[Varshith-Kali]

Fixes #4799

Bug

E3014 (requiredXor) fires a false positive when a resource property is guarded by two mutually exclusive Fn::Equals conditions, unless the compared parameter declares AllowedValues:

Conditions:
  UseIpv4: !Equals [!Ref Source, ipv4]
  UseIpv6: !Equals [!Ref Source, ipv6]

UseIpv4 and UseIpv6 can never both be true for any value of Source, yet the property-validation engine explored the both-true scenario and reported requiredXor on the ingress rule. The template-level engine (cfnlint/conditions/conditions.py) already excluded that scenario, so the two engines disagreed.

Root cause

The pairwise NAND that #4464 added in context/conditions/_conditions.py::create_from_instance sits inside a loop over template parameters that continues past any parameter without AllowedValues, and pseudo-parameters (AWS::Region, AWS::AccountId, ...) never enter the loop at all.

Fix

The NAND is now collected in a parameter-independent pass: any two Fn::Equals comparing the same single-valued reference (grouped by the right-hand side hash, which the Equal sort normalizes to the Ref dict) to different static strings are constrained to never both be true. This is sound for parameters with or without AllowedValues and for pseudo-parameters, since a Ref resolves to exactly one value. The AllowedValues exhaustion rule (Or(...) when every allowed value is covered) is preserved unchanged.

Test evidence

• New engine-level regression test (test_mutually_exclusive_equals_without_allowed_values): both-true raises Unsatisfiable for a plain parameter and for AWS::AccountId, while each condition stays individually reachable.
• New end-to-end fixture (test/fixtures/templates/good/conditions/e3014_exclusive_conditions.yaml, the issue's template A) plus a test_api.py case asserting zero matches.
• Red/green on the fixture: without the fix, the template produces 2x E3014; with the fix, 0 matches.
• Suites run: test/unit/module/context/conditions + test/unit/module/conditions (86 passed), test/unit/rules (1999 passed), test/unit/module (1012 passed; 4 failures in config/test_cli_args.py and maintenance/test_update_specs_from_pricing.py are pre-existing on unmodified main and unrelated).

[Varshith-Kali]

Hi, the [CI] Test PR run on this PR is parked waiting for a maintainer approval (first-time-contributor gate). Could someone approve it when you get a chance? Thanks.

[Varshith-Kali]

Hi @kddejong, the [CI] Test PR run here is still parked waiting for a maintainer approval (first-time-contributor gate) after my follow-up push, and your earlier approval now sits on a superseded commit. Could you approve the workflow run when you get a chance? Thanks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.68%. Comparing base (2a10fb4) to head (5b2f5f8).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4805   +/-   ##
=======================================
  Coverage   94.67%   94.68%           
=======================================
  Files         439      439           
  Lines       15995    16004    +9     
  Branches     3104     3108    +4     
=======================================
+ Hits        15144    15153    +9     
  Misses        468      468           
  Partials      383      383           

Flag	Coverage Δ
unittests	94.67% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.