localstack-core 4.6.1.dev60__py3-none-any.whl → 4.10.1.dev12__py3-none-any.whl

localstack/services/cloudformation/engine/v2/change_set_model_preproc.py

@@ -3,18 +3,15 @@ from __future__ import annotations
 import base64
 import copy
 import re
-from typing import Any, Callable, Final, Generic, Optional, TypeVar
+from collections.abc import Callable
+from typing import Any, Final, Generic, TypeVar
 
 from botocore.exceptions import ClientError
 
 from localstack import config
+from localstack.aws.api.cloudformation import ResourceStatus
 from localstack.aws.api.ec2 import AvailabilityZoneList, DescribeAvailabilityZonesResult
 from localstack.aws.connect import connect_to
-from localstack.services.cloudformation.engine.transformers import (
-    Transformer,
-    execute_macro,
-    transformers,
-)
 from localstack.services.cloudformation.engine.v2.change_set_model import (
     ChangeSetEntity,
     ChangeType,
@@ -33,6 +30,7 @@ from localstack.services.cloudformation.engine.v2.change_set_model import (
     NodeProperties,
     NodeProperty,
     NodeResource,
+    NodeResources,
     NodeTemplate,
     Nothing,
     NothingType,
@@ -47,9 +45,19 @@ from localstack.services.cloudformation.engine.v2.change_set_model import (
 from localstack.services.cloudformation.engine.v2.change_set_model_visitor import (
     ChangeSetModelVisitor,
 )
-from localstack.services.cloudformation.stores import get_cloudformation_store
+from localstack.services.cloudformation.engine.v2.resolving import (
+    REGEX_DYNAMIC_REF,
+    extract_dynamic_reference,
+    perform_dynamic_reference_lookup,
+)
+from localstack.services.cloudformation.engine.validations import ValidationError
+from localstack.services.cloudformation.stores import (
+    exports_map,
+)
 from localstack.services.cloudformation.v2.entities import ChangeSet
+from localstack.services.cloudformation.v2.types import ResolvedResource
 from localstack.utils.aws.arns import get_partition
+from localstack.utils.numbers import to_number
 from localstack.utils.objects import get_value_from_path
 from localstack.utils.run import to_str
 from localstack.utils.strings import to_bytes
@@ -70,9 +78,15 @@ _PSEUDO_PARAMETERS: Final[set[str]] = {
 
 TBefore = TypeVar("TBefore")
 TAfter = TypeVar("TAfter")
+_T = TypeVar("_T")
 
+REGEX_OUTPUT_APIGATEWAY = re.compile(
+    rf"^(https?://.+\.execute-api\.)(?:[^-]+-){{2,3}}\d\.(amazonaws\.com|{_AWS_URL_SUFFIX})/?(.*)$"
+)
 MOCKED_REFERENCE = "unknown"
 
+VALID_LOGICAL_RESOURCE_ID_RE = re.compile(r"^[A-Za-z0-9]+$")
+
 
 class PreprocEntityDelta(Generic[TBefore, TAfter]):
     before: Maybe[TBefore]
@@ -102,20 +116,24 @@ class PreprocProperties:
 
 class PreprocResource:
     logical_id: str
-    physical_resource_id: Optional[str]
-    condition: Optional[bool]
+    physical_resource_id: str | None
+    condition: bool | None
     resource_type: str
     properties: PreprocProperties
-    depends_on: Optional[list[str]]
+    depends_on: list[str] | None
+    requires_replacement: bool
+    status: ResourceStatus | None
 
     def __init__(
         self,
         logical_id: str,
         physical_resource_id: str,
-        condition: Optional[bool],
+        condition: bool | None,
         resource_type: str,
         properties: PreprocProperties,
-        depends_on: Optional[list[str]],
+        depends_on: list[str] | None,
+        requires_replacement: bool,
+        status: ResourceStatus | None = None,
     ):
         self.logical_id = logical_id
         self.physical_resource_id = physical_resource_id
@@ -123,6 +141,8 @@ class PreprocResource:
         self.resource_type = resource_type
         self.properties = properties
         self.depends_on = depends_on
+        self.requires_replacement = requires_replacement
+        self.status = status
 
