cfn-lint, One Error Found, One Clean Pass

cfn-lint

The AWS CloudFormation CLI (cfn-lint) on EL 10, pinned to a version, in a virtual environment of its own with a link in the PATH. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package; the documented install is pip. EL 10 carries no cfn-lint, and pip install into the system Python ties the CLI's dependencies to whatever the OS ships. This role puts the CLI in /opt/cfn-lint, a venv apart from the system Python: an OS update cannot break it, and it cannot break the OS. The live test asserts import cfnlint fails in /usr/bin/python3.

Pinned, and checked for consistency. cfn_lint_version is what gets installed; the live test runs pip check inside the venv and expects no broken requirements.

pip verifies nothing beyond TLS. The index is PyPI over HTTPS; there is no signature to check. For a byte-for-byte pin, give cfn_lint_pip_extra_args a requirements file with hashes and --require-hashes, or a private index.

Proven to run. The live test calls cfn-lint /tmp/cfn-lint-p/bad.yaml and expects "E3002" - the whole tree loaded and the template linter did its work.

One error found, one clean pass. The live test writes two CloudFormation templates, one with a property the S3 bucket schema does not have, and expects E3002 with exit code 2 for it and exit code 0 for the clean one - the spec loaded, the schema validator ran, the exit code a pipeline keys on is proven in both directions. cfn-lint pulls the CloudFormation resource specification with it; the venv keeps that off the system Python.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.