fix: surface user-facing errors for malformed Fn::If on Role and CodeUri

[roger-zhangg]

Issue #, if available

N/A

Description of changes

Three malformed-template inputs crashed the SAM transform with unhandled
exceptions, which CloudFormation surfaced as:

Transform AWS::Serverless-2016-10-31 failed with: Internal transform failure.

The customer had no way to know which resource or property was wrong.

1. Malformed Fn::If on AWS::Serverless::Function.Role. Fn::If
must have exactly 3 elements, but _make_lambda_role unpacked directly
without arity validation, so a 2- or 4-element list raised
ValueError: not enough values to unpack (expected 3, got 2).
Now validates via the existing validate_intrinsic_if_items helper and
raises InvalidResourceException with the logical id.

2. Malformed Fn::If on event-invoke destinations.
EventInvokeConfig.DestinationConfig.{OnSuccess,OnFailure}.Destination
also supports Fn::If, and _get_or_make_condition indexed
dest_list[1] / dest_list[2] without arity validation. A 2-element
list raised IndexError: list index out of range. Same guard is now
applied here.

3. Malformed CodeUri URIs. Since the CVE-2024-11168 fix (Python
3.9.17+/3.10.12+/3.11.4+/3.12/3.13/3.14), urllib.parse.urlparse
validates bracketed-host segments against the IPv6/IPv4 grammars. CDK
sometimes synthesizes unresolved IResolvable tokens like
s3://[TOKEN.25]/key into template strings, which now raises
ValueError from inside urlparse. parse_s3_uri now catches that and
returns None, so construct_s3_location_object raises the existing
friendly InvalidResourceException.

After the fix, users see the same class of message SAM emits for other
malformed properties:

Resource with id [MyFunction] is invalid. Malformed 'Role' property:
Fn::If requires 3 arguments. Expected form:
Fn::If: [Condition, TrueValue, FalseValue].

Resource with id [MyFunctionEventInvokeConfig] is invalid. Malformed
'Destination' property: Fn::If requires 3 arguments. Expected form:
Fn::If: [Condition, TrueValue, FalseValue].

Resource with id [MyFunction] is invalid. 'CodeUri' is not a valid S3
Uri of the form 's3://bucket/key' with optional versionId query parameter.

Description of how you validated changes

• Added translator error fixtures (auto-discovered by
  test_transform_invalid_document):
  tests/translator/input/error_function_role_fn_if_malformed.{yaml,json},
  tests/translator/input/error_function_event_destination_fn_if_malformed.{yaml,json},
  tests/translator/input/error_function_codeuri_unresolved_token.{yaml,json}.
• Added unit tests for parse_s3_uri / construct_s3_location_object
  in tests/model/s3_utils/test_uri_parser.py.
• Added two cases (too-few and too-many Fn::If args) to
  tests/model/test_sam_resources.py::TestSamFunctionRoleResolver.
• Full suite: 4503 passed, 0 failed (Python 3.13).

Checklist

• Review the generative AI contribution guidelines
• Adheres to the development guidelines
• Add/update transform tests
  • Using correct values
  • Using wrong values
• Add/update integration tests (not needed — all three failure modes are deterministic and covered by translator error tests)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[aws-sam-cli-bot]

Code Review Results

Reviewed: da99012..a32bc5d
Files: 9
Comments: 1

[aws-sam-cli-bot]

Code Review Results

Reviewed: b4aabe1..6ea76e3
Files: 9 (2 schema JSON files omitted due to size — generated files)
Comments: 1

---

Comments on lines outside the diff:

[samtranslator/model/sam_resources.py:629] [BUG] The same unguarded Fn::If unpack pattern that this PR fixes in _make_lambda_role also exists in _get_or_make_condition. A malformed Fn::If on a destination property (e.g. OnSuccess / OnFailure for event invoke config) with fewer than 3 elements will crash with an IndexError on dest_list[1] / dest_list[2], producing the same opaque "Internal transform failure" message this PR aims to eliminate.

Since the PR already imports and uses validate_intrinsic_if_items, applying the same guard here would be a minimal addition:

if is_intrinsic_if(destination):
   dest_list = destination.get("Fn::If")
   try:
       validate_intrinsic_if_items(dest_list)
   except ValueError as e:
       raise InvalidResourceException(
           logical_id,
           f"Malformed destination 'Fn::If': {e!s}. "
           "Expected form: Fn::If: [Condition, TrueValue, FalseValue].",
       ) from e
   if is_intrinsic_no_value(dest_list[1]) and is_intrinsic_no_value(dest_list[2]):

This is the same class of bug being fixed — consider addressing it in this PR to avoid a separate follow-up.

Note: The following files were omitted due to size: samtranslator/schema/schema.json, schema_source/cloudformation.schema.json (generated schema files).

[aws-sam-cli-bot]

Code Review Results

Reviewed: b4aabe1..d75aaaf
Files: 11 (1 empty __init__.py — no reviewable changes)
Comments: 1