     @staticmethod
     def _compare_conditions(c1: bool, c2: bool):
@@ -147,10 +167,10 @@ class PreprocResource:
 class PreprocOutput:
     name: str
     value: Any
-    export: Optional[Any]
-    condition: Optional[bool]
+    export: Any | None
+    condition: bool | None
 
-    def __init__(self, name: str, value: Any, export: Optional[Any], condition: Optional[bool]):
+    def __init__(self, name: str, value: Any, export: Any | None, condition: bool | None):
         self.name = name
         self.value = value
         self.export = export
@@ -178,8 +198,8 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
     def __init__(self, change_set: ChangeSet):
         self._change_set = change_set
         self._before_resolved_resources = change_set.stack.resolved_resources
-        self._before_cache = dict()
-        self._after_cache = dict()
+        self._before_cache = {}
+        self._after_cache = {}
 
     def _setup_runtime_cache(self) -> None:
         runtime_cache_key = self.__class__.__name__
@@ -207,6 +227,8 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
     def process(self) -> None:
         self._setup_runtime_cache()
         node_template = self._change_set.update_model.node_template
+        node_conditions = self._change_set.update_model.node_template.conditions
+        self.visit(node_conditions)
         self.visit(node_template)
         self._save_runtime_cache()
 
@@ -218,11 +240,13 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             if node_resource.name == resource_name:
                 self.visit(node_resource)
                 return node_resource
-        raise RuntimeError(f"No resource '{resource_name}' was found")
+        raise ValidationError(
+            f"Template format error: Unresolved resource dependencies [{resource_name}] in the Resources block of the template"
+        )
 
     def _get_node_property_for(
         self, property_name: str, node_resource: NodeResource
-    ) -> Optional[NodeProperty]:
+    ) -> NodeProperty | None:
         # TODO: this could be improved with hashmap lookups if the Node contained bindings and not lists.
         for node_property in node_resource.properties.properties:
             if node_property.name == property_name:
@@ -233,7 +257,8 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
     def _deployed_property_value_of(
         self, resource_logical_id: str, property_name: str, resolved_resources: dict
     ) -> Any:
-        # TODO: typing around resolved resources is needed and should be reflected here.
+        # We have to override this function to make sure it does not try to access the
+        # resolved resource
 
         # Before we can obtain deployed value for a resource, we need to first ensure to
         # process the resource if this wasn't processed already. Ideally, values should only
@@ -248,17 +273,17 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             raise RuntimeError(
                 f"No deployed instances of resource '{resource_logical_id}' were found"
             )
-        properties = resolved_resource.get("Properties", dict())
-        # support structured properties, e.g. NestedStack.Outputs.OutputName
-        property_value: Optional[Any] = get_value_from_path(properties, property_name)
+        properties = resolved_resource.get("Properties", {})
+        # TODO support structured properties, e.g. NestedStack.Outputs.OutputName
+        property_value: Any | None = get_value_from_path(properties, property_name)
 
         if property_value:
-            if not isinstance(property_value, str):
-                # TODO: is this correct? If there is a bug in the logic here, it's probably
-                #  better to know about it with a clear error message than to receive some form
-                #  of message about trying to use a dictionary in place of a string
+            if not isinstance(property_value, (str, list, dict)):
+                # Str: Standard expected type. TODO validate bools and numbers
+                # List: Multiple resource types can return a list of values e.g. AWS::EC2::VPC.
+                # Dict: Custom resources in CloudFormation can return arbitrary data structures.
                 raise RuntimeError(
-                    f"Accessing property '{property_name}' from '{resource_logical_id}' resulted in a non-string value"
+                    f"Accessing property '{property_name}' from '{resource_logical_id}' resulted in a non-string value nor list"
                 )
             return property_value
         elif config.CFN_IGNORE_UNSUPPORTED_RESOURCE_TYPES:
@@ -277,7 +302,7 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
 
