Repository: aws-cloudformation/cfn-lint

Issue:
W2030 Default value required on conditionally included property
*cfn-lint version: 0.21.3*

CloudFormation provides the AWS::NoValue pseudo-parameter, which allows for a property to be included based on a given Condition. However, cfn-lint will still validate the potential value provided for the property, even if it will not actually be used in the deployment.

Example template:

```yaml
Parameters:
  Retention:
    Type: Number
    Description: Retention in days for the log group (-1 for no retention)
    Default: -1
Conditions:
  IsRetention: 
    !Not [!Equals [!Ref 'Retention', '-1']]
Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: 'some-log-group'
      RetentionInDays: !If [IsRetention, !Ref Retention, !Ref 'AWS::NoValue']
```

This template allows the user to specify the retention on a log group, or use the number -1 if they wish to have unlimited retention. This is achieved via a Condition as well as an If block that conditionally includes the property.

This leads to the following linter output:

```
cfn-lint --template template.yaml
W2030 You must specify a valid Default value for Retention (-1).   
Valid values are ['1', '3', '5', '7', '14', '30', '60', '90', '120', '150', '180', '365', '400', '545', '731', '1827', '3653']
cloudformation/template.yaml:5:5
```

This can of course be avoided by disabling this specific check in the template Metadata block. Unfortunately it cannot be disabled in the resource Metadata, as the validation error happens on the Parameter:

```yaml
Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - W2030
```

This might be a difficult situation to account for, since it would require the Condition to be evaluated to determine whether the property itself should even be checked.


Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/parameters/AllowedValue.py b/src/cfnlint/rules/parameters/AllowedValue.py
--- a/src/cfnlint/rules/parameters/AllowedValue.py
+++ b/src/cfnlint/rules/parameters/AllowedValue.py
@@ -36,10 +36,14 @@ def initialize(self, cfn):
         for property_type_spec in RESOURCE_SPECS.get(cfn.regions[0]).get('PropertyTypes'):
             self.resource_sub_property_types.append(property_type_spec)
 
-    def check_value_ref(self, value, **kwargs):
+    def check_value_ref(self, value, path, **kwargs):
         """Check Ref"""
         matches = []
 
+        if 'Fn::If' in path:
+            self.logger.debug('Not able to guarentee that the default value hasn\'t been conditioned out')
+            return matches
+
         allowed_value_specs = kwargs.get('value_specs', {}).get('AllowedValues', {})
         cfn = kwargs.get('cfn')
 


Test patch:
diff --git a/test/fixtures/templates/good/resources/properties/allowed_values.yaml b/test/fixtures/templates/good/resources/properties/allowed_values.yaml
--- a/test/fixtures/templates/good/resources/properties/allowed_values.yaml
+++ b/test/fixtures/templates/good/resources/properties/allowed_values.yaml
@@ -31,12 +31,25 @@ Parameters:
     Default: 1
     Description: The retention length of the logs.
     Type: Number
+  Retention:
+    Type: Number
+    Description: Retention in days for the log group (-1 for no retention)
+    Default: -1
+Conditions:
+  IsRetention:
+    !Not [!Equals [!Ref 'Retention', '-1']]
 Resources:
   LogGroup:
     Type: "AWS::Logs::LogGroup"
     Properties:
       RetentionInDays: !Ref LogsRetentionLength
       LogGroupName: '/name'
+  LogGroupWithCondition:
+    Type: AWS::Logs::LogGroup
+    Properties:
+      LogGroupName: 'some-log-group'
+      # Don't error when Retention is used inside a condition
+      RetentionInDays: !If [IsRetention, !Ref Retention, !Ref 'AWS::NoValue']
   AmazonMQBroker:
     Type: "AWS::AmazonMQ::Broker"
     Properties: