Allow for secretsmanager dynamic refs in Parameter defaults (#3707)

aws-cloudformation · Sep 23, 2024 · c35fc09 · c35fc09
1 parent cf66b46
commit c35fc09
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/src/cfnlint/rules/functions/DynamicReferenceSecretsManagerPath.py b/src/cfnlint/rules/functions/DynamicReferenceSecretsManagerPath.py
@@ -29,6 +29,12 @@ def validate(self, validator: Validator, s: Any, instance: Any, schema: Any):
             ):
                 return
 
+            if (
+                validator.context.path.path[0] == "Parameters"
+                and validator.context.path.path[2] == "Default"
+            ):
+                return
+
         yield ValidationError(
             (
                 f"Dynamic reference {instance!r} to secrets manager can only be "

diff --git a/test/unit/rules/functions/test_dynamic_reference_secrets_manager_path.py b/test/unit/rules/functions/test_dynamic_reference_secrets_manager_path.py
@@ -42,6 +42,12 @@ def context(cfn):
             ["Resources", "MyResource", "Properties", "LoginProfile", "Password"],
             [],
         ),
+        (
+            "Valid secrets manager",
+            "{{resolve:secretsmanager:Parameter}}",
+            ["Parameters", "MyParameter", "Default"],
+            [],
+        ),
         (
             "Short list",
             "{{resolve:secretsmanager:Parameter}}",