Package: cfn-lint
AWS CloudFormation LinterValidate AWS CloudFormation yaml/json templates against theAWS CloudFormation Resource Specificationand additional
checks.  Includes checking valid values for resource properties and best practices.WarningThis is an attempt to provide validation for AWS CloudFormation templates properties and
their values.  For values things can get pretty complicated (mappings, joins, splits,
conditions, and nesting those functions inside each other) so it's a best effort to
validate those values but the promise is to not fail if we can't understand or translate
all the things that could be going on.ContributeWe encourage you to contribute tocfn-lint! Please check out theContributing Guidelinesfor more information on how to proceed.CommunityJoin us on Discord! Connect & interact with CloudFormation developers &
experts, find channels to discuss and get help for cfn-lint, CloudFormation registry, StackSets,
Guard and more:Serverless Application ModelThe Serverless Application Model (SAM) is supported by the linter. The template is
transformed usingAWS SAMbefore the linter processes the template.To get information about theSAM Transformation, run the linter with--infoInstallPython 3.8+ is supported.Pippip install cfn-lint. If pip is not available, runpython setup.py clean --allthenpython setup.py install.Homebrew (macOS)brew install cfn-lintDockerIncfn-python-lintsource tree:dockerbuild--tagcfn-python-lint:latest.In repository to be linted:dockerrun--rm-v`pwd`:/datacfn-python-lint:latest/data/template.yamlEditor PluginsThere are IDE plugins available to get direct linter feedback from you favorite editor:AtomEmacsNeoVim 0.2.0+/Vim 8ALECocSyntasticSublimeVisual Studio CodeIntelliJ IDEAGitHub ActionOnline demoBasic Usagecfn-lint template.yamlcfn-lint -t template.yamlMultiple files can be linted by either specifying multiple specific files:cfn-lint template1.yaml template2.yamlcfn-lint -t template1.yaml template2.yamlor by using wildcards (globbing):Lint allyamlfiles inpath:cfn-lint path/*.yamlLint allyamlfiles inpathand all subdirectories (recursive):cfn-lint path/**/*.yamlNote: If using sh/bash/zsh, you must enable globbing.
(shopt -s globstarfor sh/bash,setopt extended_globfor zsh).Exit Codescfn-lintwill return a non zero exit if there are any issues with your template. The value is dependent on the severity of the issues found.  For each level of discovered errorcfn-lintwill use bitwise OR to determine the final exit code.  This will result in these possibilities.0 is no issue was found2 is an error4 is a warning6 is an error and a warning8 is an informational10 is an error and informational12 is an warning and informational14 is an error and a warning and an informationalConfiguring Exit Codescfn-lintallows you to configure exit codes. You can provide the parameter--non-zero-exit-codewith a value ofinformational,warning,error, ornone.cfn-lintwill determine the exit code based on the match severity being the value of the parameter--non-zero-exit-codeand higher. The exit codes will remain the same as above.The order of severity is as follows:informationaldefaultwarningerrornoneExit code will always be 0 unless there is a syntax errorSpecifying the template as an input streamThe template to be linted can also be passed using standard input:cat path/template.yaml | cfn-lint -Specifying the template with other parameterscfn-lint -r us-east-1 ap-south-1 -- template.yamlcfn-lint -r us-east-1 ap-south-1 -t template.yamlConfigurationCommand LineFrom a command prompt runcfn-lint <path to template>to run standard linting of the template.Config FileIt will look for a configuration file in the following locations (by order of preference):.cfnlintrc,.cfnlintrc.yamlor.cfnlintrc.ymlin the current working directory~/.cfnlintrcfor the home directoryIn that file you can specify settings from the parameter section below.Example:templates:-test/fixtures/templates/good/**/*.yamlignore_templates:-codebuild.yamlinclude_checks:-Icustom_rules:custom_rules.txtParametersOptional parameters:Command LineMetadataOptionsDescription-h, --helpGet description of cfn-lint-z, --custom-rulesfilenameText file containing user-defined custom rules. Seeherefor more information-t, --templatefilenameAlternative way to specify Template file path to the file that needs to be tested by cfn-lint-f, --formatformatquiet, parseable, json, junit, pretty, sarifOutput format-l, --list-rulesList all the rules-r, --regionsregions[REGIONS [REGIONS ...]], ALL_REGIONSTest the template against many regions.Supported regions-b, --ignore-bad-templateignore_bad_templateIgnores bad template errors--ignore-templatesIGNORE_TEMPLATES [IGNORE_TEMPLATES ...]Ignore templates from being scanned-a, --append-rulesappend_rules[RULESPATH [RULESPATH ...]]Specify one or more rules paths using one or more --append-rules arguments.  Each path can be either a directory containing python files, or an import path to a module.-i, --ignore-checksignore_checks[IGNORE_CHECKS [IGNORE_CHECKS ...]]Only check rules whose ID do not match or prefix these values.  Examples:- A value ofWwill disable all warnings-W2disables all Warnings for Parameter rules.