Repository: aws-cloudformation/cfn-lint

Issue:
Using `Fn::Split` in `ManagedPolicyArns` as part of a `AWS::IAM::Role` results in incorrect E1018 error
*cfn-lint version: 0.4.2*

*Description of issue.*

Using `Fn::Split` in `ManagedPolicyArns` as part of a `AWS::IAM::Role` results in incorrect E1018 error.

e.g.
```
E1018 Split unsupported function for Resources/EnhancedMonitoringRole/Properties/ManagedPolicyArns/Fn::Split
```

However, I think this is incorrect, since I have been able to produce a working stack based off a template that has this snippet:

```
...<snip>...
Parameters:
  MandatoryPolicies:
    Description: Provide a list of policies that are mandatory on all roles
    Type: CommaDelimitedList
...<snip>...
Resources:
  EnhancedMonitoringRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: monitoring.rds.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns: !Split
        - ","
        - !Sub
          - "${PolicyList},arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
          - PolicyList: !Join [",", !Ref "MandatoryPolicies"]
```

I passed the parameter this string (well, this is a sanitised version of it anyway...):
```
arn:aws:iam::999912312399:policy/SecOpsRestrictionPolicy,arn:aws:iam::999912312399:policy/IAMRestrictionPolicy
``` 

If you point me in the right direction, I may be able to contribute a patch.


Discussion:
I need to make the error message better.  Sorry about that.  What I think its really triggering on is the use of the Sub in the Split which isn't a supported function according to the documentation.  However this wouldn't be the first time that we have found issues with the documentation.  I'm hoping I can test this quick to validate and add support for Sub in Split. Should try to update the documentation to.
 https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-split.html#w2ab2c21c28c55c15

Resolving patch:
diff --git a/src/cfnlint/rules/functions/Split.py b/src/cfnlint/rules/functions/Split.py
--- a/src/cfnlint/rules/functions/Split.py
+++ b/src/cfnlint/rules/functions/Split.py
@@ -43,6 +43,7 @@ def match(self, cfn):
             'Fn::If',
             'Fn::Join',
             'Fn::Select',
+            'Fn::Sub',
             'Ref'
         ]
 
@@ -61,9 +62,9 @@ def match(self, cfn):
                         if len(split_string) == 1:
                             for key, _ in split_string.items():
                                 if key not in supported_functions:
-                                    message = 'Split unsupported function for {0}'
+                                    message = 'Fn::Split doesn\'t support the function {0} at {1}'
                                     matches.append(RuleMatch(
-                                        tree + [key], message.format('/'.join(map(str, tree)))))
+                                        tree + [key], message.format(key, '/'.join(map(str, tree)))))
                         else:
                             message = 'Split list of singular function or string for {0}'
                             matches.append(RuleMatch(


Test patch: