Repository: aws-cloudformation/cfn-lint

Issue:
W2030 Default value required on conditionally included property
*cfn-lint version: 0.21.3*

CloudFormation provides the AWS::NoValue pseudo-parameter, which allows for a property to be included based on a given Condition. However, cfn-lint will still validate the potential value provided for the property, even if it will not actually be used in the deployment.

Example template:

```yaml
Parameters:
  Retention:
    Type: Number
    Description: Retention in days for the log group (-1 for no retention)
    Default: -1
Conditions:
  IsRetention: 
    !Not [!Equals [!Ref 'Retention', '-1']]
Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: 'some-log-group'
      RetentionInDays: !If [IsRetention, !Ref Retention, !Ref 'AWS::NoValue']
```

This template allows the user to specify the retention on a log group, or use the number -1 if they wish to have unlimited retention. This is achieved via a Condition as well as an If block that conditionally includes the property.

This leads to the following linter output:

```
cfn-lint --template template.yaml
W2030 You must specify a valid Default value for Retention (-1).   
Valid values are ['1', '3', '5', '7', '14', '30', '60', '90', '120', '150', '180', '365', '400', '545', '731', '1827', '3653']
cloudformation/template.yaml:5:5
```

This can of course be avoided by disabling this specific check in the template Metadata block. Unfortunately it cannot be disabled in the resource Metadata, as the validation error happens on the Parameter:

```yaml
Metadata:
  cfn-lint:
    config:
      ignore_checks:
        - W2030
```

This might be a difficult situation to account for, since it would require the Condition to be evaluated to determine whether the property itself should even be checked.


Discussion:
You have the same problem if the Condition is set on the Resource instead of the property:

```
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !Ref Retention
    Condition: IsRetention
```



Resolving patch:
diff --git a/src/cfnlint/rules/parameters/AllowedValue.py b/src/cfnlint/rules/parameters/AllowedValue.py
--- a/src/cfnlint/rules/parameters/AllowedValue.py
+++ b/src/cfnlint/rules/parameters/AllowedValue.py
@@ -40,12 +40,19 @@ def check_value_ref(self, value, path, **kwargs):
         """Check Ref"""
         matches = []
 
+        cfn = kwargs.get('cfn')
         if 'Fn::If' in path:
-            self.logger.debug('Not able to guarentee that the default value hasn\'t been conditioned out')
+            self.logger.debug(
+                'Not able to guarentee that the default value hasn\'t been conditioned out')
+            return matches
+        if path[0] == 'Resources' and 'Condition' in cfn.template.get(
+                path[0], {}).get(path[1]):
+            self.logger.debug(
+                'Not able to guarentee that the default value '
+                'hasn\'t been conditioned out')
             return matches
 
         allowed_value_specs = kwargs.get('value_specs', {}).get('AllowedValues', {})
-        cfn = kwargs.get('cfn')
 
         if allowed_value_specs:
             if value in cfn.template.get('Parameters', {}):
@@ -63,13 +70,15 @@ def check_value_ref(self, value, path, **kwargs):
                                 if str(allowed_value) not in allowed_value_specs:
                                     param_path = ['Parameters', value, 'AllowedValues', index]
                                     message = 'You must specify a valid allowed value for {0} ({1}).\nValid values are {2}'
-                                    matches.append(RuleMatch(param_path, message.format(value, allowed_value, allowed_value_specs)))
+                                    matches.append(RuleMatch(param_path, message.format(
+                                        value, allowed_value, allowed_value_specs)))
                         if default_value:
                             # Check Default, only if no allowed Values are specified in the parameter (that's covered by E2015)
                             if str(default_value) not in allowed_value_specs:
                                 param_path = ['Parameters', value, 'Default']
                                 message = 'You must specify a valid Default value for {0} ({1}).\nValid values are {2}'
-                                matches.append(RuleMatch(param_path, message.format(value, default_value, allowed_value_specs)))
+                                matches.append(RuleMatch(param_path, message.format(
+                                    value, default_value, allowed_value_specs)))
 
         return matches
 
@@ -87,7 +96,8 @@ def check(self, cfn, properties, value_specs, property_specs, path):
                             cfn.check_value(
                                 p_value, prop, p_path,
                                 check_ref=self.check_value_ref,
-                                value_specs=RESOURCE_SPECS.get(cfn.regions[0]).get('ValueTypes').get(value_type, {}),
+                                value_specs=RESOURCE_SPECS.get(cfn.regions[0]).get(
+                                    'ValueTypes').get(value_type, {}),
                                 cfn=cfn, property_type=property_type, property_name=prop
                             )
                         )
@@ -98,7 +108,8 @@ def match_resource_sub_properties(self, properties, property_type, path, cfn):
         """Match for sub properties"""
         matches = list()
 
-        specs = RESOURCE_SPECS.get(cfn.regions[0]).get('PropertyTypes').get(property_type, {}).get('Properties', {})
+        specs = RESOURCE_SPECS.get(cfn.regions[0]).get(
+            'PropertyTypes').get(property_type, {}).get('Properties', {})
         property_specs = RESOURCE_SPECS.get(cfn.regions[0]).get('PropertyTypes').get(property_type)
         matches.extend(self.check(cfn, properties, specs, property_specs, path))
 
@@ -108,7 +119,8 @@ def match_resource_properties(self, properties, resource_type, path, cfn):
         """Check CloudFormation Properties"""
         matches = list()
 
-        specs = RESOURCE_SPECS.get(cfn.regions[0]).get('ResourceTypes').get(resource_type, {}).get('Properties', {})
+        specs = RESOURCE_SPECS.get(cfn.regions[0]).get(
+            'ResourceTypes').get(resource_type, {}).get('Properties', {})
         resource_specs = RESOURCE_SPECS.get(cfn.regions[0]).get('ResourceTypes').get(resource_type)
         matches.extend(self.check(cfn, properties, specs, resource_specs, path))
 


Test patch:
diff --git a/test/fixtures/templates/good/resources/properties/allowed_values.yaml b/test/fixtures/templates/good/resources/properties/allowed_values.yaml
--- a/test/fixtures/templates/good/resources/properties/allowed_values.yaml
+++ b/test/fixtures/templates/good/resources/properties/allowed_values.yaml
@@ -50,6 +50,11 @@ Resources:
       LogGroupName: 'some-log-group'
       # Don't error when Retention is used inside a condition
       RetentionInDays: !If [IsRetention, !Ref Retention, !Ref 'AWS::NoValue']
+  LogGroupWithResourceCondition:
+    Type: AWS::Logs::LogGroup
+    Condition: IsRetention
+    Properties:
+      RetentionInDays: !Ref Retention
   AccessKey:
     Type: "AWS::IAM::AccessKey"
     Properties: