Validate Cloudformation parameters with custom logic
Tags: cloudformation, rules
Published: 2021-02-03 15:34:32

---
title: Validate Cloudformation parameters with custom logic
published: true
description: This post shows how you can validate parameters meet logical conditions in your cloudformation stack. This allows for faster fails in circumstances when user provides properly linted but logically false values.
tags: cloudformation, rules
//cover_image: https://direct_url_to_image.jpg
---
## Scenario

I have a Cloudformation (cfn) template that can conditionally build or omit specific resources. The stack requires a RADIUS service (specifics are unimportant) and the template can either build one for the user or can accept an IP Address of a pre-existing service. I use 2 parameters to allow the user to specify how the template works:

```yaml
Parameters:
  DeployFreeRadius:
    Description: Will build a freeradius server and use as workspaces MFA. allowed values - yes, no
    Default: "yes"
    Type: String
    AllowedValues: ["yes","no"]
  ExistingRadiusIp:
    Description: If you have an existing RADIUS server, input the IP. Only Specify if DeployFreeRadius == no
    Type: String
    AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})|^(?![\s\S])'
    ConstraintDescription: Must be a valid IP address or empty
```

## The Problem

What happens if if a user says "no" to deploying RADIUS but also doesn't provide an IP? Or, what happens when they say "yes" and also provide an IP? Bad stuff, I'm sure.

Luckily, I discovered an [undocumented cloudformation feature](https://www.cloudar.be/awsblog/undocumented-feature-using-template-constraint-rules-in-cloudformation/), constraint [rules](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/reference-template_constraint_rules.html). The feature was built specifically for Service Catalog to quickly fail a stack build when a user provides untenable param values. Below are the "rules" I wrote to prevent the undesirable scenarios detailed in the previous paragraph.

```yaml
Rules:
  # Fail when any assertion returns false
  # Check if instructed do not deploy RADIUS and provides no RADIUS svr ip
  NoDeployAndNoExistingProvided:
    RuleCondition: !Equals
      - !Ref DeploySampleRADIUS
      - "no"
    Assertions:
      - AssertDescription: You must either Deploy RADIUS or specify a RADIUS Server IP
        Assert: !Not
          - !Equals
            - !Ref ExistingRADIUSIp
            - ""
  # Check if instructed to deploy RADIUS and provides also provides RADIUS svr ip
  DeployButAlsoExistingProvided:
    RuleCondition: !Equals
      - !Ref DeploySampleRADIUS
      - "yes"
    Assertions:
      - AssertDescription: You must either Deploy RADIUS or specify a RADIUS Server IP
        Assert: !Equals
            - !Ref ExistingRADIUSIp
            - ""
```

## Conclusion

If your user provides the incorrect parameter values, the stack build fails almost instantly. Here's an example of what the error looks like:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/se7iq808ydlt9d0f2029.png)

**Update:** A coworker shared that this feature actually _has_ been [documented](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/rules-section-structure.html)!