WAFv2 error E3002

[johnk-novu]

cfn-lint version: (cfn-lint --version) 0.26.2

Description of issue.

I get an error when running cfn-lint against a template with WAFv2 resources. The template provisions the resources in AWS as expected.

$ cfn-lint templates/template.yml
E3002 Expecting an object at Resources/AlbWafRegexPatternSet/Properties/RegularExpressionList
templates/template.yml:256:7

template snippet:

  AlbWafRegexPatternSet:
    Type: 'AWS::WAFv2::RegexPatternSet'
    Properties:
      Description: !Sub "${FullEnv}-${AppName} WAF Regex Pattern Set"
      Name: !Sub "${FullEnv}-${AppName}-regex-pattern-set"
      RegularExpressionList:
        - RegexString: '^.*$'
      Scope: 'REGIONAL'

WAFv2 Cloudformation documentation: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-regexpatternset.html

[PatMyron]

Confirmed, run into this myself testing both AWS::WAFv2::IPSet.Addresses and AWS::WAFv2::RegexPatternSet.RegularExpressionList:

https://github.com/PatMyron/cloud/blob/e412b86e70ff61fe6d523abf5553170e1193ed04/cloudformation/minimal.yaml#L642-L655

[kddejong]

@PatMyron we may have to patch this one.

"AWS::WAFv2::RegexPatternSet.RegularExpressionList": {
  "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-regexpatternset-regularexpressionlist.html",
  "Properties": {
    "RegularExpressionList": {
      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-regexpatternset-regularexpressionlist.html#cfn-wafv2-regexpatternset-regularexpressionlist-regularexpressionlist",
      "ItemType": "Regex",
      "Required": false,
      "Type": "List",
      "UpdateType": "Mutable"
    }
  }
}

The way the spec is written we would have is something like this.

AlbWafRegexPatternSet:
    Type: 'AWS::WAFv2::RegexPatternSet'
    Properties:
      Description: !Sub "${FullEnv}-${AppName} WAF Regex Pattern Set"
      Name: !Sub "${FullEnv}-${AppName}-regex-pattern-set"
      RegularExpressionList:
        RegularExpressionList: 
        - RegexString: '^.*$'
      Scope: 'REGIONAL'

[kddejong]

Looks like we are patching this. I'll try to get that written this weekend and in for a release early next week

[kddejong]

Looks like the documentation matches the spec here too.