Repository: aws-cloudformation/cfn-lint

Issue:
v1: E3510 Exception 'not enough values to unpack (expected 2, got 1)' raised while validating 'cfnLint' when 'Ref' is resolved
### CloudFormation Lint Version

v1.3.0

### What operating system are you using?

Ubuntu

### Describe the bug

cfn-lint get an internal error when handling serverless transformer CSV parameters this worked fin in 0.87.7. The validation works fine if we specify actions to the policy inline.

Don't work:

```yaml
Parameters:
  Actions:
    Type: 'CommaDelimitedList'

Resource:
        :
            - Effect: Allow
              Action: !Ref 'Actions'
              Resource: '*'
```

Ex of what works: 

```yaml
            - Effect: Allow
              Action:
                - 'lambda:InvokeFunction'
              Resource: '*'
```



### Expected behavior

That cfn-lint don't get an internal error while resolving CSV parameters.

### Reproduction template

```yaml
---
AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: 'Bug E3510.'

Parameters:

  DeploymentBucket:
    Type: 'String'
    Description: 'Name of the DeploymentBucket.'

  FunctionFileName:
    Type: 'String'
    Description: 'File name of the lambda function.'

  ScheduleExpr:
    Type: 'String'
    Description: 'Schedule expression to trigger the function with.'

  Actions:
    Type: 'CommaDelimitedList'
    Description: >-
      List of the actions the lambda needs to perform
    Default: ''

Resources:
  ScheduledServerlessFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri:
        Bucket: !Ref 'DeploymentBucket'
        Key: !Sub 'lambda/scheduled_lambda/${FunctionFileName}.zip'
      Handler: !Sub '${FunctionFileName}.lambda_handler'
      Runtime: python3.9
      Architectures:
        - x86_64
      Policies:
        - Statement:
            - Effect: Allow
              # E3510 - bug in cfn-lint 1.30?
              Action: !Ref 'Actions'
              Resource: '*'
      Events:
        CloudWatchEvent:
          Type: Schedule
          Properties:
            Schedule: !Ref 'ScheduleExpr'
```



Discussion:

Patch:
diff --git a/src/cfnlint/rules/resources/iam/Permissions.py b/src/cfnlint/rules/resources/iam/Permissions.py
index 8be5cf81ad..d988292a77 100644
--- a/src/cfnlint/rules/resources/iam/Permissions.py
+++ b/src/cfnlint/rules/resources/iam/Permissions.py
@@ -38,6 +38,15 @@ def validate(
         for action in actions:
             if action == "*":
                 continue
+            if ":" not in action:
+                yield ValidationError(
+                    (
+                        f"{action!r} is not a valid action."
+                        "Must be of the form service:action or '*'"
+                    ),
+                    rule=self,
+                )
+                return
             service, permission = action.split(":", 1)
             service = service.lower()
             permission = permission.lower()


Test patch:
diff --git a/test/unit/rules/resources/iam/test_iam_permissions.py b/test/unit/rules/resources/iam/test_iam_permissions.py
index 5e95e52be1..f4b9068977 100644
--- a/test/unit/rules/resources/iam/test_iam_permissions.py
+++ b/test/unit/rules/resources/iam/test_iam_permissions.py
@@ -29,6 +29,7 @@ def rule():
         ("Invalid string with ending astrisk", "s3:Foo*", 1),
         ("Invalid string with starting astrisk", "s3:*Foo", 1),
         ("Invalid service", "foo:Bar", 1),
+        ("Empty string", "", 1),
     ],
 )
 def test_permissions(name, instance, err_count, rule, validator):