Invalid FindInMap does not get picked up

Got the following mapping:

Mappings:
  CertificateMap:
    us-east-1:
      Arn: arn:aws:acm:us-east-1:<account>:certificate/<id>

Resources
  AppAlbListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      # ...
      Certificates:
        - CertificateArn:
            Fn::FindInMap: [CertificateMap, !Ref 'AWS::Region', id]

As you can see, Fn::FindInMap is referencing the id key instead of Arn. We should add a rule to fail in such a scenario.

[kddejong]

I had ideas to create this rule a few times but I always paused when you realized you can use Ref for the MapName. But what we should have done is just punt in that scenario. Have some check for common scenarios of the map being a string is better than nothing.

[hoshsadiq]

Yes please, would be good. I do have a few questions.