internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: aws-cloudformation/cfn-lint

Issue:
!Sub with nested, multiargument !GetAtt fails with E0002 when processing E1019
*cfn-lint version: 0.27.1*

E0002 Unknown exception while processing rule E1019: sequence item 1: expected str instance, dict_node found

```yaml
- !Sub
  - '{{resolve:ssm-secure:/${SSMMasterDBPasswordKeyFullName}:${PasswordVersion}}}'
  - PasswordVersion:
      "Fn::GetAtt":
        - CredentialsHelper
        - !Ref SSMMasterDBPasswordKeyFullNameVersion
```

I'm attempting to use !GetAtt within a !Sub's secondary arguments, which definitely works, but causes cfn-lint to blow up with the above error


Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/functions/Sub.py b/src/cfnlint/rules/functions/Sub.py
--- a/src/cfnlint/rules/functions/Sub.py
+++ b/src/cfnlint/rules/functions/Sub.py
@@ -70,7 +70,15 @@ def _test_parameters(self, parameters, cfn, tree):
                             matches.extend(self._test_parameter(value, cfn, {}, tree))
                         elif key in ['Fn::GetAtt']:
                             if isinstance(value, list):
-                                matches.extend(self._test_parameter('.'.join(value), cfn, {}, tree))
+                                # Only test this if all the items are a string
+                                if_all_strings = True
+                                for v in value:
+                                    if not isinstance(v, six.string_types):
+                                        # skip things got too complex
+                                        if_all_strings = False
+                                if if_all_strings:
+                                    matches.extend(self._test_parameter(
+                                        '.'.join(value), cfn, {}, tree))
                             elif isinstance(value, six.string_types):
                                 matches.extend(self._test_parameter(value, cfn, {}, tree))
                 else:


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
Unexpected E1029 error
*cfn-lint version: (0.29.1)*

*Description of issue.*

After this version was released, I started getting an error when linting a template.  This error specific to `BuildSpec` attributes for a `AWS::CodeBuild::Project` project.

    E1029 Found an embedded parameter outside of an "Fn::Sub" at 
    Resources/MyCodeBuild/Properties/Source/BuildSpec
    cloudformation.json:151:11

I mocked up a JSON template that showcases the problem and [attached](https://github.com/aws-cloudformation/cfn-python-lint/files/4383494/cloudformation.txt) it.



Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/functions/SubNeeded.py b/src/cfnlint/rules/functions/SubNeeded.py
--- a/src/cfnlint/rules/functions/SubNeeded.py
+++ b/src/cfnlint/rules/functions/SubNeeded.py
@@ -19,7 +19,7 @@ class SubNeeded(CloudFormationLintRule):
     # Free-form text properties to exclude from this rule
     # content is part of AWS::CloudFormation::Init
     excludes = ['UserData', 'ZipFile', 'Condition', 'AWS::CloudFormation::Init',
-                'CloudWatchAlarmDefinition', 'TopicRulePayload']
+                'CloudWatchAlarmDefinition', 'TopicRulePayload', 'BuildSpec']
     api_excludes = ['Uri', 'Body']
 
     # IAM Policy has special variables that don't require !Sub, Check for these
@@ -150,8 +150,8 @@ def match(self, cfn):
             if not found_sub:
                 # Remove the last item (the variable) to prevent multiple errors on 1 line errors
                 path = parameter_string_path[:-1]
-                message = 'Found an embedded parameter outside of an "Fn::Sub" at {}'.format(
-                    '/'.join(map(str, path)))
+                message = 'Found an embedded parameter "{}" outside of an "Fn::Sub" at {}'.format(
+                    variable, '/'.join(map(str, path)))
                 matches.append(RuleMatch(path, message))
 
         return matches


Test patch:
diff --git a/test/unit/rules/functions/test_sub_needed.py b/test/unit/rules/functions/test_sub_needed.py
--- a/test/unit/rules/functions/test_sub_needed.py
+++ b/test/unit/rules/functions/test_sub_needed.py
@@ -31,9 +31,9 @@ def test_template_config(self):
         )
         self.helper_file_rule_config(
             'test/fixtures/templates/good/functions/sub_needed_custom_excludes.yaml',
-            {}, 3
-        )        
+            {}, 4
+        )
 
     def test_file_negative(self):
         """Test failure"""
-        self.helper_file_negative('test/fixtures/templates/bad/functions/sub_needed.yaml', 4)
+        self.helper_file_negative('test/fixtures/templates/bad/functions/sub_needed.yaml', 6)
Repository: aws-cloudformation/cfn-lint

