Rules

Rule levels

A rule returns feedback on a specific level: Error, Warning or Informational.

Errors

Errors will start with the letter E. Errors will (or can) result in a hard failure for the template being validated.

Warnings

Warnings start with the letter W. Warnings alert you when the template doesn't follow best practices but should still function. Example: If you use a parameter for a RDS master password you should have the parameter property NoEcho set to true.

Informational

Informational results start with the letter I. Informational alert you when the template doesn't follow best practices, just like the Warnings, but in a non-blocking way. The Informational level is disabled by default and has to be enabled explicitly using -c I or --include-checks I.

Categories

Rule Numbers	Category
(E|W|I)0XXX	Basic Template Errors. Examples: Not parseable, main sections (Outputs, Resources, etc.)
(E|W|I)1XXX	Functions (Ref, GetAtt, etc.)
(E|W|I)2XXX	Parameters
(E|W|I)3XXX	Resources
(E|W|I)4XXX	Metadata
(E|W|I)6xxx	Outputs
(E|W|I)7xxx	Mappings
(E|W|I)8xxx	Conditions
(E|W|I)9xxx	Reserved for users rules

Warning Rule E3012 is used to check the types for value of a resource property. A number is a number, string is a string, etc. There are occasions where this could be just a warning and other times it could be an error. cfn-lint doesn't have an exception process so all instances of this issue are considered errors. You can disable this rule using --ignore-checks if it is not required for your internal best practices. Conversely, strict typing is NOT enforced by default for this rule, so if strict adherence to resource value types is necessary for your use case, you can use --configure-rule E3012:strict=true to enforce the rule.

Experimental rules

Sometimes there are (new) rules that might be complex, that doesn't have enough solid test templates and examples and/or might have unexpected results. We support adding in these rules so they can be tested, tweaked and improved before they become generally available.

A rule can be marked as experimental by setting the experimental flag in the Rule's MetaData:

class MyExperimentalRule(CloudFormationLintRule):
    id = 'E1234'
    ...
    experimental = True

To include these rules, use the -e/include-experimental argument when running cfn-lint.

Rules

(This documentation is generated by running cfn-lint --update-documentation, do not alter this manually)

The following 307 rules are applied by this linter:

