configorama 0.10.2 → 0.10.3

package/README.md

@@ -1667,7 +1667,7 @@ const config = await configorama('config.yml', { syntax })
 |---|---|---|---|
 | `prefix` | `string` | `'${'` | Opening delimiter |
 | `suffix` | `string` | `'}'` | Closing delimiter |
-| `excludePatterns` | `string[]` | `['AWS', 'stageVariables']` | Patterns to exclude via negative lookahead (so e.g. `${AWS::Region}` is left untouched by CloudFormation users) |
+| `excludePatterns` | `string[]` | `['AWS', 'aws:', 'stageVariables']` | Patterns to exclude via negative lookahead (so e.g. `${AWS::Region}` and `${aws:username}` are left untouched by CloudFormation users) |
 
 ---
 
@@ -1762,7 +1762,7 @@ buildVariableSyntax('<', '>')      // <env:FOO>
 function buildVariableSyntax(
   prefix: string = '${',
   suffix: string = '}',
-  excludePatterns: string[] = ['AWS', 'stageVariables']
+  excludePatterns: string[] = ['AWS', 'aws:', 'stageVariables']
 ): string
 ```
 
@@ -1891,6 +1891,9 @@ const config = await configorama(configFile, {
 | `allowUnknownVariableTypes` | `boolean \| string[]` | `false` | Allow unknown variable types to pass through |
 | `allowUnresolvedVariables` | `boolean \| string[]` | `false` | Allow known types that can't resolve to pass through |
 | `allowUndefinedValues` | `boolean` | `false` | Allow undefined as a valid end result |
+| `ignorePaths` | `string[]` | Built-in CloudFormation/code paths | Glob-like config paths whose values should be left verbatim |
+| `skipResolutionPaths` | `string[]` | `[]` | Alias for `ignorePaths` |
+| `disableDefaultIgnorePaths` | `boolean` | `false` | Disable the built-in CloudFormation/code ignore paths |
 | `returnMetadata` | `boolean` | `false` | Return `{ config, metadata }` instead of just the resolved config |
 | `returnPreResolvedVariableDetails` | `boolean` | `false` | Return metadata about variables *without* resolving them (used by `analyze()`) |
 | `useDotEnvFiles` | `boolean` | `false` | Auto-load `.env`, `.env.{stage}`, etc. into `process.env` before resolution (via [env-stage-loader](https://www.npmjs.com/package/env-stage-loader)) |
@@ -2084,8 +2087,14 @@ configorama config.yml --info
 # Verify config (check for errors without resolving)
 configorama config.yml --verify
 
-# Extract specific path from config
-configorama config.yml database.host
+# Extract a specific path from config
+configorama config.yml .database.host
+
+# Print an extracted scalar without JSON quotes
+configorama config.yml .database.host --raw
+
+# Copy the formatted output to your clipboard
+configorama config.yml .database.host --raw --copy
 
 # Output as YAML
 configorama config.yml --format yaml
@@ -2102,6 +2111,8 @@ Options:
   -v, --version             Show version number
   -o, --output <file>       Write output to file instead of stdout
   -f, --format <format>     Output format: json, yaml, or js (default: json)
+  -r, --raw                 Print extracted scalar values without JSON quoting
+  -c, --copy                Copy the formatted output to the clipboard
   -d, --debug               Enable debug mode
   -i, --info                Show info about the config
   -V, --verify              Verify the config
@@ -2110,10 +2121,24 @@ Options:
   --allow-undefined         Allow undefined values in the final output
 
 Path Extraction:
-  configorama config.yml database.host    Extract specific value
-  configorama config.yml functions[0]     Extract from array
+  configorama config.yml .database.host   Extract a nested value
+  configorama config.yml '.functions[0]'  Extract from an array
+  configorama -r config.yml .stage        Print raw scalar output
+  configorama -r -c config.yml .stage     Print and copy raw scalar output
 ```
 
+Path extraction uses jq-style paths. JSON remains the default output format, so extracted strings are quoted by default:
+
+```bash
+configorama config.yml .stage
+# "prod"
+
+configorama config.yml .stage --raw
+# prod
+```
+
+`--copy` copies exactly the formatted value that the CLI prints. It uses native clipboard commands where available: `pbcopy` on macOS, `clip` on Windows, and `wl-copy`, `xclip`, or `xsel` on Linux.
