Skip to content

Correct EventBridge pseudo and numeric pattern handling #475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
satyakigh merged 1 commit into from
Oct 21, 2026
Merged

Correct EventBridge pseudo and numeric pattern handling #475

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions scripts/snapshots/rule_categorization_audit.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,13 @@ severity model documented in `product.md`.

## Summary

- Total rules: **317**
- By severity: Fatal=69, Error=153, Warn=72, Info=23
- By true origin: CfnLint=218, Engine=29, Engine(collision)=1, Schema=69
- By category: BestPractice=59, Deprecation=8, Intrinsic=52, Parameter=8, Reference=2, Resource=92, Schema=25, Security=14, Structure=57
- Total rules: **318**
- By severity: Fatal=69, Error=154, Warn=72, Info=23
- By true origin: CfnLint=218, Engine=30, Engine(collision)=1, Schema=69
- By category: BestPractice=59, Deprecation=8, Intrinsic=52, Parameter=8, Reference=2, Resource=93, Schema=25, Security=14, Structure=57
- cfn-lint reference: 329 rule IDs loaded
- E→F promoted rules: 51
- Engine-extra rules: 60
- Engine-extra rules: 61

## 1. Origin correctness

Expand Down Expand Up @@ -301,7 +301,7 @@ with `cargo test -p cfn-validate --test engine_parity` for ground truth.

**CEL only (4):** `E3023`, `E3024`, `E3510`, `W2530`

_Scanned 257 CEL sites (197 IDs), 282 Rego sites (193 IDs)._
_Scanned 258 CEL sites (198 IDs), 283 Rego sites (194 IDs)._

## Appendix: full rule inventory

Expand Down Expand Up @@ -458,6 +458,7 @@ _Scanned 257 CEL sites (197 IDs), 282 Rego sites (193 IDs)._
| `E9003` | Error | Intrinsic | CfnLint | CfnLint | GetAtt return type may not match usage context |
| `E9004` | Error | Intrinsic | Schema ⚠ | CfnLint | GetAtt attribute must exist on target resource type |
| `E9006` | Error | Schema | CfnLint | CfnLint | Property value not valid for conditional extension enum |
| `E9014` | Error | Resource | Engine | Engine | EventBridge rule and archive EventPattern must use valid matchers |
| `E9101` | Error | Intrinsic | Schema ⚠ | Engine | Invalid nesting of intrinsic functions |
| `E9106` | Error | Structure | Schema ⚠ | Engine | Circular dependency in condition definitions |
| `F0000` | Fatal | Structure | Schema | Schema | Duplicate key in template |
Expand Down
2 changes: 1 addition & 1 deletion src/cel-engine/tests/conformance.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ Resources:
fn invalid_event_patterns_trigger_e9014_once_per_rejected_matcher() {
let ids = validate_file("bad/E9014_invalid_event_patterns.yaml");
let event_pattern_findings = ids.iter().filter(|rule_id| rule_id.as_str() == "E9014").count();
assert_eq!(event_pattern_findings, 29, "Expected one E9014 per rejected pattern shape, got: {ids:?}");
assert_eq!(event_pattern_findings, 34, "Expected one E9014 per rejected pattern shape, got: {ids:?}");
}