Rule ID	Title	Description	Config (Name:Type:Default)	Source	Tags
E0000	Parsing error found when parsing the template	Checks for JSON/YAML formatting errors in your template		Source	base
E0001	Error found when transforming the template	Errors found when performing transformation on the template		Source	base,transform
E0002	Error processing rule on the template	Errors found when processing a rule on the template		Source	base,rule
E0003	Error with cfn-lint configuration	Error as a result of the cfn-lint configuration		Source	base,rule
E0100	Validate deployment file configuration	Validate if a deployment file has the correct syntax for one of the supported formats		Source	base
E0200	Validate parameter file configuration	Validate if a parameter file has the correct syntax for one of the supported formats		Source	base
E1001	Basic CloudFormation Template Configuration	Making sure the basic CloudFormation template components are properly configured	sections:string:	Source	base
E1002	Validate if a template size is too large	Check the size of the template is less than the upper limit		Source	limits
E1003	Validate the max size of a description	Check if the size of the template description is less than the upper limit		Source	description,limits
E1004	Template description can only be a string	Template description can only be a string		Source	description
E1005	Validate Transform configuration	Validate that the transforms section of a template is properly configured		Source	transform
E1010	GetAtt validation of parameters	Validates that GetAtt parameters are to valid resources and properties of those resources		Source	functions,getatt
E1011	FindInMap validation of configuration	Making sure the function is a list of appropriate config		Source	functions,findinmap
E1015	GetAz validation of parameters	Making sure the GetAz function is properly configured		Source	functions,getaz
E1016	ImportValue validation of parameters	Making sure the ImportValue function is properly configured		Source	functions,importvalue
E1017	Select validation of parameters	Making sure the Select function is properly configured		Source	functions,select
E1018	Split validation of parameters	Making sure the split function is properly configured		Source	functions,split
E1019	Sub validation of parameters	Making sure the sub function is properly configured		Source	functions,sub
E1020	Ref validation of value	Making sure the Ref has a String value (no other functions are supported)		Source	functions,ref
E1021	Base64 validation of parameters	Making sure the Base64 function is properly configured		Source	functions,base64
E1022	Join validation of parameters	Making sure the join function is properly configured		Source	functions,join
E1024	Cidr validation of parameters	Making sure the function CIDR is a list with valid values		Source	functions,cidr
E1027	Check dynamic references secure strings are in supported locations	Dynamic References Secure Strings are only supported for a small set of resource properties. Validate that they are being used in the correct location when checking values and Fn::Sub in resource properties. Currently doesn't check outputs, maps, conditions, parameters, and descriptions.		Source	functions,dynamic reference
E1028	Check Fn::If structure for validity	Check Fn::If to make sure its valid. Condition has to be a string.		Source	functions,if
E1029	Sub is required if a variable is used in a string	If a substitution variable exists in a string but isn't wrapped with the Fn::Sub function the deployment will fail.	custom_excludes:string:	Source	functions,sub
E1030	Length validation of parameters	Making sure Fn::Length is configured correctly		Source	functions,length
E1031	ToJsonString validation of parameters	Making sure Fn::ToJsonString is configured correctly		Source	functions,toJsonString
E1032	Validates ForEach functions	Validates that ForEach parameters have a valid configuration		Source	functions,foreach
E1040	Check if GetAtt matches destination format	Validate that if source and destination format exists that they match		Source	functions,getatt
E1041	Check if Ref matches destination format	When source and destination format exists validate that they match in a Ref		Source	functions,ref
E1050	Validate the structure of a dynamic reference	Make sure dynamic reference strings have the correct syntax		Source	functions,dynamic reference
E1051	Validate dynamic references to secrets manager are only in resource properties	Dynamic references from secrets manager can only be used in resource properties		Source	functions,dynamic reference
E1052	Validate dynamic references to SSM are in a valid location	Dynamic references to SSM parameters are only supported in certain locations		Source	functions,dynamic reference
E1101	Validate an item against additional checks	Use supplemental logic to validate properties against		Source
E1103	Validate the format of a value	Parent rule for validating the format keyword in schemas		Source
E1150	Validate security group format	Security groups have to ref/gettatt to a security group or has the valid pattern		Source
E1151	Validate VPC id format	Check that a VPC id matches a pattern		Source
E1152	Validate AMI id format	Check that a AMI id matches a pattern		Source
E1153	Validate security group name	Security group names have to valid pattern		Source
E1154	Validate VPC subnet id format	Check that a VPC subnet id matches a pattern		Source
E1155	Validate CloudWatch logs group name	Check that a CloudWatch log group name matches a pattern		Source
E1156	Validate IAM role ARN format	Validate IAM role ARN validation for ref/gett and string values		Source
E1157	Validate KMS key ARN format	Validate KMS key ARN format for ref/getatt and string values		Source
E1158	Validate SNS topic ARN format	Validate SNS topic ARN format for ref/getatt and string values		Source
E1159	Validate ACM certificate ARN format	Validate ACM certificate ARN format for ref/getatt and string values		Source
E1160	Validate Lambda function ARN format	Validate Lambda function ARN format for ref/getatt and string values		Source
E1161	Validate S3 bucket name format	Validate S3 bucket name format for ref/getatt and string values		Source
E1162	Validate KMS key ID format	Validate KMS key ID format for key UUIDs and aliases		Source
E1163	Validate Lambda function name format	Validate Lambda function name format for ref/getatt and string values		Source
E1164	Validate KMS alias name format	Validate KMS alias name format for ref/getatt and string values		Source
E1700	Rules have the appropriate configuration	Making sure the Rules section is properly configured		Source	rules
E1701	Validate the configuration of Assertions	Make sure the Assert value in a Rule is properly configured		Source	rules
E1702	Validate the configuration of Rules RuleCondition	Make sure the RuleCondition in a Rule is properly configured		Source	rules
E2001	Parameters have appropriate properties	Making sure the parameters are properly configured		Source	parameters
E2002	Parameters have appropriate type	Making sure the parameters have a correct type		Source	parameters
E2003	Parameters have appropriate names	Check if Parameters are properly named (A-Za-z0-9)		Source	parameters,name
E2010	Parameter limit not exceeded	Check the number of Parameters in the template is less than the upper limit		Source	parameters,limits