+
 ### CLI Examples
 
 **Basic resolution:**
@@ -2151,12 +2176,20 @@ database:
   host: localhost
   port: 5432
 
-# Extract database.host
-configorama config.yml database.host
+# Extract database.host as JSON
+configorama config.yml .database.host
+# Output: "localhost"
+
+# Extract database.host as a raw scalar
+configorama config.yml .database.host --raw
+# Output: localhost
+
+# Extract and copy the raw scalar
+configorama config.yml .database.host --raw --copy
 # Output: localhost
 
 # Extract database config as JSON
-configorama config.yml database --format json
+configorama config.yml .database --format json
 # Output: {"host":"localhost","port":5432}
 ```
 

package/cli.js

@@ -2,6 +2,7 @@
 
 const fs = require('fs')
 const minimist = require('minimist')
+const { spawnSync } = require('child_process')
 const Configorama = require('./src/main')
 const deepLog = require('./src/utils/ui/deep-log')
 const { logHeader } = require('./src/utils/ui/logs')
@@ -12,13 +13,15 @@ const getValueAtPath = require('./src/utils/parsing/getValueAtPath')
 // Parse command line arguments
 const argv = minimist(process.argv.slice(2), {
   string: ['output', 'o', 'format', 'f', 'param'],
-  boolean: ['help', 'h', 'version', 'v', 'V', 'debug', 'allow-unknown', 'allow-undefined', 'list', 'info', 'verify'],
+  boolean: ['help', 'h', 'version', 'v', 'V', 'debug', 'allow-unknown', 'allow-undefined', 'list', 'info', 'verify', 'raw', 'r', 'copy', 'c'],
   alias: {
     h: 'help',
     v: 'version',
     V: 'verify',
     o: 'output',
     f: 'format',
+    r: 'raw',
+    c: 'copy',
     l: 'list',
     i: 'info',
   },
@@ -40,6 +43,8 @@ Options:
   -v, --version             Show version number
   -o, --output <file>       Write output to file instead of stdout
   -f, --format <format>     Output format: json, yaml, or js (default: json)
+  -r, --raw                 Print extracted scalar values without JSON quoting
+  -c, --copy                Copy the formatted output to the clipboard
   -d, --debug               Enable debug mode
   -i, --info                Show info about the config
   -V, --verify              Verify the config
@@ -62,6 +67,8 @@ Path Extraction:
 Examples:
   configorama config.yml
   configorama config.yml .database.host
+  configorama -r config.yml .database.host
+  configorama -r --copy config.yml .database.host
   configorama '.servers[0].port' config.yml
   configorama --info config.yml
   configorama --format yaml config.json
@@ -84,11 +91,53 @@ if (argv.version) {
 let inputFile = null
 let extractPath = null
 
+function isFileArg(arg) {
+  if (fs.existsSync(arg) && fs.statSync(arg).isFile()) return true
+  return arg.startsWith('./') || arg.startsWith('../')
+}
+
+function getClipboardCommands() {
+  if (process.env.CONFIGORAMA_CLIPBOARD_COMMAND) {
+    return [{ command: process.env.CONFIGORAMA_CLIPBOARD_COMMAND, shell: true }]
+  }
+
+  if (process.platform === 'darwin') return [{ command: 'pbcopy', args: [] }]
+  if (process.platform === 'win32') return [{ command: 'clip', args: [] }]
+
+  return [
+    { command: 'wl-copy', args: [] },
+    { command: 'xclip', args: ['-selection', 'clipboard'] },
+    { command: 'xsel', args: ['--clipboard', '--input'] }
+  ]
+}
+
+function copyToClipboard(value) {
+  let lastError = ''
+  for (const candidate of getClipboardCommands()) {
+    const result = spawnSync(candidate.command, candidate.args || [], {
+      input: String(value),
+      encoding: 'utf8',
+      shell: !!candidate.shell,
+      stdio: ['pipe', 'ignore', 'pipe']
+    })
+
+    if (!result.error && result.status === 0) return { ok: true }
+    lastError = result.error ? result.error.message : (result.stderr || '').trim()
+  }
+
+  return {
+    ok: false,
+    error: lastError || 'No supported clipboard command found'
+  }
+}
+
 for (const arg of argv._) {
   if (arg === 'setup') continue
 
   // jq-style paths start with '.' or '['
-  if (arg.startsWith('.') || arg.startsWith('[')) {
+  if (!inputFile && isFileArg(arg)) {
+    inputFile = arg
+  } else if (arg.startsWith('.') || arg.startsWith('[')) {
