diff --git a/src/cfnlint/helpers.py b/src/cfnlint/helpers.py index 77c2283fb5..d728ec2c1d 100644 --- a/src/cfnlint/helpers.py +++ b/src/cfnlint/helpers.py @@ -136,7 +136,7 @@ REGEX_DYN_REF_SSM_SECURE = re.compile( r"^.*{{resolve:ssm-secure:[a-zA-Z0-9_\.\-/]+(:\d+)?}}.*$" ) -REGEX_SUB_PARAMETERS = re.compile(r"\${([^!].*?)}") +REGEX_SUB_PARAMETERS = re.compile(r"\${\s*([^!\s].*?)\s*}") FUNCTIONS = frozenset( [ diff --git a/test/unit/rules/functions/test_sub.py b/test/unit/rules/functions/test_sub.py index 0e6c55c8e4..e3b813e2fa 100644 --- a/test/unit/rules/functions/test_sub.py +++ b/test/unit/rules/functions/test_sub.py @@ -162,6 +162,18 @@ def context(cfn): {"type": "string"}, [], ), + ( + "Valid Fn::Sub with a space and escape char", + {"Fn::Sub": "${ !Foo }"}, + {"type": "string"}, + [], + ), + ( + "Valid Fn::Sub with a space and no escape char", + {"Fn::Sub": "${ AWS::AccountId }"}, + {"type": "string"}, + [], + ), ( "Invalid Fn::Sub with a too to many elements", {"Fn::Sub": ["${foo}", {"foo": "bar"}, {}]},