E3031: ManagedPolicyArns contains invalid characters... for a valid managed Policy

cfn-lint version: 0.49.2

I’m getting this cfn-lint error for a sam-cli template:

[cfn-lint] E3031: ManagedPolicyArns contains invalid characters (Pattern: arn:(aws[a-zA-Z-]*)?:iam::(\d{12}|aws):policy/[a-zA-Z_0-9+=,.@\-_/]+) at Resources/MyFunctionRole/Properties/ManagedPolicyArns/4

specifically for the CloudWatchLambdaInsightsExecutionRolePolicy policy:

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
    ...
      Policies:
        - AWSLambdaRole       # AWS Managed Role to allow Lambda invokation permissions
        - CloudWatchLambdaInsightsExecutionRolePolicy   # Lambda Insights

but that error is not applicable since this syntax works and is officially supported via the documentation: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html#sam-function-policies

where it states: This property accepts a single string or a list of strings, and can be the name of AWS managed policies or...

[thesuavehog]

I am experiencing this issue as well. Given that the the SAM templates work fine with this format

Policies:
  - AmazonElasticFileSystemClientReadWriteAccess
  - AWSLambdaVPCAccessExecutionRole

and given that this project’s goal is to identify issues with the CloudFormation YML, and this is obviously not an issue since the SAM YML translates and deploys fine, this should be considered a bug - and one that means I cannot use this tool in a validation pipeline to catch errors… which is kinda the point of this tool.

When I view the processed final template in the CloudFormation console, the YML format does not add the arn:aws:iam::aws:policy/ prefix but the JSON format does. I guess that means that the YML format is valid without the prefix.

Now, I’m not sure what the right fix is in the project code though since I presume the only values that are allowed that are String values not ARN values are those that are pre-defined AWS Policies. It seems high maintenance to include a fixed list of those policies but maybe that’s better than failing on them?

[kddejong]

When doing this in an account. This makes me think the SAM translator package is not doing the same as what is happening in actuality.

"ManagedPolicyArns": [
  "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  "arn:aws:iam::aws:policy/service-role/AWSLambdaRole",
  "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
],