Issue:
AWS::AutoScaling::AutoScalingGroup MaxInstanceLifetime Validation
*cfn-lint version: 0.29.2*

*Description of issue.*

When using the parameter `MaxInstanceLifetime` for `AWS::AutoScaling::AutoScalingGroup` we are hit with the following lint error:

```
$ cfn-lint templates/proj/rgs/rgs_autoscale_stretch_elb.yml
E3002 Invalid Property Resources/autoscalegroup/Properties/MaxInstanceLifetime
templates/proj/rgs/rgs_autoscale_stretch_elb.yml:194:7
```

The template which leads to the error:

```
[...]

  autoscalegroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AvailabilityZones: !Ref AvailabilityZones
      Cooldown: '300'
      HealthCheckGracePeriod: !Ref GracePeriod
      HealthCheckType: ELB
      MaxSize: !Ref MaxSize
      MinSize: !Ref MinSize
      MaxInstanceLifetime: !Ref MaxInstanceLifetime
      VPCZoneIdentifier: !Ref EC2SubnetIDs
      TargetGroupARNs:
        - !Ref elbtargetgroup
      LaunchConfigurationName: !Ref launchconfiguration
      Tags: [...]
        PropagateAtLaunch: true
      TerminationPolicies:
        - Default

[..]
```

It seems the parameter is currently not supported by cfn-lint, would be cool to see support for it.


Discussion:
looks like this is in the 12.0.0 version of the spec.  Working on a release now.  You can run `cfn-lint --update-specs` or wait for the `v0.29.3` release 
@kddejong thanks for letting me know, we fixed it now by using `cfn-lint --update-specs`.
You may keep the issue open until you have released `0.29.3`

Resolving patch:
diff --git a/src/cfnlint/version.py b/src/cfnlint/version.py
--- a/src/cfnlint/version.py
+++ b/src/cfnlint/version.py
@@ -3,4 +3,4 @@
 SPDX-License-Identifier: MIT-0
 """
 
-__version__ = '0.29.3'
+__version__ = '0.29.4'


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
Python2.7 dependency issue
*cfn-lint version: 0.29.4*

Hi,

When installing a project that has cfn-lint as a dependency ([moto](https://github.com/spulec/moto)) using Python2.7, I'm getting this error:
```
Searching for networkx~=2.1
Reading https://pypi.org/simple/networkx/
...
Best match: networkx 2.4
...
NetworkX 2.3+ requires Python 3.5 or later (2.7 detected).
             
For Python 2.7, please install version 2.2 using:

$ pip install 'networkx==2.2'
```

It looks like this is due to incorrect usage of the ~= operator in setup.py:
```
'networkx~=2.4;python_version>="3.5"',
'networkx~=2.1;python_version<"3.5"'
```

This semantic has the same outcome for both python versions - use any version that's 2.x, but lower than 3.x.
IMO, this should say:
```
'networkx~=2.4;python_version>="3.5"',
'networkx<=2.2;python_version<"3.5"'
```
NetworkX 2.2 is the latest version that supports Python2: https://networkx.github.io/documentation/networkx-2.2/news.html

Happy to create a PR for this, if it's an acceptable change?


Discussion:
Some more information:
The issue can be reproduced by running the following command:
```
python setup.py sdist
```
The issue goes away when I pin cfn-lint to an older version, i.e. ```"cfn-lint>=0.4.0,<=0.28.3",``` (which was the last release before the ```networkx``` dependency was introduced)
Is there a way networkx itself can prevent networkx 2.3+ installations through Python 2? That could also theoretically solve this for all networkx dependents

I wonder how our [Python 2.7 tests end up with networkx 2.2](https://travis-ci.com/github/aws-cloudformation/cfn-python-lint/jobs/313724038)
@bblommers I think that works for me if you want to submit it.


Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -73,7 +73,7 @@ def get_version(filename):
         'pathlib2>=2.3.0;python_version<="3.4"',
         'importlib_resources~=1.0.2;python_version<"3.7"',
         'networkx~=2.4;python_version>="3.5"',
-        'networkx~=2.1;python_version<"3.5"'
+        'networkx<=2.2;python_version<"3.5"'
     ],
     python_requires='>=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*',
     entry_points={


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
False Error
*cfn-lint version: (`cfn-lint --version`)*
0.29.5

*Description of issue.*
I'm getting the following error in a [`RequestMappingTemplate`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-appsync-resolver.html#cfn-appsync-resolver-requestmappingtemplate) on [`AWS::AppSync::Resolver`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-appsync-resolver.html). I believe this should be an exception to the rule, as it's completely normal to have `${}` inside the mapping template.

