[Varshith-Kali]

Fixes #4894

Problem

E3051 cannot validate an AWS::SSM::Document whose Content is a JSON string rather than an object. Every such document was reported invalid with the same parser error, whether the JSON was well-formed or not:

E3051 Document is not valid ('Template could not be parsed: a string or stream input is required')

Root cause

Content decoded from a template arrives as a str_node (a str subclass carrying source marks), and cfnlint.decode.decode_str rejects it instead of treating it as a string, so parsing fails before the document is ever examined. This affects all document types, not just one.

Fix

Convert to a plain str before calling decode_str in src/cfnlint/rules/resources/ssm/Document.py. The decoded document gets fresh source marks from parsing the string itself, so no location information is lost by the conversion.

This is independent of #4844: the branch is built on current upstream main without #4844, and #4844's early return for AppConfig types sits ahead of this branch, so the two do not interfere.

Note: #4899 appears to be a byte-identical duplicate of #4894 (same title, same body, same author), so this PR fixes both.

Verification

Reproduced on current main before the fix (valid and malformed JSON string Content both produced the identical spurious message), then verified after the fix via cfn-lint on template files:

• Well-formed JSON string Content: no finding (exit 0)
• Malformed JSON string Content ({bad json, unclosed [): E3051 Document is not valid with the actual parser message, distinct from the old generic message
• Schema-invalid string Content ({"schemaVersion":}): real enum validation error from inside the document
• Object-form Content: unchanged, no finding

Tests added in test/unit/rules/resources/ssm/test_document.py, using str_node to cover the real template path (plain str inputs already worked, which is why the existing tests did not catch this):

• Well-formed JSON string as str_node: no finding
• Malformed JSON string as str_node: real defect message, not the generic parser message
• Schema-invalid string as str_node: inner schema validation runs
• Object-form Content as dict_node: unchanged

Test results: test_document.py 10 passed; test/unit/rules/resources/ 1355 passed; test/unit/rules/ 2082 passed; test/unit/module/decode/ 16 passed. The new string-content test fails on the pre-fix code, confirming it covers the regression.

[Varshith-Kali]

Hi kddejong, this PR's CI is parked at the first-time-contributor approval gate (the github-actions run shows action_required). Could you approve the workflow run when you have a moment? Thanks!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.73%. Comparing base (b3bc127) to head (9ccd50d).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4902   +/-   ##
=======================================
  Coverage   94.73%   94.73%           
=======================================
  Files         442      442           
  Lines       16088    16088           
  Branches     3121     3121           
=======================================
  Hits        15241    15241           
  Misses        467      467           
  Partials      380      380           

Flag	Coverage Δ
unittests	94.72% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.