#[test]
Expand Down
32 changes: 30 additions & 2 deletions src/cfn-validate/tests/resource_rule_parity.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2410,7 +2410,11 @@ fn invalid_event_patterns_have_identical_precise_diagnostics() {
"Properties.EventPattern.detail.price.0.numeric",
"must contain two or four elements",
),
("EqualNumericBoundsRule", "Properties.EventPattern.detail.price.0.numeric", "cannot match any value"),
(
"EqualNumericBoundsRule",
"Properties.EventPattern.detail.price.0.numeric",
"must have a lower bound strictly less than its upper bound",
),
(
"AnythingButMixedValuesRule",
"Properties.EventPattern.detail.state.0.anything-but",
Expand All @@ -2437,6 +2441,27 @@ fn invalid_event_patterns_have_identical_precise_diagnostics() {
("EmptyObjectRule", "Properties.EventPattern.detail", "must not be an empty object"),
("NestedMatchArrayRule", "Properties.EventPattern.source.0", "must be a scalar value or a matcher object"),
("ParameterWithInvalidSiblingRule", "Properties.EventPattern.detail.state", "is an empty array"),
("ScalarPseudoParameterRule", "Properties.EventPattern.source", "must be an array or an object"),
(
"PseudoNumericOperandRule",
"Properties.EventPattern.detail.account.0.numeric.1",
"must be a finite number whose decimal value is preserved as a 64-bit double",
),
(
"NestedNotificationArnsRule",
"Properties.EventPattern.resources.0",
"must be a scalar value or a matcher object",
),
(
"NotificationArnsPrefixRule",
"Properties.EventPattern.detail.topic.0.prefix",
"must be a string or an equals-ignore-case object containing one string",
),
(
"NonRepresentableNumericRule",
"Properties.EventPattern.detail.price.0.numeric.1",
"must be a finite number whose decimal value is preserved as a 64-bit double",
),
("NestedScalarArchive", "Properties.EventPattern.detail.a.b.c", "must be an array or an object"),
];
assert_eq!(rego_findings.len(), expected.len(), "one finding per rejected pattern shape: {rego_findings:?}");
Expand All @@ -2460,7 +2485,10 @@ fn valid_and_unresolved_event_patterns_are_not_reported() {
let rego_findings = selected_findings(&rego, template, &["E9014"]);
let cel_findings = selected_findings(&cel, template, &["E9014"]);
assert_eq!(rego_findings, cel_findings);
assert!(rego_findings.is_empty(), "every matcher here is accepted by EventBridge: {rego_findings:?}");
assert!(
rego_findings.is_empty(),
"valid and deployment-controlled event patterns must not be reported: {rego_findings:?}"
);
}

