JSON/YAML discrepancy when parsing functions about cloudformation-guard HOT 8 CLOSED

You are correct. The behaviors are different because of the different way CFn intrinsic functions are represented within the two formats. We're working through a number of possible ways to address it.

Check out this part of the README for more info: https://github.com/aws-cloudformation/cloudformation-guard/blob/master/cfn-guard/README.md#working-with-cloudformation-intrinsic-functions

For your second approach, try changing the Tags reference to a wildcard (Tags.*) and the "==" will match if any part of the Tags list passes.

from cloudformation-guard.

The wildcard solution is sadly not applicable because it will fail on any additional tags that aren't defined in the ruleset (#23 (comment))

from cloudformation-guard.

I added some comments to #23.

[EDIT: Removed my repeat of the intrinsics details above]

That said, I'm not happy about how it works right now. We're kicking around different approaches to come up with a behavior that reconciles the different representations without being lossy or confusing. Hopefully, we'll get an elegant, supportable solution out soon. In the mean time, you need to use the |OR| with a checking for the intrinsic in JSON on one side and YAML on the other.

from cloudformation-guard.

For example:

AWS::EC2::Volume AvailabilityZone == ["EC2Instance","AvailabilityZone"] |OR| AWS::EC2::Volume AvailabilityZone == {"Fn::GetAtt":["EC2Instance","AvailabilityZone"]}

from cloudformation-guard.

Yeah I'm using regex match now instead. It's really ugly tho 😅

from cloudformation-guard.

Check out the latest release-0.5.2 branch. I added JSON list literals to make the task of matching against intrinsics in both YAML and JSON templates a bit easier.

For example:

let tag_vals = [{"Key":"OwnerContact","Value":"OwnerContact"},{"Key":"OwnerContact","Value":{"Ref":"OwnerContact"}}]
AWS::EC2::SecurityGroup Tags.* IN %tag_vals

Should now work correctly for both the YAML and JSON versions you're trying to check.

from cloudformation-guard.

Works and also 0.5.2 is quite a lot faster too!

Thanks :)

from cloudformation-guard.

Awesome! 👍

from cloudformation-guard.