     extractPath = arg
   } else if (!inputFile) {
     inputFile = arg
@@ -134,6 +183,10 @@ const {
   l,
   info,
   i,
+  r,
+  raw,
+  c,
+  copy,
   'allow-unknown': allowUnknown, 
   'allow-undefined': allowUndefined,
   'allow-unknown-file-refs': allowUnknownFileRefs,
@@ -177,7 +230,9 @@ configorama(inputFile, options)
     let output
 
     // Format the output
-    switch (argv.format.toLowerCase()) {
+    if (argv.raw && extractPath && (config === null || ['string', 'number', 'boolean'].includes(typeof config))) {
+      output = config === null ? 'null' : String(config)
+    } else switch (argv.format.toLowerCase()) {
       case 'yaml':
       case 'yml':
         const YAML = require('./src/parsers/yaml')
@@ -204,6 +259,14 @@ configorama(inputFile, options)
         output = JSON.stringify(config, null, 2)
     }
 
+    if (argv.copy) {
+      const copyResult = copyToClipboard(output)
+      if (!copyResult.ok) {
+        console.error(`Error: Unable to copy to clipboard: ${copyResult.error}`)
+        process.exit(1)
+      }
+    }
+
     // Write to file or stdout
     if (argv.output) {
       fs.writeFileSync(argv.output, output)
@@ -230,4 +293,4 @@ configorama(inputFile, options)
       console.error('error', error)
     }
     process.exit(1)
-  })
+  })

package/index.d.ts

@@ -38,6 +38,18 @@ interface ConfigoramaSettings {
   /** Allow undefined values as final results */
   allowUndefinedValues?: boolean
 
+  /**
+   * Glob-like config paths whose values should be left verbatim.
+   * Useful for embedded languages that also use ${...}.
+   */
+  ignorePaths?: string[]
+
+  /** Alias for ignorePaths */
+  skipResolutionPaths?: string[]
+
+  /** Disable the built-in CloudFormation and embedded-code ignore paths */
+  disableDefaultIgnorePaths?: boolean
+
   // === Legacy Options (deprecated, use above instead) ===
 
   /** @deprecated Use allowUnknownVariableTypes instead */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "configorama",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "Variable support for configuration files",
   "main": "src/index.js",
   "types": "index.d.ts",

package/src/index.js

@@ -13,6 +13,9 @@ const { buildVariableSyntax } = require('./utils/variables/variableUtils')
  * @property {Object.<string, Function>} [functions] - Object of custom functions
  * @property {boolean} [allowUnknownVars] - allow unknown variables to pass through without throwing errors
  * @property {boolean} [allowUndefinedValues] - allow undefined values to pass through without throwing errors
+ * @property {string[]} [ignorePaths] - glob-like config paths whose values should be left verbatim
+ * @property {string[]} [skipResolutionPaths] - alias for ignorePaths
+ * @property {boolean} [disableDefaultIgnorePaths] - disable built-in CloudFormation and embedded-code ignore paths
  * @property {Object|Function} [dynamicArgs] - values passed into .js config files if user using javascript config
  * @property {boolean} [returnMetadata] - return both config and metadata about variables found
  * @property {boolean} [dotEnvSilent] - suppress env-stage-loader logs when useDotenv/useDotEnv is enabled

package/src/main.js

@@ -60,6 +60,7 @@ const { mergeByKeys } = require('./utils/parsing/mergeByKeys')
 const { arrayToJsonPath } = require('./utils/parsing/arrayToJsonPath')
 /* Utils - paths */
 const { findLineByPath } = require('./utils/paths/findLineForKey')
+const { normalizeIgnorePaths, compileIgnorePaths, shouldIgnorePath } = require('./utils/paths/ignorePaths')
 /* Utils - regex */
 const { combineRegexes, funcRegex, fileRefSyntax, textRefSyntax } = require('./utils/regex')
 /* Utils - strings */
@@ -162,6 +163,11 @@ class Configorama {
       // CLI users can still see them with --verbose or dotEnvSilent: false.
       dotEnvSilent: !VERBOSE,
       dotEnvDebug: false,
+      // Glob-like path patterns whose values should be left verbatim.
+      // Useful for embedded languages that also use ${...}, such as
+      // CloudFormation Fn::Sub, inline Lambda code, and CloudFront functions.
