cfn-guard 3.2.0

AWS CloudFormation Guard is an open-source general-purpose policy-as-code evaluation tool. It provides developers with a simple-to-use, yet powerful and expressive domain-specific language (DSL) to define policies and enables developers to validate JSON- or YAML- formatted structured data with those policies.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

rule compare_number_of_buckets(expected) {
    %expected == 5
}

let buckets = Resources.*[ Type == 'AWS::S3::Bucket' ]

rule COMBINED_FUNCTION_AND_PARAMETERIZED_RULES when %buckets !empty {
    compare_number_of_buckets(count(%buckets))
}

rule compare_result_of_regex_replace(replaced, expected) {
    %replaced == %expected
}

let template = Resources.*[ Type == 'AWS::New::Service'] 

rule PARAMETERIZED_RULE_WITH_FUNCTION_CALL_IN_PARAMS when %template exists {
    let arn = %template.Properties.Arn 
    let expected = "aws/123456789012/us-west-2/newservice-Table/extracted"
    compare_result_of_regex_replace(regex_replace(%arn, "^arn:(\w+):(\w+):([\w0-9-]+):(\d+):(.+)$", "${1}/${4}/${3}/${2}-${5}"), %expected)
}