Repository: aws-cloudformation/cfn-lint

Issue:
E3031: ManagedPolicyArns contains invalid characters... for a valid managed Policy
*cfn-lint version: 0.49.2*

I'm getting this cfn-lint error for a sam-cli template:
```
[cfn-lint] E3031: ManagedPolicyArns contains invalid characters (Pattern: arn:(aws[a-zA-Z-]*)?:iam::(\d{12}|aws):policy/[a-zA-Z_0-9+=,.@\-_/]+) at Resources/MyFunctionRole/Properties/ManagedPolicyArns/4
```

specifically for the `CloudWatchLambdaInsightsExecutionRolePolicy` policy:
```yaml
Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
    ...
      Policies:
        - AWSLambdaRole       # AWS Managed Role to allow Lambda invokation permissions
        - CloudWatchLambdaInsightsExecutionRolePolicy   # Lambda Insights
```

but that error is not applicable since this syntax works and is officially supported via the documentation:
https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html#sam-function-policies

where it states:
`This property accepts a single string or a list of strings, and can be the name of AWS managed policies or...`



Discussion:
Translated.  Weird that SAM translates `AWSLambdaRole` into the full ARN but not `CloudWatchLambdaInsightsExecutionRolePolicy`

```json
"MyFunctionRole": {
  "Type": "AWS::IAM::Role",
  "Properties": {
    ...
    "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
          "arn:aws:iam::aws:policy/service-role/AWSLambdaRole",
          "CloudWatchLambdaInsightsExecutionRolePolicy"
    ],
    ...
  }
}
```
It's not doing `AmazonElasticFileSystemClientReadWriteAccess` either.  Is there a pending fix for this?
pattern here if it needs to be changed:
https://github.com/aws-cloudformation/cfn-lint/blob/df8b91b2af04edf6fae32a0e6e00f3537a721c5e/src/cfnlint/data/ExtendedSpecs/all/03_value_types/aws_iam.json#L13-L15
Are folks experiencing this as a bug with SAM translation, or as a bug purely at the linting level - like a misreported problem? I'm trying to isolate / identify whether problems I'm experiencing are related to this issue, but I'm not clear on what ought to work.

In other words, should it work to do this, and I just ignore the linting error?

```YAML
Policies:
  - AmazonElasticFileSystemClientReadWriteAccess
  - AWSLambdaVPCAccessExecutionRole
```

Or should should I believe the linting error and use a fully qualified ARN instead?

```YAML
Policies:
  - arn:aws:iam::aws:policy/AmazonElasticFileSystemClientReadWriteAccess
  - AWSLambdaVPCAccessExecutionRole
```
When doing this  in an account.  This makes me think the SAM translator package is not doing the same as what is happening in actuality.
```json
"ManagedPolicyArns": [
  "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  "arn:aws:iam::aws:policy/service-role/AWSLambdaRole",
  "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
],
```
@kddejong wonder if this new SAM release is the difference:
https://github.com/aws-cloudformation/cfn-lint/pull/2027
Upgrading should pick that up:
`pip3 install cfn-lint --upgrade`
_cfn-lint 0.53.0_

The issue still persists. 
I concur, it is still happening w/ cfn-lint 0.53.0
I am experiencing this issue as well.
Given that the the SAM templates work fine with this format
```yml
Policies:
  - AmazonElasticFileSystemClientReadWriteAccess
  - AWSLambdaVPCAccessExecutionRole
```

and given that this project's goal is to identify issues with the CloudFormation YML, and this is obviously _not_ an issue since the SAM YML translates and deploys fine, this should be considered a **bug** - and one that means I cannot use this tool in a validation pipeline to catch errors... which is kinda the point of this tool.

When I view the processed final template in the CloudFormation console, the YML format does not add the `arn:aws:iam::aws:policy/` prefix but the JSON format does. I guess that means that the YML format is valid without the prefix.

Now, I'm not sure what the right fix is in the project code though since I presume the only values that are allowed that are String values not ARN values are those that are pre-defined AWS Policies. It seems high maintenance to include a fixed list of those policies but maybe that's better than failing on them?



Resolving patch:
diff --git a/scripts/update_serverless_aws_policies.py b/scripts/update_serverless_aws_policies.py
new file mode 100755
--- /dev/null
+++ b/scripts/update_serverless_aws_policies.py
@@ -0,0 +1,30 @@
+#!/usr/bin/env python
+"""
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+SPDX-License-Identifier: MIT-0
+"""
+
+import logging
+import boto3
+import json
+from samtranslator.translator.managed_policy_translator import ManagedPolicyLoader
+LOGGER = logging.getLogger('cfnlint')
+
+
+def main():
+    session = boto3.session.Session()
+    client = session.client('iam', region_name='us-east-1')
+
+    policyLoader = ManagedPolicyLoader(client)
+    policyLoader.load()
+
+    filename = 'src/cfnlint/data/Serverless/ManagedPolicies.json'
+    with open(filename, 'w+') as f:
+        json.dump(policyLoader._policy_map, f, indent=2, sort_keys=True, separators=(',', ': '))
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (ValueError, TypeError):
+        LOGGER.error(ValueError)


Test patch: