Package: dwcflint
dwcflint - Custom rules and wrapper for Amazon's cfnlintThis Python module is a runnable module and wrapper around Amazons cfn-lint tool for Cloudformation file linting that
adds a few extra rules. It is written in Python 3, lightweight (only a single dependency) and fast.BackgroundThis module was created at Daniel Wellington during early 2019 as we were
gradually running into various gotchas and corner cases with Cloudformation.
Some of these gotchas caused issues during testing and production of our
projects, and we started thinking about how we could automatically detect
these Cloudformation patterns and warn about them before they made it into
AWS stack deployments. This led to the discovery of AWS' cfn-lint and we
decided to create a wrapper around this tool so that we could easily bundle
custom rules for the corner cases we discovered and distribute them among
the development teams. Eventually we made the decision to open source this
module as it can be useful to other developers and organizations as well.How to run in a pipeline# assuming you have Python 3 installed
pip3 install dwcflint
dwcflint cloudformation/cf.yaml

# or for multiple files
dwcflint 'cloudformation/*.yaml'For an even simpler setup, you can add the installation line to your custom pipeline images and then just calldwcflintin your project-specific pipeline step(s).How to add new rulesTo add a new rule, create a new class in thecflint/rulesfolder that
extends theCloudFormationLintRuleclass. Then add a public method namedmatchthat takes theselfandcfnparameters. The match method should return
an array ofRuleMatchobjects or an empty array if no matches for the rule
logic were found in the Cloudformation file. Then add public string fields named
id, shortdesc and description. The id field must be prefixed with a 'W' or
an 'E' representing whether it's an error or a warning, followed by a
positive integer representing it's id.How to run locallypip3 install dwcflint
dwcflint cloudformation/cf.yaml
# or for multiple files
dwcflint 'cloudformation/*.yaml'How to run testspython3 -m unittest discover -s tests/ -t tests/List of rulesNo mismatched log groups and subscription filtersNo missing endpoint typesNo missing log retention periodNo use of deprecated lambda runtimesNo use of full access policiesNo use of leading zeroes in numbers or stringsNo missing/implicit log groups for lambdasNo use of old style subscription filtersNo use of provisioned throughputNo use of reserved environment variable namesNo use of reserved words for Dynamodb column namesNo malformed subscription filtersDependenciescfnlint (https://pypi.org/project/cfn-lint/)Sample outputE1338 Error: The mapping with the key dev.examplemall-locationA.machineid and value 0600586 will have its value's leading zero(es) stripped by aws-cli. It is highly recommended that you add a leading non-numeric character and convert it back in your code or use a number without a leading zero to avoid incorrect values.
test-data/cf.yaml:24:7

W1337 The policies of DailySalesPollerExampleMall01Role contain overly broad policies: AmazonSQSFullAccess, AmazonDynamoDBFullAccess
test-data/cf.yaml:74:1

W1337 The policies of SftpUploaderRole contain overly broad policies: AmazonDynamoDBFullAccess, AmazonSSMFullAccess
test-data/cf.yaml:74:1

W1337 The policies of PutItemShipmentsLambdaRole contain too broad policy actions: s3:*
test-data/cf.yaml:342:9

E1338 Error: The resource property with the value 01 will have its value's leading zero(es) stripped by aws-cli. It is highly recommended that you add a leading non-numeric character and convert it back in your code or use a number without a leading zero to avoid incorrect values.
test-data/cf.yaml:376:7Commandline usageusage: dwcflint [-h] [--regions REGIONS]
                  [--include-experimental INCLUDEEXPERIMENTAL]
                  [--included-rules INCLUDEDRULES]
                  [--ignored-rules IGNOREDRULES]
                  templatefile

...

positional arguments:
  templatefile          The cloudformation yaml file to be linted

optional arguments:
  -h, --help            show this help message and exit
  --regions REGIONS     A comma-separated list of AWS regions
  --include-experimental INCLUDEEXPERIMENTAL
                        Include experimental rules from Amazon?
  --included-rules INCLUDEDRULES
                        A comma-separated list of rule ids to include
  --ignored-rules IGNOREDRULES
                        A comma-separated list of rule ids to exclude