E2011	Validate the name for a parameter	Validate the name of a parameter with special handling of the max length length		Source	parameters,limits
E2015	Default value is within parameter constraints	Making sure the parameters have a default value inside AllowedValues, MinValue, MaxValue, AllowedPattern		Source	parameters
E2529	Check for SubscriptionFilters have beyond 2 attachments to a CloudWatch Log Group	The current limit for a CloudWatch Log Group is they can have 2 subscription filters. We will look for duplicate LogGroupNames inside Subscription Filters and make sure they are within 2. This doesn't account for any other subscription filters getting set.		Source	resources,lambda
E2530	SnapStart supports the configured runtime	To properly leverage SnapStart, you must have a runtime of Java11 or greater		Source	resources,lambda
E2531	Validate if lambda runtime is deprecated	Check the lambda runtime has reached the end of life		Source	resources,lambda,runtime
E2533	Check if Lambda Function Runtimes are updatable	Check if an EOL Lambda Runtime is specified and you cannot update the function		Source	resources,lambda,runtime
E2900	Validate deployment file parameters are valid against template parameters	Validates that required properties are provided, allowed values are valid, types are correct, and the pattern matches in a deployment file for the parameters specified in a template		Source	parameters
E3001	Basic CloudFormation Resource Check	Making sure the basic CloudFormation resources are properly configured		Source	resources
E3002	Resource properties are invalid	Making sure that resources properties are properly configured		Source	resources
E3003	Required Resource properties are missing	Make sure that Resources properties that are required exist		Source	resources,properties,required
E3004	Resource dependencies are not circular	Check that Resources are not circularly dependent by DependsOn, Ref, Sub, or GetAtt		Source	resources,circularly,dependson,ref,sub,getatt
E3005	Check DependsOn values for Resources	Check that the DependsOn values are valid		Source	resources,dependson
E3006	Validate the CloudFormation resource type	Resource types are validated against the spec accounting for regions		Source	resources
E3007	Unique resource and parameter names	All resources and parameters must have unique names		Source	parameters,resources
E3008	Validate an array in order	Will validate arrays in order for schema validation		Source	resources,properties,array,prefixItems
E3009	Check CloudFormation init configuration	Validate that the items in a CloudFormation init adhere to standards		Source	resources,cloudformation init
E3010	Resource limit not exceeded	Check the number of Resources in the template is less than the upper limit		Source	resources,limits
E3011	Check property names in Resources	Validate property names are property configured in Resources		Source	resources,limits
E3012	Check resource properties values	Checks resource property values with Primitive Types for values that match those types.	strict:boolean:False	Source	resources
E3013	CloudFront Aliases	CloudFront aliases should contain valid domain names		Source	properties,cloudfront
E3014	Validate only one of a set of required properties are specified	Make sure that Resources properties that are required exist. Along with other properties not being specified		Source	resources
E3015	Validate the resource condition is valid	Check the condition of a resource to make sure it exists inside the template		Source	resources,conditions
E3016	Check the configuration of a resources UpdatePolicy	Make sure a resources UpdatePolicy is properly configured		Source	resources,updatepolicy
E3017	Check Properties that need at least one of a list of properties	Making sure CloudFormation properties that require at least one property from a list. More than one can be included.		Source	resources
E3018	Check Properties that need only one of a list of properties	Making sure CloudFormation properties that require only one property from a list. One has to be specified.		Source	resources
E3019	Validate that all resources have unique primary identifiers	Use the primary identifiers in a resource schema to validate that resources inside the template are unique	exceptions:object:{'AWS::CodeBuild::Project': {'primaryIdentifier': ['/properties/Name']}}	Source	parameters,resources
E3020	Validate that when a property is specified another property should be excluded	When certain properties are specified other properties should not be included		Source	resources
E3021	Validate that when a property is specified that other properties should be included	When certain properties are specified it results in other properties to be required		Source	resources
E3022	Resource SubnetRouteTableAssociation Properties	Validate there is only one SubnetRouteTableAssociation per subnet		Source	resources,ec2,subnet,route table
E3023	Validate Route53 RecordSets	Check if all RecordSets are correctly configured		Source	resources,route53,record_set
E3024	Validate tag configuration	Validates tag values to make sure they have unique keys and they follow pattern requirements		Source	parameters,resources,tags
E3025	Validates RDS DB Instance Class	Validates the RDS DB instance types based on region and data gathered from the pricing APIs		Source	resources
E3026	Check Elastic Cache Redis Cluster settings	Evaluate Redis Cluster groups to make sure automatic failover is enabled when cluster mode is enabled		Source	resources,elasticcache
E3027	Validate AWS Event ScheduleExpression format	Validate the formation of the AWS::Event ScheduleExpression		Source	resources,events
E3028	Validate the metadata section of a resource	The metadata section can be unstructured but we do validate the items we can		Source	resources
E3029	Validate Route53 record set aliases	When using alias records you can't specify TTL or certain types are allowed		Source	resources,route53,record_set
E3030	Check if properties have a valid value	Check if properties have a valid value in case of an enumator		Source	resources,property,allowed value
E3031	Check if property values adhere to a specific pattern	Check if properties have a valid value in case of a pattern (Regular Expression)	exceptions:list:[]	Source	resources,property,allowed pattern,regex
E3032	Check if a array has between min and max number of values specified	Check array for the number of items in the list to validate they are between the minimum and maximum		Source	resources,property,array,length
E3033	Check if a string has between min and max number of values specified	Check strings for its length between the minimum and maximum		Source	resources,property,string,size
E3034	Check if a number is between min and max	Check numbers (integers and floats) for its value being between the minimum and maximum		Source	resources,property,number,size
E3035	Check DeletionPolicy values for Resources	Check that the DeletionPolicy values are valid		Source	resources,deletionpolicy
E3036	Check UpdateReplacePolicy values for Resources	Check that the UpdateReplacePolicy values are valid		Source	resources,updatereplacepolicy
E3037	Check if a list has duplicate values	Certain lists don't support duplicate items. Check when duplicates are provided but not supported.		Source	resources,property,list
