internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: aws-cloudformation/cfn-lint

Issue:
AWS::ApiGateway::Authorizer - E3008 Property "RestApiId" has no valid Fn::GetAtt options
Given the following template:

```yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
  ProvisionedProduct:
    Type: AWS::ServiceCatalog::CloudFormationProvisionedProduct
    Properties:
      ProductName: example
      ProvisioningArtifactName: v1

  Authoriser:
    Type: AWS::ApiGateway::Authorizer
    Properties:
      RestApiId: !GetAtt ProvisionedProduct.Outputs.RestApiId
      Type: TOKEN
```

The following error is output when using cfn-lint 0.42.0:

```
E3008 Property "RestApiId" has no valid Fn::GetAtt options at Resources/Authoriser/Properties/RestApiId/Fn::GetAtt
template.yml:13:7
```


Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/resources/properties/ValueRefGetAtt.py b/src/cfnlint/rules/resources/properties/ValueRefGetAtt.py
--- a/src/cfnlint/rules/resources/properties/ValueRefGetAtt.py
+++ b/src/cfnlint/rules/resources/properties/ValueRefGetAtt.py
@@ -129,7 +129,7 @@ def check_value_getatt(self, value, path, **kwargs):
             #  A custom resource voids the spec.  Move on
             return matches
 
-        if resource_type == 'AWS::CloudFormation::Stack' and resource_attribute[0] == 'Outputs':
+        if resource_type in ['AWS::CloudFormation::Stack', 'AWS::ServiceCatalog::CloudFormationProvisionedProduct'] and resource_attribute[0] == 'Outputs':
             # Nested Stack Outputs
             # if its a string type we are good and return matches
             # if its a list its a failure as Outputs can only be strings


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
E3021 after upgrading to cfn_lint-0.44.0
cfn-lint version: cfn_lint-0.44.0

Hi! 

After upgrading to version cfn_lint 0.44.0 don't validate  AWS::Events::Rule

This was reported valid since yesterday:

```yaml
  TaskSchedule:
    Type: AWS::Events::Rule
    Properties:
      Description: xxxxxxxxx
      Name: !Join ["-", [!Ref EnvironmentName, scheduled, !Ref App]]
      ScheduleExpression: "cron(15 9 * * ? *)"
      State: "ENABLED"
      Targets:
        - Arn:
            Fn::ImportValue: !Sub ${EnvironmentName}-microservice-cluster-arn
          RoleArn: !GetAtt ServiceRole.Arn
          Id: my-task
          EcsParameters:
            TaskCount: 1
            TaskDefinitionArn: !Ref TaskDefinition
```

The error reported is: `E3021 An Events Rule can have up to 5 Targets`

There is one Target so should still be valid 





Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/resources/events/RuleTargetsLimit.py b/src/cfnlint/rules/resources/events/RuleTargetsLimit.py
--- a/src/cfnlint/rules/resources/events/RuleTargetsLimit.py
+++ b/src/cfnlint/rules/resources/events/RuleTargetsLimit.py
@@ -21,6 +21,9 @@ def __init__(self):
         self.resource_property_types = ['AWS::Events::Rule']
         self.limits = {}
 
+    def initialize(self, cfn):
+        self.limits = {}
+
     # pylint: disable=W0613
     def check_value(self, value, path):
         """Count them up """


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
Ignoring ${} parameters from Fn::Sub checks
*cfn-lint version: 0.44.1*

*Description of issue.* 
I using the `AWS::ApiGatewayV2::Api` clause and referencing the [`RouteSelectionExpression`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-api.html#cfn-apigatewayv2-api-routeselectionexpression) property which takes values like `${request.body.action}`. Cloudformation accepts `RouteSelectionExpression: "${request.body.action}"` as perfectly valid but cfn-lint is triggering `E1029: Found an embedded parameter "${request.body.action}" outside of an "Fn::Sub" at Resources/agwApi/Properties/RouteSelectionExpression`. I'm not sure if there's a way to escape the ${} characters which makes cfn-lint happy as well as CFN.


Cfn-lint uses the [CloudFormation Resource Specifications](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html) as the base to do validation. These files are included as part of the application version. Please update to the latest version of `cfn-lint` or update the spec files manually (`cfn-lint -u`)



Discussion:
Ah just noticed #1278 and #740 believe the former will help address my issue. This can be closed, apologies for the duplication. 

