Rules

Rule levels

A rule returns feedback on a specific level: Error, Warning or Informational.

Errors

Errors will start with the letter E. Errors will (or can) result in a hard failure for the template being validated.

Warnings

Warnings start with the letter W. Warnings alert you when the template doesn't follow best practices but should still function. Example: If you use a parameter for a RDS master password you should have the parameter property NoEcho set to true.

Informational

Informational results start with the letter I. Informational alert you when the template doesn't follow best practices, just like the Warnings, but in a non-blocking way. The Informational level is disabled by default and has to be enabled explicitly using -c I or --include-checks I.

Experimental rules

Sometimes there are (new) rules that might be complex, that doesn't have enough solid test templates and examples and/or might have unexpected results. We support adding in these rules so they can be tested, tweaked and improved before they become generally available.

A rule can be marked as experimental by setting the experimental flag in the Rule's MetaData:

class MyExperimentalRule(CloudFormationLintRule):
    id = 'E1234'
    ...
    experimental = True

To include these rules, use the -e/include-experimental argument when running cfn-lint.

Rules

(This documentation is generated by running cfn-lint --update-documentation, do not alter this manually)

The following 263 rules are applied by this linter:

Rule ID	Title	Description	Config (Name:Type:Default)	Source	Tags
E0000	Parsing error found when parsing the template	Checks for JSON/YAML formatting errors in your template		Source	`base`
E0001	Error found when transforming the template	Errors found when performing transformation on the template		Source	`base`,`transform`
E0002	Error processing rule on the template	Errors found when processing a rule on the template		Source	`base`,`rule`
E0003	Error with cfn-lint configuration	Error as a result of the cfn-lint configuration		Source	`base`,`rule`
E0100	Validate deployment file configuration	Validate if a deployment file has the correct syntax for one of the supported formats		Source	`base`
E0200	Validate parameter file configuration	Validate if a parameter file has the correct syntax for one of the supported formats		Source	`base`
E1001	Basic CloudFormation Template Configuration	Making sure the basic CloudFormation template components are properly configured	sections:string:	Source	`base`
E1002	Validate if a template size is too large	Check the size of the template is less than the upper limit		Source	`limits`
E1003	Validate the max size of a description	Check if the size of the template description is less than the upper limit		Source	`description`,`limits`
E1004	Template description can only be a string	Template description can only be a string		Source	`description`
E1005	Validate Transform configuration	Validate that the transforms section of a template is properly configured		Source	`transform`
E1010	GetAtt validation of parameters	Validates that GetAtt parameters are to valid resources and properties of those resources		Source	`functions`,`getatt`
E1011	FindInMap validation of configuration	Making sure the function is a list of appropriate config		Source	`functions`,`findinmap`
E1015	GetAz validation of parameters	Making sure the GetAz function is properly configured		Source	`functions`,`getaz`
E1016	ImportValue validation of parameters	Making sure the ImportValue function is properly configured		Source	`functions`,`importvalue`
E1017	Select validation of parameters	Making sure the Select function is properly configured		Source	`functions`,`select`
E1018	Split validation of parameters	Making sure the split function is properly configured		Source	`functions`,`split`
E1019	Sub validation of parameters	Making sure the sub function is properly configured		Source	`functions`,`sub`
E1020	Ref validation of value	Making sure the Ref has a String value (no other functions are supported)		Source	`functions`,`ref`
E1021	Base64 validation of parameters	Making sure the Base64 function is properly configured		Source	`functions`,`base64`
E1022	Join validation of parameters	Making sure the join function is properly configured		Source	`functions`,`join`
E1024	Cidr validation of parameters	Making sure the function CIDR is a list with valid values		Source	`functions`,`cidr`
E1027	Check dynamic references secure strings are in supported locations	Dynamic References Secure Strings are only supported for a small set of resource properties. Validate that they are being used in the correct location when checking values and Fn::Sub in resource properties. Currently doesn't check outputs, maps, conditions, parameters, and descriptions.		Source	`functions`,`dynamic reference`
E1028	Check Fn::If structure for validity	Check Fn::If to make sure its valid. Condition has to be a string.		Source	`functions`,`if`
E1029	Sub is required if a variable is used in a string	If a substitution variable exists in a string but isn't wrapped with the Fn::Sub function the deployment will fail.	custom_excludes:string:	Source	`functions`,`sub`
E1030	Length validation of parameters	Making sure Fn::Length is configured correctly		Source	`functions`,`length`
E1031	ToJsonString validation of parameters	Making sure Fn::ToJsonString is configured correctly		Source	`functions`,`toJsonString`
E1032	Validates ForEach functions	Validates that ForEach parameters have a valid configuration		Source	`functions`,`foreach`