+      ignorePaths: [],
+      skipResolutionPaths: [],
     }, options)
 
     // Backward compat: allowUnknownVars -> allowUnknownVariableTypes
@@ -221,9 +227,10 @@ class Configorama {
 
     // Use $[...] syntax for HCL/Terraform files to avoid conflicts with Terraform's ${} syntax
     const isHclFile = detectedFileType === '.tf' || detectedFileType === '.hcl'
+    const defaultExcludedPatterns = ['AWS', 'aws:', 'stageVariables']
     const defaultSyntax = isHclFile
-      ? buildVariableSyntax('$[', ']', ['AWS', 'stageVariables'])
-      : buildVariableSyntax('${', '}', ['AWS', 'stageVariables'])
+      ? buildVariableSyntax('$[', ']', defaultExcludedPatterns)
+      : buildVariableSyntax('${', '}', defaultExcludedPatterns)
 
     const varSyntax = options.syntax || defaultSyntax
     let varRegex
@@ -247,6 +254,7 @@ class Configorama {
     this.varPrefixPattern = new RegExp('^' + this.varPrefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
     this.varSuffixPattern = new RegExp(escapedSuffix + '$')
     this.varSuffixWithSpacePattern = new RegExp('\\s+' + escapedSuffix + '$')
+    this.ignorePathPatterns = compileIgnorePaths(normalizeIgnorePaths(this.settings))
 
     // Set initial config object to populate
     if (typeof fileOrObject === 'object') {
@@ -1063,6 +1071,7 @@ class Configorama {
       originalConfig: this.originalConfig,
       varSuffix: this.varSuffix,
       varSuffixWithSpacePattern: this.varSuffixWithSpacePattern,
+      ignorePathPatterns: this.ignorePathPatterns,
     })
 
     return this._cachedMetadata
@@ -1102,9 +1111,8 @@ class Configorama {
   // #######################
   // ## PROPERTY HANDLING ##
   // #######################
-  isCloudFormationSubPath(pathValue) {
-    if (!pathValue || !pathValue.length) return false
-    return pathValue[pathValue.length - 1] === 'Fn::Sub'
+  shouldSkipResolution(pathValue) {
+    return shouldIgnorePath(pathValue, this.ignorePathPatterns)
   }
 
   /**
@@ -1264,10 +1272,10 @@ class Configorama {
       }
       return false
     })
-    /* Leave CloudFormation Fn::Sub bodies verbatim. ${...} inside a !Sub is a
-       CloudFormation reference, not a configorama variable. */
+    /* Leave opaque paths verbatim. These often contain non-configorama
+       `${...}` syntax from CloudFormation, JavaScript, shell, VTL, etc. */
     variables = variables.filter((property) => {
-      return !this.isCloudFormationSubPath(property.path)
+      return !this.shouldSkipResolution(property.path)
     })
     /*
     console.log(`variables at call count ${this.callCount}`, variables)
@@ -1555,7 +1563,7 @@ class Configorama {
       console.log(valueObject)
     }
     const property = valueObject.value
-    if (this.isCloudFormationSubPath(valueObject.path)) {
+    if (this.shouldSkipResolution(valueObject.path)) {
       return Promise.resolve(property)
     }
     const matches = this.getMatches(property)

package/src/metadata.js

@@ -6,6 +6,7 @@ const fs = require('fs')
 const traverse = require('traverse')
 const dotProp = require('dot-prop')
 const { normalizePath, extractFilePath, resolveInnerVariables } = require('./utils/paths/filePathUtils')
+const { shouldIgnorePath } = require('./utils/paths/ignorePaths')
 const { findNestedVariables } = require('./utils/variables/findNestedVariables')
 const { splitOnPipe } = require('./utils/strings/splitOnPipe')
 
@@ -21,6 +22,7 @@ const { splitOnPipe } = require('./utils/strings/splitOnPipe')
  * @param {Object} params.originalConfig - this.originalConfig, used for dotProp.get checks
  * @param {string} params.varSuffix
  * @param {RegExp} params.varSuffixWithSpacePattern
+ * @param {string[][]} [params.ignorePathPatterns]
  * @returns {Object} Metadata object containing variables, fileDependencies, and summary
  */
 function collectVariableMetadata({
@@ -33,6 +35,7 @@ function collectVariableMetadata({
   originalConfig,
   varSuffix,
   varSuffixWithSpacePattern,
+  ignorePathPatterns,
 }) {
   const foundVariables = []
   const variableData = {}
@@ -46,8 +49,8 @@ function collectVariableMetadata({
   traverse(displayConfig).forEach(function (rawValue) {
     if (typeof rawValue === 'string' && rawValue.match(variableSyntax)) {
       const configValuePath = this.path.join('.')
-      /* Skip Fn::Sub variables */
-      if (configValuePath.endsWith('Fn::Sub')) {
+      /* Skip opaque paths that contain non-configorama ${...} syntax. */
+      if (shouldIgnorePath(this.path, ignorePathPatterns)) {
         return
       }
 

package/src/utils/parsing/parse.js

@@ -10,7 +10,7 @@ const { executeTypeScriptFileSync } = require('../../parsers/typescript')
 const { executeESMFileSync } = require('../../parsers/esm')
 const cloudFormationSchema = require('./cloudformationSchema')
 
-const DEFAULT_VAR_SYNTAX = '\\${((?!AWS|stageVariables)[ ~:a-zA-Z0-9=+!@#%*<>?._\'",|\\-\\/\\(\\)\\\\]+?)}'
+const DEFAULT_VAR_SYNTAX = '\\${((?!AWS|aws:|stageVariables)[ ~:a-zA-Z0-9=+!@#%*<>?._\'",|\\-\\/\\(\\)\\\\]+?)}'
 
 const KNOWN_EXTENSIONS = new Set([
   '.yml', '.yaml', '.json', '.json5', '.jsonc',

package/src/utils/paths/ignorePaths.js

@@ -0,0 +1,69 @@
+const DEFAULT_IGNORE_PATHS = [
+  '**.Fn::Sub',
+  '**.Properties.Code.ZipFile',
+  '**.Properties.FunctionCode',
+  '**.Properties.UserData',
+  '**.Properties.BuildSpec',
+  '**.Properties.DefinitionString',
+  '**.Properties.DefinitionBody',
+  '**.Properties.RequestMappingTemplate',
+  '**.Properties.ResponseMappingTemplate',
+  '**.Properties.RequestTemplates.*',
+  '**.Properties.ResponseTemplates.*',
+  '**.Metadata.AWS::CloudFormation::Init.*.files.*.content',
+  '**.Metadata.AWS::CloudFormation::Init.*.commands.*.command'
+]
+
+function toArray(value) {
+  if (!value) return []
+  return Array.isArray(value) ? value : [value]
+}
+
+function pathToSegments(pathValue) {
+  if (!pathValue) return []
+  return Array.isArray(pathValue) ? pathValue.map(String) : String(pathValue).split('.')
+}
+
+function patternToSegments(pattern) {
+  return String(pattern).split('.')
+}
+
+function matchSegments(patternSegments, pathSegments) {
+  if (!patternSegments.length) return pathSegments.length === 0
+
+  const [head, ...tail] = patternSegments
+  if (head === '**') {
+    if (matchSegments(tail, pathSegments)) return true
+    return pathSegments.length > 0 && matchSegments(patternSegments, pathSegments.slice(1))
+  }
+
+  if (!pathSegments.length) return false
+  if (head !== '*' && head !== pathSegments[0]) return false
+  return matchSegments(tail, pathSegments.slice(1))
+}
+
+function normalizeIgnorePaths(options = {}) {
+  const defaults = options.disableDefaultIgnorePaths ? [] : DEFAULT_IGNORE_PATHS
+  return Array.from(new Set([
+    ...defaults,
+    ...toArray(options.ignorePaths),
+    ...toArray(options.skipResolutionPaths)
+  ]))
+}
+
+function compileIgnorePaths(patterns) {
+  return toArray(patterns).map(patternToSegments)
+}
+
+function shouldIgnorePath(pathValue, compiledPatterns) {
+  if (!compiledPatterns || !compiledPatterns.length) return false
+  const pathSegments = pathToSegments(pathValue)
+  return compiledPatterns.some((patternSegments) => matchSegments(patternSegments, pathSegments))
+}
+
+module.exports = {
+  DEFAULT_IGNORE_PATHS,
+  normalizeIgnorePaths,
+  compileIgnorePaths,
+  shouldIgnorePath
+}

package/src/utils/strings/splitByComma.test.js

@@ -2,7 +2,7 @@ const { test } = require('uvu')
 const assert = require('uvu/assert')
 const { splitByComma } = require('./splitByComma')
 
-const variableSyntax = /\${((?!AWS|stageVariables)[ ~:a-zA-Z0-9=+!@#%*<>?._'",|\-\/\(\)\\]+?)}/g
+const variableSyntax = /\${((?!AWS|aws:|stageVariables)[ ~:a-zA-Z0-9=+!@#%*<>?._'",|\-\/\(\)\\]+?)}/g
 
 test('splitByComma - should return array with original string when no commas present', () => {
   const result = splitByComma('singleString')
@@ -145,4 +145,4 @@ test('splitByComma - should handle odd backslashes (escaped quote)', () => {
 })
 
 // Run all tests
-test.run() 
+test.run()

package/src/utils/variables/findNestedVariables.js

@@ -358,7 +358,7 @@ function findNestedVariablesOld(input, regex, variablesKnownTypes, debug = false
 }
 
 // // Test with the example
-// const regex = /\${((?!AWS|stageVariables)[ ~:a-zA-Z0-9=+!@#%*<>?._'",|\-\/\(\)\\]+?)}/g
+// const regex = /\${((?!AWS|aws:|stageVariables)[ ~:a-zA-Z0-9=+!@#%*<>?._'",|\-\/\(\)\\]+?)}/g
 // const input = '${file(./config.${opt:stage, ${defaultStage}}.json):CREDS}'
 
 // // Run the function with debug output
@@ -374,4 +374,4 @@ function findNestedVariablesOld(input, regex, variablesKnownTypes, debug = false
 
 module.exports = {
   findNestedVariables
-}
+}

package/src/utils/variables/findNestedVariables.test.js

@@ -9,7 +9,7 @@ const getValueFromOptions = require('../../resolvers/valueFromOptions')
 const getValueFromGit = require('../../resolvers/valueFromGit')
 
 // Define the regex pattern as used in the main function
-const regex = /\${((?!AWS|stageVariables)[ ~:a-zA-Z0-9=+!@#%*<>?._'",|\-\/\(\)\\]+?)}/g;
+const regex = /\${((?!AWS|aws:|stageVariables)[ ~:a-zA-Z0-9=+!@#%*<>?._'",|\-\/\(\)\\]+?)}/g;
 const variablesKnownTypes = /(^env:|^opt:|^self:|^file\((~?[\{\}\:\$a-zA-Z0-9._\-\/,'" ]+?)\)|^git:|(\${)?deep:\d+(\.[^}]+)*()}?)/
 
 const fileRefSyntax = RegExp(/^file\((~?[@\{\}\:\$a-zA-Z0-9._\-\/,'" ]+?)\)/g)
@@ -239,4 +239,4 @@ test('findNestedVariables - deep - no var types passed', () => {
 
 
 // Run all tests
-test.run(); 
+test.run();

package/src/utils/variables/variableUtils.js

@@ -93,10 +93,10 @@ Remove or update the \${${variableString}} to fix
  * Excludes suffix characters from the allowed set to prevent parsing issues
  * @param {string} [prefix='${'] - Variable prefix
  * @param {string} [suffix='}'] - Variable suffix
- * @param {string[]} [excludePatterns=['AWS', 'stageVariables']] - Patterns to exclude via negative lookahead
+ * @param {string[]} [excludePatterns=['AWS', 'aws:', 'stageVariables']] - Patterns to exclude via negative lookahead
  * @returns {string} Regex source string
  */
-function buildVariableSyntax(prefix = '${', suffix = '}', excludePatterns = ['AWS', 'stageVariables']) {
+function buildVariableSyntax(prefix = '${', suffix = '}', excludePatterns = ['AWS', 'aws:', 'stageVariables']) {
   // All allowed characters, stored as individual escaped entries for regex character class
   // Each entry is how it appears in a regex character class
   // NOTE: { and } are intentionally excluded - they break nested variable matching
@@ -145,4 +145,4 @@ module.exports = {
   getFallbackString,
   verifyVariable,
   buildVariableSyntax
-} 
+}

package/src/utils/variables/variableUtils.test.js

@@ -172,6 +172,15 @@ test('buildVariableSyntax - supports backslash in values', () => {
   assert.is(match[0], "${env:FOO, 'path\\to\\file'}")
 })
 
+test('buildVariableSyntax - default ${} syntax excludes IAM aws variables', () => {
+  const syntax = buildVariableSyntax('${', '}')
+  const regex = new RegExp(syntax, 'g')
+
+  assert.not.ok('${aws:username}'.match(regex))
+  assert.not.ok('arn:aws:s3:::bucket/${aws:PrincipalTag/team}/*'.match(regex))
+  assert.ok('${self:custom.value}'.match(regex))
+})
+
 test('buildVariableSyntax - double brace ${{}} syntax excludes }', () => {
   const syntax = buildVariableSyntax('${{', '}}')
   const regex = new RegExp(syntax, 'g')