Resolving patch:
diff --git a/src/cfnlint/rules/functions/SubNeeded.py b/src/cfnlint/rules/functions/SubNeeded.py
--- a/src/cfnlint/rules/functions/SubNeeded.py
+++ b/src/cfnlint/rules/functions/SubNeeded.py
@@ -20,7 +20,8 @@ class SubNeeded(CloudFormationLintRule):
     # Free-form text properties to exclude from this rule
     excludes = ['UserData', 'ZipFile', 'Condition', 'AWS::CloudFormation::Init',
                 'CloudWatchAlarmDefinition', 'TopicRulePayload', 'BuildSpec',
-                'RequestMappingTemplate', 'LogFormat', 'TemplateBody', 'ResponseMappingTemplate']
+                'RequestMappingTemplate', 'LogFormat', 'TemplateBody', 'ResponseMappingTemplate',
+                'RouteSelectionExpression']
     api_excludes = ['Uri', 'Body', 'ConnectionId']
 
 


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
Using !Ref in ContentUri of LayerVersion throw error E0001
*cfn-lint version: 0.43.0*

*Description of issue.*

The `ContentUri` property of a resource type [AWS::Serverless::LayerVersion][1] can be a string or a `LayerContent` object. But, if we use `!Ref` the template is marked as an error with the message:
>[cfn-lint] E0001: Error transforming template: Resource with id [CommonDependenciesLayer4ffbb56ae8] is invalid. 'ContentUri' requires Bucket and Key properties to be specified.

Here is an example:
```yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Parameters:
  EnvironmentName:
    Description: An environment name
    Type: String
    Default: staging
    AllowedValues:
      - sandbox
      - prod
      - staging

  LayerContentUri:
    Type: String
    Description: Layer content uri
    Default: '../dependencies-layer/nodejs'


Resources:
  CommonDependenciesLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub '${EnvironmentName}-common-dependencies'
      Description: 'Common dependencies'
      ContentUri: !Ref LayerContentUri
      CompatibleRuntimes:
        - nodejs12.x
      RetentionPolicy: Retain
    Metadata:
      BuildMethod: nodejs12.x
```
The template deploys ok using `sam deploy` so it is not an error. I'm already using the latest version of `cfn-lint` and already did `cfn-lint -u`

Hope this gets fixed soon.

PS: nice job!

[1]: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-layerversion.html


Discussion:

Resolving patch:
diff --git a/src/cfnlint/transform.py b/src/cfnlint/transform.py
--- a/src/cfnlint/transform.py
+++ b/src/cfnlint/transform.py
@@ -181,7 +181,13 @@ def _update_to_s3_uri(
         uri_property = resource_property_dict.get(property_key, '.')
 
         # ignore if dict or already an S3 Uri
-        if isinstance(uri_property, dict) or Transform.is_s3_uri(uri_property):
+        if isinstance(uri_property, dict):
+            if len(uri_property) == 1:
+                for k in uri_property.keys():
+                    if k == 'Ref':
+                        resource_property_dict[property_key] = s3_uri_value
+            return
+        if Transform.is_s3_uri(uri_property):
             return
 
         resource_property_dict[property_key] = s3_uri_value


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
Add AWS SSO Permission Set inline policy to IAM policy checking
E2507 "Check if IAM Policies are properly configured" should add `AWS::SSO::PermissionSet.InlinePolicy` to its list of policy properties to check.

https://github.com/aws-cloudformation/cfn-python-lint/blob/master/src/cfnlint/rules/resources/iam/Policy.py#L35

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sso-permissionset.html#cfn-sso-permissionset-inlinepolicy


Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/resources/iam/Policy.py b/src/cfnlint/rules/resources/iam/Policy.py
--- a/src/cfnlint/rules/resources/iam/Policy.py
+++ b/src/cfnlint/rules/resources/iam/Policy.py
@@ -38,6 +38,7 @@ def __init__(self):
             'AWS::IAM::Policy': 'PolicyDocument',
             'AWS::IAM::Role': 'Policies',
             'AWS::IAM::User': 'Policies',
+            'AWS::SSO::PermissionSet': 'InlinePolicy',
         }
         for resource_type in self.resources_and_keys:
             self.resource_property_types.append(resource_type)
@@ -197,7 +198,7 @@ def match_resource_properties(self, properties, resourcetype, path, cfn):
                             resource_exceptions=resource_exceptions,
                             start_mark=key.start_mark, end_mark=key.end_mark,
                         ))
-            elif key in ['KeyPolicy', 'PolicyDocument', 'RepositoryPolicyText', 'AccessPolicies']:
+            elif key in ['KeyPolicy', 'PolicyDocument', 'RepositoryPolicyText', 'AccessPolicies', 'InlinePolicy']:
                 matches.extend(
                     cfn.check_value(
                         obj=properties, key=key,
diff --git a/src/cfnlint/template.py b/src/cfnlint/template.py
--- a/src/cfnlint/template.py
+++ b/src/cfnlint/template.py
@@ -470,6 +470,10 @@ def get_location_yaml(self, text, path):
                 result = self.get_location_yaml(text[path[0]], path[1:])
             except KeyError as err:
                 pass
+            # TypeError will help catch string indices must be integers for when
+            # we parse JSON string and get a path inside that json string
+            except TypeError as err:
+                pass
             if not result:
                 try:
                     for key in text:


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
Exception processing E3037 for AWS::S3::Bucket.Transition.TransitionDate
```
$ cfn-lint --version
cfn-lint 0.44.5
```

The `TransitionDate` property is defined with `PrimitiveType: "Timestamp"`:

```yaml
AWSTemplateFormatVersion: 2010-09-09

Resources:
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            Transitions:
              - StorageClass: INTELLIGENT_TIERING
                TransitionDate: 2021-01-01T00:00:00.000Z
```

This is a valid template and can be successfully deployed, but `cfn-lint` fails with:

```
$ cfn-lint scratch.yml
E0002 Unknown exception while processing rule E3037: Object of type datetime is not JSON serializable
scratch.yml:1:1
```

Running with `--debug` shows the exception is generated at https://github.com/aws-cloudformation/cfn-python-lint/blob/c7658511bd7066417682103f21f71983c67ea6d0/src/cfnlint/rules/resources/properties/ListDuplicates.py#L36

Quoting the TransitionDate value suppresses this error, e.g. `TransitionDate: "2021-01-01T00:00:00.000Z"`


Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/resources/properties/ListDuplicates.py b/src/cfnlint/rules/resources/properties/ListDuplicates.py
--- a/src/cfnlint/rules/resources/properties/ListDuplicates.py
+++ b/src/cfnlint/rules/resources/properties/ListDuplicates.py
@@ -34,7 +34,7 @@ def _check_duplicates(self, values, path, scenario=None):
         if isinstance(values, list):
             for index, value in enumerate(values):
                 value_hash = hashlib.sha1(json.dumps(
-                    value, sort_keys=True).encode('utf-8')).hexdigest()
+                    value, sort_keys=True, default=str).encode('utf-8')).hexdigest()
                 if value_hash in list_items:
                     if not scenario:
                         message = 'List has a duplicate value at {0}'


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
E1017 with nested !Select
*cfn-lint version: (`cfn-lint --version`)*
0.46.0

*Description of issue.*
When linting this CFT YAML:
```yaml
subnet0A:
    DependsOn: ipv6CidrBlock
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref vpc
      CidrBlock: !Select
        - !Select
          - 1
          - !Split
            - ','
            - !FindInMap
              - subnetMap
              - !Ref numAzs
              - !Ref numSubnets
        - 'Fn::Cidr':
            - !GetAtt
              - vpc
              - CidrBlock
            - !Select
              - 0
              - !Split
                - ','
                - !FindInMap
                  - subnetMap
                  - !Ref numAzs
                  - !Ref numSubnets
            - !FindInMap
              - subnetMap
              - maskTocidrBits
              - !Ref subnetMask
```

I get this error:

E1017 Select index should be an Integer or a function Ref or FindInMap for Resources/subnet0A/Properties/CidrBlock/Fn::Select

Template works fine.
thanks

Cfn-lint uses the [CloudFormation Resource Specifications](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html) as the base to do validation. These files are included as part of the application version. Please update to the latest version of `cfn-lint` or update the spec files manually (`cfn-lint -u`)



Discussion:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-select.html#w2ab1c33c28c51c15 says it only supports `Ref` and `FindInMap`.  It looks like that may be inaccurate and you can also embed another select?
Correct, it seems to work for me anyway.

Resolving patch:
diff --git a/src/cfnlint/rules/functions/Select.py b/src/cfnlint/rules/functions/Select.py
--- a/src/cfnlint/rules/functions/Select.py
+++ b/src/cfnlint/rules/functions/Select.py
@@ -40,7 +40,7 @@ def match(self, cfn):
                     if isinstance(index_obj, dict):
                         if len(index_obj) == 1:
                             for index_key, _ in index_obj.items():
-                                if index_key not in ['Ref', 'Fn::FindInMap']:
+                                if index_key not in ['Ref', 'Fn::FindInMap', 'Fn::Select']:
                                     message = 'Select index should be an Integer or a function Ref or FindInMap for {0}'
                                     matches.append(RuleMatch(
                                         tree, message.format('/'.join(map(str, tree)))))


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
False negative for E1012 Ref not found
*cfn-lint version: (`cfn-lint --version`)* 0.48.0

*Description of issue.*

Example template:

```yaml
AWSTemplateFormatVersion: 2010-09-09

Resources:

  A:
    Type: AWS::Route53::HostedZone
    Properties:
      Name: example.com.

  Record:
    Type: AWS::Route53::RecordSet
    Properties:
      Name: example.com.
      Type: CNAME
      HostedZoneId: !Ref AB
      ResourceRecords:
      - example.org
```

Linting this passes even though the `!Ref AB` fails on cloudformation

Commeting out resource "A" makse it fail - it looks to me like any `!Ref` that matches a prefix will pass. This may be due to use of `re.match` in `RegexDict` without a terminating `$`.


Discussion:
Good catch. I'm on it.


Resolving patch:
diff --git a/src/cfnlint/helpers.py b/src/cfnlint/helpers.py
--- a/src/cfnlint/helpers.py
+++ b/src/cfnlint/helpers.py
@@ -204,15 +204,32 @@
 class RegexDict(dict):
 
     def __getitem__(self, item):
-        possible_items = {k: v for k, v in self.items() if re.match(k, item)}
+        possible_items = {}
+        for k, v  in self.items():
+            if isinstance(v, dict):
+                if v.get('Type') == 'MODULE':
+                    if re.match(k, item):
+                        possible_items[k] = v
+                else:
+                    if k == item:
+                        possible_items[k] = v
+            elif re.match(k, item):
+                possible_items[k] = v
         if not possible_items:
             raise KeyError
         longest_match = sorted(possible_items.keys(), key=len)[-1]
         return possible_items[longest_match]
 
     def __contains__(self, item):
-        for k in self.keys():
-            if re.match(k, item):
+        for k, v in self.items():
+            if isinstance(v, dict):
+                if v.get('Type') == 'MODULE':
+                    if re.match(k, item):
+                        return True
+                else:
+                    if k == item:
+                        return True
+            elif re.match(k, item):
                 return True
         return False
 


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
E7003 Errors when using Fn::Transform inside a Mapping
*cfn-lint version: 0.49.2*

*Description of issue.*
#2006 tightened what is considered valid for use in a Mapping.  This causes it to reject what otherwise appears to be a valid use of `Fn::Transform` as the body of a Mapping.

For example, this snippet is valid CFN:

```yaml
Mappings:
  AwsAgentPlatformMap:
    Fn::Transform:
      Name: AWS::Include
      Parameters:
        Location: s3://my-bucket-name/version/3.0.1/amazonlinux2/a-json-file.json
```

This usage trips the newly enhanced regex:

```
E7003 Mapping key (Fn::Transform) has invalid name. Name has to be alphanumeric, '-' or '.'
```


Discussion:
see https://github.com/aws-cloudformation/cfn-lint/issues/2014, planning on continuing to track this in https://github.com/aws-cloudformation/cfn-lint/issues/476

Resolving patch:
diff --git a/src/cfnlint/rules/mappings/KeyName.py b/src/cfnlint/rules/mappings/KeyName.py
--- a/src/cfnlint/rules/mappings/KeyName.py
+++ b/src/cfnlint/rules/mappings/KeyName.py
@@ -35,7 +35,7 @@ def check_key(self, key, path):
         if not isinstance(key, six.string_types):
             message = 'Mapping key ({0}) has to be a string.'
             matches.append(RuleMatch(path[:], message.format(key)))
-        elif not re.match('^[a-zA-Z0-9.-]{1,255}$', key):
+        elif not re.match('^[a-zA-Z0-9.-]{1,255}$', key) and key != 'Fn::Transform':
             message = 'Mapping key ({0}) has invalid name. Name has to be alphanumeric, \'-\' or \'.\''
             matches.append(RuleMatch(path[:], message.format(key)))
 


Test patch:
diff --git a/test/fixtures/templates/good/mappings/key_name.yaml b/test/fixtures/templates/good/mappings/key_name.yaml
--- a/test/fixtures/templates/good/mappings/key_name.yaml
+++ b/test/fixtures/templates/good/mappings/key_name.yaml
@@ -1,5 +1,10 @@
 AWSTemplateFormatVersion: "2010-09-09"
 Mappings:
+  AwsAgentPlatformMap:
+    Fn::Transform:
+      Name: AWS::Include
+      Parameters:
+        Location: s3://my-bucket-name/version/3.0.1/amazonlinux2/a-json-file.json
   myMap:
     '123456789012':
       AMI: "ami-7f418316"
Repository: aws-cloudformation/cfn-lint

Issue:
Incorrect E1029 errors when literal YAML block style is used
*cfn-lint version: 0.51.0

Embedded parameters are being flagged for not being wrapped in a `!Sub`, but they are in fact wrapped in a `!Sub`.