E1040	Check if GetAtt matches destination format	Validate that if source and destination format exists that they match		Source	`functions`,`getatt`
E1041	Check if Ref matches destination format	When source and destination format exists validate that they match in a Ref		Source	`functions`,`ref`
E1050	Validate the structure of a dynamic reference	Make sure dynamic reference strings have the correct syntax		Source	`functions`,`dynamic reference`
E1051	Validate dynamic references to secrets manager are only in resource properties	Dynamic references from secrets manager can only be used in resource properties		Source	`functions`,`dynamic reference`
E1052	Validate dynamic references to SSM are in a valid location	Dynamic references to SSM parameters are only supported in certain locations		Source	`functions`,`dynamic reference`
E1101	Validate an item against additional checks	Use supplemental logic to validate properties against		Source
E1103	Validate the format of a value	Parent rule for validating the format keyword in schemas		Source
E1150	Validate security group format	Security groups have to ref/gettatt to a security group or has the valid pattern		Source
E1151	Validate VPC id format	Check that a VPC id matches a pattern		Source
E1152	Validate AMI id format	Check that a AMI id matches a pattern		Source
E1153	Validate security group name	Security group names have to valid pattern		Source
E1154	Validate VPC subnet id format	Check that a VPC subnet id matches a pattern		Source
E1155	Validate CloudWatch logs group name	Check that a CloudWatch log group name matches a pattern		Source
E1156	Validate IAM role ARN format	Validate IAM role ARN validation for ref/gett and string values		Source
E1700	Rules have the appropriate configuration	Making sure the Rules section is properly configured		Source	`rules`
E1701	Validate the configuration of Assertions	Make sure the Assert value in a Rule is properly configured		Source	`rules`
E1702	Validate the configuration of Rules RuleCondition	Make sure the RuleCondition in a Rule is properly configured		Source	`rules`
E2001	Parameters have appropriate properties	Making sure the parameters are properly configured		Source	`parameters`
E2002	Parameters have appropriate type	Making sure the parameters have a correct type		Source	`parameters`
E2003	Parameters have appropriate names	Check if Parameters are properly named (A-Za-z0-9)		Source	`parameters`,`name`
E2010	Parameter limit not exceeded	Check the number of Parameters in the template is less than the upper limit		Source	`parameters`,`limits`
E2011	Validate the name for a parameter	Validate the name of a parameter with special handling of the max length length		Source	`parameters`,`limits`
E2015	Default value is within parameter constraints	Making sure the parameters have a default value inside AllowedValues, MinValue, MaxValue, AllowedPattern		Source	`parameters`
E2529	Check for SubscriptionFilters have beyond 2 attachments to a CloudWatch Log Group	The current limit for a CloudWatch Log Group is they can have 2 subscription filters. We will look for duplicate LogGroupNames inside Subscription Filters and make sure they are within 2. This doesn't account for any other subscription filters getting set.		Source	`resources`,`lambda`
E2530	SnapStart supports the configured runtime	To properly leverage SnapStart, you must have a runtime of Java11 or greater		Source	`resources`,`lambda`
E2531	Validate if lambda runtime is deprecated	Check the lambda runtime has reached the end of life		Source	`resources`,`lambda`,`runtime`
E2533	Check if Lambda Function Runtimes are updatable	Check if an EOL Lambda Runtime is specified and you cannot update the function		Source	`resources`,`lambda`,`runtime`
E2900	Validate deployment file parameters are valid against template parameters	Validates that required properties are provided, allowed values are valid, types are correct, and the pattern matches in a deployment file for the parameters specified in a template		Source	`parameters`
E3001	Basic CloudFormation Resource Check	Making sure the basic CloudFormation resources are properly configured		Source	`resources`
E3002	Resource properties are invalid	Making sure that resources properties are properly configured		Source	`resources`
E3003	Required Resource properties are missing	Make sure that Resources properties that are required exist		Source	`resources`,`properties`,`required`
E3004	Resource dependencies are not circular	Check that Resources are not circularly dependent by DependsOn, Ref, Sub, or GetAtt		Source	`resources`,`circularly`,`dependson`,`ref`,`sub`,`getatt`
E3005	Check DependsOn values for Resources	Check that the DependsOn values are valid		Source	`resources`,`dependson`
E3006	Validate the CloudFormation resource type	Resource types are validated against the spec accounting for regions		Source	`resources`
E3007	Unique resource and parameter names	All resources and parameters must have unique names		Source	`parameters`,`resources`
E3008	Validate an array in order	Will validate arrays in order for schema validation		Source	`resources`,`properties`,`array`,`prefixItems`
E3009	Check CloudFormation init configuration	Validate that the items in a CloudFormation init adhere to standards		Source	`resources`,`cloudformation init`
E3010	Resource limit not exceeded	Check the number of Resources in the template is less than the upper limit		Source	`resources`,`limits`
E3011	Check property names in Resources	Validate property names are property configured in Resources		Source	`resources`,`limits`