#[test]
Expand Down
2 changes: 1 addition & 1 deletion src/rego-engine/tests/integration.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -872,7 +872,7 @@ fn e2e_e9014_invalid_event_patterns() {
let report = validate_fixture("bad/E9014_invalid_event_patterns.yaml");
let event_pattern_findings = report.diagnostics.iter().filter(|diagnostic| diagnostic.rule_id == "E9014").count();
assert_eq!(
event_pattern_findings, 29,
event_pattern_findings, 34,
"Expected one E9014 per rejected pattern shape, got: {:?}",
report.diagnostics
);
Expand Down
224 changes: 212 additions & 12 deletions src/resources/expected/validation_reports1.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7859,12 +7859,12 @@
"filePath": "bad/E9014_invalid_event_patterns.yaml",
"status": "OK",
"metadata": {
"resourcesScanned": 30,
"resourcesScanned": 35,
"counts": {
"fatal": 0,
"errors": 29,
"errors": 34,
"warnings": 0,
"informational": 31,
"informational": 36,
"debug": 0
},
"suppressed": 0,
Expand Down Expand Up @@ -8135,7 +8135,7 @@
{
"ruleId": "E9014",
"severity": "ERROR",
"message": "numeric range in 'EventPattern.detail.price[0]' cannot match any value",
"message": "numeric range in 'EventPattern.detail.price[0]' must have a lower bound strictly less than its upper bound",
"source": "ENGINE",
"entity": {
"logicalId": "EqualNumericBoundsRule",
Expand Down Expand Up @@ -8432,6 +8432,106 @@
"ruleDescription": "EventBridge rule and archive EventPattern must use valid matchers",
"phase": "LINT"
},
{
"ruleId": "E9014",
"severity": "ERROR",
"message": "'EventPattern.source' must be an array or an object",
"source": "ENGINE",
"entity": {
"logicalId": "ScalarPseudoParameterRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.EventPattern.source",
"suggestedFix": "Wrap the value in an array",
"category": "Resource",
"startLine": 205,
"startColumn": 9,
"endLine": 205,
"endColumn": 15,
"ruleDescription": "EventBridge rule and archive EventPattern must use valid matchers",
"phase": "LINT"
},
{
"ruleId": "E9014",
"severity": "ERROR",
"message": "numeric comparison value in 'EventPattern.detail.account[0]' must be a finite number whose decimal value is preserved as a 64-bit double",
"source": "ENGINE",
"entity": {
"logicalId": "PseudoNumericOperandRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.EventPattern.detail.account.0.numeric.1",
"suggestedFix": "Use a finite number whose decimal value is preserved as a 64-bit double",
"category": "Resource",
"startLine": 212,
"startColumn": 42,
"endLine": 212,
"endColumn": 43,
"ruleDescription": "EventBridge rule and archive EventPattern must use valid matchers",
"phase": "LINT"
},
{
"ruleId": "E9014",
"severity": "ERROR",
"message": "'EventPattern.resources[0]' must be a scalar value or a matcher object",
"source": "ENGINE",
"entity": {
"logicalId": "NestedNotificationArnsRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.EventPattern.resources.0",
"suggestedFix": "Use a scalar value or an object containing exactly one matcher operator",
"category": "Resource",
"startLine": 218,
"startColumn": 26,
"endLine": 218,
"endColumn": 27,
"ruleDescription": "EventBridge rule and archive EventPattern must use valid matchers",
"phase": "LINT"
},
{
"ruleId": "E9014",
"severity": "ERROR",
"message": "prefix in 'EventPattern.detail.topic[0]' must be a string or an equals-ignore-case object containing one string",
"source": "ENGINE",
"entity": {
"logicalId": "NotificationArnsPrefixRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.EventPattern.detail.topic.0.prefix",
"suggestedFix": "Use a string or an object containing only equals-ignore-case with a string value",
"category": "Resource",
"startLine": 225,
"startColumn": 20,
"endLine": 225,
"endColumn": 26,
"ruleDescription": "EventBridge rule and archive EventPattern must use valid matchers",
"phase": "LINT"
},
{
"ruleId": "E9014",
"severity": "ERROR",
"message": "numeric comparison value in 'EventPattern.detail.price[0]' must be a finite number whose decimal value is preserved as a 64-bit double",
"source": "ENGINE",
"entity": {
"logicalId": "NonRepresentableNumericRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.EventPattern.detail.price.0.numeric.1",
"suggestedFix": "Use a finite number whose decimal value is preserved as a 64-bit double",
"category": "Resource",
"startLine": 232,
"startColumn": 35,
"endLine": 232,
"endColumn": 36,
