RuleActionOverrides throws E3002 Invalid Property with ManagedRuleGroupStatement

CloudFormation Lint Version

cfn-lint 0.72.2

What operating system are you using?

Mac

Describe the bug

RuleActionOverrides throws an E3002 Invalid Property error when used with ManagedRuleGroupStatement.

$ cfn-lint ruleactionoverride.yaml 
E3002 Invalid Property Resources/ExampleWebACL/Properties/Rules/0/Statement/ManagedRuleGroupStatement/RuleActionOverrides
ruleactionoverride.yaml:30:15

Expected behavior

This should not throw an error as it’s valid per CloudFormation’s documentation. I also successfully ran a CloudFormation stack update with a template similar to the example included in this issue.

• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html
• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-rule.html
• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-statement.html
• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-managedrulegroupstatement.html
• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ruleactionoverride.html

Reproduction template

AWSTemplateFormatVersion: "2010-09-09"
Description: "RuleActionOverrides Example"

Resources:

  ExampleWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: ExampleWebACL
      DefaultAction:
        Block: {}
      Scope: REGIONAL
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: ExampleWebACL
      Rules:
        - Name: ExampleRuleActionOverrides
          Priority: 0
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: ExampleRuleActionOverrides
          Statement:
            ManagedRuleGroupStatement:
              Name: AWSManagedRulesCommonRuleSet
              VendorName: AWS
              RuleActionOverrides:
                - Name: NoUserAgent_HEADER
                  ActionToUse:
                    Count: {}

[kddejong]

I’m going to watch this weeks spec drop to see if its covered and if not I will patch this property in so its covered going forward.

[spedersen-emailage]

Confirmed working!

$ cfn-lint -v
cfn-lint 0.72.5
$ cfn-lint waf_example.yaml 
$