[Varshith-Kali]

Issue #, if available: #4771

Description of changes:

Problem: A template with Resources: {} passes cfn-lint with exit 0, while CloudFormation ValidateTemplate rejects it. E1001 already flags a missing Resources key, so the empty section was a false negative in the same rule.

Root cause: The base template schema (src/cfnlint/data/schemas/other/template/configuration.json) declares "required": ["Resources"] but gives the Resources property an unconstrained {} schema. Likewise, the Resources section schema used by E3001 (src/cfnlint/data/schemas/other/resources/configuration.json) caps at maxProperties: 500 but sets no lower bound. Neither schema rejects an empty object.

Fix: Add "minProperties": 1 to the Resources property in the base template schema. This makes E1001 fire on Resources: {}, consistent with the existing E1001 finding for a missing Resources key. The keyword is not mapped in E1001's rule_set, so the error is attributed to E1001 itself, matching how required and additionalProperties violations are reported. Only E1001 consumes this schema, so the blast radius is limited to templates with an empty Resources section (which CloudFormation rejects anyway).

Verification:

• Red (before fix): cfn-lint on a template with Resources: {} exited 0 with no findings.
• Green (after fix): it reports E1001 expected minimum property count: 1, found: 0 at the Resources key and exits 2. A template missing Resources still reports 'Resources' is a required property, and a valid template with a resource still passes clean.
• Tests: updated test_base_template.py counts (base.yaml 1 to 2, base_date.yaml 1 to 2, base_null.yaml 2 to 3) and test_json_schema.py expectations for the new error; added a test_empty_resources regression test. Full unit rule suite: 1943 passed. The module suite failures (missing defusedxml, network dependent graph/pricing tests) are pre-existing environment issues, verified identical on the pristine tree. Integration test_good_templates passes.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[Varshith-Kali]

Thanks for the approval. The post-approval CI failure was a real regression from this change, now fixed: minProperties: 1 on Resources correctly flagged two fixtures that shipped with empty Resources: {} (test_success_escape_character and the metdata.yaml integration case).

Fixed in 5c20c1a: both fixtures now carry a minimal resource (an S3 bucket in the JSON decode fixture; a AWS::Lambda::Permission in metdata.yaml, chosen as an I4010 low-value type with no hardcoded-partition ARNs per I3042, so the integration results file is unchanged). The failing unit + integration tests pass locally (5/5), full fixture results file untouched. No product-code changes.

[Varshith-Kali]

Thanks again for the approval. The fix for the post-approval CI failure is pushed (5c20c1a), but the two fresh workflow runs ([CI] Test PR and [CI] Test PR Data) are parked at "action_required", so CI has not executed on the new head yet. Could you approve the workflow runs when convenient?

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.68%. Comparing base (27243cb) to head (627c49f).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4781      +/-   ##
==========================================
- Coverage   94.72%   94.68%   -0.04%     
==========================================
  Files         439      439              
  Lines       15908    15908              
  Branches     3079     3079              
==========================================
- Hits        15069    15063       -6     
- Misses        458      463       +5     
- Partials      381      382       +1     

Flag	Coverage Δ
unittests	94.68% <ø> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.