I3042 in PipelineConfigurationBody for AWS::OSIS::Pipeline when defining DynamoDB table_arn

[jburnham]

CloudFormation Lint Version

cfn-lint 1.9.4

What operating system are you using?

macOS

Describe the bug

The template receives the following warning

[cfn-lint] I3042: ARN in Resource IngestionPipeline contains hardcoded Partition in ARN or incorrectly placed Pseudo Parameters

The regex for I3042 seems to be confused with the table_arn: part of the pipeline configuration as defined in Opensearch¹. If I rename it to just table:, the warning goes away. This is regardless if the value of table_arn: is a full arn using ${AWS::Partition} or a variable reference as is the case in the reproduction template.

Expected behavior

I expect the template to be valid as there is no use of a hardcoded partition nor any use of a pseudo parameter afaict.

Reproduction template

---
AWSTemplateFormatVersion: 2010-09-09

Parameters:
  DynamoDBTableArn:
    Description: "DynamoDB Table ARN"
    Type: String
  EnvironmentName:
    Type: String
    AllowedValues:
      - staging
      - production
  PipelineName:
    Description: "Name of the ingestion pipeline"
    Type: String
  PipelineMinUnits:
    Description: Min Units for ingestion pipeline
    Type: Number
  PipelineMaxUnits:
    Description: Max Units for ingestion pipeline
    Type: Number
Resources:
  IngestionPipeline:
    Type: AWS::OSIS::Pipeline
    Properties:
      PipelineName: !Sub ${PipelineName}
      MaxUnits: !Ref PipelineMaxUnits
      MinUnits: !Ref PipelineMinUnits
      PipelineConfigurationBody: !Sub |
          version: "2"
          dynamodb-pipeline:
            source:
              dynamodb:
                acknowledgments: true
                tables:
                  - table_arn: ${DynamoDBTableArn}
                  - export:
                      s3_bucket: mybucket
                      s3_prefix: ${EnvironmentName}
                    stream:
                      start_position: "LATEST"
                aws:
                  region: us-east-1

Footnotes

1. https://opensearch.org/docs/latest/data-prepper/pipelines/configuration/sources/dynamo-db/#usage ↩

[kddejong]

cfn-lint/src/cfnlint/rules/resources/HardCodedArnProperties.py

Line 28 in 39ca987

r"arn:(\$\{[^:]*::[^:]*}|[^:]*):[^:]+:(\$\{[^:]*::[^:]*}|[^:]*):(\$\{[^:]*::[^:]*}|[^:]*)"

I think the issue is [^:] which will match any character but: including newlines.

[kddejong]

I think the new regex pattern in the PR will do better with handling newlines and spacing

[jburnham]

@kddejong confirmed, testing the PR against our full template corrected the warning