E3038	Check if Serverless Resources have Serverless Transform	Check that a template with Serverless Resources also includes the Serverless Transform		Source	resources,transform
E3039	AttributeDefinitions / KeySchemas mismatch	Verify the set of Attributes in AttributeDefinitions and KeySchemas match		Source	resources,dynamodb
E3040	Validate we aren't configuring read only properties	Read only properties can be configured in a CloudFormation template but they aren't sent to the resource provider code and can cause drift.		Source	resources,properties
E3041	RecordSet HostedZoneName is a superdomain of or equal to Name	In a RecordSet, the HostedZoneName must be a superdomain of or equal to the Name being validated		Source	resource,properties,route53
E3042	Validate at least one essential container is specified	Check that every TaskDefinition specifies at least one essential container		Source	properties,ecs,task,container,fargate
E3043	Validate parameters for in a nested stack	Evalute if parameters for a nested stack are specified and if parameters are specified for a nested stack that aren't required.		Source	resources,cloudformation
E3044	ECS service using FARGATE or EXTERNAL can only use SchedulingStrategy of REPLICA	When using a LaunchType of Fargate the SchedulingStrategy has to be Replica		Source	properties,ecs,service,container,fargate
E3045	Validate AccessControl are set with OwnershipControls	When using AccessControl other than private you must also configure OwnershipControls. The default is bucket owner enforced which disables ACLs.		Source	resources,s3
E3046	Validate ECS task logging configuration for awslogs	When 'awslogs' the options 'awslogs-group' and 'awslogs-region' are required		Source	resources
E3047	Validate ECS Fargate tasks have the right combination of CPU and memory	When using a ECS Fargate task there is a specfic combination of memory and cpu that can be used		Source	properties,ecs,service,container,fargate
E3048	Validate ECS Fargate tasks have required properties and values	When using a ECS Fargate task there is a specfic combination of required properties and values		Source	properties,ecs,service,container,fargate
E3049	Validate ECS tasks with dynamic host port have traffic-port ELB target groups	When using an ECS task definition of host port 0 and associating that container to an ELB the target group has to have a 'HealthCheckPort' of 'traffic-port'		Source	resources
E3050	Check if REFing to a IAM resource with path set	Some resources don't support looking up the IAM resource by name. This check validates when a REF is being used and the Path is not '/'		Source	properties,iam
E3051	Validate the structure of a SSM document	SSM documents are nested JSON/YAML in CloudFormation this rule adds validation to those documents		Source	properties,ssm,document
E3052	Validate ECS service requires NetworkConfiguration	When using an ECS task definition has NetworkMode set to 'awsvpc' then 'NetworkConfiguration' is required		Source	resources,ecs
E3053	Validate ECS task definition is has correct values for 'HostPort'	The 'HostPort' must either be undefined or equal to the 'ContainerPort' value		Source	resources,ecs
E3054	Validate ECS service using Fargate uses TaskDefinition that allows Fargate	When using an ECS service with 'LaunchType' of 'FARGATE' the associated task definition must have 'RequiresCompatibilities' specified with 'FARGATE' listed		Source	resources,ecs
E3055	Check CreationPolicy values for Resources	Check that the CreationPolicy values are valid		Source	resources,creationPolicy
E3057	Validate that CloudFront TargetOriginId is a specified Origin	CloudFront TargetOriginId has to map to an Origin Id that is in the same DistributionConfig		Source	properties,cloudfront
E3058	Validate at least one of the properties are required	Make sure at least one of the resource properties are included		Source	resources
E3059	Validate subnet CIDRs are within the CIDRs of the VPC	When specifying subnet CIDRs for a VPC the subnet CIDRs most be within the VPC CIDRs		Source	resources,ec2,vpc,subnet
E3060	Validate subnet CIDRs do not overlap with other subnets	When specifying subnet CIDRs for a VPC the subnet CIDRs most not overlap with eachother		Source	resources,ec2,vpc,subnet
E3061	Validate the days for tierings in IntelligentTieringConfigurations	When using AWS::S3::Bucket to configure IntelligentTieringConfigurations the Tierings have minimum and maximum values		Source	resources,s3
E3062	Validates RDS DB Instance Class based on Engine and EngineVersion	Validates the RDS DB instance types based on 'Engine' and 'EngineVersion'. 'EngineVersion' is based on the minor version.		Source	resources
E3063	Validate GuardDuty Detector property exclusivity	The request failed because both DataSources and Features were provided. You can provide only one; it is recommended to use Features.		Source	resources,guardduty
E3501	Validate SQS queue properties are valid	Depending on if the queue is FIFO or not the properties and allowed values change. This rule validates properties and values based on the queue type.		Source	resources,sqs
E3502	Validate SQS DLQ queues are the same type	SQS queues using DLQ have to have the destination queue as the same type (FIFO or standard)		Source	resources,sqs
E3503	ValidationDomain is superdomain of DomainName	In ValidationDomainOptions, the ValidationDomain must be a superdomain of the DomainName being validated		Source	certificate,certificatemanager,domainvalidationoptions,validationdomain
E3504	Check minimum 90 period is met between BackupPlan cold and delete	Check that Backup plans with lifecycle rules have >= 90 days between cold and delete		Source	properties,backup,plan,lifecycle
E3505	Validate SQS 'VisibilityTimeout' is greater than a function's 'Timeout'	When attaching a Lambda function to a SQS queue to a Lambda function the SQS 'VisibilityTimeout' has to be greater than or equal to the lambda functions's 'Timeout'		Source	resources,lambda,sqs
E3510	Validate identity based IAM polices	IAM identity polices are embedded JSON in CloudFormation. This rule validates those embedded policies.		Source	resources,iam
E3511	Validate IAM role arn pattern	Validate an IAM role arn pattern matches		Source	parameters,iam
E3512	Validate resource based IAM polices	IAM resources polices are embedded JSON in CloudFormation. This rule validates those embedded policies.		Source	resources,iam
E3513	Validate ECR repository policy	Private ECR repositories have a policy. This rule validates those policies.		Source	resources,iam,ecr
E3514	Validate IAM resource policy resource ARNs	Validates an IAM resource policy has a compliant resource ARN		Source	parameters,iam
E3530	Validate IAM trust polices	IAM trust polices are embedded JSON in CloudFormation. This rule validates those embedded policies.		Source	resources,iam
E3601	Validate the structure of a StateMachine definition	Validate the Definition or DefinitionString inside a AWS::StepFunctions::StateMachine resource		Source	resources,statemachine
E3615	Validate the period is a valid value	Valid values are 10, 30, 60, and any multiple of 60.		Source	resources,cloudwatch
E3617	Validate ManagedBlockchain instance type	Validates the ManagedBlockchain instance types based on region and data gathered from the pricing APIs		Source	resources
E3620	Validate a DocDB DB Instance class	Validates the DocDB instance types based on region and data gathered from the pricing APIs		Source	resources