     def _after_deployed_property_value_of(
         self, resource_logical_id: str, property_name: str
-    ) -> Optional[str]:
+    ) -> str | None:
         return self._before_deployed_property_value_of(
             resource_logical_id=resource_logical_id, property_name=property_name
         )
@@ -367,8 +392,12 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
         node_mapping: NodeMapping = self._get_node_mapping(map_name=map_name)
         top_level_value = node_mapping.bindings.bindings.get(top_level_key)
         if not isinstance(top_level_value, NodeObject):
-            raise RuntimeError()
+            error_key = "::".join([map_name, top_level_key, second_level_key])
+            raise ValidationError(f"Template error: Unable to get mapping for {error_key}")
         second_level_value = top_level_value.bindings.get(second_level_key)
+        if not isinstance(second_level_value, (TerminalValue, NodeArray, NodeObject)):
+            error_key = "::".join([map_name, top_level_key, second_level_key])
+            raise ValidationError(f"Template error: Unable to get mapping for {error_key}")
         mapping_value_delta = self.visit(second_level_value)
         return mapping_value_delta
 
@@ -380,10 +409,63 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             return PreprocEntityDelta(before=before, after=after)
         delta = super().visit(change_set_entity=change_set_entity)
         if isinstance(delta, PreprocEntityDelta):
+            delta = self._maybe_perform_replacements(delta)
             self._before_cache[entity_scope] = delta.before
             self._after_cache[entity_scope] = delta.after
         return delta
 
+    def _maybe_perform_replacements(self, delta: PreprocEntityDelta) -> PreprocEntityDelta:
+        delta = self._maybe_perform_static_replacements(delta)
+        delta = self._maybe_perform_dynamic_replacements(delta)
+        return delta
+
+    def _maybe_perform_static_replacements(self, delta: PreprocEntityDelta) -> PreprocEntityDelta:
+        return self._maybe_perform_on_delta(delta, self._perform_static_replacements)
+
+    def _maybe_perform_dynamic_replacements(self, delta: PreprocEntityDelta) -> PreprocEntityDelta:
+        return self._maybe_perform_on_delta(delta, self._perform_dynamic_replacements)
+
+    def _maybe_perform_on_delta(
+        self, delta: PreprocEntityDelta | None, f: Callable[[_T], _T]
+    ) -> PreprocEntityDelta | None:
+        if isinstance(delta.before, str):
+            delta.before = f(delta.before)
+        if isinstance(delta.after, str):
+            delta.after = f(delta.after)
+        return delta
+
+    def _perform_dynamic_replacements(self, value: _T) -> _T:
+        if not isinstance(value, str):
+            return value
+
+        if dynamic_ref := extract_dynamic_reference(value):
+            new_value = perform_dynamic_reference_lookup(
+                reference=dynamic_ref,
+                account_id=self._change_set.account_id,
+                region_name=self._change_set.region_name,
+            )
+            if new_value:
+                # We need to use a function here, to avoid backslash processing by regex.
+                # From the regex sub documentation:
+                # repl can be a string or a function; if it is a string, any backslash escapes in it are processed.
+                # Using a function, we can avoid this processing.
+                return REGEX_DYNAMIC_REF.sub(lambda _: new_value, value)
+
+        return value
+
+    @staticmethod
+    def _perform_static_replacements(value: str) -> str:
+        api_match = REGEX_OUTPUT_APIGATEWAY.match(value)
+        if api_match and value not in config.CFN_STRING_REPLACEMENT_DENY_LIST:
+            prefix = api_match[1]
+            host = api_match[2]
+            path = api_match[3]
+            port = localstack_host().port
+            value = f"{prefix}{host}:{port}/{path}"
+            return value
+
+        return value
+
     def _cached_apply(
         self, scope: Scope, arguments_delta: PreprocEntityDelta, resolver: Callable[[Any], Any]
     ) -> PreprocEntityDelta:
@@ -432,6 +514,9 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
 
         return PreprocEntityDelta(before=before, after=after)
 
+    def visit_node_property(self, node_property: NodeProperty) -> PreprocEntityDelta:
+        return self.visit(node_property.value)
+
     def visit_terminal_value_modified(
         self, terminal_value_modified: TerminalValueModified
     ) -> PreprocEntityDelta:
@@ -465,15 +550,15 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
 
     def visit_node_object(self, node_object: NodeObject) -> PreprocEntityDelta:
         node_change_type = node_object.change_type
-        before = dict() if node_change_type != ChangeType.CREATED else Nothing
-        after = dict() if node_change_type != ChangeType.REMOVED else Nothing
+        before = {} if node_change_type != ChangeType.CREATED else Nothing
+        after = {} if node_change_type != ChangeType.REMOVED else Nothing
         for name, change_set_entity in node_object.bindings.items():
             delta: PreprocEntityDelta = self.visit(change_set_entity=change_set_entity)
             delta_before = delta.before
             delta_after = delta.after
-            if not is_nothing(before) and not is_nothing(delta_before) and delta_before is not None:
+            if not is_nothing(before) and not is_nothing(delta_before):
                 before[name] = delta_before
-            if not is_nothing(after) and not is_nothing(delta_after) and delta_after is not None:
+            if not is_nothing(after) and not is_nothing(delta_after):
                 after[name] = delta_after
         return PreprocEntityDelta(before=before, after=after)
 
@@ -484,33 +569,57 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             arguments_list = arguments.split(".")
         else:
             arguments_list = arguments
+
+        if len(arguments_list) < 2:
+            raise ValidationError(
+                "Template error: every Fn::GetAtt object requires two non-empty parameters, the resource name and the resource attribute"
+            )
+
         logical_name_of_resource = arguments_list[0]
-        attribute_name = arguments_list[1]
+        attribute_name = ".".join(arguments_list[1:])
 
         node_resource = self._get_node_resource_for(
             resource_name=logical_name_of_resource,
             node_template=self._change_set.update_model.node_template,
         )
-        node_property: Optional[NodeProperty] = self._get_node_property_for(
+
+        if not is_nothing(node_resource.condition_reference):
+            condition = self._get_node_condition_if_exists(node_resource.condition_reference.value)
+            evaluation_result = self._resolve_condition(condition.name)
+
+            if select_before and not evaluation_result.before:
+                raise ValidationError(
+                    f"Template format error: Unresolved resource dependencies [{logical_name_of_resource}] in the Resources block of the template"
+                )
+
+            if not select_before and not evaluation_result.after:
+                raise ValidationError(
+                    f"Template format error: Unresolved resource dependencies [{logical_name_of_resource}] in the Resources block of the template"
+                )
+
+        # Custom Resources can mutate their definition
+        # So the preproc should search first in the resource values and then check the template
+        if select_before:
+            value = self._before_deployed_property_value_of(
+                resource_logical_id=logical_name_of_resource,
+                property_name=attribute_name,
+            )
+        else:
+            value = self._after_deployed_property_value_of(
+                resource_logical_id=logical_name_of_resource,
+                property_name=attribute_name,
+            )
+        if value is not None:
+            return value
+
+        node_property: NodeProperty | None = self._get_node_property_for(
             property_name=attribute_name, node_resource=node_resource
         )
         if node_property is not None:
             # The property is statically defined in the template and its value can be computed.
             property_delta = self.visit(node_property)
             value = property_delta.before if select_before else property_delta.after
-        else:
-            # The property is not statically defined and must therefore be available in
-            # the properties deployed set.
-            if select_before:
-                value = self._before_deployed_property_value_of(
-                    resource_logical_id=logical_name_of_resource,
-                    property_name=attribute_name,
-                )
-            else:
-                value = self._after_deployed_property_value_of(
-                    resource_logical_id=logical_name_of_resource,
-                    property_name=attribute_name,
-                )
+
         return value
 
     def visit_node_intrinsic_function_fn_get_att(
@@ -539,6 +648,12 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             return args[0] == args[1]
 
         arguments_delta = self.visit(node_intrinsic_function.arguments)
+
+        if isinstance(arguments_delta.after, list) and len(arguments_delta.after) != 2:
+            raise ValidationError(
+                "Template error: every Fn::Equals object requires a list of 2 string parameters."
+            )
+
         delta = self._cached_apply(
             scope=node_intrinsic_function.scope,
             arguments_delta=arguments_delta,
@@ -549,21 +664,38 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
     def visit_node_intrinsic_function_fn_if(
         self, node_intrinsic_function: NodeIntrinsicFunction
     ) -> PreprocEntityDelta:
-        def _compute_delta_for_if_statement(args: list[Any]) -> PreprocEntityDelta:
-            condition_name = args[0]
-            boolean_expression_delta = self._resolve_condition(logical_id=condition_name)
-            return PreprocEntityDelta(
-                before=args[1] if boolean_expression_delta.before else args[2],
-                after=args[1] if boolean_expression_delta.after else args[2],
+        # `if` needs to be short-circuiting i.e. if the condition is True we don't evaluate the
+        # False branch. If the condition is False, we don't evaluate the True branch.
+        if len(node_intrinsic_function.arguments.array) != 3:
+            raise ValueError(
+                f"Incorrectly constructed Fn::If usage, expected 3 arguments, found {len(node_intrinsic_function.arguments.array)}"
             )
 
-        arguments_delta = self.visit(node_intrinsic_function.arguments)
-        delta = self._cached_apply(
-            scope=node_intrinsic_function.scope,
-            arguments_delta=arguments_delta,
-            resolver=_compute_delta_for_if_statement,
-        )
-        return delta
+        condition_delta = self.visit(node_intrinsic_function.arguments.array[0])
+        if_delta = PreprocEntityDelta()
+        if not is_nothing(condition_delta.before):
+            node_condition = self._get_node_condition_if_exists(
+                condition_name=condition_delta.before
+            )
+            condition_value = self.visit(node_condition).before
+            if condition_value:
+                arg_delta = self.visit(node_intrinsic_function.arguments.array[1])
+            else:
+                arg_delta = self.visit(node_intrinsic_function.arguments.array[2])
+            if_delta.before = arg_delta.before
+
+        if not is_nothing(condition_delta.after):
+            node_condition = self._get_node_condition_if_exists(
+                condition_name=condition_delta.after
+            )
+            condition_value = self.visit(node_condition).after
+            if condition_value:
+                arg_delta = self.visit(node_intrinsic_function.arguments.array[1])
+            else:
+                arg_delta = self.visit(node_intrinsic_function.arguments.array[2])
+            if_delta.after = arg_delta.after
+
+        return if_delta
 
     def visit_node_intrinsic_function_fn_and(
         self, node_intrinsic_function: NodeIntrinsicFunction
@@ -598,8 +730,12 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
     def visit_node_intrinsic_function_fn_not(
         self, node_intrinsic_function: NodeIntrinsicFunction
     ) -> PreprocEntityDelta:
-        def _compute_fn_not(arg: bool) -> bool:
-            return not arg
+        def _compute_fn_not(arg: list[bool] | bool) -> bool:
+            # Is the argument ever a lone boolean?
+            if isinstance(arg, list):
+                return not arg[0]
+            else:
+                return not arg
 
         arguments_delta = self.visit(node_intrinsic_function.arguments)
         delta = self._cached_apply(
@@ -609,65 +745,6 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
         )
         return delta
 
-    def _compute_fn_transform(self, args: dict[str, Any]) -> Any:
-        # TODO: add typing to arguments before this level.
-        # TODO: add schema validation
-        # TODO: add support for other transform types
-
-        account_id = self._change_set.account_id
-        region_name = self._change_set.region_name
-        transform_name: str = args.get("Name")
-        if not isinstance(transform_name, str):
-            raise RuntimeError("Invalid or missing Fn::Transform 'Name' argument")
-        transform_parameters: dict = args.get("Parameters")
-        if not isinstance(transform_parameters, dict):
-            raise RuntimeError("Invalid or missing Fn::Transform 'Parameters' argument")
-
-        if transform_name in transformers:
-            # TODO: port and refactor this 'transformers' logic to this package.
-            builtin_transformer_class = transformers[transform_name]
-            builtin_transformer: Transformer = builtin_transformer_class()
-            transform_output: Any = builtin_transformer.transform(
-                account_id=account_id, region_name=region_name, parameters=transform_parameters
-            )
-            return transform_output
-
-        macros_store = get_cloudformation_store(
-            account_id=account_id, region_name=region_name
-        ).macros
-        if transform_name in macros_store:
-            # TODO: this formatting of stack parameters is odd but required to integrate with v1 execute_macro util.
-            #  consider porting this utils and passing the plain list of parameters instead.
-            stack_parameters = {
-                parameter["ParameterKey"]: parameter
-                for parameter in self._change_set.stack.parameters
-            }
-            transform_output: Any = execute_macro(
-                account_id=account_id,
-                region_name=region_name,
-                parsed_template=dict(),  # TODO: review the requirements for this argument.
-                macro=args,  # TODO: review support for non dict bindings (v1).
-                stack_parameters=stack_parameters,
-                transformation_parameters=transform_parameters,
-                is_intrinsic=True,
-            )
-            return transform_output
-
-        raise RuntimeError(
-            f"Unsupported transform function '{transform_name}' in '{self._change_set.stack.stack_name}'"
-        )
-
-    def visit_node_intrinsic_function_fn_transform(
-        self, node_intrinsic_function: NodeIntrinsicFunction
-    ) -> PreprocEntityDelta:
-        arguments_delta = self.visit(node_intrinsic_function.arguments)
-        delta = self._cached_apply(
-            scope=node_intrinsic_function.scope,
-            arguments_delta=arguments_delta,
-            resolver=self._compute_fn_transform,
-        )
-        return delta
-
     def visit_node_intrinsic_function_fn_sub(
         self, node_intrinsic_function: NodeIntrinsicFunction
     ) -> PreprocEntityDelta:
@@ -677,7 +754,7 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             sub_parameters: dict
             if isinstance(args, str):
                 string_template = args
-                sub_parameters = dict()
+                sub_parameters = {}
             elif (
                 isinstance(args, list)
                 and len(args) == 2
@@ -784,7 +861,7 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
                 if values == "":
                     return ""
                 raise RuntimeError(f"Invalid arguments list definition for Fn::Join: '{args}'")
-            str_values: list[str] = list()
+            str_values: list[str] = []
             for value in values:
                 if value is None:
                     continue
@@ -806,13 +883,27 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
     ):
         # TODO: add further support for schema validation
         def _compute_fn_select(args: list[Any]) -> Any:
-            values: list[Any] = args[1]
+            values = args[1]
+            # defer evaluation if the selection list contains unresolved elements (e.g., unresolved intrinsics)
+            if isinstance(values, list) and not all(isinstance(value, str) for value in values):
+                raise RuntimeError("Fn::Select list contains unresolved elements")
+
             if not isinstance(values, list) or not values:
-                raise RuntimeError(f"Invalid arguments list value for Fn::Select: '{values}'")
+                raise ValidationError(
+                    "Template error: Fn::Select requires a list argument with two elements: an integer index and a list"
+                )
+            try:
+                index: int = int(args[0])
+            except ValueError as e:
+                raise ValidationError(
+                    "Template error: Fn::Select requires a list argument with two elements: an integer index and a list"
+                ) from e
+
             values_len = len(values)
-            index: int = int(args[0])
-            if not isinstance(index, int) or index < 0 or index > values_len:
-                raise RuntimeError(f"Invalid or out of range index value for Fn::Select: '{index}'")
+            if index < 0 or index >= values_len:
+                raise ValidationError(
+                    "Template error: Fn::Select requires a list argument with two elements: an integer index and a list"
+                )
             selection = values[index]
             return selection
 
@@ -839,6 +930,17 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             return split_string
 
         arguments_delta = self.visit(node_intrinsic_function.arguments)
+
+        if not (
+            is_nothing(arguments_delta.after)
+            or isinstance(arguments_delta.after, list)
+            and len(arguments_delta.after) == 2
+        ):
+            raise ValidationError(
+                "Template error: every Fn::Split object requires two parameters, "
+                "(1) a string delimiter and (2) a string to be split or a function that returns a string to be split."
+            )
+
         delta = self._cached_apply(
             scope=node_intrinsic_function.scope,
             arguments_delta=arguments_delta,
@@ -925,8 +1027,8 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
     def visit_node_parameters(
         self, node_parameters: NodeParameters
     ) -> PreprocEntityDelta[dict[str, Any], dict[str, Any]]:
-        before_parameters = dict()
-        after_parameters = dict()
+        before_parameters = {}
+        after_parameters = {}
         for parameter in node_parameters.parameters:
             parameter_delta = self.visit(parameter)
             parameter_before = parameter_delta.before
@@ -938,6 +1040,10 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
         return PreprocEntityDelta(before=before_parameters, after=after_parameters)
 
     def visit_node_parameter(self, node_parameter: NodeParameter) -> PreprocEntityDelta:
+        if not VALID_LOGICAL_RESOURCE_ID_RE.match(node_parameter.name):
+            raise ValidationError(
+                f"Template format error: Parameter name {node_parameter.name} is non alphanumeric."
+            )
         dynamic_value = node_parameter.dynamic_value
         dynamic_delta = self.visit(dynamic_value)
 
@@ -951,8 +1057,11 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
 
         def _resolve_parameter_type(value: str, type_: str) -> Any:
             match type_:
-                case "List<String>":
+                case "List<String>" | "CommaDelimitedList":
                     return [item.strip() for item in value.split(",")]
+                case "Number":
+                    # TODO: validate the parameter type at template parse time (or whatever is in parity with AWS) so we know this cannot fail
+                    return to_number(value)
             return value
 
         if not is_nothing(after):
@@ -969,11 +1078,17 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
         return delta
 
     def _resource_physical_resource_id_from(
-        self, logical_resource_id: str, resolved_resources: dict
-    ) -> str:
+        self, logical_resource_id: str, resolved_resources: dict[str, ResolvedResource]
+    ) -> str | None:
         # TODO: typing around resolved resources is needed and should be reflected here.
-        resolved_resource = resolved_resources.get(logical_resource_id, dict())
-        physical_resource_id: Optional[str] = resolved_resource.get("PhysicalResourceId")
+        resolved_resource = resolved_resources.get(logical_resource_id, {})
+        if resolved_resource.get("ResourceStatus") not in {
+            ResourceStatus.CREATE_COMPLETE,
+            ResourceStatus.UPDATE_COMPLETE,
+        }:
+            return None
+
+        physical_resource_id = resolved_resource.get("PhysicalResourceId")
         if not isinstance(physical_resource_id, str):
             raise RuntimeError(f"No PhysicalResourceId found for resource '{logical_resource_id}'")
         return physical_resource_id
@@ -992,6 +1107,9 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
         self, node_intrinsic_function: NodeIntrinsicFunction
     ) -> PreprocEntityDelta:
         def _compute_fn_ref(logical_id: str) -> PreprocEntityDelta:
+            if logical_id == "AWS::NoValue":
+                return Nothing
+
             reference_delta: PreprocEntityDelta = self._resolve_reference(logical_id=logical_id)
             if isinstance(before := reference_delta.before, PreprocResource):
                 reference_delta.before = before.physical_resource_id
@@ -1028,8 +1146,8 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
 
     def visit_node_array(self, node_array: NodeArray) -> PreprocEntityDelta:
         node_change_type = node_array.change_type
-        before = list() if node_change_type != ChangeType.CREATED else Nothing
-        after = list() if node_change_type != ChangeType.REMOVED else Nothing
+        before = [] if node_change_type != ChangeType.CREATED else Nothing
+        after = [] if node_change_type != ChangeType.REMOVED else Nothing
         for change_set_entity in node_array.array:
             delta: PreprocEntityDelta = self.visit(change_set_entity=change_set_entity)
             delta_before = delta.before
@@ -1040,15 +1158,12 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
                 after.append(delta_after)
         return PreprocEntityDelta(before=before, after=after)
 
-    def visit_node_property(self, node_property: NodeProperty) -> PreprocEntityDelta:
-        return self.visit(node_property.value)
-
     def visit_node_properties(
         self, node_properties: NodeProperties
     ) -> PreprocEntityDelta[PreprocProperties, PreprocProperties]:
         node_change_type = node_properties.change_type
-        before_bindings = dict() if node_change_type != ChangeType.CREATED else Nothing
-        after_bindings = dict() if node_change_type != ChangeType.REMOVED else Nothing
+        before_bindings = {} if node_change_type != ChangeType.CREATED else Nothing
+        after_bindings = {} if node_change_type != ChangeType.REMOVED else Nothing
         for node_property in node_properties.properties:
             property_name = node_property.name
             delta = self.visit(node_property)
@@ -1088,9 +1203,27 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             after = after_delta.after
         return PreprocEntityDelta(before=before, after=after)
 
+    def visit_node_resources(self, node_resources: NodeResources):
+        """
+        Skip resources where they conditionally evaluate to False
+        """
+        for node_resource in node_resources.resources:
+            if not is_nothing(node_resource.condition_reference):
+                condition_delta = self._resolve_resource_condition_reference(
+                    node_resource.condition_reference
+                )
+                condition_after = condition_delta.after
+                if condition_after is False:
+                    continue
+            self.visit(node_resource)
+
     def visit_node_resource(
         self, node_resource: NodeResource
     ) -> PreprocEntityDelta[PreprocResource, PreprocResource]:
+        if not VALID_LOGICAL_RESOURCE_ID_RE.match(node_resource.name):
+            raise ValidationError(
+                f"Template format error: Resource name {node_resource.name} is non alphanumeric."
+            )
         change_type = node_resource.change_type
         condition_before = Nothing
         condition_after = Nothing
@@ -1127,6 +1260,7 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
                 resource_type=type_delta.before,
                 properties=properties_delta.before,
                 depends_on=depends_on_before,
+                requires_replacement=False,
             )
         if change_type != ChangeType.REMOVED and is_nothing(condition_after) or condition_after:
             logical_resource_id = node_resource.name
@@ -1143,6 +1277,7 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
                 resource_type=type_delta.after,
                 properties=properties_delta.after,
                 depends_on=depends_on_after,
+                requires_replacement=node_resource.requires_replacement,
             )
         return PreprocEntityDelta(before=before, after=after)
 
@@ -1189,9 +1324,17 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
     def visit_node_outputs(
         self, node_outputs: NodeOutputs
     ) -> PreprocEntityDelta[list[PreprocOutput], list[PreprocOutput]]:
-        before: list[PreprocOutput] = list()
-        after: list[PreprocOutput] = list()
+        before: list[PreprocOutput] = []
+        after: list[PreprocOutput] = []
         for node_output in node_outputs.outputs:
+            if not is_nothing(node_output.condition_reference):
+                condition_delta = self._resolve_resource_condition_reference(
+                    node_output.condition_reference
+                )
+                condition_after = condition_delta.after
+                if condition_after is False:
+                    continue
+
             output_delta: PreprocEntityDelta[PreprocOutput, PreprocOutput] = self.visit(node_output)
             output_before = output_delta.before
             output_after = output_delta.after
@@ -1200,3 +1343,29 @@ class ChangeSetModelPreproc(ChangeSetModelVisitor):
             if not is_nothing(output_after):
                 after.append(output_after)
         return PreprocEntityDelta(before=before, after=after)
+
+    def visit_node_intrinsic_function_fn_import_value(
+        self, node_intrinsic_function: NodeIntrinsicFunction
+    ) -> PreprocEntityDelta:
+        def _compute_fn_import_value(string) -> str:
+            if not isinstance(string, str):
+                raise RuntimeError(f"Invalid parameter for import: '{string}'")
+
+            exports = exports_map(
+                account_id=self._change_set.account_id, region_name=self._change_set.region_name
+            )
+
+            return exports.get(string, {}).get("Value") or Nothing
+
+        arguments_delta = self.visit(node_intrinsic_function.arguments)
+        delta = self._cached_apply(
+            scope=node_intrinsic_function.scope,
+            arguments_delta=arguments_delta,
+            resolver=_compute_fn_import_value,
+        )
+        return delta
+
+    def visit_node_intrinsic_function_fn_transform(
+        self, node_intrinsic_function: NodeIntrinsicFunction
+    ):
+        raise RuntimeError("Fn::Transform should have been handled by the Transformer")