Please provide as much information as possible:

Sample template (extraneous lines have been removed):
```yaml
Resources:
  SomeStackset:
    Type: AWS::CloudFormation::StackSet
    Properties:
      TemplateBody: |
        Resources:
          SomeRole:
            Type: AWS::IAM::Role
            Properties:
              Policies:
                -
                  PolicyName: SomeName
                  PolicyDocument:
                    Version: 2012-10-17
                    Statement:
                      -
                        Effect: Allow
                        Action:
                          - iam:GetSomething
                        Resource:
                          - !Sub arn:aws:iam::${AWS::AccountId}:role/SomeRole*
```

The error is an [E1029](https://github.com/aws-cloudformation/cfn-lint/blob/main/src/cfnlint/rules/functions/SubNeeded.py), and the line number referenced is the line number where the YAML literal appears (here, the line that contains `TemplateBody: |`)

This appears to be a new issue with [release 0.51.0](https://github.com/aws-cloudformation/cfn-lint/releases/tag/v0.51.0). The code in question above hasn't changed in my repo for a long time, and I don't get the error on previous releases.



Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/functions/SubNeeded.py b/src/cfnlint/rules/functions/SubNeeded.py
--- a/src/cfnlint/rules/functions/SubNeeded.py
+++ b/src/cfnlint/rules/functions/SubNeeded.py
@@ -18,6 +18,8 @@ class SubNeeded(CloudFormationLintRule):
     source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-sub.html'
     tags = ['functions', 'sub']
 
+    exceptions = ['TemplateBody']
+
     def __init__(self):
         """Init"""
         super(SubNeeded, self).__init__()
@@ -111,7 +113,7 @@ def match(self, cfn):
             var_stripped = var[2:-1].strip()
 
             # If we didn't find an 'Fn::Sub' it means a string containing a ${parameter} may not be evaluated correctly
-            if not 'Fn::Sub' in parameter_string_path:
+            if not 'Fn::Sub' in parameter_string_path and parameter_string_path[-2] not in self.exceptions:
                 if (var_stripped in refs or var_stripped in getatts) or 'DefinitionString' in parameter_string_path:
                     # Remove the last item (the variable) to prevent multiple errors on 1 line errors
                     path = parameter_string_path[:-1]


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
`InstanceRefresh` flagged as invalid value for `SuspendProcesses`
*cfn-lint version: 0.54.3*

`InstanceRefresh` is missing from the allowed values in the `SuspendProcesses` key of the ASG rolling update policy:
```
E3016 Allowed values for SuspendProcesses are (Launch, Terminate, HealthCheck, ReplaceUnhealthy, AZRebalance, AlarmNotification, ScheduledActions, AddToLoadBalancer)
```

For reference, [the documentation](https://docs.aws.amazon.com/autoscaling/ec2/APIReference/API_SuspendProcesses.html) lists the following:

- Launch
- Terminate
- AddToLoadBalancer
- AlarmNotification
- AZRebalance
- HealthCheck
- InstanceRefresh
- ReplaceUnhealthy
- ScheduledActions

Sample template:
```yaml
---
AWSTemplateFormatVersion: 2010-09-09
Resources:
  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    UpdatePolicy:
      AutoScalingRollingUpdate:
        SuspendProcesses:
          - InstanceRefresh
    Properties:
      MinSize: 1
      MaxSize: 1
      LaunchConfigurationName: placeholder
```


Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/resources/updatepolicy/Configuration.py b/src/cfnlint/rules/resources/updatepolicy/Configuration.py
--- a/src/cfnlint/rules/resources/updatepolicy/Configuration.py
+++ b/src/cfnlint/rules/resources/updatepolicy/Configuration.py
@@ -39,7 +39,7 @@ class Configuration(CloudFormationLintRule):
                     'ValidValues': [
                         'Launch', 'Terminate', 'HealthCheck',
                         'ReplaceUnhealthy', 'AZRebalance', 'AlarmNotification',
-                        'ScheduledActions', 'AddToLoadBalancer'
+                        'ScheduledActions', 'AddToLoadBalancer', 'InstanceRefresh',
                     ]
                 },
                 'WaitOnResourceSignals': {


Test patch: