fix(core): throw on intrinsics in CFN update and create policies

packages/aws-cdk-lib/cloudformation-include/test/invalid-templates.test.ts

@@ -245,6 +245,75 @@ describe('CDK Include', () => {
       },
     );
   });
+
+  test('throws an exception if Tags contains invalid intrinsics', () => {
+    expect(() => {
+      includeTestTemplate(stack, 'tags-with-invalid-intrinsics.json');
+    }).toThrow(/expression does not exist in the template/);
+  });
+
+  test('non-leaf Intrinsics cannot be used in the top-level creation policy', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, true);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-create-policy.json');
+    }).toThrow(/intrinsics cannot be used in update, deletion, or update-replace policies./);
+  });
+
+  test('Intrinsics cannot be used in the autoscaling creation policy', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, true);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-create-policy-autoscaling.json');
+    }).toThrow(/intrinsics cannot be used in update, deletion, or update-replace policies./);
+  });
+
+  test('Intrinsics cannot be used in the create policy resource signal', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, true);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-create-policy-resource-signal.json');
+    }).toThrow(/intrinsics cannot be used in update, deletion, or update-replace policies./);
+  });
+
+  test('Intrinsics cannot be used in the top-level update policy', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, true);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-update-policy.json');
+    }).toThrow(/intrinsics cannot be used in update, deletion, or update-replace policies./);
+  });
+
+  test('Intrinsics cannot be used in the auto scaling rolling update update policy', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, true);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-update-policy-autoscaling-rolling-update.json');
+    }).toThrow(/intrinsics cannot be used in update, deletion, or update-replace policies./);
+  });
+
+  test('Intrinsics cannot be used in the auto scaling replacing update update policy', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, true);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-update-policy-autoscaling-replacing-update.json');
+    }).toThrow(/intrinsics cannot be used in update, deletion, or update-replace policies./);
+  });
+
+  test('Intrinsics cannot be used in the auto scaling scheduled action update policy', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, true);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-update-policy-autoscaling-scheduled-action.json');
+    }).toThrow(/intrinsics cannot be used in update, deletion, or update-replace policies./);
+  });
+
+  test('Intrinsics cannot be used in the code deploy lambda alias update policy', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, true);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-update-policy-code-deploy-lambda-alias-update.json');
+    }).toThrow(/intrinsics cannot be used in update, deletion, or update-replace policies./);
+  });
+
+  test('FF toggles error checking', () => {
+    stack.node.setContext(cxapi.CFN_INCLUDE_REJECT_COMPLEX_RESOURCE_UPDATE_CREATE_POLICY_INTRINSICS, false);
+    expect(() => {
+      includeTestTemplate(stack, 'intrinsics-update-policy-code-deploy-lambda-alias-update.json');
+    }).not.toThrow();
+  });
 });
 
 interface IncludeTestTemplateProps {

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsics-create-policy-autoscaling.json

@@ -0,0 +1,23 @@
+{
+  "Parameters": {
+    "MinSuccessfulInstancesPercent": {
+      "Type": "Number"
+    }
+  },
+  "Resources": {
+    "AutoScalingCreationPolicyIntrinsic": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": "1",
+        "MaxSize": "5"
+      },
+      "CreationPolicy": {
+        "AutoScalingCreationPolicy": {
+          "MinSuccessfulInstancesPercent": {
+            "Ref": "MinSuccessfulInstancesPercent"
+          }
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsics-create-policy-complex.json

@@ -0,0 +1,42 @@
+{
+  "Parameters": {
+    "CountParameter": {
+      "Type": "Number",
+      "Default": 3
+    }
+  },
+  "Conditions": {
+    "SomeCondition": {
+      "Fn::Equals": [
+        2,
+        2
+      ]
+    }
+  },
+  "Resources": {
+    "ASG": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": "1",
+        "MaxSize": "5"
+      },
+      "CreationPolicy": {
+        "AutoScalingCreationPolicy": {
+          "MinSuccessfulInstancesPercent": 50
+        },
+        "ResourceSignal": {
+          "Count": {
+            "Fn::If": [
+              "SomeCondition",
+              {
+                "Ref": "CountParameter"
+              },
+              4
+            ]
+          },
+          "Timeout":"PT5H4M3S"
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsics-create-policy-resource-signal.json

@@ -0,0 +1,24 @@
+{
+  "Parameters": {
+    "CountParameter": {
+      "Type": "Number",
+      "Default": 3
+    }
+  },
+  "Resources": {
+    "ResourceSignalIntrinsic": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": "1",
+        "MaxSize": "5"
+      },
+      "CreationPolicy": {
+        "ResourceSignal": {
+          "Count": {
+            "Ref": "CountParameter"
+          }
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsics-update-policy-autoscaling-replacing-update.json

@@ -0,0 +1,22 @@
+{
+  "Parameters": {
+    "WillReplace": {
+      "Type": "Boolean",
+      "Default": false
+    }
+  },
+  "Resources": {
+    "ASG": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": "1",
+        "MaxSize": "10"
+      },
+      "UpdatePolicy": {
+        "AutoScalingReplacingUpdate": {
+          "WillReplace" : { "Ref": "WillReplace" }
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsics-update-policy-autoscaling-rolling-update.json

