Merge branch 'develop' into tmp/1760119558/main

roger-zhangg · web-flow · commit e91ed6b24b6c · 2025-10-10T11:06:37.000-07:00
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -26,7 +26,7 @@ jobs:
           - "3.11"
     steps:
     - uses: actions/checkout@v5
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python }}
     - run: make init
diff --git a/.github/workflows/check_compatibility.yml b/.github/workflows/check_compatibility.yml
@@ -13,7 +13,7 @@ jobs:
       - name: Checkout the PR
         uses: actions/checkout@v5
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 
diff --git a/.github/workflows/schema.yml b/.github/workflows/schema.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 
diff --git a/bin/run_cfn_lint.sh b/bin/run_cfn_lint.sh
@@ -10,6 +10,22 @@ if [ ! -d "${VENV}" ]; then
 fi
 
 "${VENV}/bin/python" -m pip install cfn-lint --upgrade --quiet
-# update cfn schema
-"${VENV}/bin/cfn-lint" -u
+# update cfn schema with retry logic (can fail due to network issues)
+MAX_RETRIES=3
+RETRY_COUNT=0
+while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
+    if "${VENV}/bin/cfn-lint" -u; then
+        echo "Successfully updated cfn-lint schema"
+        break
+    else
+        RETRY_COUNT=$((RETRY_COUNT + 1))
+        if [ $RETRY_COUNT -lt $MAX_RETRIES ]; then
+            echo "cfn-lint schema update failed, retrying... (attempt $RETRY_COUNT of $MAX_RETRIES)"
+            sleep 2
+        else
+            echo "cfn-lint schema update failed after $MAX_RETRIES attempts"
+            exit 1
+        fi
+    fi
+done
 "${VENV}/bin/cfn-lint" --format parseable
diff --git a/integration/resources/templates/combination/function_with_msk.yaml b/integration/resources/templates/combination/function_with_msk.yaml
@@ -60,6 +60,7 @@ Resources:
         MyMskEvent:
           Type: MSK
           Properties:
+            Enabled: false
             StartingPosition: LATEST
             Stream:
               Ref: MyMskCluster
diff --git a/integration/resources/templates/combination/function_with_msk_trigger_and_confluent_schema_registry.yaml b/integration/resources/templates/combination/function_with_msk_trigger_and_confluent_schema_registry.yaml
@@ -60,6 +60,7 @@ Resources:
         MyMskEvent:
           Type: MSK
           Properties:
+            Enabled: false
             StartingPosition: LATEST
             Stream:
               Ref: MyMskCluster
diff --git a/integration/resources/templates/combination/function_with_msk_trigger_and_s3_onfailure_events_destinations.yaml b/integration/resources/templates/combination/function_with_msk_trigger_and_s3_onfailure_events_destinations.yaml
@@ -27,6 +27,11 @@ Resources:
               logs:CreateLogStream, logs:PutLogEvents, s3:ListBucket]
             Effect: Allow
             Resource: '*'
+          - Action: [s3:PutObject, s3:ListBucket]
+            Effect: Allow
+            Resource:
+            - arn:aws:s3:::*/*
+            - arn:aws:s3:::*
       ManagedPolicyArns:
       - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
       Tags:
@@ -60,6 +65,7 @@ Resources:
         MyMskEvent:
           Type: MSK
           Properties:
+            Enabled: false
             StartingPosition: LATEST
             Stream:
               Ref: MyMskCluster
diff --git a/integration/resources/templates/combination/function_with_msk_using_managed_policy.yaml b/integration/resources/templates/combination/function_with_msk_using_managed_policy.yaml
@@ -33,6 +33,7 @@ Resources:
         MyMskEvent:
           Type: MSK
           Properties:
+            Enabled: false
             StartingPosition: LATEST
             Stream:
               Ref: MyMskCluster
diff --git a/samtranslator/internal/data/aws_managed_policies.json b/samtranslator/internal/data/aws_managed_policies.json
@@ -756,7 +756,7 @@
     "AmazonGrafanaCloudWatchAccess": "arn:aws:iam::aws:policy/service-role/AmazonGrafanaCloudWatchAccess",
     "AmazonGrafanaRedshiftAccess": "arn:aws:iam::aws:policy/service-role/AmazonGrafanaRedshiftAccess",
     "AmazonGrafanaServiceLinkedRolePolicy": "arn:aws:iam::aws:policy/aws-service-role/AmazonGrafanaServiceLinkedRolePolicy",
-    "AmazonGuardDutyFullAccess": "arn:aws:iam::aws:policy/AmazonGuardDutyFullAccess",
+    "AmazonGuardDutyFullAccess_v2": "arn:aws:iam::aws:policy/AmazonGuardDutyFullAccess_v2",
     "AmazonGuardDutyMalwareProtectionServiceRolePolicy": "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyMalwareProtectionServiceRolePolicy",
     "AmazonGuardDutyReadOnlyAccess": "arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess",
     "AmazonGuardDutyServiceRolePolicy": "arn:aws:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
@@ -1577,7 +1577,7 @@
     "AmazonFreeRTOSOTAUpdate": "arn:aws-cn:iam::aws:policy/service-role/AmazonFreeRTOSOTAUpdate",
     "AmazonGlacierFullAccess": "arn:aws-cn:iam::aws:policy/AmazonGlacierFullAccess",
     "AmazonGlacierReadOnlyAccess": "arn:aws-cn:iam::aws:policy/AmazonGlacierReadOnlyAccess",
-    "AmazonGuardDutyFullAccess": "arn:aws-cn:iam::aws:policy/AmazonGuardDutyFullAccess",
+    "AmazonGuardDutyFullAccess_v2": "arn:aws-cn:iam::aws:policy/AmazonGuardDutyFullAccess_v2",
     "AmazonGuardDutyMalwareProtectionServiceRolePolicy": "arn:aws-cn:iam::aws:policy/aws-service-role/AmazonGuardDutyMalwareProtectionServiceRolePolicy",
     "AmazonGuardDutyReadOnlyAccess": "arn:aws-cn:iam::aws:policy/AmazonGuardDutyReadOnlyAccess",
     "AmazonGuardDutyServiceRolePolicy": "arn:aws-cn:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
@@ -2200,7 +2200,7 @@
     "AmazonFSxServiceRolePolicy": "arn:aws-us-gov:iam::aws:policy/aws-service-role/AmazonFSxServiceRolePolicy",
     "AmazonGlacierFullAccess": "arn:aws-us-gov:iam::aws:policy/AmazonGlacierFullAccess",
     "AmazonGlacierReadOnlyAccess": "arn:aws-us-gov:iam::aws:policy/AmazonGlacierReadOnlyAccess",
-    "AmazonGuardDutyFullAccess": "arn:aws-us-gov:iam::aws:policy/AmazonGuardDutyFullAccess",
+    "AmazonGuardDutyFullAccess_v2": "arn:aws-us-gov:iam::aws:policy/AmazonGuardDutyFullAccess_v2",
     "AmazonGuardDutyReadOnlyAccess": "arn:aws-us-gov:iam::aws:policy/AmazonGuardDutyReadOnlyAccess",
     "AmazonGuardDutyServiceRolePolicy": "arn:aws-us-gov:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
     "AmazonInspector2FullAccess": "arn:aws-us-gov:iam::aws:policy/AmazonInspector2FullAccess",
@@ -2608,7 +2608,7 @@
     "AmazonGrafanaCloudWatchAccess": "arn:aws-eusc:iam::aws:policy/service-role/AmazonGrafanaCloudWatchAccess",
     "AmazonGrafanaRedshiftAccess": "arn:aws-eusc:iam::aws:policy/service-role/AmazonGrafanaRedshiftAccess",
     "AmazonGrafanaServiceLinkedRolePolicy": "arn:aws-eusc:iam::aws:policy/aws-service-role/AmazonGrafanaServiceLinkedRolePolicy",
-    "AmazonGuardDutyFullAccess": "arn:aws-eusc:iam::aws:policy/AmazonGuardDutyFullAccess",
+    "AmazonGuardDutyFullAccess_v2": "arn:aws-eusc:iam::aws:policy/AmazonGuardDutyFullAccess_v2",
     "AmazonGuardDutyMalwareProtectionServiceRolePolicy": "arn:aws-eusc:iam::aws:policy/aws-service-role/AmazonGuardDutyMalwareProtectionServiceRolePolicy",
     "AmazonGuardDutyReadOnlyAccess": "arn:aws-eusc:iam::aws:policy/AmazonGuardDutyReadOnlyAccess",
     "AmazonGuardDutyServiceRolePolicy": "arn:aws-eusc:iam::aws:policy/aws-service-role/AmazonGuardDutyServiceRolePolicy",
diff --git a/samtranslator/internal/schema_source/aws_serverless_function.py b/samtranslator/internal/schema_source/aws_serverless_function.py
@@ -411,6 +411,7 @@ class HttpApiEvent(BaseModel):
 