E3012	Check resource properties values	Checks resource property values with Primitive Types for values that match those types.	strict:boolean:False	Source	`resources`
E3013	CloudFront Aliases	CloudFront aliases should contain valid domain names		Source	`properties`,`cloudfront`
E3014	Validate only one of a set of required properties are specified	Make sure that Resources properties that are required exist. Along with other properties not being specified		Source	`resources`
E3015	Validate the resource condition is valid	Check the condition of a resource to make sure it exists inside the template		Source	`resources`,`conditions`
E3016	Check the configuration of a resources UpdatePolicy	Make sure a resources UpdatePolicy is properly configured		Source	`resources`,`updatepolicy`
E3017	Check Properties that need at least one of a list of properties	Making sure CloudFormation properties that require at least one property from a list. More than one can be included.		Source	`resources`
E3018	Check Properties that need only one of a list of properties	Making sure CloudFormation properties that require only one property from a list. One has to be specified.		Source	`resources`
E3019	Validate that all resources have unique primary identifiers	Use the primary identifiers in a resource schema to validate that resources inside the template are unique	exceptions:object:{'AWS::CodeBuild::Project': {'primaryIdentifier': ['/properties/Name']}}	Source	`parameters`,`resources`
E3020	Validate that when a property is specified another property should be excluded	When certain properties are specified other properties should not be included		Source	`resources`
E3021	Validate that when a property is specified that other properties should be included	When certain properties are specified it results in other properties to be required		Source	`resources`
E3022	Resource SubnetRouteTableAssociation Properties	Validate there is only one SubnetRouteTableAssociation per subnet		Source	`resources`,`ec2`,`subnet`,`route table`
E3023	Validate Route53 RecordSets	Check if all RecordSets are correctly configured		Source	`resources`,`route53`,`record_set`
E3024	Validate tag configuration	Validates tag values to make sure they have unique keys and they follow pattern requirements		Source	`parameters`,`resources`,`tags`
E3025	Validates RDS DB Instance Class	Validates the RDS DB instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3026	Check Elastic Cache Redis Cluster settings	Evaluate Redis Cluster groups to make sure automatic failover is enabled when cluster mode is enabled		Source	`resources`,`elasticcache`
E3027	Validate AWS Event ScheduleExpression format	Validate the formation of the AWS::Event ScheduleExpression		Source	`resources`,`events`
E3028	Validate the metadata section of a resource	The metadata section can be unstructured but we do validate the items we can		Source	`resources`
E3029	Validate Route53 record set aliases	When using alias records you can't specify TTL or certain types are allowed		Source	`resources`,`route53`,`record_set`
E3030	Check if properties have a valid value	Check if properties have a valid value in case of an enumator		Source	`resources`,`property`,`allowed value`
E3031	Check if property values adhere to a specific pattern	Check if properties have a valid value in case of a pattern (Regular Expression)	exceptions:list:[]	Source	`resources`,`property`,`allowed pattern`,`regex`
E3032	Check if a array has between min and max number of values specified	Check array for the number of items in the list to validate they are between the minimum and maximum		Source	`resources`,`property`,`array`,`length`
E3033	Check if a string has between min and max number of values specified	Check strings for its length between the minimum and maximum		Source	`resources`,`property`,`string`,`size`
E3034	Check if a number is between min and max	Check numbers (integers and floats) for its value being between the minimum and maximum		Source	`resources`,`property`,`number`,`size`
E3035	Check DeletionPolicy values for Resources	Check that the DeletionPolicy values are valid		Source	`resources`,`deletionpolicy`
E3036	Check UpdateReplacePolicy values for Resources	Check that the UpdateReplacePolicy values are valid		Source	`resources`,`updatereplacepolicy`
E3037	Check if a list has duplicate values	Certain lists don't support duplicate items. Check when duplicates are provided but not supported.		Source	`resources`,`property`,`list`
E3038	Check if Serverless Resources have Serverless Transform	Check that a template with Serverless Resources also includes the Serverless Transform		Source	`resources`,`transform`
E3039	AttributeDefinitions / KeySchemas mismatch	Verify the set of Attributes in AttributeDefinitions and KeySchemas match		Source	`resources`,`dynamodb`
E3040	Validate we aren't configuring read only properties	Read only properties can be configured in a CloudFormation template but they aren't sent to the resource provider code and can cause drift.		Source	`resources`,`properties`
E3041	RecordSet HostedZoneName is a superdomain of or equal to Name	In a RecordSet, the HostedZoneName must be a superdomain of or equal to the Name being validated		Source	`resource`,`properties`,`route53`
E3042	Validate at least one essential container is specified	Check that every TaskDefinition specifies at least one essential container		Source	`properties`,`ecs`,`task`,`container`,`fargate`
E3043	Validate parameters for in a nested stack	Evalute if parameters for a nested stack are specified and if parameters are specified for a nested stack that aren't required.		Source	`resources`,`cloudformation`
E3044	ECS service using FARGATE or EXTERNAL can only use SchedulingStrategy of REPLICA	When using a LaunchType of Fargate the SchedulingStrategy has to be Replica		Source	`properties`,`ecs`,`service`,`container`,`fargate`
E3045	Validate AccessControl are set with OwnershipControls	When using AccessControl other than private you must also configure OwnershipControls. The default is bucket owner enforced which disables ACLs.		Source	`resources`,`s3`
E3046	Validate ECS task logging configuration for awslogs	When 'awslogs' the options 'awslogs-group' and 'awslogs-region' are required		Source	`resources`
E3047	Validate ECS Fargate tasks have the right combination of CPU and memory	When using a ECS Fargate task there is a specfic combination of memory and cpu that can be used		Source	`properties`,`ecs`,`service`,`container`,`fargate`
E3048	Validate ECS Fargate tasks have required properties and values	When using a ECS Fargate task there is a specfic combination of required properties and values		Source	`properties`,`ecs`,`service`,`container`,`fargate`
E3049	Validate ECS tasks with dynamic host port have traffic-port ELB target groups	When using an ECS task definition of host port 0 and associating that container to an ELB the target group has to have a 'HealthCheckPort' of 'traffic-port'		Source	`resources`
E3050	Check if REFing to a IAM resource with path set	Some resources don't support looking up the IAM resource by name. This check validates when a REF is being used and the Path is not '/'		Source	`properties`,`iam`
E3051	Validate the structure of a SSM document	SSM documents are nested JSON/YAML in CloudFormation this rule adds validation to those documents		Source	`properties`,`ssm`,`document`
E3052	Validate ECS service requires NetworkConfiguration	When using an ECS task definition has NetworkMode set to 'awsvpc' then 'NetworkConfiguration' is required		Source	`resources`,`ecs`
E3053	Validate ECS task definition is has correct values for 'HostPort'	The 'HostPort' must either be undefined or equal to the 'ContainerPort' value		Source	`resources`,`ecs`
E3054	Validate ECS service using Fargate uses TaskDefinition that allows Fargate	When using an ECS service with 'LaunchType' of 'FARGATE' the associated task definition must have 'RequiresCompatibilities' specified with 'FARGATE' listed		Source	`resources`,`ecs`
E3055	Check CreationPolicy values for Resources	Check that the CreationPolicy values are valid		Source	`resources`,`creationPolicy`
E3057	Validate that CloudFront TargetOriginId is a specified Origin	CloudFront TargetOriginId has to map to an Origin Id that is in the same DistributionConfig		Source	`properties`,`cloudfront`
E3058	Validate at least one of the properties are required	Make sure at least one of the resource properties are included		Source	`resources`
E3059	Validate subnet CIDRs are within the CIDRs of the VPC	When specifying subnet CIDRs for a VPC the subnet CIDRs most be within the VPC CIDRs		Source	`resources`,`ec2`,`vpc`,`subnet`
E3060	Validate subnet CIDRs do not overlap with other subnets	When specifying subnet CIDRs for a VPC the subnet CIDRs most not overlap with eachother		Source	`resources`,`ec2`,`vpc`,`subnet`
E3061	Validate the days for tierings in IntelligentTieringConfigurations	When using AWS::S3::Bucket to configure IntelligentTieringConfigurations the Tierings have minimum and maximum values		Source	`resources`,`s3`
E3062	Validates RDS DB Instance Class based on Engine and EngineVersion	Validates the RDS DB instance types based on 'Engine' and 'EngineVersion'. 'EngineVersion' is based on the minor version.		Source	`resources`
E3501	Validate SQS queue properties are valid	Depending on if the queue is FIFO or not the properties and allowed values change. This rule validates properties and values based on the queue type.		Source	`resources`,`sqs`
E3502	Validate SQS DLQ queues are the same type	SQS queues using DLQ have to have the destination queue as the same type (FIFO or standard)		Source	`resources`,`sqs`
E3503	ValidationDomain is superdomain of DomainName	In ValidationDomainOptions, the ValidationDomain must be a superdomain of the DomainName being validated		Source	`certificate`,`certificatemanager`,`domainvalidationoptions`,`validationdomain`
E3504	Check minimum 90 period is met between BackupPlan cold and delete	Check that Backup plans with lifecycle rules have >= 90 days between cold and delete		Source	`properties`,`backup`,`plan`,`lifecycle`
E3505	Validate SQS 'VisibilityTimeout' is greater than a function's 'Timeout'	When attaching a Lambda function to a SQS queue to a Lambda function the SQS 'VisibilityTimeout' has to be greater than or equal to the lambda functions's 'Timeout'		Source	`resources`,`lambda`,`sqs`
E3510	Validate identity based IAM polices	IAM identity polices are embedded JSON in CloudFormation. This rule validates those embedded policies.		Source	`resources`,`iam`
E3511	Validate IAM role arn pattern	Validate an IAM role arn pattern matches		Source	`parameters`,`iam`
E3512	Validate resource based IAM polices	IAM resources polices are embedded JSON in CloudFormation. This rule validates those embedded policies.		Source	`resources`,`iam`
E3513	Validate ECR repository policy	Private ECR repositories have a policy. This rule validates those policies.		Source	`resources`,`iam`,`ecr`
E3514	Validate IAM resource policy resource ARNs	Validates an IAM resource policy has a compliant resource ARN		Source	`parameters`,`iam`
E3601	Validate the structure of a StateMachine definition	Validate the Definition or DefinitionString inside a AWS::StepFunctions::StateMachine resource		Source	`resources`,`statemachine`