E3621	Validate the instance types for AppStream Fleet	Validates the AppStream Fleet instance types based on region and data gathered from the pricing APIs		Source	resources
E3628	Validate EC2 instance types based on region	Validates the EC2 instance types based on region and data gathered from the pricing APIs		Source	resources
E3633	Validate Lambda event source mapping StartingPosition is used correctly	When 'EventSourceArn' is associate to Kinesis, Kafka, or DynamoDB you must specify 'StartingPosition		Source	resources
E3634	Validate Lambda event source mapping starting position is used with SQS	When 'EventSourceArn' is associated to SQS don't specify 'StartingPosition'		Source	resources
E3635	Validate Neptune DB instance class	Validates the instance types for Neptune DB based on region and data gathered from the pricing APIs		Source	resources
E3636	Validate CodeBuild projects using S3 also have Location	When using 'S3' for 'Type' then you must also specify 'Location'		Source	resources,codebuild
E3638	Validate DynamoDB BillingMode pay per request configuration	When 'BillingMode' is 'PAY_PER_REQUEST' don't specify 'ProvisionedThroughput'		Source	resources
E3639	When BillingMode is Provisioned you must specify ProvisionedThroughput	When 'BillingMode' is 'Provisioned' 'ProvisionedThroughput' is required		Source	resources
E3641	Validate GameLift Fleet EC2 instance type	Validates the GameLift Fleet EC2 instance types based on region and data gathered from the pricing APIs		Source	resources
E3647	Validate ElastiCache cluster cache node type	Validates the ElastiCache instance types based on region and data gathered from the pricing APIs		Source	resources
E3652	Validate Elasticsearch domain cluster instance	Validates the Elasticsearch instance types based on region and data gathered from the pricing APIs		Source	resources
E3660	RestApi requires a name when not using an OpenAPI specification	When using AWS::ApiGateway::RestApi you have to provide 'Name' if you don't provide 'Body' or 'BodyS3Location'		Source	resources,apigateway
E3661	Validate Route53 health check has AlarmIdentifier when using CloudWatch	When 'Type' is 'CLOUDWATCH_METRIC' you must specify 'AlarmIdentifier'		Source	resources
E3663	Validate Lambda environment variable names aren't reserved	Lambda reserves a set of environment variable names for its use. This rule validates that the provided environment variable names don't use the reserved variable names		Source	resources,lambda,runtime
E3667	Validate RedShift cluster node type	Validates the RedShift instance types based on region and data gathered from the pricing APIs		Source	resources
E3670	Validate the instance types for an AmazonMQ Broker	Validates the instance types for AmazonMQ broker based on region and data gathered from the pricing APIs		Source	resources
E3671	Validate block device mapping configuration	Certain volume types require Iops to be specified		Source	resources,ec2
E3672	Validate the cluster node type for a DAX Cluster	Validates the DAX cluster instance types based on region and data gathered from the pricing APIs		Source	resources
E3673	Validate if an ImageId is required	Validate if an ImageID is required. It can be required if the associated LaunchTemplate doesn't specify an ImageID		Source	resources,ec2
E3674	Primary cannoy be True when PrivateIpAddress is specified	Only specify the private IP address for an instance in one spot		Source	resources,ec2
E3675	Validate EMR cluster instance type	Validates the EMR cluster instance types based on region and data gathered from the pricing APIs		Source	resources
E3676	Validate ELBv2 protocols that require certificates have a certificate specified	When using HTTP or TLS you must specify a certificate		Source	resources
E3677	Validate Lambda using ZipFile requires an allowable runtime	Using the ZipFile attribute requires a javascript or python runtime to be specified		Source	resources
E3678	Using the ZipFile attribute requires a runtime to be specified	Using the ZipFile attribute requires a runtime to be specified		Source	resources
E3679	Validate ELB protocols that require certificates have a certificate specified	When using HTTPS or SSL you must provide a certificate		Source	resources
E3680	Application load balancers require at least 2 subnets			Source	resources
E3681	Validate target group target type property restrictions	When a TargetGroup target type is lambda or not there are different restrictions on properties.		Source	resources
E3682	Validate when using Aurora certain properies aren't required	When creating an aurora DBInstance don't specify 'AllocatedStorage', 'BackupRetentionPeriod', 'CopyTagsToSnapshot', 'DeletionProtection', 'EnableIAMDatabaseAuthentication', 'MasterUserPassword', or 'StorageEncrypted'		Source	resources
E3683	Validate target group protocol property restrictions	When a TargetGroup protocol is HTTP/HTTPS or GENEVE there are different restrictions on properties.		Source	resources
E3684	Validate target group health check protocol property restrictions	When a TargetGroup health check protocol is specified there are restrictions on other properties.		Source	resources
E3685	Container image functions cannot use Handler, Runtime, or Layers	Functions with PackageType 'Image' cannot specify Handler, Runtime, or Layers properties		Source	resources
E3686	Validate allowed properties when using a serverless RDS DB cluster	Validate that when EngineMode is 'serverless' or 'provisioned' that the appropriate allowed properties are provided. If 'EngineMode' is not provided make sure serverless properties don't exist at all.		Source	resources
E3687	Validate to and from ports based on the protocol	When using icmp, icmpv6, tcp, or udp you have to specify the to and from port ranges		Source	resources
E3688	Validate that to and from ports are both -1	When ToPort or FromPort are -1 the other one must also be -1		Source	resources
E3689	Validate MonitoringInterval and MonitoringRoleArn are used together	When MonitoringInterval is greater than 0 you need to specify MonitoringRoleArn. If MonitoringRoleArn is specified MonitoringInterval has to be greather than 0.		Source	resources
E3690	Validate DB Cluster Engine and Engine Version	Validate the DB Cluster engine along with the engine version		Source	resources
E3691	Validate DB Instance Engine and Engine Version	Validate the DB Instance engine along with the engine version		Source	resources
E3692	Validate Multi-AZ DB cluster configuration	When creating a Multi-AZ DB Cluster there are required fields and the allowed values are different		Source	resources
E3693	Validate Aurora DB cluster configuration	When creating an Aurora DB Cluster there are required fields and the allowed values are different		Source	resources
E3694	Validates RDS DB Cluster instance class	Validates the RDS DB Cluster instance types based on region and data gathered from the pricing APIs		Source	resources
E3695	Validate Elasticache Cluster Engine and Engine Version	Validate the Elasticache cluster engine along with the engine version		Source	resources
E3696	LogLevel is not supported when LogFormat is set to Text	LogLevel is not supported when LogFormat is set to 'Text'. Remove LogLevel from your request or change the LogFormat to 'JSON'		Source	resources
