cfn-resolver-lib

cfn-resolver-lib

JavaScript library that resolves and evaluates values in AWS CloudFormation templates based on the provided stack parameters and produces the JS object representation of the resolved CFN template.

Did you ever had to debug what's wrong with your AWS CloudFormation template and why your stack deployment fails? Your YAML/JSON could contain some logic with all kinds of nested intrinsic functions and CFN pseudo parameters and sometimes this can get even more complex when you use a tool (e.g. AWS CDK) that generates the file for you.

If you have more than couple of these in your templates it is quite time consuming to figure out which exactly caused the deployment to fail. This simple tool (cfn-resolver-lib and cfn-resolver-cli) tries to mitigate the issue by evaulating these logic and provide the final exact values that will be used in deployment time.

cfn-resolver can help you

• understand your CFN template better
• troubleshoot CloudFormation deployment issues faster
• secure your IaC with unit tests that assert on exact values before actually deploying anything
  • e.g. your unit test now can assert that the s3_reader IAM user has access to prod-uswest2-redshift-log S3 bucket in us-west-2 region in your prod stack.

CLI and Examples

Check out cfn-resolver-cli

How to use?

Install the npm package

npm i cfn-resolver-lib

Write your JavaScript code:

const NodeEvaluator = require('cfn-resolver-lib');

const stackParameters = {
  RefResolvers:
  {
      "AWS::Region": "us-west-2",
      "AWS::Partition": "aws",
      "AWS::AccountId": "000000111111",
      "Stage": "prod",
      "AWS::StackId": "MyEvaluatedFakeStackUsWest2"
  },
  "Fn::GetAttResolvers": {
      AuditLogsBucket: {
          "Arn": "arn:aws:s3:::prod-uswest2-redshift-log"
      }
  }
};

const resolvedObj = new NodeEvaluator(cloufFormationTemplateDeseralizedObj, stackParameters).evaluateNodes();

Supported Features

• Condition Functions
  • Fn::And
  • Fn::Equals
  • Fn::If
  • Fn::Not
  • Fn::Or
• Fn::FindInMap
• Fn::GetAtt
• Fn::GetAZs
• Fn::Join
• Fn::Select
• Fn::Split
• Fn::Sub (at the moment only key-value map subtitution is supported)
• Ref

Unsported Features

• Fn::Transform

Roadmap

• Enchance Fn::Sub to work with template parameter names, resource logical IDs, resource attributes
• Support Fn::ImportValue
• Support Fn::Base64
• Support Fn::Cidr
• Add linter/debugging features by identified valudation errors and warnings found during template evaluation (e.g. like cfn-lint)

Contribution

Feel free to implement any missing features or fix bugs. In any case don't forget to add unit tests.