foreach false negative

[whoDoneItAgain]

CloudFormation Lint Version

1.28

What operating system are you using?

windows

Describe the bug

the code lints without error and validates via validate-template but fails to create the stack.

error is: Transform AWS::LanguageExtensions failed with: Fn::If layout is incorrect.

i have isolated the issue to conditional properties of resources created in the foreach.

in the code snippet, cloudformation doesn't like the conditions on the IOPS and Throughput properties.

this snippet does through an error for the availability zone. my actual template pulls that in as a parameter.

Expected behavior

Error thrown. really i'm hoping its user error. i've tried multiple variations but all fail or throw a lint error.

Reproduction template

AWSTemplateFormatVersion: '2010-09-09'
Description: This AWS CloudFormation template deploys EC2 Additional Volumes

Transform:
  - AWS::LanguageExtensions

Parameters:
  # Additional EBS Volume
  AdditionalVolume1:
    Description: "Additional Volume 1. Syntax: DeviceId,VolumeType,VolumeSize,VolumeIops,VolumeThroughput. Ex. 'xvdf,gp3,250,3000,125'"
    Type: CommaDelimitedList
    Default: '-,-'

  AdditionalVolume2:
    Description: "Additional Volume 2.Syntax: DeviceId,VolumeType,VolumeSize,VolumeIops,VolumeThroughput. Ex. 'xvdf,gp3,250,3000,125'"
    Type: CommaDelimitedList
    Default: '-,-'

  AdditionalVolume3:
    Description: "Additional Volume 3.Syntax: DeviceId,VolumeType,VolumeSize,VolumeIops,VolumeThroughput. Ex. 'xvdf,gp3,250,3000,125'"
    Type: CommaDelimitedList
    Default: '-,'

Conditions:
  'Fn::ForEach::ConditionAdditionalVolume':
    - Identifier
    - ['1', '2', '3']
    - 'ConditionAdditionalVolume${Identifier}': !Not
        - !Equals
          - !Select
            - 0
            - !Ref
              'Fn::Sub': 'AdditionalVolume${Identifier}'
          - '-'

      'ConditionAdditionalVolumeIops${Identifier}': !Or
        - !Equals
          - !Select
            - 1
            - !Ref
              'Fn::Sub': 'AdditionalVolume${Identifier}'
          - gp3
        - !Equals
          - !Select
            - 1
            - !Ref
              'Fn::Sub': 'AdditionalVolume${Identifier}'
          - io1
        - !Equals
          - !Select
            - 1
            - !Ref
              'Fn::Sub': 'AdditionalVolume${Identifier}'
          - io2

      'ConditionAdditionalVolumeThroughput${Identifier}': !Equals
        - !Select
          - 1
          - !Ref
            'Fn::Sub': 'AdditionalVolume${Identifier}'
        - gp3

Resources:
  'Fn::ForEach::AdditionalVolume':
    - Identifier
    - ['1', '2', '3']
    - 'AdditionalEbsVolume${Identifier}':
        Type: AWS::EC2::Volume
        Condition: !Sub 'ConditionAdditionalVolume${Identifier}'
        DeletionPolicy: Delete
        UpdateReplacePolicy: Delete
        Properties:
          AvailabilityZone: us-east-1a
          Encrypted: true
          Iops: !If
            - !Sub 'ConditionAdditionalVolumeIops${Identifier}'
            - 3000
            - !Ref AWS::NoValue
          KmsKeyId: abcd
          Size: !Select
            - 2
            - !Ref
              'Fn::Sub': AdditionalVolume${Identifier}
          Throughput: !If
            - !Sub 'ConditionAdditionalVolumeThroughput${Identifier}'
            - 125
            - !Ref AWS::NoValue
          VolumeType: !Select
            - 1
            - !Ref
              'Fn::Sub': AdditionalVolume${Identifier}

[kddejong]

I was able to replicate this... looking into it. Makes me wonder if this is a language extension bug or not as my first review makes me think that this should be good.

[kddejong]

Okay, I think the issue has to do with the Fn::If not resolving the condition name [Fn::If, 0].

So this is a simpler reproduction.

Transform:
  - AWS::LanguageExtensions

Conditions:
  'Fn::ForEach::Number':
    - Identifier
    - ['1']
    - 'Condition${Identifier}': !Not
        - !Equals
          - '-'
          - '-'

Resources:
  'Fn::ForEach::Number':
    - Identifier
    - ['1']
    - 'Condition${Identifier}':
        Type: AWS::SSM::Parameter
        Properties:
          Type: String
          Value:
            Fn::If:
            - !Sub 'Condition${Identifier}'
            - 1
            - 2   

We could just disable function resolution in that path. This seems similar to aws-cloudformation/cfn-language-discussion#147

[kddejong]

@whoDoneItAgain is this a bug to the language extension? I can match it but this seems like something that should be handled correctly?

[whoDoneItAgain]

@kddejong im not sure. Cfnlint doesn't catch anything in vscode or cli. I only know there's a problem with the template when I try and deploy in cloudformation. I can provide the exact cloudformation output tomorrow.