aws-cloudformation / aws-cloudformation/cfn-lint

Feature request: Custom rules to require a property be set

Open
#2,185 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2.6k
Forks
643
Avg merge
1d 19h
Merged PRs (30d)
41

Description

*cfn-lint version: 0.56.0*

*Description of issue.*
Custom rules can restrict the value of a property but if it's not set they are ignored.

I wanted to set a rule to ensure all SQS queues have are encrypted, ie:
```
AWS::SQS::Queue KmsMasterKeyId != "" WARN "Queues should always be encrypted"
```
However this doesn't work, because if you don't pass the property at all, then the custom rule is ignored.
I can image a bunch of similar use cases just requiring encryption across all services.

Contributor guide

Open the contributing guide

Research direction

No file or test is named in the issue. Start by locating cfn-lint's custom-rule evaluation and existing tests for property-value restrictions; verify that a rule can detect an omitted KmsMasterKeyId on AWS::SQS::Queue and that the warning is emitted as requested.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
security, tooling
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.