E3697	Validate Lambda environment variables do not exceed 4 KB	AWS Lambda limits the total size of all environment variables to 4 KB. If this limit is exceeded, the deployment will fail. This rule sums the lengths of all keys and values and validates the total does not exceed 4096 bytes.		Source	resources,lambda
E3698	API Gateway Stage and Deployment must use the same RestApi	When an API Gateway Stage references a Deployment, both must reference the same RestApi. A mismatch causes a deployment failure.		Source	resources,apigateway
E3699	API Gateway Method and Authorizer must use the same RestApi	When an API Gateway Method references an Authorizer, both must reference the same RestApi. A mismatch causes a deployment failure.		Source	resources,apigateway
E3700	Validate CodePipeline Source actions are only in the first stage	When using AWS::CodePipeline::Pipeline this rule will validate that Source actions are only used in the first stage		Source	resources,codepipeline
E3701	Validate input and output artifact names are used properly	When using AWS::CodePipeline::Pipeline InputArtifacts names have to be previously used OutputArtifact names. Additionally, the OutputArtifacts names have to be unique		Source	resources,codepipeline
E3702	Validate the number of input and output artifacts in a CodePipeline	When using AWS::CodePipeline::Pipeline action types have different contraints for InputArtifacts and OutputArtifacts		Source	resources,codepipeline
E3703	Validate the configuration of a pipeline action	When definition a CodePipeline certain action types have configuration constraints so this rule validates them		Source	resources,codepipeline
E3704	Validate TransitEncryptionEnabled is set when using Valkey engine	When Engine is valkey, TransitEncryptionEnabled must be explicitly set		Source	resources,elasticache
E3705	Validate SQS FIFO queue EventSourceMapping BatchSize is at most 10	When an EventSourceMapping references a FIFO SQS queue, the BatchSize must be at most 10		Source	resources,lambda,sqs
E3706	MaxSize must be greater than or equal to MinSize	Validates that AutoScaling group MaxSize is greater than or equal to MinSize		Source	resources,autoscaling
E3707	Validate RDS DBInstance Engine matches DBCluster Engine	When a DBInstance references a DBCluster via DBClusterIdentifier, the Engine property must match between the two resources		Source	resources,rds
E3708	API Gateway Method AuthorizationType must match Authorizer Type	When using AuthorizationType 'CUSTOM', the referenced Authorizer must have Type 'TOKEN' or 'REQUEST'. When using AuthorizationType 'COGNITO_USER_POOLS', the Authorizer must have Type 'COGNITO_USER_POOLS'.		Source	resources,apigateway
E3709	Validate RDS DBInstance StorageEncrypted matches DBCluster	When a DBInstance references a DBCluster via DBClusterIdentifier, the StorageEncrypted property must match between the two resources		Source	resources,rds
E3710	Resource type is from a service that has been shut down	Checks if a resource type belongs to an AWS service that has reached full shutdown and is no longer available		Source	resources,lifecycle
E3711	Validate ListenerRule target group protocol is not GENEVE	When a ListenerRule forwards to a TargetGroup, the TargetGroup protocol must not be GENEVE. GENEVE is only supported with Gateway Load Balancers, not Application or Network Load Balancers.		Source	resources,elasticloadbalancingv2
E3712	TargetTrackingScaling policy requires ASG MaxSize greater than MinSize	When using a TargetTrackingScaling policy the referenced AutoScalingGroup must have MaxSize different from MinSize to allow scaling		Source	resources,autoscaling
E3713	Validate Fargate ECS services use supported log drivers	When using an ECS service with 'LaunchType' of 'FARGATE' the referenced task definition containers must use a supported log driver ('awslogs', 'splunk', or 'awsfirelens'). Other log drivers like 'json-file' or 'syslog' are not supported on Fargate.		Source	resources,ecs
E3714	Validate LaunchTemplate SecurityGroup and Subnet are in the same VPC	When a LaunchTemplate references SecurityGroups via 'SecurityGroupIds' and Subnets via 'NetworkInterfaces', the SecurityGroup's VpcId must match the Subnet's VpcId		Source	resources,ec2
E3715	VirtualName must use ephemeral device format when Ebs is absent	When specifying VirtualName without Ebs in a block device mapping, the value must match 'ephemeralN' (N=0-23) or the deployment will fail.		Source	resources,ec2
E3716	Validate Lambda layer ARN length based on region	Validates the Lambda layer ARN length based on region. ARN length varies by partition due to partition and region name length.		Source	resources,lambda
E3718	Validate API Gateway Authorizer TTL based on type	AuthorizerResultTtlInSeconds maximum of 3600 only applies to TOKEN and REQUEST authorizers.		Source	resources,apigateway
E3719	Validate RDS BackupRetentionPeriod configuration	BackupRetentionPeriod is not allowed when DBClusterIdentifier is specified. For standalone non-Aurora instances the maximum is 35.		Source	resources,rds
E3720	Validate StorageEncrypted is set when KmsKeyId is specified	When specifying a KmsKeyId for a non-custom engine RDS DBInstance, StorageEncrypted must be set to true. Custom engines (custom-*) handle encryption implicitly and do not require StorageEncrypted.		Source	resources,rds
E3721	Validate ReplicaMode value for Oracle and Db2 engines	When specifying ReplicaMode for Oracle or Db2 engines, the value must be 'mounted' or 'open-read-only'.		Source	resources,rds
E4001	Metadata Interface have appropriate properties	Metadata Interface properties are properly configured		Source	metadata
E4002	Validate the configuration of the Metadata section	Validates that Metadata section is an object and has no null values		Source	metadata
E5001	Check that Modules resources are valid	Check that Modules resources are valid		Source	resources,modules
E6001	Check the properties of Outputs	Validate the property structure for outputs		Source	outputs
E6002	Outputs have required properties	Making sure the outputs have required properties		Source	outputs
E6003	Check the type of Outputs	Validate the type of properties in the Outputs section		Source	outputs
E6004	Outputs have appropriate names	Check if Outputs are properly named (A-Za-z0-9)		Source	outputs
E6005	Validate the Output condition is valid	Check the condition of an output to make sure it exists inside the template		Source	outputs,conditions
E6010	Output limit not exceeded	Check the number of Outputs in the template is less than the upper limit		Source	outputs,limits
E6011	Check property names in Outputs	Validate property names are property configured in Outputs		Source	outputs,limits
E6101	Validate that outputs values are a string	Make sure that output values have a type of string		Source	outputs
E6102	Validate that output exports have values of strings	Make sure output exports have a value of type string		Source	outputs
E7001	Mappings are appropriately configured	Check if Mappings are properly configured		Source	mappings
E7002	Check property names in Mappings	Validate property names are property configured in Mappings		Source	mappings,limits
E7010	Max number of properties for Mappings	Check the number of Mappings in the template is less than the upper limit		Source	mappings,limits
E8001	Conditions have appropriate properties	Check if Conditions are properly configured		Source	conditions
