AllowedPattern broken with CommaDelimitedList parameter

[garretwilson]

Describe the bug

I have an AWS CloudFormation template with the following parameter:

  Profiles:
    Description: The comma-separated list of active profiles, such as "dev,test".
    Type: CommaDelimitedList
    Default: ""
    AllowedPattern: '\w+'
    ConstraintDescription: Active profile identifiers must only use word characters, separated by commas.

The latest documentation for AllowedPattern says:

When applied to a parameter of type CommaDelimitedList, the pattern must match each value in the list.

I try to invoke aws cloudformation deploy … passing the Profiles parameter:

aws cloudformation deploy … --parameter-overrides … Profiles=dev,test

This doesn't work either:

aws cloudformation deploy … --parameter-overrides … Profiles="dev,test"

In fact even this doesn't work!

aws cloudformation deploy … --parameter-overrides … Profiles=dev

The AWS CLI tells me:

An error occurred (ValidationError) when calling the CreateChangeSet operation: Parameter Profiles failed to satisfy constraint: Active profile identifiers must only use word characters, separated by commas.

If I remove AllowedPattern, it works:

  Profiles:
    Description: The comma-separated list of active profiles, such as "dev,test".
    Type: CommaDelimitedList
    Default: ""
    # AllowedPattern: '\w+'
    ConstraintDescription: Active profile identifiers must only use word characters, separated by commas.

If I switch to PowerShell and try this, it fails as well:

aws cloudformation deploy … --parameter-overrides … Profiles=dev,test

This fails, too, in PowerShell:

aws cloudformation deploy … --parameter-overrides … 'Profiles=dev'

And this fails, too, in PowerShell:

aws cloudformation deploy … --parameter-overrides '… Profiles=dev'

Expected Behavior

I expected the value dev,test to be assigned to the Profiles parameter, exactly has happens if I remove the AllowedPattern from the template.

Current Behavior

The CLI tells me:

`An error occurred (ValidationError) when calling the CreateChangeSet operation: Parameter Profiles failed to satisfy constraint: Active profile identifiers must only use word characters, separated by commas.

Add the following parameter to a CloudFormation template:

Parameters:
  Profiles:
    Description: The comma-separated list of active profiles, such as "dev,test".
    Type: CommaDelimitedList
    Default: ""
    AllowedPattern: '\w+'
    ConstraintDescription: Active profile identifiers must only use word characters, separated by commas.

Reproduction Steps

aws cloudformation deploy--stack-name foo --template-file bar.yaml --parameter-overrides Profiles=dev,test

Possible Solution

It works if I remove AllowedPattern from the CloudFormation template.

Additional Information/Context

I have tried it with two CLI versions in three shells:

• WSL Ubunutu: aws-cli/2.11.0 Python/3.11.2 Linux/5.15.90.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/off
• Git Bash: aws-cli/2.9.21 Python/3.9.11 Windows/10 exe/AMD64 prompt/off
• PowerShell: aws-cli/2.9.21 Python/3.9.11 Windows/10 exe/AMD64 prompt/off

CLI version used

aws-cli/2.11.0 Python/3.11.2 Linux/5.15.90.1-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/off

Environment details (OS name and version, etc.)

Windows 10

[tim-finnigan]

Hi @garretwilson thanks for reporting this issue. I could reproduce the behavior you described. In fact, it seems that the error you referenced will occur as long as AllowedPattern is present, regardless of which pattern you use there. Have you tried doing this via the AWS SAM CLI or explored any other workarounds?

[garretwilson]

Have you tried doing this via the AWS SAM CLI or explored any other workarounds?

The only workaround I have tried is to leave out the AllowedPattern, in which case it works. I've already spent hours filing a Stack Overflow questions, responding to Stack Overflow comments, reading other Stack Overflow questions, re-reading the documentation, trying other combinations, etc.

I'm happy that you've been able to reproduce the issue, and it seems that we're in agreement that this behavior doesn't match the documentation. Seeing that this is therefore an AWS bug in some shape or form, I was wondering if the AWS team could continue the investigation from here?

[garretwilson]

What do I need to do to get this some visibility? Is it filed in the wrong repository? Should it be moved to https://github.com/aws-cloudformation/cloudformation-cli/ ? Is there some reason a blatant bug in core CloudFormation language functionality is being ignored?

[tim-finnigan]

Hi @garretwilson thanks for following up — looking again at your template, I think the issue might be due to the Default: "" line as that is calling the regex to fail. If I remove that line (or add a word there to pass the regex pattern) then it appears to be working.

[garretwilson]

I think the issue might be due to the Default: "" line as that is calling the regex to fail.

OK, so you've narrowed down the source of the bug that's breaking this. Can this be scheduled for a fix please?

As I explained in the description, the AllowedPattern here refers to each value in the list, not to the value as a whole. To repeat the quote from the documentation, with my emphasis added:

When applied to a parameter of type CommaDelimitedList, the pattern must match each value in the list.

Thus if I provided a Default: "foo,bar", then the list contains two elements, "foo" and "bar", and the AllowedPattern should be applied to each of those elements individually. (i.e. AllowedPattern should not be applied to the entire string "foo,bar".

In this case, Default: "" indicates a list with no elements whatsoever, in which case there are no elements for AllowedPattern to be applied to, and thus AllowedPattern should not be applied at all.

Think about it this way:

• If I supply Default: "foo,bar", AllowedPattern should be applied to "foo" and AllowedPattern should be applied to "bar".
• If I supply Default: "foo", AllowedPattern should be applied to "foo".
• If I supply Default: "", there is nothing for AllowedPattern to be applied to, because the list is empty.

[tim-finnigan]

Thanks for your patience and apologies that this fell off our radar. For more context - the original error you reported is coming from this CloudFormation service API: https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateChangeSet.html. We can escalate issues like this internally to the CloudFormation team for further review. (Alternatively if you have a support plan we recommend reaching out through AWS Support for issues like this).

The regex included here is for matching one or more word characters: AllowedPattern: '\w+'. In the documentation you linked earlier, it notes for Default:

A value of the appropriate type for the template to use if no value is specified when a stack is created. If you define constraints for the parameter, you must specify a value that adheres to those constraints.

So I think the issue here is that you did not "specify a value that adheres to those constraints". The empty string Default: "" does not match the AllowedPattern constraints, and Default should just not be included in the template if you do not want to set a default value.

Based on the info above, I don't think there is a bug here. But if if you think that the wording could be better clarified in the docs, we recommend using the Provide feedback links at the bottom of API documentation pages to suggest improvements.