Array of strings is an output value type (#3312)

* Array of strings is an output value type * Add one more element as possible in dynreference
aws-cloudformation · Jun 18, 2024 · 21be43c · 21be43c
1 parent 8dae604
commit 21be43c
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 4 deletions.
diff --git a/src/cfnlint/rules/functions/DynamicReference.py b/src/cfnlint/rules/functions/DynamicReference.py
@@ -37,8 +37,10 @@
         {"type": "string", "enum": ["SecretString", ""]},  # secret-string
         {"type": "string"},  # json-key
         {"type": "string"},  # version-stage or version-id
+        {"type": "string"},  # version-stage or version-id
     ],
-    "maxItems": 6,
+    "minItems": 3,
+    "maxItems": 7,
     "type": "array",
 }
 
@@ -56,8 +58,10 @@
         {"type": "string", "enum": ["SecretString", ""]},  # secret-string
         {"type": "string"},  # json-key
         {"type": "string"},  # version-stage or version-id
+        {"type": "string"},  # version-stage or version-id
     ],
-    "maxItems": 12,
+    "minItems": 9,
+    "maxItems": 13,
     "type": "array",
 }
 

diff --git a/src/cfnlint/rules/outputs/Value.py b/src/cfnlint/rules/outputs/Value.py
@@ -32,7 +32,12 @@ def validate(self, validator: Validator, _: Any, instance: Any, schema: Any):
             context=validator.context.evolve(
                 functions=list(FUNCTIONS),
             ),
-            schema={"type": "string"},
+            schema={
+                "type": ["array", "string"],
+                "items": {
+                    "type": "string",
+                },
+            },
         )
 
         yield from self._iter_errors(validator, instance)
diff --git a/test/unit/rules/functions/test_dynamic_reference.py b/test/unit/rules/functions/test_dynamic_reference.py
@@ -172,6 +172,25 @@ def context(cfn):
             },
             [],
         ),
+        (
+            "Invalid SSM Parameter with string version",
+            "{{resolve:secretsmanager:arn:aws:secretsmanager:us-east-1:012345678901:secret:my-secret:SecretString::::}}",
+            {"type": "test"},
+            {
+                "E1051": _TestRule(),
+                "E1027": _TestRule(),
+            },
+            [
+                ValidationError(
+                    "['resolve', 'secretsmanager', 'arn', 'aws', "
+                    "'secretsmanager', 'us-east-1', '012345678901', "
+                    "'secret', 'my-secret', 'SecretString', "
+                    "'', '', '', ''] is too long (13)",
+                    validator="maxItems",
+                    rule=DynamicReference(),
+                )
+            ],
+        ),
     ],
 )
 def test_validate(name, instance, schema, child_rules, expected, rule, context, cfn):

diff --git a/test/unit/rules/outputs/test_value.py b/test/unit/rules/outputs/test_value.py
@@ -16,7 +16,7 @@
         (1.0, 1),
         (1, 1),
         (True, 1),
-        (["foo"], 1),
+        ([{}], 1),
         ({"foo": "bar"}, 1),
     ],
 )