Skip to content

fix: handle SAM RestApi stage references - #4730

Merged
kddejong merged 3 commits into
aws-cloudformation:mainfrom
0xTaoZ:fix/sam-restapi-stage
Oct 20, 2026
Merged

kddejong merged 3 commits into
aws-cloudformation:mainfrom
0xTaoZ:fix/sam-restapi-stage

Conversation

@0xTaoZ

@0xTaoZ 0xTaoZ commented Sep 29, 2026

Copy link
Copy Markdown
Contributor

What

Fixes #4714.

This updates SAM implicit-resource handling so AWS::Serverless::StateMachine Api events create the same synthetic implicit ServerlessRestApi/stage context as function Api events. It also teaches Fn::Sub validation that SAM ${Api.Stage} references are generated stage-resource references, not CloudFormation Fn::GetAtt attributes on the API resource.

Why

SAM rewrites ${ServerlessRestApi.Stage} to the generated stage logical id during transform. cfn-lint was treating it as a GetAtt against AWS::Serverless::Api/AWS::ApiGateway::RestApi, causing false positives after the schema-based SAM validation changes.

Tests

  • .venv/bin/python -m pytest test/unit/module/context/test_inject_sam_implicit.py test/unit/rules/functions/test_sub.py -q
  • .venv/bin/python -m pytest test/unit/rules/functions/test_sub.py test/unit/rules/functions/test_getatt.py test/unit/module/context/test_inject_sam_implicit.py -q
  • .venv/bin/ruff check src/cfnlint/context/context.py src/cfnlint/rules/functions/Sub.py test/unit/module/context/test_inject_sam_implicit.py test/unit/rules/functions/test_sub.py
  • .venv/bin/ruff format --check src/cfnlint/context/context.py src/cfnlint/rules/functions/Sub.py test/unit/module/context/test_inject_sam_implicit.py test/unit/rules/functions/test_sub.py
  • git diff --check

Note: I also tried a CLI smoke with the issue-shaped SAM templates, but this local environment could not download enhanced schemas due to CERTIFICATE_VERIFY_FAILED, so the focused unit tests are the reliable validation here.

Supersedes #4719. The commit and scope are unchanged.

@0xTaoZ
0xTaoZ force-pushed the fix/sam-restapi-stage branch from 6b1893b to 7dde3a6 Compare October 9, 2026 01:36
@codecov

codecov Bot commented Oct 20, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 88.88889% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.72%. Comparing base (be66fb3) to head (6e9f4c3).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
src/cfnlint/rules/functions/Sub.py 83.33% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4730      +/-   ##
==========================================
- Coverage   94.72%   94.72%   -0.01%     
==========================================
  Files         439      439              
  Lines       15840    15858      +18     
  Branches     3060     3067       +7     
==========================================
+ Hits        15005    15021      +16     
- Misses        456      457       +1     
- Partials      379      380       +1     
Flag Coverage Δ
unittests 94.72% <88.88%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@kddejong
kddejong merged commit 0b205fe into aws-cloudformation:main Oct 20, 2026
20 of 21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

False positives on SAM implicit ServerlessRestApi since 1.54.0: StateMachine Api events ignored, and .Stage checked as a GetAtt

2 participants