[kddejong]

Summary

{"Fn::GetAtt": "MyResource"} (JSON string form without a .) crashed cfn-lint with an unhandled IndexError: list index out of range, surfaced as E1010 Exception 'list index out of range' raised while validating 'fn_getatt'.

The string form is split on the first "." into [resource, attribute]. The schema's minItems/maxItems only constrain the array form (they are ignored for strings), so a dotless string produced a single-element list that passed validation, and _resolve_getatt then indexed value[1] and crashed.

This fixes it in two complementary ways:

1. Schema (getatt.json): add a pattern so the string form must contain a resource and an attribute separated by a dot. The resource segment is a CloudFormation logical id ([a-zA-Z0-9]+); the attribute is left unconstrained (.+) so custom-resource attribute names (underscores, hyphens) and nested attributes (.Outputs.X) are still accepted. The real per-resource attribute validation continues to happen in _resolve_getatt.
2. Rule (GetAtt.py): a guard emits a clear message and returns before the crashing value[1] index, so a malformed value can never crash even if the schema is bypassed.

The array form ({"Fn::GetAtt": ["MyResource"]}) and the YAML shorthand (!GetAtt MyResource) were already handled by minItems: 2.

Fixes #4694

Behavior

Before:

E1010 Exception 'list index out of range' raised while validating 'fn_getatt'

After:

E1010 {'Fn::GetAtt': 'MyBucket'} is not a valid GetAtt. It must specify a resource and an attribute name

Custom-resource attributes with non-alphanumerics (e.g. MyCustom.my_attr-1) remain valid — verified against main.

Testing

• Added unit cases in test/unit/rules/functions/test_getatt.py: dotless string (clean error) and a custom-resource attribute with underscores/hyphens (valid, guards against an over-strict pattern).
• pytest test/unit/rules/functions/ — 279 pass.
• ruff check, ruff format --check, isort, mypy — all clean.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.65%. Comparing base (33cae2d) to head (238c5a0).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4696   +/-   ##
=======================================
  Coverage   94.65%   94.65%           
=======================================
  Files         434      434           
  Lines       15558    15561    +3     
  Branches     3018     3019    +1     
=======================================
+ Hits        14726    14729    +3     
  Misses        454      454           
  Partials      378      378           

Flag	Coverage Δ
unittests	94.65% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.