulegen output from the template - so it's sort of a working-backward way to arrive at what a valid rule would look like for a property.)

That said, there's a lot of room for improvement in the experience so that nested structures inside properties can themselves be descended into and addressed using the dotted notation.

After pondering this particular case, we're trying to nail down what a simple, intuitive syntax for this kind of thing would be.

What are your thoughts on something like:

AWS::IAM::Role AssumeRolePolicyDocument.|.Statement.*.Principal.Service.* == lambda.amazonaws.com

Where the | in the address indicates the possible need for a transform of the property under the address? Internally, we could just attempt to parse it as json or yaml and then continue to descend into it.

from cloudformation-guard.

The proposed solution looks good. I'm not sure on how flexible the parser is, but perhaps we could place the placeholder on the field that is being optionally processed, like so:

AWS::IAM::Role AssumeRolePolicyDocument|.Statement.*.Principal.Service.* == lambda.amazonaws.com

from cloudformation-guard.