Skip to content

fix(E1152): accept resolve:ssm: ImageId on AWS::EC2::Instance - #4828

Merged
kddejong merged 1 commit into
aws-cloudformation:mainfrom
Varshith-Kali:fix/e1152-resolve-ssm-instance-imageid
Oct 22, 2026
Merged

kddejong merged 1 commit into
aws-cloudformation:mainfrom
Varshith-Kali:fix/e1152-resolve-ssm-instance-imageid

Conversation

@Varshith-Kali

Copy link
Copy Markdown
Contributor

Issue #, if available: Fixes #4826

Description of changes:

  • Problem: E1152 reported a false positive on AWS::EC2::Instance ImageId when the value is a resolve:ssm:<parameter> reference. EC2 resolves the Systems Manager parameter at launch for a plain instance, and the AWS CDK emits exactly this form on AWS::EC2::Instance (MachineImage.resolveSsmParameterAtLaunch). The issue's repro template deploys to CREATE_COMPLETE.
  • Root cause: The resolve:ssm: exception added for E1152 and dynamic parameters #3329 in src/cfnlint/rules/formats/ImageId.py was keyed to a single cfn path: Resources/AWS::EC2::LaunchTemplate/Properties/LaunchTemplateData/ImageId. The same SSM-at-launch behavior on AWS::EC2::Instance/Properties/ImageId was not covered, so the value fell through to the AMI id pattern check.
  • Fix: Replaced the single-path equality check with a tuple of accepted paths covering both the launch template form and Resources/AWS::EC2::Instance/Properties/ImageId. Any other resolve:ssm: value (or any other location) is still validated against the AMI pattern as before.

Test evidence:

  • New regression test in test/unit/rules/formats/test_image_id.py: resolve:ssm:... at Resources/AWS::EC2::Instance/Properties/ImageId passes. Verified it fails on the unpatched code (red) and passes with the fix (green).
  • End-to-end check via cfnlint.api.lint_file on the issue's repro template: pre-fix, E1152 'resolve:ssm:...' is not a 'AWS::EC2::Image.Id' ...; post-fix, zero matches. Launch-template template still clean (regression), and an invalid ImageId: ami-abc still raises E1152.
  • test/unit/rules/formats/: 90 passed. test/unit/rules/: 2025 passed. ruff check and ruff format --check clean on both changed files.

@Varshith-Kali

Copy link
Copy Markdown
Contributor Author

Hi, the Test PR run on this PR is parked waiting for a maintainer approval (first-time-contributor gate). Could someone approve it when you get a chance? Thanks.

The resolve:ssm: exception added for aws-cloudformation#3329 only covered
LaunchTemplateData.ImageId. EC2 also resolves a Systems Manager
parameter at launch for a plain AWS::EC2::Instance, and the AWS CDK
emits this form there (MachineImage.resolveSsmParameterAtLaunch).

Fixes aws-cloudformation#4826

Signed-off-by: Varshith Puli <pulivarshit@gmail.com>
@kddejong
kddejong force-pushed the fix/e1152-resolve-ssm-instance-imageid branch from 5f07a98 to b67f3fd Compare October 22, 2026 16:08
@codecov

codecov Bot commented Oct 22, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.68%. Comparing base (e8f395b) to head (b67f3fd).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4828   +/-   ##
=======================================
  Coverage   94.68%   94.68%           
=======================================
  Files         439      439           
  Lines       15973    15974    +1     
  Branches     3097     3097           
=======================================
+ Hits        15124    15125    +1     
  Misses        467      467           
  Partials      382      382           
Flag Coverage Δ
unittests 94.67% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@kddejong
kddejong merged commit f0b0e23 into aws-cloudformation:main Oct 22, 2026
24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

E1152: resolve:ssm: ImageId rejected on AWS::EC2::Instance

2 participants