[Varshith-Kali]

Problem

E3009 validates Metadata/AWS::CloudFormation::Init against the hand-written cfn_init.json, where each command's command was typed as {"type": "string"} only. The AWS::CloudFormation::Init reference describes command as "Either an array or a string specifying the command to run", and cfn-init runs a list as an argument vector without a shell (subprocess.Popen(self._cmd, ..., shell=isinstance(self._cmd, str), ...) in aws-cfn-bootstrap).

So a valid, deployable template using the array form:

commands:
  "000_reload":
    command: ["systemctl", "daemon-reload"]

was reported as E3009 ['systemctl', 'daemon-reload'] is not of type 'string' with exit 2, a CI-blocking false positive. The issue includes a cfn-init run on Amazon Linux 2023 confirming the array commands execute.

Fix

Widen the command property in cfn_init.json to accept a string or an array of strings (using the multi-line "type" array style already used elsewhere in this schema, with "items": {"type": "string"} for the array form). E3009 is purely schema-driven, so no rule code changes were needed.

Verification

• The issue's reproduction template now lints clean (exit 0); previously it produced the two E3009 errors above (exit 2).
• Added regression tests to test/unit/rules/resources/test_cfn_init.py: the array form (issue case, fails pre-fix), the string form, plus invalid shapes (command: 42 and ["echo", 42]) which are still reported.
• test/unit/rules/: 2002 passed.

Fixes #4801

[Varshith-Kali]

Hi, the [CI] Test PR run on this PR is parked waiting for a maintainer approval (first-time-contributor gate). Could someone approve it when you get a chance? Thanks.

[Varshith-Kali]

Checking in: the workflows are still awaiting approval. Grateful for a click when you have a moment.

[Varshith-Kali]

Hi team, the [CI] Test PR workflow run on the current head is still parked waiting for a first-time-contributor approval (action_required). Could a maintainer approve the run so CI can proceed? Thanks.

[Varshith-Kali]

Hi @kddejong, friendly follow up: the CI runs on this PR are still parked at the first-time-contributor approval gate (action_required), so the checks cannot start until a maintainer approves the run. Could you approve it when you have a moment? Thanks!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.73%. Comparing base (b3bc127) to head (96b2e88).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4809   +/-   ##
=======================================
  Coverage   94.73%   94.73%           
=======================================
  Files         442      442           
  Lines       16088    16088           
  Branches     3121     3121           
=======================================
  Hits        15241    15241           
  Misses        467      467           
  Partials      380      380           

Flag	Coverage Δ
unittests	94.72% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.