-W2001will disable ruleW2001-e, --include-experimentalinclude_experimentalWhether rules that still in an experimental state should be included in the checks-c, --include-checksINCLUDE_CHECKS [INCLUDE_CHECKS ...]Include rules whose id match these values-m, --mandatory-checksRules to check regardless of ignore configuration--non-zero-exit-codeinformational (default), warning, error, none]Exit code will be non zero from the specified rule class and higher-x,  --configure-ruleCONFIGURE_RULES [CONFIGURE_RULES ...]Provide configuration for a rule. Format RuleId:key=value. Example: E3012:strict=true-D, --debugSpecify to enable debug logging. Debug logging outputs detailed information about rules processing, useful for debugging rules.-I, --infoSpecify to enable logging. Outputs additional information about the template processing.-u, --update-specsUpdate theCloudFormation Resource Specifications.  You may need sudo to run this.  You will need internet access when running this command-o, --override-specfilenameSpec-style file containing custom definitions. Can be used to override CloudFormation specifications. More infohere-g, --build-graphCreates a file in the same directory as the template that models the template's resources inDOT format-s, --registry-schemasone or more directories ofCloudFormation RegistryResource Schemas-v, --versionVersion of cfn-lintInfo RulesTo maintain backwards compatibilityinforules are not included by default.  To include these rules you will need to include-c Ior--include-checks IMetadataTemplate Based MetadataInside the root level Metadata key you can configure cfn-lint using the supported parameters.Metadata:cfn-lint:config:regions:-us-east-1-us-east-2ignore_checks:-E2530Resource Based MetadataInside a resources Metadata key you can configure cfn-lint to ignore checks.  This will filter out failures for the resource in which the Metadata belongs. Keep in mind thatAWS::Serverlessresources may lose metadata during the Serverless transformResources:myInstance:Type:AWS::EC2::InstanceMetadata:cfn-lint:config:ignore_checks:-E3030Properties:InstanceType:nt.x4superlargeImageId:ami-abc1234Precedencecfn-lint applies configurations from several sources. The rules at lower levels are overridden by those at higher levels.cfnlintrc configurationsTemplate Metadata configurationsCLI parametersConfigure RulesCertain rules support configuration properties. You can configure these rules by usingconfigure_rulesparameter.From the command line the format isRuleId:key=value, for example:E3012:strict=true.
From the cfnlintrc or Metadata section the format isMetadata:cfn-lint:config:configure_rules:RuleId:key:valueThe configurable rules have a non-empty Config entry in the tablehere.Getting Started GuidesThere aregetting started guidesavailable in the documentation section to help with integratingcfn-lintor creating rules.RulesThis linter checks the AWS CloudFormation template by processing a collection of Rules, where every rule handles a specific function check or validation of the template.This collection of rules can be extended with custom rules using the--append-rulesargument.More information describing how rules are set up and an overview of all the Rules that are applied by this linter are documentedhere.Custom RulesThe linter supports the creation of custom one-line rules which compare any resource with a property using pre-defined operators. These custom rules take the following format:<Resource Type> <Property[*]> <Operator> <Value> [Error Level] [Custom Error Message]ExampleA separate custom rule text file must be created.The example below validatesexample_template.ymldoes not use any EC2 instances of sizem4.16xlargecustom_rule.txtAWS::EC2::Instance InstanceType NOT_EQUALS "m4.16xlarge" WARN "This is an expensive instance type, don't use it"example_template.ymlAWSTemplateFormatVersion: "2010-09-09"
Resources:
        myInstance:
                Type: AWS::EC2::Instance
                Properties:
                        InstanceType: m4.16xlarge
                        ImageId: ami-asdfefThe custom rule can be added to theconfiguration fileor ran as acommand line argumentThe linter will produce the following output, runningcfn-lint example_template.yml -z custom_rules.txt:W9001  This is an expensive instance type, don't use it
mqtemplate.yml:6:17More information describing how custom rules are setup and an overview of all operators available is documentedhere.Customize specificationsThe linter follows theAWS CloudFormation Resource Specificationsby default. However, for your use case specific requirements might exist. For example, within your organisation it might be mandatory to useTagging.The linter provides the possibility to implement these customized specifications using the--override-specargument.More information about how this feature works is documentedherepre-commitIf you'd like cfn-lint to be run automatically when making changes to files in your Git repository, you can installpre-commitand add the following text to your repositories'.pre-commit-config.yaml:repos:-repo:https://github.com/aws-cloudformation/cfn-lintrev:v0.85.3# The version of cfn-lint to usehooks:-id:cfn-lintfiles:path/to/cfn/dir/.*\.(json|yml|yaml)$If you are using a.cfnlintrcand specifying thetemplatesorignore_templateswe would recommend using the.cfnlintrcexlusively to determine which files should be scanned and then using:repos:-repo:https://github.com/aws-cloudformation/cfn-lintrev:v0.85.3# The version of cfn-lint to usehooks:-id:cfn-lint-rcNote: When mixing .cfnlintrc ignore_templates and files option in your .pre-commit-config.yaml cfn-lint may return a file not found errorIf you exclude thefiles:line above, every json/yml/yaml file will be checked.You can see available cfn-lint versions on thereleases page.