"ruleDescription": "EventBridge rule and archive EventPattern must use valid matchers",
"phase": "LINT"
},
{
"ruleId": "E9014",
"severity": "ERROR",
Expand All @@ -8445,9 +8545,9 @@
"propertyPath": "Properties.EventPattern.detail.a.b.c",
"suggestedFix": "Wrap the value in an array",
"category": "Resource",
"startLine": 212,
"startLine": 245,
"startColumn": 15,
"endLine": 212,
"endLine": 245,
"endColumn": 16,
"ruleDescription": "EventBridge rule and archive EventPattern must use valid matchers",
"phase": "LINT"
Expand All @@ -8464,9 +8564,9 @@
},
"propertyPath": "Properties.Name",
"category": "Best Practice",
"startLine": 203,
"startLine": 236,
"startColumn": 7,
"endLine": 203,
"endLine": 236,
"endColumn": 11,
"documentationUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-events",
"ruleDescription": "Create-only property updated triggers resource replacement",
Expand All @@ -8487,9 +8587,9 @@
},
"propertyPath": "Properties.SourceArn",
"category": "Best Practice",
"startLine": 207,
"startLine": 240,
"startColumn": 7,
"endLine": 207,
"endLine": 240,
"endColumn": 16,
"ruleDescription": "Create-only property updated triggers resource replacement",
"phase": "SCHEMA",
Expand Down Expand Up @@ -9058,6 +9158,106 @@
"ruleDescription": "Resource should have Tags",
"phase": "LINT"
},
{
"ruleId": "I9040",
"severity": "INFO",
"message": "Resource 'ScalarPseudoParameterRule' of type 'AWS::Events::Rule' supports Tags but none are configured",
"source": "ENGINE",
"entity": {
"logicalId": "ScalarPseudoParameterRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.Tags",
"suggestedFix": "Add Tags to improve resource organization and cost tracking",
"category": "Best Practice",
"startLine": 202,
"startColumn": 5,
"endLine": 202,
"endColumn": 15,
"ruleDescription": "Resource should have Tags",
"phase": "LINT"
},
{
"ruleId": "I9040",
"severity": "INFO",
"message": "Resource 'PseudoNumericOperandRule' of type 'AWS::Events::Rule' supports Tags but none are configured",
"source": "ENGINE",
"entity": {
"logicalId": "PseudoNumericOperandRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.Tags",
"suggestedFix": "Add Tags to improve resource organization and cost tracking",
"category": "Best Practice",
"startLine": 208,
"startColumn": 5,
"endLine": 208,
"endColumn": 15,
"ruleDescription": "Resource should have Tags",
"phase": "LINT"
},
{
"ruleId": "I9040",
"severity": "INFO",
"message": "Resource 'NestedNotificationArnsRule' of type 'AWS::Events::Rule' supports Tags but none are configured",
"source": "ENGINE",
"entity": {
"logicalId": "NestedNotificationArnsRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.Tags",
"suggestedFix": "Add Tags to improve resource organization and cost tracking",
"category": "Best Practice",
"startLine": 215,
"startColumn": 5,
"endLine": 215,
"endColumn": 15,
"ruleDescription": "Resource should have Tags",
"phase": "LINT"
},
{
"ruleId": "I9040",
"severity": "INFO",
"message": "Resource 'NotificationArnsPrefixRule' of type 'AWS::Events::Rule' supports Tags but none are configured",
"source": "ENGINE",
"entity": {
"logicalId": "NotificationArnsPrefixRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.Tags",
"suggestedFix": "Add Tags to improve resource organization and cost tracking",
"category": "Best Practice",
"startLine": 221,
"startColumn": 5,
"endLine": 221,
"endColumn": 15,
"ruleDescription": "Resource should have Tags",
"phase": "LINT"
},
{
"ruleId": "I9040",
"severity": "INFO",
"message": "Resource 'NonRepresentableNumericRule' of type 'AWS::Events::Rule' supports Tags but none are configured",
"source": "ENGINE",
"entity": {
"logicalId": "NonRepresentableNumericRule",
"entityType": "Resource",
"resourceType": "AWS::Events::Rule"
},
"propertyPath": "Properties.Tags",
"suggestedFix": "Add Tags to improve resource organization and cost tracking",
"category": "Best Practice",
"startLine": 228,
"startColumn": 5,
"endLine": 228,
"endColumn": 15,
"ruleDescription": "Resource should have Tags",
"phase": "LINT"
},
{
"ruleId": "I9040",
"severity": "INFO",
Expand All @@ -9071,9 +9271,9 @@
"propertyPath": "Properties.Tags",
"suggestedFix": "Add Tags to improve resource organization and cost tracking",
"category": "Best Practice",
"startLine": 202,
"startLine": 235,
"startColumn": 5,
"endLine": 202,
"endLine": 235,
"endColumn": 15,
"ruleDescription": "Resource should have Tags",
"phase": "LINT"
Expand Down
Loading
Loading