aws / aws/aws-sam-cli

Support immediate validation of parameter values on entry

Open
#3,244 2 comments 1 reaction 0 assignees View on GitHub
area/deploy type/feature
Dominant language
Python
Stars
6.7k
Forks
1.2k
Avg merge
1d 10h
Merged PRs (30d)
52

Description

It would be valuable to have immediate parameter value validation upon entry.

For example, a parameter may be defined in `template.yml` (e.g. as per the [official documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-masteruserpassword) for RDS password constraints):

```yaml
Parameters:
DBAdminPassword:
Description: Database admin password
Type: String
MinLength: 8
MaxLength: 128
AllowedPattern: "[^\\s@\"\\/]*"
ConstraintDescription: 'The password can include any printable ASCII character except "/", """, or "@".'
```

It would then be useful to have the value validated against both the implicit constraints and explicitly stated constraints upon entry:

```
$ sam deploy -g

Configuring SAM deploy
======================

Looking for config file [samconfig.toml] : Found
Reading default arguments : Success

Setting default arguments for 'sam deploy'
=========================================
Stack Name [myapp-backend]:
AWS Region [us-east-1]:
Parameter DBInstanceClass [db.t2.micro]:
Parameter DBPostgresVersion [12.7]:
Parameter DBAllocatedStorage [5]:
Parameter DBName [mydb]:
Parameter DBAdminUser [admin]:
Parameter DBAdminPassword [] (The password can include any printable ASCII character except "/", """, or "@".): ZCd)6Qyt~T^<"/\!3i,2L:&,&=*NzU#[

Invalid parameter value.

Parameter DBAdminPassword [] (The password can include any printable ASCII character except "/", """, or "@".):
```

The current behavior is to let the value pass until the deployment initiation phase, at which point the deployment attempt doesn't pass validation:

```
$ sam deploy -g

Configuring SAM deploy
======================

Looking for config file [samconfig.toml] : Found
Reading default arguments : Success

Setting default arguments for 'sam deploy'
=========================================
Stack Name [myapp-backend]:
AWS Region [us-east-1]:
Parameter DBInstanceClass [db.t2.micro]:
Parameter DBPostgresVersion [12.7]:
Parameter DBAllocatedStorage [5]:
Parameter DBName [mydb]:
Parameter DBAdminUser [admin]:
Parameter DBAdminPassword []: ZCd)6Qyt~T^<"/\!3i,2L:&,&=*NzU#[
#Shows you resources changes to be deployed and require a 'Y' to initiate deploy
Confirm changes before deploy [y/N]:
#SAM needs permission to be able to create roles to connect to the resources in your template
Allow SAM CLI IAM role creation [Y/n]:
Save arguments to configuration file [Y/n]:
SAM configuration file [samconfig.toml]:
SAM configuration environment [default]:

Looking for resources needed for deployment: Found!

Managed S3 bucket: aws-sam-cli-managed-default-samclisourcebucket-hw20z48xixco
A different default S3 bucket can be set in samconfig.toml

Saved arguments to config file
Running 'sam deploy' for future deployments will use the parameters saved above.
The above parameters can be changed by modifying samconfig.toml
Learn more about samconfig.toml syntax at
https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-config
.html

Uploading to myapp-backend/c26270266b2546e105a4b9588ceed669 248067 / 248067 (100.00%)
Uploading to myapp-backend/611706200045c2015244856d552824b0 620 / 620 (100.00%)
Uploading to myapp-backend/99beaacc5f7faa76fe3d48e90ce9ab52 870 / 870 (100.00%)
Uploading to myapp-backend/fd4d6f52df1662f7622eb7a73ba31c77 630 / 630 (100.00%)

Deploying with following values
===============================
Stack name : myapp-backend
Region : us-east-1
Confirm changeset : False
Deployment s3 bucket : aws-sam-cli-managed-default-samclisourcebucket-hw20z48xixco
Capabilities : ["CAPABILITY_IAM"]
Parameter overrides : {"DBInstanceClass": "db.t2.micro", "DBPostgresVersion": "12.7", "DBAllocatedStorage": "5", "DBName": "mydb", "DBAdminUser": "admin", "DBAdminPassword": "ZCd)6Qyt~T^<\"/\\!3i,2L:&,&=*NzU#["}
Signing Profiles : {}

Initiating deployment
=====================
Uploading to myapp-backend/26a34904b77c7349a000bd41c640542f.template 7825 / 7825 (100.00%)
Error: Failed to create changeset for the stack: myapp-backend, An error occurred (ValidationError) when calling the CreateChangeSet operation: Parameter DBAdminPassword failed to satisfy constraint: The password can include any printable ASCII character except "/", """, or "@".
```

This is a noticeable inconvenience.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.