E3012 false positive when Fn::If guards a String-typed parameter used in an integer context

[hoganbr-amzn]

CloudFormation Lint Version

1.52.1

What operating system are you using?

Mac

Describe the bug

Rule E3012 reports a type error when a Ref to a String-typed parameter is used where an integer is expected, even when the code path is guarded by an Fn::If condition that ensures the value is only evaluated when it contains a numeric string. CloudFormation accepts numeric strings in integer-typed properties and deploys successfully.

This pattern is common when a parameter serves dual purpose, with Fn::If + AWS::NoValue removing the property entirely when active.

Expected behavior

No error should be reported in this case as the condition prevents a non-integer value.

Reproduction template

Parameters:
  MyCapacity:
    Type: String
    AllowedPattern: "\\d+|auto"
    Default: "auto"

Conditions:
  UseProvisionedCapacity:
    !Not [!Equals [!Ref MyCapacity, "auto"]]

Resources:
  MyTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: Example
      KeySchema:
        - { AttributeName: id, KeyType: HASH }
      AttributeDefinitions:
        - { AttributeName: id, AttributeType: S }
      ProvisionedThroughput:
        !If
          - UseProvisionedCapacity
          - ReadCapacityUnits: !Ref MyCapacity
            WriteCapacityUnits: !Ref MyCapacity
          - !Ref "AWS::NoValue"

cfn-lint output:

E3012 'auto' is not of type 'integer'

[kddejong]

Thank you for reporting this issue. I was unable to reproduce the E3012 error using the provided template with cfn-lint 1.53.0 (or with strict mode enabled). The template lints cleanly with a default configuration.

Could you provide some additional details to help us reproduce?

1. Do you have a .cfnlintrc or .cfnlintrc.yml configuration file? If so, could you share its contents?
2. Are you running cfn-lint with any additional flags (e.g., --configure-rule, --strict, etc.)?
3. Is the exact template you shared the one that fails, or is it a simplified version of a larger template?

Any additional context would help us track this down.

[hoganbr-amzn]

@kddejong this was a simplified template, the original template also included 2 Transforms that when I added back to the simplified template reproduced the issue using version 1.52.1 of cfn-lint with no configuration or arguments:

AWSTemplateFormatVersion: "2010-09-09"
Transform:
  - AWS::LanguageExtensions
  - AWS::Serverless-2016-10-31

Parameters:
  MyCapacity:
    Type: String
    AllowedPattern: "\\d+|auto"
    Default: "auto"

Conditions:
  UseOnDemand:
    !Equals [!Ref MyCapacity, "auto"]
  UseProvisioned:
    !Not [!Equals [!Ref MyCapacity, "auto"]]

Resources:
  MyTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: Example
      KeySchema:
        - { AttributeName: id, KeyType: HASH }
      AttributeDefinitions:
        - { AttributeName: id, AttributeType: S }
      BillingMode:
        !If
          - UseOnDemand
          - PAY_PER_REQUEST
          - PROVISIONED
      ProvisionedThroughput:
        !If
          - UseOnDemand
          - !Ref "AWS::NoValue"
          - ReadCapacityUnits: !Ref MyCapacity
            WriteCapacityUnits: 50

  MyScalableTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    Condition: UseProvisioned
    Properties:
      MaxCapacity: 1000
      MinCapacity: !Ref MyCapacity
      ResourceId: !Sub "table/${MyTable}"
      RoleARN: !Sub "arn:aws:iam::${AWS::AccountId}:role/autoscaling"
      ScalableDimension: "dynamodb:table:ReadCapacityUnits"
      ServiceNamespace: dynamodb

Output:

cfn-lint /tmp/template.yml
E3012 'auto' is not of type 'integer'
/tmp/template.yml:36:13

E3012 'auto' is not of type 'integer'
/tmp/template.yml:44:7

[kddejong]

Thanks for the extra detail — the two Transform entries were the missing piece. I can now reproduce this, and importantly it only reproduces when both AWS::LanguageExtensions and AWS::Serverless-2016-10-31 are present. With either transform alone (or neither), the template lints clean — which is why the simplified template in the original report didn't reproduce for me.

Root cause: the SAM transform module (_sam.py) contains a step that, when AWS::LanguageExtensions is also declared, replaces every {"Ref": <param>} in Resources with that parameter's Default value. So !Ref MyCapacity gets rewritten to the literal "auto" inside the integer-typed fields, while the Conditions still reference {"Ref": "MyCapacity"}. That severs the link E3012's condition-satisfiability logic needs, so it sees a hard "auto" in an integer field and errors — even though the guarding Fn::If/Condition means "auto" never actually reaches that field at deploy time.

Fix: this is resolved by #4491, which removes the SAM translator dependency (and the _sam.py Ref-inlining behavior) in favor of schema-based SAM validation. I verified against that branch:

• The template above (both transforms) → lints clean ✅
• The !Ref is preserved instead of being inlined to "auto", so the condition guard is honored — same as a non-transformed template
• E3012 still correctly fires on a genuine hard-literal type error (e.g. ReadCapacityUnits: "auto"), so detection isn't weakened

#4491 is still open, so this will land when that PR merges. I'll keep this issue open and linked until then.