E3615	Validate the period is a valid value	Valid values are 10, 30, 60, and any multiple of 60.		Source	`resources`,`cloudwatch`
E3617	Validate ManagedBlockchain instance type	Validates the ManagedBlockchain instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3620	Validate a DocDB DB Instance class	Validates the DocDB instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3621	Validate the instance types for AppStream Fleet	Validates the AppStream Fleet instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3628	Validate EC2 instance types based on region	Validates the EC2 instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3633	Validate Lambda event source mapping StartingPosition is used correctly	When 'EventSourceArn' is associate to Kinesis, Kafka, or DynamoDB you must specify 'StartingPosition		Source	`resources`
E3634	Validate Lambda event source mapping starting position is used with SQS	When 'EventSourceArn' is associated to SQS don't specify 'StartingPosition'		Source	`resources`
E3635	Validate Neptune DB instance class	Validates the instance types for Neptune DB based on region and data gathered from the pricing APIs		Source	`resources`
E3636	Validate CodeBuild projects using S3 also have Location	When using 'S3' for 'Type' then you must also specify 'Location'		Source	`resources`,`codebuild`
E3638	Validate DynamoDB BillingMode pay per request configuration	When 'BillingMode' is 'PAY_PER_REQUEST' don't specify 'ProvisionedThroughput'		Source	`resources`
E3639	When BillingMode is Provisioned you must specify ProvisionedThroughput	When 'BillingMode' is 'Provisioned' 'ProvisionedThroughput' is required		Source	`resources`
E3641	Validate GameLift Fleet EC2 instance type	Validates the GameLift Fleet EC2 instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3647	Validate ElastiCache cluster cache node type	Validates the ElastiCache instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3652	Validate Elasticsearch domain cluster instance	Validates the Elasticsearch instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3660	RestApi requires a name when not using an OpenAPI specification	When using AWS::ApiGateway::RestApi you have to provide 'Name' if you don't provide 'Body' or 'BodyS3Location'		Source	`resources`,`apigateway`
E3661	Validate Route53 health check has AlarmIdentifier when using CloudWatch	When 'Type' is 'CLOUDWATCH_METRIC' you must specify 'AlarmIdentifier'		Source	`resources`
E3663	Validate Lambda environment variable names aren't reserved	Lambda reserves a set of environment variable names for its use. This rule validates that the provided environment variable names don't use the reserved variable names		Source	`resources`,`lambda`,`runtime`
E3667	Validate RedShift cluster node type	Validates the RedShift instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3670	Validate the instance types for an AmazonMQ Broker	Validates the instance types for AmazonMQ broker based on region and data gathered from the pricing APIs		Source	`resources`
E3671	Validate block device mapping configuration	Certain volume types require Iops to be specified		Source	`resources`,`ec2`
E3672	Validate the cluster node type for a DAX Cluster	Validates the DAX cluster instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3673	Validate if an ImageId is required	Validate if an ImageID is required. It can be required if the associated LaunchTemplate doesn't specify an ImageID		Source	`resources`,`ec2`
E3674	Primary cannoy be True when PrivateIpAddress is specified	Only specify the private IP address for an instance in one spot		Source	`resources`,`ec2`
E3675	Validate EMR cluster instance type	Validates the EMR cluster instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3676	Validate ELBv2 protocols that require certificates have a certificate specified	When using HTTP or TLS you must specify a certificate		Source	`resources`
E3677	Validate Lambda using ZipFile requires an allowable runtime	Using the ZipFile attribute requires a javascript or python runtime to be specified		Source	`resources`
E3678	Using the ZipFile attribute requires a runtime to be specified	Using the ZipFile attribute requires a runtime to be specified		Source	`resources`
E3679	Validate ELB protocols that require certificates have a certificate specified	When using HTTPS or SSL you must provide a certificate		Source	`resources`
E3680	Application load balancers require at least 2 subnets			Source	`resources`
E3681	Validate target group target type property restrictions	When a TargetGroup target type is lambda or not there are different restrictions on properties.		Source	`resources`
E3682	Validate when using Aurora certain properies aren't required	When creating an aurora DBInstance don't specify 'AllocatedStorage', 'BackupRetentionPeriod', 'CopyTagsToSnapshot', 'DeletionProtection', 'EnableIAMDatabaseAuthentication', 'MasterUserPassword', or 'StorageEncrypted'		Source	`resources`
E3683	Validate target group protocol property restrictions	When a TargetGroup protocol is HTTP/HTTPS or GENEVE there are different restrictions on properties.		Source	`resources`
E3684	Validate target group health check protocol property restrictions	When a TargetGroup health check protocol is specified there are restrictions on other properties.		Source	`resources`
E3686	Validate allowed properties when using a serverless RDS DB cluster	Validate that when EngineMode is 'serverless' or 'provisioned' that the appropriate allowed properties are provided. If 'EngineMode' is not provided make sure serverless properties don't exist at all.		Source	`resources`
