Repository: aws-cloudformation/cfn-lint

Issue:
Invalid Aliases when using SSM dynamic references
### CloudFormation Lint Version

0.83.0

### What operating system are you using?

Mac

### Describe the bug

When using a dynamic reference to resolve the Alias domain, cfn-lint fails indicating it's an invalid alias. Shouldn't the code check if this is a `REGEX_DYN_REF` in https://github.com/aws-cloudformation/cfn-lint/blob/main/src/cfnlint/rules/resources/cloudfront/Aliases.py and ignore if so?

A workaround would be to use "!Sub" which apparently is ignored already (`FUNCTIONS`). Shouldn't we also ignore when `REGEX_DYN_REF`?

### Expected behavior

E3013 shouldn't be informed, since there's no way to validate the dynamic-reference value from cfn-lint perspective (?)

### Reproduction template

```
CloudFront:
        Type: AWS::CloudFront::Distribution
        Properties:
            DistributionConfig:
                Enabled: true
                Aliases:
                    - "{{resolve:ssm:/env/fqdns/certifier}}"
                DefaultRootObject: index.html
``` 


Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/resources/cloudfront/Aliases.py b/src/cfnlint/rules/resources/cloudfront/Aliases.py
--- a/src/cfnlint/rules/resources/cloudfront/Aliases.py
+++ b/src/cfnlint/rules/resources/cloudfront/Aliases.py
@@ -4,7 +4,7 @@
 """
 import regex as re
 
-from cfnlint.helpers import FUNCTIONS
+from cfnlint.helpers import FUNCTIONS, REGEX_DYN_REF
 from cfnlint.rules import CloudFormationLintRule, RuleMatch
 
 
@@ -35,6 +35,8 @@ def match(self, cfn):
                 for alias in aliases:
                     if isinstance(alias, str) and alias not in FUNCTIONS:
                         wildcard = alias.split(".")
+                        if re.match(REGEX_DYN_REF, alias):
+                            continue
                         if "*" in wildcard[1:]:
                             path = result["Path"] + ["Aliases"]
                             message = f'Invalid use of wildcards: {alias} at {"/".join(result["Path"])}'


Test patch:
diff --git a/test/fixtures/templates/good/resources/cloudfront/aliases.yaml b/test/fixtures/templates/good/resources/cloudfront/aliases.yaml
new file mode 100644
--- /dev/null
+++ b/test/fixtures/templates/good/resources/cloudfront/aliases.yaml
@@ -0,0 +1,23 @@
+AWSTemplateFormatVersion: 2010-09-09
+Resources:
+  CloudFrontDistribution:
+    Type: "AWS::CloudFront::Distribution"
+    Properties:
+      DistributionConfig:
+        Aliases:
+          - "{{resolve:ssm:/env/fqdns/certifier}}"
+        DefaultCacheBehavior:
+          AllowedMethods:
+            - "GET"
+            - "HEAD"
+          CachedMethods:
+            - "GET"
+            - "HEAD"
+          ForwardedValues:
+            QueryString: true
+          TargetOriginId: "s3"
+          ViewerProtocolPolicy: "https-only"
+        Enabled: true
+        Origins:
+          - Id: "s3"
+            DomainName: www.example.com.s3.amazonaws.com"
diff --git a/test/unit/rules/resources/cloudfront/test_aliases.py b/test/unit/rules/resources/cloudfront/test_aliases.py
--- a/test/unit/rules/resources/cloudfront/test_aliases.py
+++ b/test/unit/rules/resources/cloudfront/test_aliases.py
@@ -4,7 +4,7 @@
 """
 from test.unit.rules import BaseRuleTestCase
 
-from cfnlint.rules.resources.cloudfront.Aliases import Aliases  # pylint: disable=E0401
+from cfnlint.rules.resources.cloudfront.Aliases import Aliases
 
 
 class TestCloudFrontAliases(BaseRuleTestCase):
@@ -14,6 +14,9 @@ def setUp(self):
         """Setup"""
         super(TestCloudFrontAliases, self).setUp()
         self.collection.register(Aliases())
+        self.success_templates = [
+            "test/fixtures/templates/good/resources/cloudfront/aliases.yaml"
+        ]
 
     def test_file_positive(self):
         """Test Positive"""