E8002	Check if the referenced Conditions are defined	Making sure the used conditions are actually defined in the Conditions section		Source	conditions
E8003	Check Fn::Equals structure for validity	Check Fn::Equals is a list of two elements		Source	functions,equals
E8004	Check Fn::And structure for validity	Check Fn::And is a list of two elements		Source	functions,and
E8005	Check Fn::Not structure for validity	Check Fn::Not is a list of one element		Source	functions,not
E8006	Check Fn::Or structure for validity	Check Fn::Or is a list of two elements		Source	functions,or
E8007	Check Condition structure for validity	Check Condition has a value of another condition		Source	functions,condition
I1002	Validate approaching the template size limit	Check the size of the template is approaching the upper limit		Source	limits
I1003	Validate if we are approaching the max size of a description	Check if the size of the template description is approaching the upper limit		Source	description,limits
I1022	Use Sub instead of Join	Prefer a sub instead of Join when using a join delimiter that is empty		Source	functions,sub,join
I2003	Validate AllowedPattern is a valid regexs	Validate the pattern defined in a AllowedPattern. This is informational as the service side regex library is different than the Python one		Source	parameters,allowed pattern
I2010	Parameter limit	Check the number of Parameters in the template is approaching the upper limit		Source	parameters,limits
I2011	Parameter name limit	Check the size of Parameter names in the template is approaching the upper limit		Source	parameters,limits
I2530	Validate that SnapStart is configured for >= Java11 runtimes	SnapStart is a no-cost feature that can increase performance up to 10x. Enable SnapStart for Java 11 and greater runtimes		Source	resources,lambda
I3010	Resource limit	Check the number of Resources in the template is approaching the upper limit		Source	resources,limits
I3011	Check stateful resources have a set UpdateReplacePolicy/DeletionPolicy	The default action when replacing/removing a resource is to delete it. This check requires you to explicitly set policies		Source	resources,updatereplacepolicy,deletionpolicy
I3012	Resource name limit	Check the size of Resource names in the template is approaching the upper limit		Source	resources,limits
I3013	Check resources with auto expiring content have explicit retention period	The behaviour for data retention is different across AWS Services.If no retention period is specified the default for some services is to delete the data after a period of time.This check requires you to explicitly set the retention period for those resources to avoid unexpected data losses		Source	resources,retentionperiod
I3037	Check if a list that allows duplicates has any duplicates	Certain lists support duplicate items.Provide an alert when list of strings or numbers have repeats.		Source	resources,property,list
I3042	ARNs should use correctly placed Pseudo Parameters	Checks Resources if ARNs use correctly placed Pseudo Parameters instead of hardcoded Partition, Region, and Account Number	partition:boolean:True region:boolean:False accountId:boolean:False	Source	resources
I3100	Checks for legacy instance type generations	New instance type generations increase performance and decrease cost		Source	resources,ec2,rds,elasticcache,elasticsearch
I3510	Validate statement resources match the actions	IAM policy statements have different constraints between actions and resources. This rule validates that resource ARNs or asterisks match the actions.		Source	resources,iam
I6010	Output limit	Check the number of Outputs in the template is approaching the upper limit		Source	outputs,limits
I6011	Output name limit	Check the size of Output names in the template is approaching the upper limit		Source	outputs,limits
I7002	Mapping name limit	Check the size of Mapping names in the template is approaching the upper limit		Source	mappings,limits
I7010	Mapping limit	Check the number of Mappings in the template is approaching the upper limit		Source	mappings,limits
W1001	Ref/GetAtt to resource that is available when conditions are applied	Check the Conditions that affect a Ref/GetAtt to make sure the resource being related to is available when there is a resource condition.		Source	conditions,resources,relationships,ref,getatt,sub
W1011	Instead of REFing a parameter for a secret use a dynamic reference	Instead of REFing a parameter for a secret use a dynamic reference. Solutions like SSM parameter store and secrets manager provide better security of sercrets		Source	functions,dynamic reference,ref
W1019	Validate that parameters to a Fn::Sub are used	Validate that Fn::Sub Parameters are used		Source	functions,sub
W1020	Sub isn't needed if it doesn't have a variable defined	Checks sub strings to see if a variable is defined.		Source	functions,sub
W1028	Check Fn::If has a path that cannot be reached	Check Fn::If path can be reached		Source	functions,if
W1030	Validate the values that come from a Ref function	Resolve the Ref and then validate the values against the schema		Source	functions,ref
W1031	Validate the values that come from a Fn::Sub function	Resolve the Fn::Sub and then validate the values against the schema		Source	functions,sub
W1032	Validate the values that come from a Fn::Join function	Resolve the Fn::Join and then validate the values against the schema		Source	functions,join
W1033	Validate the values that come from a Fn::Split function	Resolve the Fn::Split and then validate the values against the schema		Source	functions,split
W1034	Validate the values that come from a Fn::FindInMap function	Resolve the Fn::FindInMap and then validate the values against the schema		Source	functions,findinmap
W1035	Validate the values that come from a Fn::Select function	Resolve the Fn::Select and then validate the values against the schema		Source	functions,select
W1036	Validate the values that come from a Fn::GetAZs function	Resolve the Fn::GetAZs and then validate the values against the schema		Source	functions,getazs
W1040	Validate the values that come from a Fn::ToJsonString function	Resolve the Fn::ToJsonString and then validate the values against the schema		Source	functions,tojsonstring
W1051	Validate dynamic references to secrets manager are not used when a secrets manager ARN was expected	Certain properties expect a secret manager ARN. This rule validates if you may be accidently using a secret in place of the ARN		Source	functions,dynamic reference
W1053	Dynamic references should not contain spaces	Dynamic references with spaces between '{{' and 'resolve' will not be resolved by CloudFormation and will be treated as a literal string		Source	functions,dynamic reference
W1100	Validate if the template is using YAML merge	The CloudFormation service does not support YAML anchors, aliases, or merging. This rule validates if the merge capability is being used		Source	yaml
W2001	Check if Parameters are Used	Making sure the parameters defined are used		Source	parameters
W2002	Parameter type is not officially supported by CloudFormation	CloudFormation accepts any AWS::SSM::Parameter::Value<> or List<> pattern, but only validates specific types. Using unsupported types may work but CloudFormation will not validate the parameter values.		Source	parameters