E3687	Validate to and from ports based on the protocol	When using icmp, icmpv6, tcp, or udp you have to specify the to and from port ranges		Source	`resources`
E3688	Validate that to and from ports are both -1	When ToPort or FromPort are -1 the other one must also be -1		Source	`resources`
E3689	Validate MonitoringInterval and MonitoringRoleArn are used together	When MonitoringInterval is greater than 0 you need to specify MonitoringRoleArn. If MonitoringRoleArn is specified MonitoringInterval has to be greather than 0.		Source	`resources`
E3690	Validate DB Cluster Engine and Engine Version	Validate the DB Cluster engine along with the engine version		Source	`resources`
E3691	Validate DB Instance Engine and Engine Version	Validate the DB Instance engine along with the engine version		Source	`resources`
E3692	Validate Multi-AZ DB cluster configuration	When creating a Multi-AZ DB Cluster there are required fields and the allowed values are different		Source	`resources`
E3693	Validate Aurora DB cluster configuration	When creating an Aurora DB Cluster there are required fields and the allowed values are different		Source	`resources`
E3694	Validates RDS DB Cluster instance class	Validates the RDS DB Cluster instance types based on region and data gathered from the pricing APIs		Source	`resources`
E3695	Validate Elasticache Cluster Engine and Engine Version	Validate the Elasticache cluster engine along with the engine version		Source	`resources`
E3700	Validate CodePipeline Source actions are only in the first stage	When using AWS::CodePipeline::Pipeline this rule will validate that Source actions are only used in the first stage		Source	`resources`,`codepipeline`
E3701	Validate input and output artifact names are used properly	When using AWS::CodePipeline::Pipeline InputArtifacts names have to be previously used OutputArtifact names. Additionally, the OutputArtifacts names have to be unique		Source	`resources`,`codepipeline`
E3702	Validate the number of input and output artifacts in a CodePipeline	When using AWS::CodePipeline::Pipeline action types have different contraints for InputArtifacts and OutputArtifacts		Source	`resources`,`codepipeline`
E3703	Validate the configuration of a pipeline action	When definition a CodePipeline certain action types have configuration constraints so this rule validates them		Source	`resources`,`codepipeline`
E4001	Metadata Interface have appropriate properties	Metadata Interface properties are properly configured		Source	`metadata`
E4002	Validate the configuration of the Metadata section	Validates that Metadata section is an object and has no null values		Source	`metadata`
E5001	Check that Modules resources are valid	Check that Modules resources are valid		Source	`resources`,`modules`
E6001	Check the properties of Outputs	Validate the property structure for outputs		Source	`outputs`
E6002	Outputs have required properties	Making sure the outputs have required properties		Source	`outputs`
E6003	Check the type of Outputs	Validate the type of properties in the Outputs section		Source	`outputs`
E6004	Outputs have appropriate names	Check if Outputs are properly named (A-Za-z0-9)		Source	`outputs`
E6005	Validate the Output condition is valid	Check the condition of an output to make sure it exists inside the template		Source	`outputs`,`conditions`
E6010	Output limit not exceeded	Check the number of Outputs in the template is less than the upper limit		Source	`outputs`,`limits`
E6011	Check property names in Outputs	Validate property names are property configured in Outputs		Source	`outputs`,`limits`
E6101	Validate that outputs values are a string	Make sure that output values have a type of string		Source	`outputs`
E6102	Validate that output exports have values of strings	Make sure output exports have a value of type string		Source	`outputs`
E7001	Mappings are appropriately configured	Check if Mappings are properly configured		Source	`mappings`
E7002	Check property names in Mappings	Validate property names are property configured in Mappings		Source	`mappings`,`limits`
E7010	Max number of properties for Mappings	Check the number of Mappings in the template is less than the upper limit		Source	`mappings`,`limits`
E8001	Conditions have appropriate properties	Check if Conditions are properly configured		Source	`conditions`
E8002	Check if the referenced Conditions are defined	Making sure the used conditions are actually defined in the Conditions section		Source	`conditions`
E8003	Check Fn::Equals structure for validity	Check Fn::Equals is a list of two elements		Source	`functions`,`equals`
E8004	Check Fn::And structure for validity	Check Fn::And is a list of two elements		Source	`functions`,`and`
E8005	Check Fn::Not structure for validity	Check Fn::Not is a list of one element		Source	`functions`,`not`
E8006	Check Fn::Or structure for validity	Check Fn::Or is a list of two elements		Source	`functions`,`or`
E8007	Check Condition structure for validity	Check Condition has a value of another condition		Source	`functions`,`condition`
I1002	Validate approaching the template size limit	Check the size of the template is approaching the upper limit		Source	`limits`
I1003	Validate if we are approaching the max size of a description	Check if the size of the template description is approaching the upper limit		Source	`description`,`limits`
I1022	Use Sub instead of Join	Prefer a sub instead of Join when using a join delimiter that is empty		Source	`functions`,`sub`,`join`
