Skip to content

fix(E3005): skip DependsOn check when target condition is always true - #4843

Merged
kddejong merged 2 commits into
aws-cloudformation:mainfrom
Varshith-Kali:fix-4820-e3005-always-true-condition
Oct 24, 2026
Merged

kddejong merged 2 commits into
aws-cloudformation:mainfrom
Varshith-Kali:fix-4820-e3005-always-true-condition

Conversation

@Varshith-Kali

Copy link
Copy Markdown
Contributor

What

E3005 (DependsOn) reported that a target resource "will not exist when condition 'X' is False" even when condition X provably always evaluates to true. In that case the resource always exists, so there is no scenario in which the DependsOn can fail. This adds Conditions.is_always_true, which asks the existing SAT solver whether the condition's negation is unsatisfiable (result cached per condition name), and Template.is_resource_available now returns no scenarios in that case before running the regular scenario analysis.

Why

Resolves the report in #4820. A DependsOn on a resource with a constant-true condition (a constant Fn::Equals, or an Fn::Or over constant conditions) always deploys: CloudFormation creates both resources. The finding is a false positive.

How

  • src/cfnlint/conditions/conditions.py: new Conditions.is_always_true(condition_name) (lru-cached; returns False for unknown condition names so unresolved names keep the old behavior).
  • src/cfnlint/template/template.py: is_resource_available consults it first when the target resource has a string condition.

Testing

  • Reproduced both issue templates locally before the fix (E3005 fired on each); after the fix only the expected W8003 warnings remain.
  • Negative control: a genuinely conditional target (!Equals [!Ref Env, prod]) still reports E3005 with the False scenario.
  • New regression tests: test/unit/rules/resources/test_dependson.py (2 new cases: constant Fn::Equals, Fn::Or of constants) and test/unit/module/template/test_template.py::test_is_resource_available_always_true_condition (always-true returns [], conditional target still returns the False scenario, unknown condition name keeps prior behavior).
  • Suites: test_dependson.py 11 passed; conditions module 56 passed; resources rules plus conditions rules plus template module: 1396 passed, 1 pre-existing environment failure in test_build_graph (pygraphviz not installed; fails identically on pristine main).
  • ruff check and ruff format clean on all touched files.

Fixes #4820

@Varshith-Kali

Copy link
Copy Markdown
Contributor Author

Hi team, on this fix(E3005) PR: the [CI] Test PR workflow run on the current head is still parked waiting for a first-time-contributor approval (action_required). Could a maintainer approve the run so CI can proceed? Thanks.

@Varshith-Kali

Copy link
Copy Markdown
Contributor Author

Hi @kddejong, friendly follow up: the CI runs on this PR are still parked at the first-time-contributor approval gate (action_required), so the checks cannot start until a maintainer approves the run. Could you approve it when you have a moment? Thanks!

When a resource's Condition provably always evaluates to true, there is
no scenario in which the resource does not exist, so E3005 no longer
reports that the DependsOn target will not exist when the condition is
False. Adds Conditions.is_always_true (SAT-backed, cached) and consults
it in Template.is_resource_available before scenario analysis. A
genuinely conditional target still reports the False scenario.

Fixes aws-cloudformation#4820

Signed-off-by: Varshith Puli <pulivarshit@gmail.com>
@kddejong
kddejong force-pushed the fix-4820-e3005-always-true-condition branch from 88e0775 to 4f9d207 Compare October 24, 2026 17:07
@codecov

codecov Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.68%. Comparing base (55d6ecc) to head (2273ab9).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #4843   +/-   ##
=======================================
  Coverage   94.68%   94.68%           
=======================================
  Files         439      439           
  Lines       16009    16016    +7     
  Branches     3109     3111    +2     
=======================================
+ Hits        15158    15165    +7     
  Misses        468      468           
  Partials      383      383           
Flag Coverage Δ
unittests 94.68% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@kddejong
kddejong merged commit f8baa08 into aws-cloudformation:main Oct 24, 2026
23 of 24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

E3005 false positive when the DependsOn target's Condition is always true

2 participants