[sayaksatpathi]

Issue #, if available: Fixes #4603

Description of changes:

A template Description over 1024 characters is reported by E1003, except when its text contains something that looks like a dynamic reference ({{resolve:...}}). Then nothing is reported. FunctionFilter.filter treats any string matching REGEX_DYN_REF as a dynamic reference and returns before the cfnLint keyword is added, so E1004/E1003 never run on it.

CloudFormation doesn't resolve dynamic references in the template Description. I checked with aws cloudformation validate-template, and both of these templates (1710 and 1753 characters) are rejected with Template format error: 'Description' length is greater than 1024.:

AWSTemplateFormatVersion: "2010-09-09"
Description: "<1710 characters of prose>"
...
---
AWSTemplateFormatVersion: "2010-09-09"
Description: "<the same prose> See {{resolve:ssm:/some/path}} for config."
...

On main, cfn-lint reports E1003 for the first and nothing for the second. With this change it reports E1003 for both. Strings with dynamic references elsewhere, such as resource properties, are handled as before.

(The issue was retracted by its author as unverified. The behavior above is reproducible on 1.57.2 and against the CloudFormation API.)

Tests:

• test_filter.py: a dynamic-reference-shaped string at the template Description path keeps its normal schema.
• test_api.py: linting a template whose 1000+ character Description mentions a dynamic reference reports E1003.
• Both new tests fail on main and pass with this change. pytest test/unit test/integration passes (2974), and ruff, isort and mypy are clean.

I used Claude Code (AI) to help investigate and write this change, and reviewed and tested it before submitting.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sayaksatpathi]

Hi maintainers, I'd appreciate a review of this edge case.

I've reproduced a case where an over-length template-level Description is not reported by cfn-lint when it contains dynamic-reference-shaped text such as {{resolve:ssm:...}}. My PR includes a regression test, and the PR description documents the behavior I observed with cfn-lint 1.57.2 and CloudFormation validation.

I recognize that the original issue was retracted as unverified. Could a maintainer please confirm whether validating the Description length in this case is consistent with the project's intended behavior?

Thanks!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.72%. Comparing base (27243cb) to head (a82e36f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4765   +/-   ##
=======================================
  Coverage   94.72%   94.72%           
=======================================
  Files         439      439           
  Lines       15908    15908           
  Branches     3079     3079           
=======================================
  Hits        15069    15069           
  Misses        458      458           
  Partials      381      381           

Flag	Coverage Δ
unittests	94.72% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[kddejong]

Confirmed — this is the intended behavior, and the fix is correct.

CloudFormation does not resolve dynamic references in the template-level Description; the braces are literal text, and the 1024-character limit is enforced against that literal string. A Description over 1024 characters is rejected by CloudFormation whether or not it happens to contain {{resolve:...}} (as your validate-template check in the PR shows). So suppressing E1003 here was a real false negative, and reporting it is right.

The scoping looks good too: the dynamic-reference short-circuit is skipped only for the exact ["Description"] path, so dynamic references in resource properties and elsewhere are unaffected (verified a resource-property {{resolve:...}} still lints clean). The regression test covers it.

The retraction of the original issue doesn't change this — the reported behavior reproduces on 1.57.2 and against the CloudFormation API. Thanks for the clear write-up and the test.