I2003	Validate AllowedPattern is a valid regexs	Validate the pattern defined in a AllowedPattern. This is informational as the service side regex library is different than the Python one		Source	`parameters`,`allowed pattern`
I2010	Parameter limit	Check the number of Parameters in the template is approaching the upper limit		Source	`parameters`,`limits`
I2011	Parameter name limit	Check the size of Parameter names in the template is approaching the upper limit		Source	`parameters`,`limits`
I2530	Validate that SnapStart is configured for >= Java11 runtimes	SnapStart is a no-cost feature that can increase performance up to 10x. Enable SnapStart for Java 11 and greater runtimes		Source	`resources`,`lambda`
I3010	Resource limit	Check the number of Resources in the template is approaching the upper limit		Source	`resources`,`limits`
I3011	Check stateful resources have a set UpdateReplacePolicy/DeletionPolicy	The default action when replacing/removing a resource is to delete it. This check requires you to explicitly set policies		Source	`resources`,`updatereplacepolicy`,`deletionpolicy`
I3012	Resource name limit	Check the size of Resource names in the template is approaching the upper limit		Source	`resources`,`limits`
I3013	Check resources with auto expiring content have explicit retention period	The behaviour for data retention is different across AWS Services.If no retention period is specified the default for some services is to delete the data after a period of time.This check requires you to explicitly set the retention period for those resources to avoid unexpected data losses		Source	`resources`,`retentionperiod`
I3037	Check if a list that allows duplicates has any duplicates	Certain lists support duplicate items.Provide an alert when list of strings or numbers have repeats.		Source	`resources`,`property`,`list`
I3042	ARNs should use correctly placed Pseudo Parameters	Checks Resources if ARNs use correctly placed Pseudo Parameters instead of hardcoded Partition, Region, and Account Number	partition:boolean:True region:boolean:False accountId:boolean:False	Source	`resources`
I3100	Checks for legacy instance type generations	New instance type generations increase performance and decrease cost		Source	`resources`,`ec2`,`rds`,`elasticcache`,`elasticsearch`
I3510	Validate statement resources match the actions	IAM policy statements have different constraints between actions and resources. This rule validates that resource ARNs or asterisks match the actions.		Source	`resources`,`iam`
I6010	Output limit	Check the number of Outputs in the template is approaching the upper limit		Source	`outputs`,`limits`
I6011	Output name limit	Check the size of Output names in the template is approaching the upper limit		Source	`outputs`,`limits`
I7002	Mapping name limit	Check the size of Mapping names in the template is approaching the upper limit		Source	`mappings`,`limits`
I7010	Mapping limit	Check the number of Mappings in the template is approaching the upper limit		Source	`mappings`,`limits`
W1001	Ref/GetAtt to resource that is available when conditions are applied	Check the Conditions that affect a Ref/GetAtt to make sure the resource being related to is available when there is a resource condition.		Source	`conditions`,`resources`,`relationships`,`ref`,`getatt`,`sub`
W1011	Instead of REFing a parameter for a secret use a dynamic reference	Instead of REFing a parameter for a secret use a dynamic reference. Solutions like SSM parameter store and secrets manager provide better security of sercrets		Source	`functions`,`dynamic reference`,`ref`
W1019	Validate that parameters to a Fn::Sub are used	Validate that Fn::Sub Parameters are used		Source	`functions`,`sub`
W1020	Sub isn't needed if it doesn't have a variable defined	Checks sub strings to see if a variable is defined.		Source	`functions`,`sub`
W1028	Check Fn::If has a path that cannot be reached	Check Fn::If path can be reached		Source	`functions`,`if`
W1030	Validate the values that come from a Ref function	Resolve the Ref and then validate the values against the schema		Source	`functions`,`ref`
W1031	Validate the values that come from a Fn::Sub function	Resolve the Fn::Sub and then validate the values against the schema		Source	`functions`,`sub`
W1032	Validate the values that come from a Fn::Join function	Resolve the Fn::Join and then validate the values against the schema		Source	`functions`,`join`
W1033	Validate the values that come from a Fn::Split function	Resolve the Fn::Split and then validate the values against the schema		Source	`functions`,`split`
W1034	Validate the values that come from a Fn::FindInMap function	Resolve the Fn::FindInMap and then validate the values against the schema		Source	`functions`,`findinmap`
W1035	Validate the values that come from a Fn::Select function	Resolve the Fn::Select and then validate the values against the schema		Source	`functions`,`select`
W1036	Validate the values that come from a Fn::GetAZs function	Resolve the Fn::GetAZs and then validate the values against the schema		Source	`functions`,`getazs`
W1040	Validate the values that come from a Fn::ToJsonString function	Resolve the Fn::ToJsonString and then validate the values against the schema		Source	`functions`,`tojsonstring`
W1051	Validate dynamic references to secrets manager are not used when a secrets manager ARN was expected	Certain properties expect a secret manager ARN. This rule validates if you may be accidently using a secret in place of the ARN		Source	`functions`,`dynamic reference`
W1100	Validate if the template is using YAML merge	The CloudFormation service does not support YAML anchors, aliases, or merging. This rule validates if the merge capability is being used		Source	`yaml`
