Repository: aws-cloudformation/cfn-lint

Issue:
E3503 does not match CloudFormation - requires ValidationDomain when CF does not want it
*cfn-lint version: (`cfn-lint --version`)*

cfn-lint 0.33.2

*Description of issue.*

I created an ACM certificate resource, and there were problems configuring the `DomainValidationOptions` block. If using DNS validation, the only properties needed are `DomainName` and `HostedZoneId`. However, cfn-lint was demanding a third property named `ValidationDomain`. When submitting the stack for deployment to CF, it triggered an immediate rollback because CF views `HostedZoneId` and `ValidationDomain` as mutually exclusive.

Adding an ignore rule to skip the E3503 error allowed me to proceed without issues. This rule should be adjusted to match what CF enforces.

**Sample:**

```yaml
Resources:
  Certificate:
    Type: AWS::CertificateManager::Certificate
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - E3503
    Properties:
      DomainName: "*.aws.domain.com"
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: aws.domain.com
          HostedZoneId: !ImportValue SubdomainHostedZoneId
```



Discussion:
Agreed.  Thanks for reporting.  We will work on getting this fixed. 

Resolving patch:
diff --git a/src/cfnlint/rules/resources/certificatemanager/DomainValidationOptions.py b/src/cfnlint/rules/resources/certificatemanager/DomainValidationOptions.py
--- a/src/cfnlint/rules/resources/certificatemanager/DomainValidationOptions.py
+++ b/src/cfnlint/rules/resources/certificatemanager/DomainValidationOptions.py
@@ -29,8 +29,8 @@ def check_value(self, value, path, **kwargs):
             for property_set in property_sets:
                 properties = property_set.get('Object')
                 scenario = property_set.get('Scenario')
-                domain_name = properties.get('DomainName', '')
-                validation_domain = properties.get('ValidationDomain', '')
+                domain_name = properties.get('DomainName', None)
+                validation_domain = properties.get('ValidationDomain', None)
                 if isinstance(domain_name, six.string_types) and isinstance(validation_domain, six.string_types):
                     if domain_name == validation_domain:
                         continue


Test patch:
diff --git a/test/fixtures/templates/good/resources/certificatemanager/domain_validation_options.yaml b/test/fixtures/templates/good/resources/certificatemanager/domain_validation_options.yaml
--- a/test/fixtures/templates/good/resources/certificatemanager/domain_validation_options.yaml
+++ b/test/fixtures/templates/good/resources/certificatemanager/domain_validation_options.yaml
@@ -14,3 +14,12 @@ Resources:
       DomainValidationOptions:
         - DomainName: "example.com"
           ValidationDomain: "example.com"
+  Certificate3:
+    Type: AWS::CertificateManager::Certificate
+    Properties:
+      DomainName: "*.aws.domain.com"
+      ValidationMethod: DNS
+      DomainValidationOptions:
+        # Don't fail when one of the values don't exist
+        - DomainName: aws.domain.com
+          HostedZoneId: !ImportValue SubdomainHostedZoneId