ARN validation failure on imported values

[jonscheiding]

I'm getting validation errors when trying to use !ImportValue for properties that expect an ARN.

Sample template:

Resources:
  DomainName:
    Type: AWS::ApiGateway::DomainName
    Properties:
      RegionalCertificateArn: !ImportValue ExportedRegionalCertificateArn
      DomainName: some.domain.com
      EndpointConfiguration:
        Types:
          - REGIONAL

I get the following result:

1 crit
Resource: Resources > DomainName > Properties > RegionalCertificateArn
Message: Expecting an ARN, got 'IMPORTEDVALUEExportedRegionalCertificateArn'
Documentation: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-domainname.html

I tried doing something similar with a different type of resource that also expects an ARN:

Resources:
  User:
    Type: "AWS::IAM::User"
    Properties: 
      ManagedPolicyArns:
        - !ImportValue ExportedManagedPolicyArn
      UserName: "someuser"

This passed, but it passes even if I put in a garbage non-ARN, so it doesn't appear to be doing the validation at all.

I am using cfn-lint@1.7.2.

Similar to #143, but so far I don't see a workaround. I'm happy to work on a PR, if this is indeed erroneous behavior.

Thanks!

[jonscheiding]

I just noticed the item about injection for ImportValue in the feature backlog. Does that mean there's no reasonable workaround at this time?

[martysweet]

Hi @jonscheiding,

That's correct. This is something that needs to be added on the CLI.

Should just be:

• Add to CLI to make a dict
• On ImportValue Intrinsic, check the dict for value, otherwise compute value (like it's already doing)

[jonscheiding]

@martysweet Thanks for the response!

I would like to work on this, but it may be a while coming as I don't have a lot of bandwidth right now. I'll open a PR once I get some progress.

[martysweet]

Hi @jonscheiding, this is now released in v1.8.0! Thanks for the contribution!