We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Handle SSM parameters in E2505
The check E2505 fails when reading the CIDR from SSM using the following code:

```
  VpcCidr:
    Description: 'VPC CIDR Block'
    Type: AWS::SSM::Parameter::Value<String>
    Default: /Infra/VpcCidr
```

The message is misleading, too. It is about security groups and not cidr ranges.

https://github.com/awslabs/cfn-python-lint/blob/3b785df6b262b733bedcaa8c8de9a2c65ac161b8/src/cfnlint/rules/resources/ectwo/Vpc.py#L92

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `src/cfnlint/rules/resources/ectwo/Vpc.py`
Content:
```
1 """
2   Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 
4   Permission is hereby granted, free of charge, to any person obtaining a copy of this
5   software and associated documentation files (the "Software"), to deal in the Software
6   without restriction, including without limitation the rights to use, copy, modify,
7   merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
8   permit persons to whom the Software is furnished to do so.
9 
10   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
11   INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
12   PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
13   HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
14   OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
15   SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
16 """
17 import re
18 from cfnlint import CloudFormationLintRule
19 from cfnlint import RuleMatch
20 
21 from cfnlint.helpers import REGEX_CIDR
22 
23 
24 class Vpc(CloudFormationLintRule):
25     """Check if EC2 VPC Resource Properties"""
26     id = 'E2505'
27     shortdesc = 'Resource EC2 VPC Properties'
28     description = 'See if EC2 VPC Properties are set correctly'
29     source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html'
30     tags = ['properties', 'vpc']
31 
32     def check_vpc_value(self, value, path):
33         """Check VPC Values"""
34         matches = []
35 
36         if value not in ('default', 'dedicated'):
37             message = 'DefaultTenancy needs to be default or dedicated for {0}'
38             matches.append(RuleMatch(path, message.format(('/'.join(map(str, path))))))
39         return matches
40 
41     def check_vpc_ref(self, value, path, parameters, resources):
42         """Check ref for VPC"""
43         matches = []
44         allowed_types = [
45             'String'
46         ]
47         if value in resources:
48             message = 'DefaultTenancy can\'t use a Ref to a resource for {0}'
49             matches.append(RuleMatch(path, message.format(('/'.join(map(str, path))))))
50         elif value in parameters:
51             parameter = parameters.get(value, {})
52             parameter_type = parameter.get('Type', None)
53             if parameter_type not in allowed_types:
54                 path_error = ['Parameters', value, 'Type']
55                 message = 'Security Group Id Parameter should be of type [{0}] for {1}'
56                 matches.append(
57                     RuleMatch(
58                         path_error,
59                         message.format(
60                             ', '.join(map(str, allowed_types)),
61                             '/'.join(map(str, path_error)))))
62         return matches
63 
64     def check_cidr_value(self, value, path):
65         """Check CIDR Strings"""
66         matches = []
67 
68         if not re.match(REGEX_CIDR, value):
69             message = 'CidrBlock needs to be of x.x.x.x/y at {0}'
70             matches.append(RuleMatch(path, message.format(('/'.join(['Parameters', value])))))
71         return matches
72 
73     def check_cidr_ref(self, value, path, parameters, resources):
74         """Check CidrBlock for VPC"""
75         matches = []
76 
77         allowed_types = [
78             'String'
79         ]
80         if value in resources:
81             resource_obj = resources.get(value, {})
82             if resource_obj:
83                 resource_type = resource_obj.get('Type', '')
84                 if not resource_type.startswith('Custom::'):
85                     message = 'CidrBlock needs to be a valid Cidr Range at {0}'
86                     matches.append(RuleMatch(path, message.format(('/'.join(['Parameters', value])))))
87         if value in parameters:
88             parameter = parameters.get(value, {})
89             parameter_type = parameter.get('Type', None)
90             if parameter_type not in allowed_types:
91                 path_error = ['Parameters', value, 'Type']
92                 message = 'Security Group Id Parameter should be of type [{0}] for {1}'
93                 matches.append(
94                     RuleMatch(
95                         path_error,
96                         message.format(
97                             ', '.join(map(str, allowed_types)),
98                             '/'.join(map(str, path_error)))))
99         return matches
100 
101     def match(self, cfn):
102         """Check EC2 VPC Resource Parameters"""
103 
104         matches = []
105         matches.extend(
106             cfn.check_resource_property(
107                 'AWS::EC2::VPC', 'InstanceTenancy',
108                 check_value=self.check_vpc_value,
109                 check_ref=self.check_vpc_ref,
110             )
111         )
112         matches.extend(
113             cfn.check_resource_property(
114                 'AWS::EC2::VPC', 'CidrBlock',
115                 check_value=self.check_cidr_value,
116                 check_ref=self.check_cidr_ref,
117             )
118         )
119 
120         return matches
121
```

Path: `src/cfnlint/rules/parameters/Cidr.py`
Content:
```
1 """
2   Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 
4   Permission is hereby granted, free of charge, to any person obtaining a copy of this
5   software and associated documentation files (the "Software"), to deal in the Software
6   without restriction, including without limitation the rights to use, copy, modify,
7   merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
8   permit persons to whom the Software is furnished to do so.
9 
10   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
11   INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
12   PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
13   HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
14   OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
15   SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
16 """
17 from cfnlint import CloudFormationLintRule
18 from cfnlint import RuleMatch
19 
20 from cfnlint.helpers import REGEX_CIDR
21 
22 
23 class Cidr(CloudFormationLintRule):
24     """Check Availability Zone parameter checks """
25     id = 'W2509'
26     shortdesc = 'CIDR Parameters have allowed values'
27     description = 'Check if a parameter is being used as a CIDR. ' \
28                   'If it is make sure it has allowed values regex comparisons'
29     source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html'
30     tags = ['parameters', 'availabilityzone']
31 
32     def __init__(self):
33         """Init"""
34         super(Cidr, self).__init__()
35         resource_type_specs = [
36             'AWS::EC2::Subnet',
37             'AWS::EC2::VPC',
38             'AWS::RDS::DBSecurityGroupIngress',
39             'AWS::EC2::NetworkAclEntry',
40             'AWS::EC2::SecurityGroupIngress',
41             'AWS::EC2::SecurityGroupEgress',
42             'AWS::Redshift::ClusterSecurityGroupIngress',
43             'AWS::EC2::VPCCidrBlock',
44         ]
45 
46         property_type_specs = [
47             'AWS::RDS::DBSecurityGroup.Ingress',
48             'AWS::EC2::SecurityGroup.Egress',
49             'AWS::SES::ReceiptFilter.IpFilter',
50             'AWS::EC2::SecurityGroup.Ingress',
51         ]
52 
53         for resource_type_spec in resource_type_specs:
54             self.resource_property_types.append(resource_type_spec)
55         for property_type_spec in property_type_specs:
56             self.resource_sub_property_types.append(property_type_spec)
57 
58     # pylint: disable=W0613
59     def check_cidr_ref(self, value, path, parameters, resources):
60         """Check ref for VPC"""
61         matches = []
62 
63         if value in parameters:
64             parameter = parameters.get(value, {})
65             allowed_pattern = parameter.get('AllowedPattern', None)
66             allowed_values = parameter.get('AllowedValues', None)
67             if not allowed_pattern and not allowed_values:
68                 param_path = ['Parameters', value]
69                 full_param_path = '/'.join(param_path)
70                 message = 'AllowedPattern and/or AllowedValues for Parameter should be specified at {1}. ' \
71                           'Example for AllowedPattern: "{0}"'
72                 matches.append(RuleMatch(param_path, message.format(REGEX_CIDR.pattern, full_param_path)))
73 
74         return matches
75 
76     def check(self, properties, resource_type, path, cfn):
77         """Check itself"""
78         matches = []
79 
80         matches.extend(
81             cfn.check_value(
82                 properties, 'CIDRIP', path,
83                 check_value=None, check_ref=self.check_cidr_ref,
84                 check_find_in_map=None, check_split=None, check_join=None
85             )
86         )
87         matches.extend(
88             cfn.check_value(
89                 properties, 'Cidr', path,
90                 check_value=None, check_ref=self.check_cidr_ref,
91                 check_find_in_map=None, check_split=None, check_join=None
92             )
93         )
94         matches.extend(
95             cfn.check_value(
96                 properties, 'CidrBlock', path,
97                 check_value=None, check_ref=self.check_cidr_ref,
98                 check_find_in_map=None, check_split=None, check_join=None
99             )
100         )
101         matches.extend(
102             cfn.check_value(
103                 properties, 'CidrIp', path,
104                 check_value=None, check_ref=self.check_cidr_ref,
105                 check_find_in_map=None, check_split=None, check_join=None
106             )
107         )
108 
109         return matches
110 
111     def match_resource_sub_properties(self, properties, property_type, path, cfn):
112         """Match for sub properties"""
113         matches = []
114 
115         matches.extend(self.check(properties, property_type, path, cfn))
116 
117         return matches
118 
119     def match_resource_properties(self, properties, resource_type, path, cfn):
120         """Check CloudFormation Properties"""
121         matches = []
122 
123         matches.extend(self.check(properties, resource_type, path, cfn))
124 
125         return matches
126
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/src/cfnlint/rules/parameters/Cidr.py b/src/cfnlint/rules/parameters/Cidr.py
--- a/src/cfnlint/rules/parameters/Cidr.py
