cfn-lint
cfn-lint copied to clipboard
Missing Function not seen as a violation
cfn-lint version: (0.58.4)
Description of issue.
Invalid resource references was not picked up by the validator when executing, a further deployment in AWS resulted in a generic something is wrong with the Policy Document message.
Here is an example summary of the Template which was in flight
---
Resources:
Bucket:
Type: AWS::S3::Bucket
ManagedPolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
PolicyDocument:
Statement:
- Effect: Allow
Action:
- s3:Get*
Resource:
- !GetAtt Bucket.Arn
- [ '', [ !GetAtt Bucket.Arn , '/*' ] ]
The problem is around he second resource definition, which is missing the short form !Join function, see docs
- !Join [ '', [ !GetAtt Bucket.Arn , '/*' ] ]