W2001	Check if Parameters are Used	Making sure the parameters defined are used		Source	`parameters`
W2010	NoEcho parameters are not masked when used in Metadata and Outputs	Using the NoEcho attribute does not mask any information stored in the following: Metadata, Outputs, Resource Metadata		Source	`functions`,`dynamic reference`,`ref`
W2030	Check if parameters have a valid value	Check if parameters have a valid value in case of an enumator. The Parameter's allowed values is based on the usages in property (Ref)		Source	`parameters`,`resources`,`property`,`allowed value`
W2031	Check if parameters have a valid value based on an allowed pattern	Check if parameters have a valid value in a pattern. The Parameter's allowed pattern is based on the usages in property (Ref)		Source	`parameters`,`resources`,`property`,`pattern`
W2501	Check if Password Properties are correctly configured	Password properties should not be strings and if parameter using NoEcho		Source	`parameters`,`passwords`,`security`,`dynamic reference`
W2506	Check if ImageId Parameters have the correct type	See if there are any refs for ImageId to a parameter of inappropriate type. Appropriate Types are [AWS::EC2::Image::Id, AWS::SSM::Parameter::ValueAWS::EC2::Image::Id]		Source	`parameters`,`ec2`,`imageid`
W2511	Check IAM Resource Policies syntax	See if the elements inside an IAM Resource policy are configured correctly.		Source	`properties`,`iam`
W2530	Validate that SnapStart is properly configured	To properly leverage SnapStart, you must configure both the lambda function and attach a Lambda version resource		Source	`resources`,`lambda`
W2531	Check if EOL Lambda Function Runtimes are used	Check if an EOL Lambda Runtime is specified and give a warning if used.		Source	`resources`,`lambda`,`runtime`
W2533	Check required properties for Lambda if the deployment package is a .zip file	When the package type is Zip, you must also specify the `handler` and `runtime` properties.		Source	`resources`,`lambda`
W3002	Warn when properties are configured to only work with the package command	Some properties can be configured to only work with the CloudFormationpackage command. Warn when this is the case so user is aware.		Source	`resources`
W3005	Check obsolete DependsOn configuration for Resources	Check if DependsOn is specified if not needed. A Ref or a Fn::GetAtt already is an implicit dependency.		Source	`resources`,`dependson`,`ref`,`getatt`
W3010	Availability zone properties should not be hardcoded	Check if an Availability Zone property is hardcoded.		Source	`parameters`,`availabilityzone`
W3011	Check resources with UpdateReplacePolicy/DeletionPolicy have both	Both UpdateReplacePolicy and DeletionPolicy are needed to protect resources from deletion		Source	`resources`,`updatereplacepolicy`,`deletionpolicy`
W3034	Check if parameter values are between min and max	Check if parameter values value being between the minimum and maximum		Source	`resources`,`property`,`number`,`size`
W3037	Check IAM Permission configuration	Check for valid IAM Permissions		Source	`properties`,`iam`,`permissions`
W3045	Controlling access to an S3 bucket should be done with bucket policies	Nearly all access control configurations can be more successfully achieved with bucket policies. Consider using bucket policies instead of access control.		Source	`resources`,`s3`
W3660	Validate if multiple resources are modifying a Rest API definition	When using AWS::ApiGateway::RestApi with 'Body' or 'BodyS3Location' the resource handler will use PutRestApi with mode overwrite. Depending on how resources are updated the IaC template will drift and create orphaned resources.		Source	`resources`,`apigateway`
W3663	Validate SourceAccount is required property	When configuration a Lambda permission with a SourceArn that doesn't have an AccountId you should also specify the SourceAccount		Source	`resources`,`lambda`,`permission`
W3687	Validate that ports aren't specified for certain protocols	When using a protocol other than icmp, icmpv6, tcp, or udp the port ranges properties are ignored		Source	`resources`
W3688	When restoring DBCluster certain properties are ignored	When creating a DBCluster extra properties are ignored and could result in drift		Source	`resources`,`rds`
W3689	When using a source DB certain properties are ignored	When creating a DBCluster from a source certain properties are ignored and could result in drift		Source	`resources`,`rds`
W3693	Validate Aurora DB cluster configuration for ignored properties	When creating an Aurora DB Cluster there are fields that will allow for successful deployment but are ignored		Source	`resources`
W4001	Metadata Interface parameters exist	Metadata Interface parameters actually exist		Source	`metadata`
W4005	Validate cfnlint configuration in the Metadata	Metadata cfn-lint configuration has many values and we want to validate that		Source	`metadata`
W6001	Check Outputs using ImportValue	Check if the Output value is set using ImportValue, so creating an Output of an Output		Source	`outputs`,`importvalue`
W7001	Check if Mappings are Used	Making sure the mappings defined are used		Source	`mappings`
W8001	Check if Conditions are Used	Making sure the conditions defined are used		Source	`conditions`
W8003	Fn::Equals will always return true or false	Validate Fn::Equals to see if its comparing two strings or two equal items. While this works it may not be intended.		Source	`functions`,`equals`

* experimental rules

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!