+++ b/src/cfnlint/rules/parameters/Cidr.py
@@ -62,14 +62,16 @@
 
         if value in parameters:
             parameter = parameters.get(value, {})
+            parameter_type = parameter.get('Type')
             allowed_pattern = parameter.get('AllowedPattern', None)
             allowed_values = parameter.get('AllowedValues', None)
-            if not allowed_pattern and not allowed_values:
-                param_path = ['Parameters', value]
-                full_param_path = '/'.join(param_path)
-                message = 'AllowedPattern and/or AllowedValues for Parameter should be specified at {1}. ' \
-                          'Example for AllowedPattern: "{0}"'
-                matches.append(RuleMatch(param_path, message.format(REGEX_CIDR.pattern, full_param_path)))
+            if parameter_type not in ['AWS::SSM::Parameter::Value<String>']:
+                if not allowed_pattern and not allowed_values:
+                    param_path = ['Parameters', value]
+                    full_param_path = '/'.join(param_path)
+                    message = 'AllowedPattern and/or AllowedValues for Parameter should be specified at {1}. ' \
+                              'Example for AllowedPattern: "{0}"'
+                    matches.append(RuleMatch(param_path, message.format(REGEX_CIDR.pattern, full_param_path)))
 
         return matches
 
diff --git a/src/cfnlint/rules/resources/ectwo/Vpc.py b/src/cfnlint/rules/resources/ectwo/Vpc.py
--- a/src/cfnlint/rules/resources/ectwo/Vpc.py
+++ b/src/cfnlint/rules/resources/ectwo/Vpc.py
@@ -25,7 +25,8 @@
     """Check if EC2 VPC Resource Properties"""
     id = 'E2505'
     shortdesc = 'Resource EC2 VPC Properties'
-    description = 'See if EC2 VPC Properties are set correctly'
+    description = 'Check if the default tenancy is default or dedicated and ' \
+                  'that CidrBlock is a valid CIDR range.'
     source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html'
     tags = ['properties', 'vpc']
 
@@ -42,7 +43,8 @@
         """Check ref for VPC"""
         matches = []
         allowed_types = [
-            'String'
+            'String',
+            'AWS::SSM::Parameter::Value<String>',
         ]
         if value in resources:
             message = 'DefaultTenancy can\'t use a Ref to a resource for {0}'
@@ -52,7 +54,7 @@
             parameter_type = parameter.get('Type', None)
             if parameter_type not in allowed_types:
                 path_error = ['Parameters', value, 'Type']
-                message = 'Security Group Id Parameter should be of type [{0}] for {1}'
+                message = 'DefaultTenancy parameter should be of type [{0}] for {1}'
                 matches.append(
                     RuleMatch(
                         path_error,
@@ -75,7 +77,8 @@
         matches = []
 
         allowed_types = [
-            'String'
+            'String',
+            'AWS::SSM::Parameter::Value<String>',
         ]
         if value in resources:
             resource_obj = resources.get(value, {})
@@ -89,7 +92,7 @@
             parameter_type = parameter.get('Type', None)
             if parameter_type not in allowed_types:
                 path_error = ['Parameters', value, 'Type']
-                message = 'Security Group Id Parameter should be of type [{0}] for {1}'
+                message = 'CidrBlock parameter should be of type [{0}] for {1}'
                 matches.append(
                     RuleMatch(
                         path_error,

{"golden_diff": "diff --git a/src/cfnlint/rules/parameters/Cidr.py b/src/cfnlint/rules/parameters/Cidr.py\n--- a/src/cfnlint/rules/parameters/Cidr.py\n+++ b/src/cfnlint/rules/parameters/Cidr.py\n@@ -62,14 +62,16 @@\n \n         if value in parameters:\n             parameter = parameters.get(value, {})\n+            parameter_type = parameter.get('Type')\n             allowed_pattern = parameter.get('AllowedPattern', None)\n             allowed_values = parameter.get('AllowedValues', None)\n-            if not allowed_pattern and not allowed_values:\n-                param_path = ['Parameters', value]\n-                full_param_path = '/'.join(param_path)\n-                message = 'AllowedPattern and/or AllowedValues for Parameter should be specified at {1}. ' \\\n-                          'Example for AllowedPattern: \"{0}\"'\n-                matches.append(RuleMatch(param_path, message.format(REGEX_CIDR.pattern, full_param_path)))\n+            if parameter_type not in ['AWS::SSM::Parameter::Value<String>']:\n+                if not allowed_pattern and not allowed_values:\n+                    param_path = ['Parameters', value]\n+                    full_param_path = '/'.join(param_path)\n+                    message = 'AllowedPattern and/or AllowedValues for Parameter should be specified at {1}. ' \\\n+                              'Example for AllowedPattern: \"{0}\"'\n+                    matches.append(RuleMatch(param_path, message.format(REGEX_CIDR.pattern, full_param_path)))\n \n         return matches\n \ndiff --git a/src/cfnlint/rules/resources/ectwo/Vpc.py b/src/cfnlint/rules/resources/ectwo/Vpc.py\n--- a/src/cfnlint/rules/resources/ectwo/Vpc.py\n+++ b/src/cfnlint/rules/resources/ectwo/Vpc.py\n@@ -25,7 +25,8 @@\n     \"\"\"Check if EC2 VPC Resource Properties\"\"\"\n     id = 'E2505'\n     shortdesc = 'Resource EC2 VPC Properties'\n-    description = 'See if EC2 VPC Properties are set correctly'\n+    description = 'Check if the default tenancy is default or dedicated and ' \\\n+                  'that CidrBlock is a valid CIDR range.'