W2010	NoEcho parameters are not masked when used in Metadata and Outputs	Using the NoEcho attribute does not mask any information stored in the following: Metadata, Outputs, Resource Metadata		Source	functions,dynamic reference,ref
W2030	Check if parameters have a valid value	Check if parameters have a valid value in case of an enumator. The Parameter's allowed values is based on the usages in property (Ref)		Source	parameters,resources,property,allowed value
W2031	Check if parameters have a valid value based on an allowed pattern	Check if parameters have a valid value in a pattern. The Parameter's allowed pattern is based on the usages in property (Ref)		Source	parameters,resources,property,pattern
W2501	Check if Password Properties are correctly configured	Password properties should not be strings and if parameter using NoEcho		Source	parameters,passwords,security,dynamic reference
W2506	Check if ImageId Parameters have the correct type	See if there are any refs for ImageId to a parameter of inappropriate type. Appropriate Types are [AWS::EC2::Image::Id, AWS::SSM::Parameter::ValueAWS::EC2::Image::Id]		Source	parameters,ec2,imageid
W2511	Check IAM Resource Policies syntax	See if the elements inside an IAM Resource policy are configured correctly.		Source	properties,iam
W2530	Validate that SnapStart is properly configured	To properly leverage SnapStart, you must configure both the lambda function and attach a Lambda version resource		Source	resources,lambda
W2531	Check if EOL Lambda Function Runtimes are used	Check if an EOL Lambda Runtime is specified and give a warning if used.		Source	resources,lambda,runtime
W2533	Check required properties for Lambda if the deployment package is a .zip file	When the package type is Zip, you must also specify the handler and runtime properties.		Source	resources,lambda
W3002	Warn when properties are configured to only work with the package command	Some properties can be configured to only work with the CloudFormationpackage command. Warn when this is the case so user is aware.		Source	resources
W3005	Check obsolete DependsOn configuration for Resources	Check if DependsOn is specified if not needed. A Ref or a Fn::GetAtt already is an implicit dependency.		Source	resources,dependson,ref,getatt
W3010	Availability zone properties should not be hardcoded	Check if an Availability Zone property is hardcoded.		Source	parameters,availabilityzone
W3011	Check resources with UpdateReplacePolicy/DeletionPolicy have both	Both UpdateReplacePolicy and DeletionPolicy are needed to protect resources from deletion		Source	resources,updatereplacepolicy,deletionpolicy
W3034	Check if parameter values are between min and max	Check if parameter values value being between the minimum and maximum		Source	resources,property,number,size
W3037	Check IAM Permission configuration	Check for valid IAM Permissions		Source	properties,iam,permissions
W3045	Controlling access to an S3 bucket should be done with bucket policies	Nearly all access control configurations can be more successfully achieved with bucket policies. Consider using bucket policies instead of access control.		Source	resources,s3
W3660	Validate if multiple resources are modifying a Rest API definition	When using AWS::ApiGateway::RestApi with 'Body' or 'BodyS3Location' the resource handler will use PutRestApi with mode overwrite. Depending on how resources are updated the IaC template will drift and create orphaned resources.		Source	resources,apigateway
W3663	Validate SourceAccount is required property	When configuration a Lambda permission with a SourceArn that doesn't have an AccountId you should also specify the SourceAccount		Source	resources,lambda,permission
W3664	Validate Lambda permission Principal matches SourceArn resource type	When configuring a Lambda permission with a SourceArn that references a resource, the Principal should match the service that owns that resource type		Source	resources,lambda,permission
W3671	Iops is ignored for certain EBS volume types	When Iops is specified with volume types gp2, st1, sc1, or standard, the value is silently ignored. Remove Iops or use a volume type that supports provisioned IOPS (io1, io2, gp3).		Source	resources,ec2,ebs
W3687	Validate that ports aren't specified for certain protocols	When using a protocol other than icmp, icmpv6, tcp, or udp the port ranges properties are ignored		Source	resources
W3688	When restoring DBCluster certain properties are ignored	When creating a DBCluster extra properties are ignored and could result in drift		Source	resources,rds
W3689	When using a source DB certain properties are ignored	When creating a DBCluster from a source certain properties are ignored and could result in drift		Source	resources,rds
W3690	Validate DB Cluster Engine Version is not deprecated	Validate the DB Cluster engine version is not deprecated and can be used to create new instances		Source	resources
W3691	Validate DB Instance Engine Version is not deprecated	Validate the DB Instance engine version is not deprecated and can be used to create new instances		Source	resources
W3693	Validate Aurora DB cluster configuration for ignored properties	When creating an Aurora DB Cluster there are fields that will allow for successful deployment but are ignored		Source	resources
W3694	SNS Subscription Endpoint should match Protocol	When an SNS Subscription Protocol is 'sqs', the Endpoint should reference an SQS Queue. When Protocol is 'lambda', the Endpoint should reference a Lambda Function.		Source	resources,sns
W3696	Resource type is from a service that is sunsetting	Checks if a resource type belongs to an AWS service that is in the sunset phase and will be shut down		Source	resources,lifecycle
W3697	Resource type is from a service in maintenance mode	Checks if a resource type belongs to an AWS service that is in maintenance mode with no new features		Source	resources,lifecycle
W3698	VirtualName is ignored when Ebs is specified	When both VirtualName and Ebs are specified in a block device mapping, VirtualName is silently ignored by EC2. Remove VirtualName or Ebs.		Source	resources,ec2
W3699	ReplicaMode is ignored for non-Oracle/Db2 engines	When ReplicaMode is specified with engines other than Oracle or Db2, the value is silently ignored. Remove ReplicaMode or use an engine that supports it.		Source	resources,rds
W3700	Non-standard Domain values are converted to vpc	When Domain is specified with a value other than 'standard' or 'vpc', the value is silently converted to 'vpc'. Use 'vpc' explicitly to avoid confusion.		Source	resources,ec2
W4001	Metadata Interface parameters exist	Metadata Interface parameters actually exist		Source	metadata
W4005	Validate cfnlint configuration in the Metadata	Metadata cfn-lint configuration has many values and we want to validate that		Source	metadata
W6001	Check Outputs using ImportValue	Check if the Output value is set using ImportValue, so creating an Output of an Output		Source	outputs,importvalue
W7001	Check if Mappings are Used	Making sure the mappings defined are used		Source	mappings
W8001	Check if Conditions are Used	Making sure the conditions defined are used		Source	conditions
W8003	Fn::Equals will always return true or false	Validate Fn::Equals to see if its comparing two strings or two equal items. While this works it may not be intended.		Source	functions,equals

* experimental rules