 class MSKEventProperties(BaseModel):
     ConsumerGroupId: Optional[PassThroughProp] = mskeventproperties("ConsumerGroupId")
+    Enabled: Optional[PassThroughProp]  # TODO: it doesn't show up in docs yet
     FilterCriteria: Optional[PassThroughProp] = mskeventproperties("FilterCriteria")
     KmsKeyArn: Optional[PassThroughProp]  # TODO: add documentation
     MaximumBatchingWindowInSeconds: Optional[PassThroughProp] = mskeventproperties("MaximumBatchingWindowInSeconds")
diff --git a/samtranslator/intrinsics/actions.py b/samtranslator/intrinsics/actions.py
@@ -5,6 +5,31 @@
 from samtranslator.model.exceptions import InvalidDocumentException, InvalidTemplateException
 
 
+def _get_parameter_value(parameters: Dict[str, Any], param_name: str, default: Any = None) -> Any:
+    """
+    Get parameter value from parameters dict, but return default (None) if
+    - it's a CloudFormation internal placeholder.
+    - param_name is not in the parameters.
+
+    CloudFormation internal placeholders are passed during changeset creation with --include-nested-stacks
+    when there are cross-references between nested stacks that don't exist yet.
+    These placeholders should not be resolved by SAM.
+
+    :param parameters: Dictionary of parameter values
+    :param param_name: Name of the parameter to retrieve
+    :param default: Default value to return if parameter not found or is a placeholder
+    :return: Parameter value, or default if not found or is a CloudFormation placeholder
+    """
+    value = parameters.get(param_name, default)
+
+    # Check if the value is a CloudFormation internal placeholder
+    # E.g. {{IntrinsicFunction:api-xx/MyStack.Outputs.API/Fn::GetAtt}}
+    if isinstance(value, str) and value.startswith("{{IntrinsicFunction:"):
+        return default
+
+    return value
+
+
 class Action(ABC):
     """
     Base class for intrinsic function actions. Each intrinsic function must subclass this,
@@ -103,9 +128,9 @@ def resolve_parameter_refs(self, input_dict: Optional[Any], parameters: Dict[str
         if not isinstance(param_name, str):
             return input_dict
 
-        if param_name in parameters:
-            return parameters[param_name]
-        return input_dict
+        # Use the wrapper function to get parameter value
+        # It returns the original input unchanged if the parameter is a CloudFormation internal placeholder
+        return _get_parameter_value(parameters, param_name, input_dict)
 
     def resolve_resource_refs(
         self, input_dict: Optional[Any], supported_resource_refs: Dict[str, Any]
@@ -193,7 +218,9 @@ def do_replacement(full_ref: str, prop_name: str) -> Any:
             :param prop_name: => logicalId.property
             :return: Either the value it resolves to. If not the original reference
             """
-            return parameters.get(prop_name, full_ref)
+            # Use the wrapper function to get parameter value
+            # It returns the original input unchanged if the parameter is a CloudFormation internal placeholder
+            return _get_parameter_value(parameters, prop_name, full_ref)
 
         return self._handle_sub_action(input_dict, do_replacement)
 
diff --git a/samtranslator/schema/schema.json b/samtranslator/schema/schema.json
diff --git a/schema_source/cloudformation-docs.json b/schema_source/cloudformation-docs.json
diff --git a/schema_source/cloudformation.schema.json b/schema_source/cloudformation.schema.json
diff --git a/schema_source/sam.schema.json b/schema_source/sam.schema.json
diff --git a/tests/intrinsics/test_resolver.py b/tests/intrinsics/test_resolver.py
