Repository: aws-cloudformation/cfn-lint

Issue:
E3003 Property CidrBlock missing
*cfn-lint version: 0.8.3*

*Description of issue.*

When using `AWS::EC2::NetworkAclEntry` for an IpV6 CIDR using `Ipv6CidrBlock` instead of `CidrBlock` (see snippet below), I get this error:

```console
E3003 Property CidrBlock missing at Resources/rNaclDefaultEntryIpv6/Properties
vpc.yml:117:5
```

Please provide as much information as possible:

* Template linting issues:

```console
  rNaclDefaultEntryIpv6:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      Ipv6CidrBlock: ::/0
      Protocol: -1
      RuleAction: deny
      RuleNumber: 2
      NetworkAclId: !GetAtt [rVpc, DefaultNetworkAcl]
```

`Ipv6CidrBlock` is a valid property.


Discussion:
@tracphil we use the CloudFormation spec to help drive some of these rules.  https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html

From the spec we have this.
```
  "AWS::EC2::NetworkAclEntry": {
      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-network-acl-entry.html",
      "Properties": {
        "CidrBlock": {
          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-network-acl-entry.html#cfn-ec2-networkaclentry-cidrblock",
          "PrimitiveType": "String",
          "Required": true,
          "UpdateType": "Mutable"
        },
```

According to the documentation.
```
Required: Conditional. You must specify the CidrBlock or Ipv6CidrBlock property.
```

Which means this should be required False.  We have spec addendum we could use to provide a check to make sure we have at least one.  Also we have created a method to patch the spec to fix the issue in the short term.  @cmmeyer and @rjlohan for visibility.  

Resolving patch:
diff --git a/src/cfnlint/maintenance.py b/src/cfnlint/maintenance.py
--- a/src/cfnlint/maintenance.py
+++ b/src/cfnlint/maintenance.py
@@ -304,6 +304,21 @@ def patch_spec(content, region):
                 {'op': 'replace', 'path': '/ResourceTypes/AWS::SNS::Subscription/Properties/Protocol/Required', 'value': True}
             ])
         },
+        {
+            'Name': 'AWS::SNS::Subscription TopicArn and Protocol IS required',
+            'Regions': ['All'],
+            'Patch': jsonpatch.JsonPatch([
+                {'op': 'replace', 'path': '/ResourceTypes/AWS::SNS::Subscription/Properties/TopicArn/Required', 'value': True},
+                {'op': 'replace', 'path': '/ResourceTypes/AWS::SNS::Subscription/Properties/Protocol/Required', 'value': True}
+            ])
+        },
+        {
+            'Name': 'AWS::EC2::NetworkAclEntry CidrBlock or Ipv6CidrBlock is required',
+            'Regions': ['All'],
+            'Patch': jsonpatch.JsonPatch([
+                {'op': 'replace', 'path': '/ResourceTypes/AWS::EC2::NetworkAclEntry/Properties/CidrBlock/Required', 'value': False}
+            ])
+        },
         {
             'Name': 'AWS::SDB::Domain not supported for all regions',
             'Regions': ['us-east-2', 'ca-central-1', 'eu-central-1', 'eu-west-2', 'eu-west-3', 'ap-northeast-2', 'ap-south-1'],


Test patch: