Skip to content

refactor(misconf): propagate metadata through CF property chain#10759

Draft
nikpivkin wants to merge 2 commits into
aquasecurity:mainfrom
nikpivkin:refactor/cf-prop-metadata
Draft

refactor(misconf): propagate metadata through CF property chain#10759
nikpivkin wants to merge 2 commits into
aquasecurity:mainfrom
nikpivkin:refactor/cf-prop-metadata

Conversation

@nikpivkin
Copy link
Copy Markdown
Contributor

@nikpivkin nikpivkin commented May 29, 2026

Previously, Get*Property methods on Resource used resource-level metadata as fallback when a key was absent, so
misconfiguration findings would point to the resource root instead of the actual location in the template.

With metadata propagation through the chain, findings now point to the closest existing ancestor, which is semantically
more accurate.

The old behavior also masked a bug where incorrect property paths silently resolved by skipping
missing components — e.g. ResultConfiguration.EncryptionConfiguration.EncryptionOption would return the value of ResultConfiguration.EncryptionOption if EncryptionConfiguration did not exist.

  • GetProperty on Resource and Property now propagates parent metadata to the returned value when a key is absent
  • As*Value methods use the property's own metadata instead of requiring it as a parameter

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@nikpivkin nikpivkin force-pushed the refactor/cf-prop-metadata branch from fdce06d to cd50886 Compare May 29, 2026 11:12
@nikpivkin nikpivkin force-pushed the refactor/cf-prop-metadata branch from cd50886 to 3bb7037 Compare May 29, 2026 11:39
@nikpivkin nikpivkin added the scan/misconfiguration Issues relating to misconfiguration scanning label Jun 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

scan/misconfiguration Issues relating to misconfiguration scanning

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant