Repository: aws-cloudformation/cfn-lint

Issue:
!If seems to break rule E3012
The following template snippet (bug.yml):
```
---
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  ClusterInstanceCount:
    Description: 'The number of data nodes (instances) to use in the Amazon ES domain.'
    Type: Number
    Default: 1
Conditions:
  HasSingleClusterInstance: !Equals [!Ref ClusterInstanceCount, '1']
Resources:
  ElasticsearchDomain:
    Type: 'AWS::Elasticsearch::Domain'
    Properties:
      VPCOptions:
        SubnetIds: !If [HasSingleClusterInstance, ['SubnetAPrivate'], ['SubnetAPrivate', 'SubnetBPrivate']]
```

causes two findings with v0.3.1:
```
E3012 Property Resources/ElasticsearchDomain/Properties/VPCOptions/SubnetIds/Fn::If/1 should be of type String
bug.yml:15:9

E3012 Property Resources/ElasticsearchDomain/Properties/VPCOptions/SubnetIds/Fn::If/2 should be of type String
bug.yml:15:9
```

If I remove the `If` it validates without findings. I'm not sure if this is related to #140  or not.



Discussion:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticsearch-domain-vpcoptions.html#cfn-elasticsearch-domain-vpcoptions-subnetids

SubNetIds is an array of string, cfn-lint actually expects this. It now reads something else, since it's not specified as an "array."

It is slightly related to Issue https://github.com/awslabs/cfn-python-lint/issues/140

Something like the following setup should be valid:

```
  ElasticsearchDomain:
    Type: 'AWS::Elasticsearch::Domain'
    Properties:
      VPCOptions:
        SubnetIds:  !If
          - HasSingleClusterInstance
          - - 'SubnetAPrivate'
          - - 'SubnetAPrivate'
            - 'SubnetBPrivate'
```

Does your sample template deploy successfully?
Yea, I see the problem.  I'll try to get a hotfix in.  It is related to the issue but we should have had this scenario covered.

Resolving patch:
diff --git a/src/cfnlint/__init__.py b/src/cfnlint/__init__.py
--- a/src/cfnlint/__init__.py
+++ b/src/cfnlint/__init__.py
@@ -621,8 +621,10 @@ def get_values(self, obj, key, path=[]):
                         is_condition = True
                         results = self.get_condition_values(obj_value, path[:] + [obj_key])
                         if isinstance(results, list):
-                            matches.extend(results)
-
+                            for result in results:
+                                check_obj = obj.copy()
+                                check_obj[key] = result['Value']
+                                matches.extend(self.get_values(check_obj, key, path[:] + result['Path']))
                 if not is_condition:
                     result = {}
                     result['Path'] = path[:]


Test patch:
diff --git a/test/templates/good/resource_properties.yaml b/test/templates/good/resource_properties.yaml
--- a/test/templates/good/resource_properties.yaml
+++ b/test/templates/good/resource_properties.yaml
@@ -297,6 +297,8 @@ Parameters:
     Type: String
   ParamInstanceSecurityGroup:
     Type: List<AWS::EC2::SecurityGroup::Id>
+Conditions:
+  HasSingleClusterInstance: !Equals [!Ref 'AWS::Region', 'us-east-1']
 Resources:
   CPUAlarmHigh:
     Properties:
@@ -561,6 +563,11 @@ Resources:
       Parameters:
         sql_mode: "NO_AUTO_CREATE_USER"
         another_param: "ANOTHER_PARAMETER"
+  ElasticsearchDomain:
+    Type: 'AWS::Elasticsearch::Domain'
+    Properties:
+      VPCOptions:
+        SubnetIds: !If [HasSingleClusterInstance, ['SubnetAPrivate'], ['SubnetAPrivate', 'SubnetBPrivate']]
   Table:
     Type: 'AWS::DynamoDB::Table'
     Properties: