[BUG] Suppression Rules Ignored For Certain Checks

[SyphonxZA]

Describe the bug
Suppression rules on resources are being ignored for certain rules, resulting in a template failing validation. Most suppression rules are adhered and do not result in failures.

To Reproduce
Please supply:

Resources:
  ElasticContainerTaskExecutionRole:
    Type: AWS::IAM::Role
    Metadata:
      guard:
        SuppressedRules:
        - CFN_NO_EXPLICIT_RESOURCE_NAMES # Needlessly restrictive
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      RoleName: task-execution-role

Command:

cfn-guard validate --rules /home/redacted/development/aws-guard-rules-registry/rules/aws --data /home/redacted/development/ecs/task/product.template

Result:

/home/redacted/development/ecs/task/product.template Status = FAIL
FAILED rules
cfn_no_explicit_resource_names.guard/CFN_NO_EXPLICIT_RESOURCE_NAMES    FAIL
---
Evaluating data /home/redacted/development/ecs/task/product.template against rules cfn_no_explicit_resource_names.guard
Number of non-compliant resources 2
Resource = ElasticContainerTaskExecutionRole {
  Type      = AWS::IAM::Role
  Rule = CFN_NO_EXPLICIT_RESOURCE_NAMES {
    ALL {
      Check =  RoleName EMPTY   {
        ComparisonError {
          Error            = Check was not compliant as property [/Resources/ElasticContainerTaskExecutionRole/Properties/RoleName[L:309,C:16]] was not empty.
          PropertyPath    = /Resources/ElasticContainerTaskExecutionRole/Properties/RoleName[L:309,C:16]
          Operator        = EMPTY
          Code:
              307.            Service: ecs-tasks.amazonaws.com
              308.      ManagedPolicyArns:
              309.      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
              310.      RoleName: task-execution-role
              311.
              312.  ExternalRecordSet:

        }
      }
    }
  }
}

Expected behavior
Suppressing a rule on a resource should not result in failures.

Operating System:
Ubuntu

OS Version
24.04

[joshfried-aws]

Hi @SyphonxZA can you provide the rule being used here?

[SyphonxZA]

@joshfried-aws currently I am using the rules from this repo: https://github.com/aws-cloudformation/aws-guard-rules-registry

#
#####################################
##          AWS Solutions          ##
#####################################
# Rule Identifier:
#   CFN_NO_EXPLICIT_RESOURCE_NAMES
#
# Description:
#   Checks that the template does not explicitely name resources.
#
# Reports on:
#   Various
#
# Evaluates:
#   AWS CloudFormation
#
# Rule Parameters:
#   NA
#
# CFN_NAG Rule Id:
#   W28
#
# Scenarios:
# a) SKIP: when none of the covered resources types are present
# b) PASS: when none of the applicable types have static resource names
# c) FAIL: when any applicable types has a static resource name
# d) SKIP: when metada has rule suppression for CFN_NO_EXPLICIT_RESOURCE_NAMES or CFN_NAG W28

let applicable_types = [
  "AWS::ApiGateway::ApiKey",
  "AWS::CloudWatch::Alarm",
  "AWS::CodeDeploy::DeploymentConfig",
  "AWS::CodeDeploy::DeploymentGroup",
  "AWS::DynamoDB::Table",
  "AWS::EC2::SecurityGroup",
  "AWS::ECR::Repository",
  "AWS::ElasticLoadBalancingV2::LoadBalancer",
  "AWS::Elasticsearch::Domain",
  "AWS::IAM::Group",
  "AWS::IAM::ManagedPolicy",
  "AWS::IAM::Role",
  "AWS::Kinesis::Stream",
  "AWS::RDS::DBInstance"
]

# Select applicable resources less suppressed resources
let cloudformation_no_static_name_resources = Resources.*[Type in %applicable_types
  Metadata.cfn_nag.rules_to_suppress not exists or
  Metadata.cfn_nag.rules_to_suppress.*.id != "W28"
  Metadata.guard.SuppressedRules not exists or
  Metadata.guard.SuppressedRules.* != "CFN_NO_EXPLICIT_RESOURCE_NAMES"
]

rule CFN_NO_EXPLICIT_RESOURCE_NAMES
  when %cloudformation_no_static_name_resources !empty {
    AWS::ApiGateway::ApiKey {
      Properties{
        Name empty
      }
    }
    AWS::CloudWatch::Alarm {
      Properties{
        AlarmName empty
      }
    }
    AWS::CodeDeploy::DeploymentConfig {
      Properties{
        DeploymentConfigName empty
      }
    }
    AWS::CodeDeploy::DeploymentGroup {
      Properties{
        DeploymentGroupName empty
      }
    }
    AWS::DynamoDB::Table {
      Properties{
        TableName empty
      }
    }
    AWS::EC2::SecurityGroup {
      Properties{
        GroupName empty
      }
    }
    AWS::ECR::Repository {
      Properties{
        RepositoryName empty
      }
    }
    AWS::ElasticLoadBalancingV2::LoadBalancer {
      Properties{
        Name empty
      }
    }
    AWS::Elasticsearch::Domain {
      Properties{
        DomainName empty
      }
    }
    AWS::IAM::Group {
      Properties{
        GroupName empty
      }
    }
    AWS::IAM::ManagedPolicy {
      Properties{
        ManagedPolicyName empty
      }
    }
    AWS::IAM::Role {
      Properties{
        RoleName empty
      }
    }
    AWS::Kinesis::Stream {
      Properties{
        Name empty
      }
    }
    AWS::RDS::DBInstance {
      Properties{
        DBInstanceIdentifier empty
      }
    }
    %cloudformation_no_static_name_resources not empty
    <<
      Violation: Resource found with an explicit name, this disallows updates that require replacement of this resource.
      Fix: Remove static name from the resource
    >>
}

[joshfried-aws]

Hi @SyphonxZA, which version of cfn-guard are you using? Using v.3.1.2 I am unable to reproduce your issue

{
  "name": "issue_636.yaml",
  "metadata": {},
  "status": "SKIP",
  "not_compliant": [],
  "not_applicable": [
    "CFN_NO_EXPLICIT_RESOURCE_NAMES"
  ],
  "compliant": []
}

[SyphonxZA]

cfn-guard 3.1.2

[SyphonxZA]

Hi @joshfried-aws , I only provided the role portion of the problematic template as the violations indicated that was the cause. I see now that the roles by themselves work fine with suppression.

I did some more digging on the full template and identified the actual resource causing the issue. In the template below it will fail if CFN_NO_EXPLICIT_RESOURCE_NAMES is not suppressed on the Security Group. However the results indicate the roles are the problem, the finding should be for the Sec Group.

AWSTemplateFormatVersion: '2010-09-09'
Description: Creates an Elastic Container Service HTTP service and task.

Parameters:
  EcsClusterName:
    Type: String
    Description: The name of the ECS Cluster
  StackNameTag:
    Type: String
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: Specify the VPC ID.

Resources:
  ElasticContainerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata:
      guard:
        SuppressedRules:
        - EC2_SECURITY_GROUP_EGRESS_OPEN_TO_WORLD_RULE # For Web traffic
        - SECURITY_GROUP_EGRESS_PORT_RANGE_RULE # For Web traffic
        # - CFN_NO_EXPLICIT_RESOURCE_NAMES # Needlessly restrictive
    Properties:
      GroupDescription: VPC Security Group
      SecurityGroupEgress:
      - Description: ALLOW all TO all
        CidrIp: 0.0.0.0/0
        IpProtocol: tcp
        FromPort: 0
        ToPort: 65535
      SecurityGroupIngress:
      - Description: !Sub ALLOW http FROM ${EcsClusterName}-external-alb
        FromPort: 80
        IpProtocol: tcp
        SourceSecurityGroupId: !Sub "{{resolve:ssm:/${VpcId}/security/security-groups/security-group-id/${EcsClusterName}-external-alb}}"
        ToPort: 80
      Tags:
      - Key: Name
        Value: !Sub ${StackNameTag}-instance-security-group
      VpcId: !Ref VpcId

  ElasticContainerTaskRole:
    Type: AWS::IAM::Role
    Metadata:
      guard:
        SuppressedRules:
        - CFN_NO_EXPLICIT_RESOURCE_NAMES # Needlessly restrictive
        - IAM_NO_INLINE_POLICY_CHECK # No inherent security issue using inline policies
        - IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE # Selected actions only support the all resources wildcard('*').
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
      Path: /
      Policies:
      - PolicyName: allow-ssmmessages-access-policy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Effect: Allow
            Action:
            - ssmmessages:CreateControlChannel
            - ssmmessages:CreateDataChannel
            - ssmmessages:OpenControlChannel
            - ssmmessages:OpenDataChannel
            Resource: "*"
      RoleName: !Sub ${StackNameTag}-task-role-${AWS::Region}

  ElasticContainerTaskExecutionRole:
    Type: AWS::IAM::Role
    Metadata:
      guard:
        SuppressedRules:
        - CFN_NO_EXPLICIT_RESOURCE_NAMES # Needlessly restrictive
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      RoleName: !Sub ${StackNameTag}-execution-role-${AWS::Region}

[SyphonxZA]

Removing the Tags property (only place with a 'Name') from the Security Group does not prevent the finding. So not sure what on the Security Group is triggering the issue.....

[SyphonxZA]

When specifying the GroupName property on the Security Group (without suppressing the rule) the findings correctly include the Security Group. However they ignore the suppression on the roles and thus 3 findings are generated instead of 1. Suppressing the rule on all 3 resources works as expected.

[johanmynhardt]

Ah, I see the issue, and below are the steps to reproduce:

• Start with 01-product-must-fail.template that rightly fails
• Update 02-product-must-pass.template to suppress CFN_NO_EXPLICIT_RESOURCE_NAMES on Resources.ElasticContainerTaskExecutionRole, and the expected outcome is true
• Update 03-product-must-pass-unrelated-suppression.template to remove suppression of CFN_NO_EXPLICIT_RESOURCE_NAMES on Resources.ElasticContainerSecurityGroup
  • Observe failure on /Resources/ElasticContainerTaskExecutionRole/Properties/RoleName for CFN_NO_EXPLICIT_RESOURCE_NAMES

Starting with initial file:

## 01-product-must-fail.template
AWSTemplateFormatVersion: '2010-09-09'
Description: Creates an Elastic Container Service HTTP service and task.

Parameters:
  EcsClusterName:
    Type: String
    Description: The name of the ECS Cluster
  StackNameTag:
    Type: String
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: Specify the VPC ID.

Resources:
  ElasticContainerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Metadata:
      guard:
        SuppressedRules:
        - EC2_SECURITY_GROUP_EGRESS_OPEN_TO_WORLD_RULE # For Web traffic
        - SECURITY_GROUP_EGRESS_PORT_RANGE_RULE # For Web traffic
        - CFN_NO_EXPLICIT_RESOURCE_NAMES # Needlessly restrictive
    Properties:
      GroupDescription: VPC Security Group
      SecurityGroupEgress:
      - Description: ALLOW all TO all
        CidrIp: 0.0.0.0/0
        IpProtocol: tcp
        FromPort: 0
        ToPort: 65535
      SecurityGroupIngress:
      - Description: !Sub ALLOW http FROM ${EcsClusterName}-external-alb
        FromPort: 80
        IpProtocol: tcp
        SourceSecurityGroupId: !Sub "{{resolve:ssm:/${VpcId}/security/security-groups/security-group-id/${EcsClusterName}-external-alb}}"
        ToPort: 80
      Tags:
      - Key: Name
        Value: !Sub ${StackNameTag}-instance-security-group
      VpcId: !Ref VpcId

  ElasticContainerTaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      RoleName: !Sub ${StackNameTag}-execution-role-${AWS::Region}

Testing:

cfn-guard validate --rules rule-issue-636.guard -o yaml -d 01-product-must-fail.template

/tmp/cfn-guard/01-product-must-fail.template Status = FAIL
FAILED rules
rule-issue-636.guard/CFN_NO_EXPLICIT_RESOURCE_NAMES    FAIL

name: /tmp/cfn-guard/01-product-must-fail.template
metadata: {}
status: FAIL
not_compliant:
- Rule:
    name: CFN_NO_EXPLICIT_RESOURCE_NAMES
    metadata: {}
    messages:
      custom_message: null
      error_message: null
    checks:
    - Clause:
        Unary:
          check:
            Resolved:
              value:
                path: /Resources/ElasticContainerTaskExecutionRole/Properties/RoleName
                value:
                  Fn::Sub: ${StackNameTag}-execution-role-${AWS::Region}
              comparison:
              - Empty
              - false
          context: ' RoleName EMPTY  '
          messages:
            custom_message: ''
            error_message: Check was not compliant as property [/Resources/ElasticContainerTaskExecutionRole/Properties/RoleName[L:53,C:16]] was not empty.
not_applicable: []
compliant: []

Then apply the change:

## 02-product-must-pass.template
--- 01-product-must-fail.template       2025-05-15 14:20:53.349662421 +0200
+++ 02-product-must-pass.template       2025-05-15 14:08:09.459846270 +0200
@@ -41,6 +41,10 @@

   ElasticContainerTaskExecutionRole:
     Type: AWS::IAM::Role
+    Metadata:
+      guard:
+        SuppressedRules:
+        - CFN_NO_EXPLICIT_RESOURCE_NAMES # Suppresses failure on `RoleName`
     Properties:
       AssumeRolePolicyDocument:
         Statement:

Testing:

cfn-guard validate --rules rule-issue-636.guard -o yaml -d 02-product-must-pass.template

name: /tmp/cfn-guard/02-product-must-pass.template
metadata: {}
status: SKIP
not_compliant: []
not_applicable:
- CFN_NO_EXPLICIT_RESOURCE_NAMES
compliant: []

Then remove the CFN_NO_EXPLICIT_RESOURCE_NAMES suppression for an unrelated resource:

## 03-product-must-pass-unrelated-suppression.template
--- 02-product-must-pass.template       2025-05-15 14:08:09.459846270 +0200
+++ 03-product-must-pass-unrelated-suppression.template 2025-05-15 14:10:01.059793379 +0200
@@ -19,7 +19,6 @@
         SuppressedRules:
         - EC2_SECURITY_GROUP_EGRESS_OPEN_TO_WORLD_RULE # For Web traffic
         - SECURITY_GROUP_EGRESS_PORT_RANGE_RULE # For Web traffic
-        - CFN_NO_EXPLICIT_RESOURCE_NAMES # Needlessly restrictive
     Properties:
       GroupDescription: VPC Security Group
       SecurityGroupEgress:

Testing, expecting no failure, but failure reported on unrelated resource:

cfn-guard validate --rules rule-issue-636.guard -o yaml -d 03-product-must-pass-unrelated-suppression.template

/tmp/cfn-guard/03-product-must-pass-unrelated-suppression.template Status = FAIL
FAILED rules
rule-issue-636.guard/CFN_NO_EXPLICIT_RESOURCE_NAMES    FAIL

name: /tmp/cfn-guard/03-product-must-pass-unrelated-suppression.template
metadata: {}
status: FAIL
not_compliant:
- Rule:
    name: CFN_NO_EXPLICIT_RESOURCE_NAMES
    metadata: {}
    messages:
      custom_message: null
      error_message: null
    checks:
    - Clause:
        Unary:
          check:
            Resolved:
              value:
                path: /Resources/ElasticContainerTaskExecutionRole/Properties/RoleName
                value:
                  Fn::Sub: ${StackNameTag}-execution-role-${AWS::Region}
              comparison:
              - Empty
              - false
          context: ' RoleName EMPTY  '
          messages:
            custom_message: ''
            error_message: Check was not compliant as property [/Resources/ElasticContainerTaskExecutionRole/Properties/RoleName[L:56,C:16]] was not empty.
not_applicable: []
compliant: []

Unfortunately I'm extremely new to the internal workings of guard rules so can't quite figure out why it's behaving like this.

[SyphonxZA]

Another example of a template where suppression is ignored. For this one I have not been able to figure out what is causing it.

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  DatabaseMasterUsername:
    Type: String
    AllowedValues:
    - administrator
    Default: administrator
    Description: The master username for the MySQL Aurora RDS instance
  PrivateSubnets:
    Type: AWS::SSM::Parameter::Value<List<String>>
    AllowedValues:
    - /vpc/subnets/subnet-ids/private
    Default: /vpc/subnets/subnet-ids/private
    Description: List of private subnet identifiers returned from SSM parameter store
  StackNameTag:
    Type: String
    AllowedPattern: '[a-z\-]+'
    ConstraintDescription: Malformed input-Parameter. Must match pattern [a-z\-]+
    Description: A name for the CloudFormation stack that will be used to tag resources. Must contain lowercase letters and hyphens only
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: Specify the VPC ID.

Resources:
  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Metadata:
      guard:
        SuppressedRules:
        - EC2_SECURITY_GROUP_EGRESS_OPEN_TO_WORLD_RULE
        - RESTRICTED_INCOMING_TRAFFIC
        - CFN_NO_EXPLICIT_RESOURCE_NAMES
    Properties:
      DBSubnetGroupDescription: Subnet group for the MySQL Aurora RDS instance.
      SubnetIds: !Ref PrivateSubnets

  DBCluster:
    Type: AWS::RDS::DBCluster
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Metadata:
      guard:
        SuppressedRules:
        - AURORA_MYSQL_BACKTRACKING_ENABLED
        - RDS_CLUSTER_MASTER_USER_PASSWORD_USES_SECURE_PARAMETER # Password is resolved from Secrets Manager
        - RDS_CLUSTER_MASTER_USER_PASSWORD_USES_SECURE_SERVICE # Password is resolved from Secrets Manager
        - RDS_CLUSTER_MASTER_USER_PASSWORD_NO_PLAINTEXT_PASSWORD # Password is resolved from Secrets Manager
    Properties:
      AutoMinorVersionUpgrade: True
      BackupRetentionPeriod: 7
      BacktrackWindow: 0
      CopyTagsToSnapshot: true
      DatabaseName: default
      DBClusterIdentifier: !Sub ${StackNameTag}-cluster
      DBSubnetGroupName: !Ref DBSubnetGroup
      EnableHttpEndpoint: true
      Engine: aurora-mysql
      EngineVersion: 8.0.mysql_aurora.3.05.2
      MasterUsername: !Sub '{{resolve:secretsmanager:${DatabaseSecret}::username}}'
      MasterUserPassword: !Sub '{{resolve:secretsmanager:${DatabaseSecret}::password}}'
      MonitoringInterval: 0
      PerformanceInsightsEnabled: true
      PerformanceInsightsRetentionPeriod: 7
      PreferredBackupWindow: 07:00-07:30
      PreferredMaintenanceWindow: mon:05:00-mon:05:30
      ServerlessV2ScalingConfiguration:
        MaxCapacity: 2
        MinCapacity: 0.5
      StorageEncrypted: true
      VpcSecurityGroupIds:
      - sg-07937a5f9b3fb3830

  DBInstance:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Metadata:
      guard:
        SuppressedRules:
        - DB_INSTANCE_BACKUP_ENABLED # Not applicable. The retention period for automated backups is managed by the DB cluster.
        - RDS_AUTOMATIC_MINOR_VERSION_UPGRADE_ENABLED # Not applicable. Auto minor version upgrade is managed by the DB cluster.
        - RDS_ENHANCED_MONITORING_ENABLED # Not applicable. Enhanced monitoring is managed by the DB cluster.
        - CFN_NO_EXPLICIT_RESOURCE_NAMES # Specifying instance name is acceptable.
        - RDS_MASTER_USER_PASSWORD_USES_SECURE_PARAMETER # Not applicable. Password is managed by the DB cluster.
        - RDS_MASTER_USER_NAME_USES_SECURE_PARAMETER # Not applicable. Username is managed by the DB cluster.
        - RDS_MULTI_AZ_SUPPORT # Not applicable. Amazon Aurora DB instance Availability Zones (AZs) are managed by the DB cluster.
        - RDS_STORAGE_ENCRYPTED # Not applicable. Storage encryption is managed by the DB cluster.
        - RDS_INSTANCE_DELETION_PROTECTION_ENABLED # Not applicable. This setting doesn't apply to Amazon Aurora DB instances. You can enable or disable deletion protection for the DB cluster.
        - RDS_INSTANCE_LOGGING_ENABLED # Not applicable. CloudWatch Logs exports are managed by the DB cluster.
    Properties:
      DBInstanceIdentifier: !Sub ${StackNameTag}-writer
      DBClusterIdentifier: !Ref DBCluster
      DBInstanceClass: db.serverless
      Engine: aurora-mysql
      PubliclyAccessible: false

  DatabaseSecret:
    Type: AWS::SecretsManager::Secret
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Metadata:
      guard:
        SuppressedRules:
        - SECRETSMANAGER_ROTATION_ENABLED_CHECK # Not required.
    Properties:
      Description: Variables for the MySQL Aurora RDS instance
      GenerateSecretString:
        ExcludePunctuation: true
        GenerateStringKey: password
        PasswordLength: 16
        SecretStringTemplate: !Sub |
          {
            "database": "default",
            "engine": "mysql",
            "username": "${DatabaseMasterUsername}"
          }
      KmsKeyId: aws/secretsmanager
      Name: !Sub /${VpcId}/rds/aurora-mysql/cluster/${StackNameTag}-cluster

  DatabaseSecretTargetAttachment:
    Type: AWS::SecretsManager::SecretTargetAttachment
    Properties:
      SecretId: !Ref DatabaseSecret
      TargetId: !Ref DBCluster
      TargetType: AWS::RDS::DBCluster

Guard Findings:

Status = FAIL
FAILED rules
rds_master_user_name_no_plaintext_password.guard/RDS_MASTER_USER_NAME_USES_SECURE_PARAMETER    FAIL
---
Evaluating data /home/development/product.template against rules rds_master_user_name_no_plaintext_password.guard
Number of non-compliant resources 1
Resource = DBInstance {
  Type      = AWS::RDS::DBInstance
  Rule = RDS_MASTER_USER_NAME_USES_SECURE_PARAMETER {
    ALL {
      Check =  %rds_master_user_name_refs not EMPTY   {
        RequiredPropertyError {
          PropertyPath = /Resources/DBInstance/Properties[L:92,C:6]
          MissingProperty = MasterUsername.!Ref
          Reason = Could not find key MasterUsername inside struct at path /Resources/DBInstance/Properties[L:92,C:6]
          Code:
               90.        - RDS_INSTANCE_DELETION_PROTECTION_ENABLED # Not applicable. This setting doesn't apply to Amazon Aurora DB instances. You can enable or disable deletion protection for the DB cluster.
               91.        - RDS_INSTANCE_LOGGING_ENABLED # Not applicable. CloudWatch Logs exports are managed by the DB cluster.
               92.    Properties:
               93.      DBInstanceIdentifier: !Sub ${StackNameTag}-writer
               94.      DBClusterIdentifier: !Ref DBCluster
               95.      DBInstanceClass: db.serverless
        }
      }
    }
  }
}
data /home/development/product.template Status = FAIL
FAILED rules
rds_master_user_password_no_plaintext_password.guard/RDS_MASTER_USER_PASSWORD_USES_SECURE_PARAMETER    FAIL
---
Evaluating data data /home/development/product.template against rules rds_master_user_password_no_plaintext_password.guard
Number of non-compliant resources 1
Resource = DBInstance {
  Type      = AWS::RDS::DBInstance
  Rule = RDS_MASTER_USER_PASSWORD_USES_SECURE_PARAMETER {
    ALL {
      Check =  %rds_master_user_password_refs not EMPTY   {
        RequiredPropertyError {
          PropertyPath = /Resources/DBInstance/Properties[L:92,C:6]
          MissingProperty = MasterUserPassword.!Ref
          Reason = Could not find key MasterUserPassword inside struct at path /Resources/DBInstance/Properties[L:92,C:6]
          Code:
               90.        - RDS_INSTANCE_DELETION_PROTECTION_ENABLED # Not applicable. This setting doesn't apply to Amazon Aurora DB instances. You can enable or disable deletion protection for the DB cluster.
               91.        - RDS_INSTANCE_LOGGING_ENABLED # Not applicable. CloudWatch Logs exports are managed by the DB cluster.
               92.    Properties:
               93.      DBInstanceIdentifier: !Sub ${StackNameTag}-writer
               94.      DBClusterIdentifier: !Ref DBCluster
               95.      DBInstanceClass: db.serverless
        }
      }
    }
  }
}