>Found an embedded parameter "${context.arguments.clientId}" outside of an "Fn::Sub" at Resources/ListMemberAttributeDefinitionsResolver/Properties/RequestMappingTemplate

Example Resource:
```
  Resolver:
    Type: AWS::AppSync::Resolver
    Properties:
      ApiId: !ImportValue AppSyncApiId
      TypeName: Query
      Kind: UNIT
      FieldName: myFieldName
      DataSourceName: !GetAtt AppSyncDataSource.Name
      RequestMappingTemplate: |-
        {
            "version": "2018-05-29",
            "method": "GET",
            "params": {
                "headers": $utils.toJson($util.map.copyAndRemoveAllKeys($context.request.headers, ['host','connection','user-agent','expectation','transfer-encoding','content-length'])),
            },
            "resourcePath": "/some-path/${context.arguments.someId}"
        }
      ResponseMappingTemplate: |-
        ## return the body
        #if($context.result.statusCode == 200)
             $ctx.result.body
        #else
            ##if response is not 200, append the response to error block.
            $util.error($context.result.body, "$context.result.statusCode")
        #end
```





Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/functions/SubNeeded.py b/src/cfnlint/rules/functions/SubNeeded.py
--- a/src/cfnlint/rules/functions/SubNeeded.py
+++ b/src/cfnlint/rules/functions/SubNeeded.py
@@ -18,8 +18,10 @@ class SubNeeded(CloudFormationLintRule):
 
     # Free-form text properties to exclude from this rule
     # content is part of AWS::CloudFormation::Init
+    # RequestMappingTemplate is because of issue #1485
     excludes = ['UserData', 'ZipFile', 'Condition', 'AWS::CloudFormation::Init',
-                'CloudWatchAlarmDefinition', 'TopicRulePayload', 'BuildSpec']
+                'CloudWatchAlarmDefinition', 'TopicRulePayload', 'BuildSpec',
+                'RequestMappingTemplate']
     api_excludes = ['Uri', 'Body']
 
     # IAM Policy has special variables that don't require !Sub, Check for these


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
False positive E1029 on API GW Stage Variables with dot syntax
*cfn-lint version: 0.29.6*

In #511 you fixed a false positive when referencing API GW Stage Variables via the syntax `${stageVariables['variableName']}`, but they can also be referenced using dot syntax: `${stageVariables.variableName}`.

```
  Request:
    Type: AWS::ApiGateway::Method
    Properties:
      Integration:
        Type: HTTP_PROXY
        IntegrationHttpMethod: !Ref HttpMethod
        ConnectionType: VPC_LINK
        ConnectionId: "${stageVariables.VPCLink}"  <--- E1029
```


Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/functions/SubNeeded.py b/src/cfnlint/rules/functions/SubNeeded.py
--- a/src/cfnlint/rules/functions/SubNeeded.py
+++ b/src/cfnlint/rules/functions/SubNeeded.py
@@ -22,7 +22,7 @@ class SubNeeded(CloudFormationLintRule):
     excludes = ['UserData', 'ZipFile', 'Condition', 'AWS::CloudFormation::Init',
                 'CloudWatchAlarmDefinition', 'TopicRulePayload', 'BuildSpec',
                 'RequestMappingTemplate']
-    api_excludes = ['Uri', 'Body']
+    api_excludes = ['Uri', 'Body', 'ConnectionId']
 
     # IAM Policy has special variables that don't require !Sub, Check for these
     # https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
E2004 issue with AWS::SSM::Parameter::Value<String> Parameters
*cfn-lint version: (`cfn-lint --version`)*
0.33.0

*Description of issue.*
When using an SSM paramter store lookup to get a CIDR Range to use in a Security group, cfn-lint raised an E2004 error.

```yaml
Parameters:
  VpcID:
    Description: ID of VPC
    Type: "AWS::SSM::Parameter::Value<String>"
    Default: VpcId
    AllowedValues:
      - VpcId

  VpcCidrRange:
    Description: CIDR range of VPC
    Type: "AWS::SSM::Parameter::Value<String>"
    Default: VpcCIDRRange
    AllowedValues:
      - VpcCIDRRange

Resources:
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP egress
      VpcId: !Ref VpcID
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref VpcCidrRange
```

Error is `E2004 Cidr should be a Cidr Range based string for VpcCIDRRange product.template.yaml:9:3`

If I'm not misunderstanding, cfn-lint seems to be complaining that the String `VpcCIDRRange` is not a valid CIDR, where in fact during runtime CloudFormation will lookup the value of `VpcCIDRRange` in SSM Parameter Store and use that instead.

I guess a sensible approach here would be to disable E2004 for parameters that have a type of `AWS::SSM::Parameter::Value<String>` maybe?


Discussion:
Good catch, this file will need to be updated:
https://github.com/aws-cloudformation/cfn-python-lint/blob/fe0af928a4ab26a6cedfd76564a26c9a4120b14f/src/cfnlint/rules/parameters/CidrAllowedValues.py#L14

Resolving patch:
diff --git a/src/cfnlint/rules/parameters/CidrAllowedValues.py b/src/cfnlint/rules/parameters/CidrAllowedValues.py
--- a/src/cfnlint/rules/parameters/CidrAllowedValues.py
+++ b/src/cfnlint/rules/parameters/CidrAllowedValues.py
@@ -58,6 +58,11 @@ def check_cidr_ref(self, value, path, parameters, resources):
 
         if value in parameters:
             parameter = parameters.get(value, {})
+            parameter_type = parameters.get(value, {}).get('Type', '')
+            if parameter_type == 'AWS::SSM::Parameter::Value<String>':
+                # If we are reading from the Parameter store we can no longer
+                # check the value of the allowed values
+                return matches
             allowed_values = parameter.get('AllowedValues', None)
             if allowed_values:
                 for cidr in allowed_values:


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
Found an embedded parameter "${AWS::Partition}" outside of an "Fn::Sub" at Resources
*cfn-lint version: (`cfn-lint --version`)*
cfn-lint 0.29.5

*Description of issue.*
I have a CloudFormation Template embedded into a AWS Systems Manager Automation Document. 

Please provide as much information as possible:
* Template linting issues:

`E1029 Found an embedded parameter "${AWS::Partition}" outside of an "Fn::Sub" at Resources/DNSForwarderSetup/Properties/Content/mainSteps/0/inputs/TemplateBody
ad-3.template:433:13`

This is actually okay, I am using !Sub correctly in an Embedded CloudFormation.... 

  * Please provide a CloudFormation sample that generated the issue.

https://github.com/aws-quickstart/quickstart-microsoft-activedirectory/blob/b071c3def8d9a30fd055571c9603cad10a753f40/templates/ad-3.template#L433

  * If present, please add links to the (official) documentation for clarification.
  * Validate if the issue still exists with the latest version of `cfn-lint` and/or the latest Spec files
* Feature request:
  * Please provide argumentation about the missing feature. Context is key!
This errors if I use !Sub or Fn::Sub: when it actually correct.. 


Cfn-lint uses the [CloudFormation Resource Specifications](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html) as the base to do validation. These files are included as part of the application version. Please update to the latest version of `cfn-lint` or update the spec files manually (`cfn-lint -u`)



Discussion:

Resolving patch:
diff --git a/src/cfnlint/rules/functions/SubNeeded.py b/src/cfnlint/rules/functions/SubNeeded.py
--- a/src/cfnlint/rules/functions/SubNeeded.py
+++ b/src/cfnlint/rules/functions/SubNeeded.py
@@ -20,7 +20,7 @@ class SubNeeded(CloudFormationLintRule):
     # Free-form text properties to exclude from this rule
     excludes = ['UserData', 'ZipFile', 'Condition', 'AWS::CloudFormation::Init',
                 'CloudWatchAlarmDefinition', 'TopicRulePayload', 'BuildSpec',
-                'RequestMappingTemplate', 'LogFormat']
+                'RequestMappingTemplate', 'LogFormat', 'TemplateBody']
     api_excludes = ['Uri', 'Body', 'ConnectionId']
 
 


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
Exceptions in E3002 and E3003 when evaluating AWS::StepFunctions::StateMachine.TagsEntry for eu-west-2
Given the following template:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  StateMachineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: states.amazonaws.com
            Action: sts:AssumeRole
  
  StateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      Definition:
        StartAt: Example
      Role: !GetAtt StateMachineRole.Arn
```

The following linting errors are output when using cfn-lint 0.35.1 with the eu-west-2 region specified:

```
E0002 Unknown exception while processing rule E3002: 'AWS::StepFunctions::StateMachine.TagsEntry'
example.yml:1:1

E0002 Unknown exception while processing rule E3003: 'AWS::StepFunctions::StateMachine.TagsEntry'
example.yml:1:1
```

The errors are not shown when specifying the region as eu-west-1 or us-east-1.


Discussion:

Resolving patch:
diff --git a/scripts/update_specs_services_from_ssm.py b/scripts/update_specs_services_from_ssm.py
--- a/scripts/update_specs_services_from_ssm.py
+++ b/scripts/update_specs_services_from_ssm.py
@@ -24,7 +24,7 @@
 service_map = {
     'acm': ['AWS::CertificateManager::'],
     'apigateway': ['AWS::ApiGateway::', 'AWS::ApiGatewayV2::'],
-    'application-autoscaling': ['AWS::ApplicationAutoScaling::'],
+    # 'application-autoscaling': ['AWS::ApplicationAutoScaling::'], ## remove because SSM endpoints aren't correct
     'appstream': ['AWS::AppStream::'],
     'appsync': ['AWS::AppSync::'],
     'athena': ['AWS::Athena::'],
@@ -190,11 +190,11 @@ def add_spec_missing_services_patch(region, services):
                     for resource in sorted(spec_standard.get(standard_spec_type).keys()):
                         for spec_name in service_map.get(service):
                             if resource.startswith(spec_name):
-                                if spec_standard.get(spec_type).get(resource):
+                                if spec_standard.get(standard_spec_type).get(resource):
                                     element = {
                                         'op': 'add',
-                                        'path': '/%s/%s' % (spec_type, resource),
-                                        'value': spec_standard.get(spec_type).get(resource)
+                                        'path': '/%s/%s' % (standard_spec_type, resource),
+                                        'value': spec_standard.get(standard_spec_type).get(resource)
                                     }
                                     patches.append(element)
                                 elif standard_spec_type == 'ResourceTypes':


Test patch:
Repository: aws-cloudformation/cfn-lint

Issue:
AutoPublishAlias property in Globals section throws E0001
*cfn-lint version: (`cfn-lint --version`)*
`cfn-lint 0.34.0`

*Description of issue.*
`AutoPublishAlias` in `Globals` section, referencing template parameter throws [`E0001`](https://github.com/aws-cloudformation/cfn-python-lint/blob/master/docs/rules.md#E0001)
Having the same parameter in Function resource passes ok.

```
Transform: AWS::Serverless-2016-10-31
Parameters:
  Stage:
    Type: String
Globals:
  Function:
    Runtime: python3.8
    AutoPublishAlias: !Ref Stage
Resources:
  TestFunction:
    Type: AWS::Serverless::Function
    Properties:
      # AutoPublishAlias: !Ref Stage
      CodeUri: ..
      Handler: src.test.lambda_handler
```
`[cfn-lint] E0001: Error transforming template: Resource with id [TestFunction] is invalid. 'AutoPublishAlias' must be a string or a Ref to a template parameter`


Discussion:
Being thrown by the [Serverless transform](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/transform-aws-serverless.html) itself here: https://github.com/awslabs/serverless-application-model/blob/39be0a66412c286183d247c431c530c5550b8cf9/samtranslator/model/sam_resources.py#L377

This looks like it might be related to this issue: https://github.com/awslabs/serverless-application-model/issues/778

Resolving patch:
diff --git a/src/cfnlint/transform.py b/src/cfnlint/transform.py
--- a/src/cfnlint/transform.py
+++ b/src/cfnlint/transform.py
@@ -57,6 +57,16 @@ def _replace_local_codeuri(self):
 
         all_resources = self._template.get('Resources', {})
 
+        template_globals = self._template.get('Globals', {})
+        auto_publish_alias = template_globals.get('Function', {}).get('AutoPublishAlias')
+        if isinstance(auto_publish_alias, dict):
+            if len(auto_publish_alias) == 1:
+                for k, v in auto_publish_alias.items():
+                    if k == 'Ref':
+                        if v in self._template.get('Parameters'):
+                            self._parameters[v] = 'Alias'
+
+
         for _, resource in all_resources.items():
 
             resource_type = resource.get('Type')


Test patch: