![[cfn-lint logo]](https://github.com/aws-cloudformation/cfn-python-lint/blob/master/logo.png?raw=true){kind=logo}
Validate CloudFormation yaml/json templates against the CloudFormation spec and additional checks. Includes checking valid values for resource properties and best practices.
This is an attempt to provide validation for CloudFormation templates properties and their values. For values things can get pretty complicated (mappings, joins, splits, conditions, and nesting those functions inside each other) so it's a best effort to validate those values but the promise is to not fail if we can't understand or translate all the things that could be going on.
The Serverless Application Model (SAM) is supported by the linter. The template is transformed using AWS SAM before the linter processes the template.
To get information about the SAM Transformation, run the linter with --info
Python 2.7+ and 3.4+ are supported.
pip install cfn-lint. If pip is not available, run
python setup.py clean --all then python setup.py install.
brew install cfn-lint
In cfn-python-lint source tree:
docker build --tag cfn-python-lint:latest .
In repository to be linted:
docker run --rm -v `pwd`:/data cfn-python-lint:latest /data/template.yaml
There are IDE plugins available to get direct linter feedback from you favorite editor:
- Atom
- Emacs
- NeoVim 0.2.0+/Vim 8
- Sublime
- Visual Studio Code
- IntelliJ IDEA
cfn-lint template.yamlcfn-lint -t template.yaml
Multiple files can be linted by either specifying multiple specific files:
cfn-lint template1.yaml template2.yamlcfn-lint -t template1.yaml template2.yaml
or by using wildcards (globbing). For example:
Lint all yaml files in path:
cfn-lint path/*.yaml
Lint all yaml files in path and all subdirectories (recursive):
cfn-lint path/to/templates/**/*.yaml
Note: Glob in Python 3.5 supports recursive searching **/*.yaml. If you are using an earlier version of Python you will have to handle this manually (folder1/*.yaml, folder2/*.yaml, etc).
The template to be linted can also be passed using standard input:
cat path/template.yaml | cfn-lint -
cfn-lint -r us-east-1 ap-south-1 -- template.yamlcfn-lint -r us-east-1 ap-south-1 -t template.yaml
From a command prompt run cfn-lint <path to yaml template> to run standard linting of the template.
You can define a yaml file in your project or home folder called .cfnlintrc. In that file you can specify settings from the parameter section below.
Example:
templates:
- test/fixtures/templates/good/**/*.yaml
ignore_templates:
- codebuild.yaml
include_checks:
- IOptional parameters:
| Command Line | Metadata | Options | Description |
|---|---|---|---|
| -h, --help | Get description of cfn-lint | ||
| -t, --template | filename | Alternative way to specify Template file path to the file that needs to be tested by cfn-lint | |
| -f, --format | format | quiet, parseable, json | Output format |
| -l, --list-rules | List all the rules | ||
| -r, --regions | regions | [REGIONS [REGIONS ...]], ALL_REGIONS | Test the template against many regions. Supported regions |
| -b, --ignore-bad-template | ignore_bad_template | Ignores bad template errors | |
| --ignore-templates | IGNORE_TEMPLATES [IGNORE_TEMPLATES ...] | Ignore templates from being scanned | |
| -a, --append-rules | append_rules | [RULESPATH [RULESPATH ...]] | Specify one or more rules paths using one or more --append-rules arguments. Each path can be either a directory containing python files, or an import path to a module. |
| -i, --ignore-checks | ignore_checks | [IGNORE_CHECKS [IGNORE_CHECKS ...]] | Only check rules whose ID do not match or prefix these values. Examples: - A value of W will disable all warnings- W2 disables all Warnings for Parameter rules.- W2001 will disable rule W2001 |
| -e, --include-experimental | include_experimental | Whether rules that still in an experimental state should be included in the checks | |
| -c, --include-checks | INCLUDE_CHECKS [INCLUDE_CHECKS ...] | Include rules whose id match these values | |
| -m, --mandatory-checks | Rules to check regardless of ignore configuration | ||
| -x, --configure-rule | CONFIGURE_RULES [CONFIGURE_RULES ...] | Provide configuration for a rule. Format RuleId:key=value. Example: E3012:strict=false | |
| -D, --debug | Specify to enable debug logging. Debug logging outputs detailed information about rules processing, useful for debugging rules. | ||
| -I, --info | Specify to enable logging. Outputs additional information about the template processing. | ||
| -u, --update-specs | Update the CloudFormation Specs. You may need sudo to run this. You will need internet access when running this command | ||
| -o, --override-spec | filename | Spec-style file containing custom definitions. Can be used to override CloudFormation specifications. More info here | |
| -g, --build-graph | Creates a file in the same directory as the template that models the template's resources in DOT format | ||
| -v, --version | Version of cfn-lint |
To maintain backwards compatibility info rules are not included by default. To include these rules you will need to include -c I or --include-checks I
Inside the root level Metadata key you can configure cfn-lint using the supported parameters.
Metadata:
cfn-lint:
config:
regions:
- us-east-1
- us-east-2
ignore_checks:
- E2530Inside a resources Metadata key you can configure cfn-lint to ignore checks. This will filter out failures for the resource in which the Metadata belongs. Keep in mind that resources may lose metadata when passed through aws-sam-translator, such as AWS::Serverless::Function resources.
Resources:
myInstance:
Type: AWS::EC2::Instance
Metadata:
cfn-lint:
config:
ignore_checks:
- E3030
Properties:
InstanceType: nt.x4superlarge
ImageId: ami-abc1234cfn-lint applies configurations from several sources. The rules at lower levels are overridden by those at higher levels.
.cfnlintrcconfigurations- Template Metadata configurations
- CLI parameters
Certain rules support configuration properties. You can configure these rules by using configure_rules parameter.
From the command line the format is RuleId:key=value, for example: E3012:strict=false.
From the cfnlintrc or Metadata section the format is
Metadata:
cfn-lint:
config:
configure_rules:
RuleId:
key: valueThe configurable rules have a non-empty Config entry in the table here.
There are getting started guides available in the documentation section to help with integrating cfn-lint or creating rules.
This linter checks the CloudFormation template by processing a collection of Rules, where every rules handles a specific function check or validation of the template.
This collection of rules can be extended with custom rules using the --append-rules argument.
More information describing how rules are set up and an overview of all the Rules that are applied by this linter are documented here.
The linter follows the CloudFormation specifications by default. However, for your use case specific requirements might exist. For example, within your organisation it might be mandatory to use Tagging.
The linter provides the possibility to implement these customized specifications using the --override-spec argument.
More information about how this feature works is documented here
If you'd like cfn-lint to be run automatically when making changes to files in your Git repository, you can install pre-commit and add the following text to your repositories' .pre-commit-config.yaml:
repos:
- repo: https://github.com/aws-cloudformation/cfn-python-lint
rev: v0.29.6 # The version of cfn-lint to use
hooks:
- id: cfn-python-lint
files: path/to/cfn/dir/.*\.(json|yml|yaml)$- If you exclude the
files:line above, every json/yml/yaml file will be checked. - You can see available cfn-lint versions on the releases page.