@@ -0,0 +1,37 @@
+{
+  "Parameters": {
+    "MinInstances": {
+      "Type": "Number",
+      "Default": 1
+    },
+    "MaxBatchSize": {
+      "Type": "Number",
+      "Default": 1
+    },
+    "PauseTime": {
+      "Type": "String",
+      "Default": "PT5M"
+    },
+    "WaitOnResourceSignals": {
+      "Type": "Boolean",
+      "Default": true
+    }
+  },
+  "Resources": {
+    "ASG": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": "1",
+        "MaxSize": "10"
+      },
+      "UpdatePolicy": {
+        "AutoScalingRollingUpdate": {
+          "MinInstancesInService": { "Ref": "MinInstances" },
+          "MaxBatchSize": { "Ref": "MaxBatchSize" },
+          "PauseTime": { "Ref": "PauseTime" },
+          "WaitOnResourceSignals": { "Ref": "WaitOnResourceSignals" }
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsics-update-policy-autoscaling-scheduled-action.json

@@ -0,0 +1,24 @@
+{
+  "Parameters": {
+    "IgnoreUnmodifiedGroupSizeProperties": {
+      "Type": "Boolean",
+      "Default": false
+    }
+  },
+  "Resources": {
+    "ASG": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": "1",
+        "MaxSize": "10"
+      },
+      "UpdatePolicy": {
+        "AutoScalingScheduledAction": {
+          "IgnoreUnmodifiedGroupSizeProperties": {
+            "Ref": "IgnoreUnmodifiedGroupSizeProperties"
+          }
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsics-update-policy-code-deploy-lambda-alias-update.json

@@ -0,0 +1,34 @@
+{
+  "Parameters": {
+    "ApplicationName": {
+      "Type": "String"
+    },
+    "DeploymentGroupName": {
+      "Type": "String"
+    },
+    "BeforeAllowTrafficHook": {
+      "Type": "String"
+    },
+    "AfterAllowTrafficHook": {
+      "Type": "String"
+    }
+  },
+  "Resources": {
+    "Alias": {
+      "Type": "AWS::Lambda::Alias",
+      "Properties": {
+        "FunctionName": "SomeLambda",
+        "FunctionVersion": "SomeVersion",
+        "Name": "MyAlias"
+      },
+      "UpdatePolicy": {
+        "CodeDeployLambdaAliasUpdate": {
+          "ApplicationName": { "Ref": "ApplicationName" },
+          "DeploymentGroupName": { "Ref": "DeploymentGroupName" },
+          "BeforeAllowTrafficHook": { "Ref": "BeforeAllowTrafficHook" },
+          "AfterAllowTrafficHook": { "Ref": "AfterAllowTrafficHook" }
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/intrinsics-update-policy-complex.json

@@ -0,0 +1,33 @@
+{
+  "Conditions": {
+    "SomeCondition": {
+      "Fn::Equals": [
+        2,
+        2
+      ]
+    }
+  },
+  "Resources": {
+    "ASG": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": "1",
+        "MaxSize": "10"
+      },
+      "UpdatePolicy": {
+        "AutoScalingRollingUpdate": {
+          "MinInstancesInService": {
+            "Fn::If": [
+              "SomeCondition",
+              1,
+              2
+            ]
+          },
+          "MaxBatchSize": 2,
+          "PauseTime": "PT5M",
+          "WaitOnResourceSignals": true
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/invalid/intrinsics-create-policy-autoscaling.json

@@ -0,0 +1,28 @@
+{
+  "Conditions": {
+    "SomeCondition": {
+      "Fn::Equals": [
+        2,
+        2
+      ]
+    }
+  },
+  "Resources": {
+    "AutoScalingCreationPolicyIntrinsic": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": 1,
+        "MaxSize": 5
+      },
+      "CreationPolicy": {
+        "AutoScalingCreationPolicy": {
+          "Fn::If": [
+            "SomeCondition",
+            { "MinSuccessfulInstancesPercent": 50 },
+            { "MinSuccessfulInstancesPercent": 25 }
+          ]
+        }
+      }
+    }
+  }
+}

packages/aws-cdk-lib/cloudformation-include/test/test-templates/invalid/intrinsics-create-policy-resource-signal.json

@@ -0,0 +1,36 @@
+{
+  "Parameters": {
+    "CountParameter": {
+      "Type": "Number",
+      "Default": 3
+    }
+  },
+  "Conditions": {
+    "UseCountParameter": {
+      "Fn::Equals": [
+        2,
+        2
+      ]
+    }
+  },
+  "Resources": {
+    "ResourceSignalIntrinsic": {
+      "Type": "AWS::AutoScaling::AutoScalingGroup",
+      "Properties": {
+        "MinSize": 1,
+        "MaxSize": 5
+      },
+      "CreationPolicy": {
+        "ResourceSignal": {
+          "Fn::If": [
+            "UseCountParameter",
+            {
+              "Count": { "Ref": "CountParameter" }
+            },
+            5
+          ]
+        }
+      }
+    }
+  }
+}