aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Rules support for asserting regular expression match

Open
#1,640 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

Other

### Resource name

_No response_

### Description

CloudFormation rules has a function `Fn::Contains` ([ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-rules.html#fn-contains)) to validate that a string is in a list of allowed values. This is great, but is limited to exact string matches, so all valid inputs must be provided in the list.

It would be useful to be able to have a `Fn::Matches` intrinsic function (or similar) that rules could use to match a string against a list of allowable patterns, so that template designers can set boundaries without needing to have an exhaustive list of possible inputs.

For example, the template below illustrates a rule that asserts that the input parameter `AccountEmail` must end in `@example.com`. It's infeasible\[citation needed] to provide a template enumerating all possible allowed email addresses, but a pattern would do the trick easily.

Prefer to be able to provide a list of patterns for consistency with `Fn::Contains` and pattern legibility; it would of course be possible to write a single-pattern equivalent with `|` separators, but it would be easier to write (and read) separate patterns.

```yaml
AWSTemplateFormatVersion: "2010-09-09"

Parameters:
AccountEmail:
Type: String
Default: example@example.net

Rules:
"Force example.com email domain":
Assertions:
- Assert:
Fn::Matches:
# This does not work, wish it did!
- ["^[^@]+@example\\.com$"]
- !Ref AccountEmail
AssertDescription: "Email domain must be example.com"

Resources:
DummyResource:
Type: AWS::CloudFormation::WaitConditionHandle
Properties: {}
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

The issue names CloudFormation Rules and the Fn::Contains documentation but no repository files, tests, or implementation entry point. Start by reviewing the linked Rules reference and existing intrinsic-function behavior; done would be a defined and supported regex-matching intrinsic for rule assertions.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.