aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Rules support for asserting regular expression match
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
Other
### Resource name
_No response_
### Description
CloudFormation rules has a function `Fn::Contains` ([ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-rules.html#fn-contains)) to validate that a string is in a list of allowed values. This is great, but is limited to exact string matches, so all valid inputs must be provided in the list.
It would be useful to be able to have a `Fn::Matches` intrinsic function (or similar) that rules could use to match a string against a list of allowable patterns, so that template designers can set boundaries without needing to have an exhaustive list of possible inputs.
For example, the template below illustrates a rule that asserts that the input parameter `AccountEmail` must end in `@example.com`. It's infeasible\[citation needed] to provide a template enumerating all possible allowed email addresses, but a pattern would do the trick easily.
Prefer to be able to provide a list of patterns for consistency with `Fn::Contains` and pattern legibility; it would of course be possible to write a single-pattern equivalent with `|` separators, but it would be easier to write (and read) separate patterns.
```yaml
AWSTemplateFormatVersion: "2010-09-09"
Parameters:
AccountEmail:
Type: String
Default: example@example.net
Rules:
"Force example.com email domain":
Assertions:
- Assert:
Fn::Matches:
# This does not work, wish it did!
- ["^[^@]+@example\\.com$"]
- !Ref AccountEmail
AssertDescription: "Email domain must be example.com"
Resources:
DummyResource:
Type: AWS::CloudFormation::WaitConditionHandle
Properties: {}
```
### Other Details
_No response_
Contributor guide
Research direction
The issue names CloudFormation Rules and the Fn::Contains documentation but no repository files, tests, or implementation entry point. Start by reviewing the linked Rules reference and existing intrinsic-function behavior; done would be a defined and supported regex-matching intrinsic for rule assertions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100