Skip to content

Remove SAM translator dependency, validate SAM templates via schemas#4491

Open
kddejong wants to merge 1 commit into
aws-cloudformation:mainfrom
kddejong:remove-sam-translator
Open

Remove SAM translator dependency, validate SAM templates via schemas#4491
kddejong wants to merge 1 commit into
aws-cloudformation:mainfrom
kddejong:remove-sam-translator

Conversation

@kddejong

@kddejong kddejong commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Replace the aws-sam-translator runtime dependency with direct JSON Schema validation of SAM resource types. SAM templates are now validated against schemas from the enhanced schemas service, using the same provider schema infrastructure as CloudFormation resources.

Changes

  • Remove _sam.py transform module and aws-sam-translator dependency
  • Add _sam_globals.py to merge Globals section properties into SAM resources
  • E3724: Validates Globals section structure against the SAM Globals schema
  • E3066: Validates that Connectors and IgnoreGlobals require the SAM transform
  • Lambda rule keywords: Extended Lambda rules (E2531, E2533, etc.) to also match AWS::Serverless::Function paths
  • Sub-resource wildcard: SAM resources use the same module wildcard mechanism for Ref/GetAtt
  • Implicit resource injection: SAM-generated resources (roles, versions, aliases, stages, permissions, etc.) are injected for validation
  • GetAtt resilience: Handle unresolvable schema pointers gracefully instead of crashing

Behavioral Notes

  • Input validation: SAM resource properties, Globals, events, and policies are validated against SAM schemas from the enhanced schemas service
  • Output validation: We no longer validate the transformed CFN output (generated IAM roles, API Gateway stages, etc.). SAM owns that correctness
  • Sub-resources: !Ref MyFunctionRole and !GetAtt MyFunction.Arn pass via the wildcard mechanism

Testing

  • Unit tests for globals merging, implicit resource injection, and new rules
  • Integration tests for good/bad SAM templates, IgnoreGlobals interaction
  • All existing integration tests pass
  • Verified no false positives on real-world SAM templates

Fixes #4556

@codecov

codecov Bot commented Apr 30, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 98.85714% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.39%. Comparing base (cde01ee) to head (5e771ed).

Files with missing lines Patch % Lines
src/cfnlint/rules/functions/GetAtt.py 60.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4491      +/-   ##
==========================================
- Coverage   94.42%   94.39%   -0.04%     
==========================================
  Files         429      431       +2     
  Lines       15097    15121      +24     
  Branches     2915     2923       +8     
==========================================
+ Hits        14256    14273      +17     
- Misses        461      465       +4     
- Partials      380      383       +3     
Flag Coverage Δ
unittests 94.39% <98.85%> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@kddejong
kddejong force-pushed the remove-sam-translator branch 5 times, most recently from fdb75ab to aefb4dc Compare May 13, 2026 20:23
@kddejong kddejong changed the title WIP: Remove SAM translator dependency, validate SAM templates via schemas Remove SAM translator dependency, validate SAM templates via schemas May 13, 2026
@kddejong
kddejong force-pushed the remove-sam-translator branch from aefb4dc to 054499d Compare May 13, 2026 22:43
@kddejong
kddejong marked this pull request as ready for review May 14, 2026 15:48
@kddejong
kddejong force-pushed the remove-sam-translator branch 2 times, most recently from d0b4e98 to ca2ffa8 Compare June 25, 2026 22:58
@kddejong
kddejong force-pushed the remove-sam-translator branch 3 times, most recently from 3193d4d to 797d2d3 Compare July 15, 2026 15:50
Replace the aws-sam-translator runtime dependency with direct JSON Schema
validation of SAM resource types. SAM templates are now validated against
schemas from the enhanced schemas service using the same provider schema
infrastructure as CloudFormation resources.

- Remove _sam.py transform module and aws-sam-translator dependency
- Add _sam_globals.py to merge Globals section into SAM resources
- Add E3724 rule for Globals section validation
- Add E3066 rule for SAM resource attributes (Connectors, IgnoreGlobals)
- Extend Lambda rules to also match AWS::Serverless::Function paths
- Treat SAM resources as module-like for sub-resource Ref/GetAtt wildcard
- Handle unresolvable schema pointers gracefully in GetAtt validation
- Inject SAM implicit resources (roles, versions, aliases, stages, etc.)

Fixes aws-cloudformation#4556
@kddejong
kddejong force-pushed the remove-sam-translator branch from 797d2d3 to 5e771ed Compare July 15, 2026 16:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Using an Intrinsic Function in !Ref with LanguageExtensions and Serverless Transform results in an error

1 participant