\n     source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html'\n     tags = ['properties', 'vpc']\n \n@@ -42,7 +43,8 @@\n         \"\"\"Check ref for VPC\"\"\"\n         matches = []\n         allowed_types = [\n-            'String'\n+            'String',\n+            'AWS::SSM::Parameter::Value<String>',\n         ]\n         if value in resources:\n             message = 'DefaultTenancy can\\'t use a Ref to a resource for {0}'\n@@ -52,7 +54,7 @@\n             parameter_type = parameter.get('Type', None)\n             if parameter_type not in allowed_types:\n                 path_error = ['Parameters', value, 'Type']\n-                message = 'Security Group Id Parameter should be of type [{0}] for {1}'\n+                message = 'DefaultTenancy parameter should be of type [{0}] for {1}'\n                 matches.append(\n                     RuleMatch(\n                         path_error,\n@@ -75,7 +77,8 @@\n         matches = []\n \n         allowed_types = [\n-            'String'\n+            'String',\n+            'AWS::SSM::Parameter::Value<String>',\n         ]\n         if value in resources:\n             resource_obj = resources.get(value, {})\n@@ -89,7 +92,7 @@\n             parameter_type = parameter.get('Type', None)\n             if parameter_type not in allowed_types:\n                 path_error = ['Parameters', value, 'Type']\n-                message = 'Security Group Id Parameter should be of type [{0}] for {1}'\n+                message = 'CidrBlock parameter should be of type [{0}] for {1}'\n                 matches.append(\n                     RuleMatch(\n                         path_error,\n", "issue": "Handle SSM parameters in E2505\nThe check E2505 fails when reading the CIDR from SSM using the following code:\r\n\r\n```\r\n  VpcCidr:\r\n    Description: 'VPC CIDR Block'\r\n    Type: AWS::SSM::Parameter::Value<String>\r\n    Default: /Infra/VpcCidr\r\n```\r\n\r\nThe message is misleading, too. It is about security groups and not cidr ranges.\r\n\r\nhttps://github.com/awslabs/cfn-python-lint/blob/3b785df6b262b733bedcaa8c8de9a2c65ac161b8/src/cfnlint/rules/resources/ectwo/Vpc.py#L92\n", "before_files": [{"content": "\"\"\"\n  Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.\n\n  Permission is hereby granted, free of charge, to any person obtaining a copy of this\n  software and associated documentation files (the \"Software\"), to deal in the Software\n  without restriction, including without limitation the rights to use, copy, modify,\n  merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n  permit persons to whom the Software is furnished to do so.\n\n  THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\"\"\"\nimport re\nfrom cfnlint import CloudFormationLintRule\nfrom cfnlint import RuleMatch\n\nfrom cfnlint.helpers import REGEX_CIDR\n\n\nclass Vpc(CloudFormationLintRule):\n    \"\"\"Check if EC2 VPC Resource Properties\"\"\"\n    id = 'E2505'\n    shortdesc = 'Resource EC2 VPC Properties'\n    description = 'See if EC2 VPC Properties are set correctly'\n    source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html'\n    tags = ['properties', 'vpc']\n\n    def check_vpc_value(self, value, path):\n        \"\"\"Check VPC Values\"\"\"\n        matches = []\n\n        if value not in ('default', 'dedicated'):\n            message = 'DefaultTenancy needs to be default or dedicated for {0}'\n            matches.append(RuleMatch(path, message.format(('/'.join(map(str, path))))))\n        return matches\n\n    def check_vpc_ref(self, value, path, parameters, resources):\n        \"\"\"Check ref for VPC\"\"\"\n        matches = []\n        allowed_types = [\n            'String'\n        ]\n        if value in resources:\n            message = 'DefaultTenancy can\\'t use a Ref to a resource for {0}'\n            matches.append(RuleMatch(path, message.format(('/'.join(map(str, path))))))\n        elif value in parameters:\n            parameter = parameters.get(value, {})\n            parameter_type = parameter.get('Type', None)\n            if parameter_type not in allowed_types:\n                path_error = ['Parameters', value, 'Type']\n                message = 'Security Group Id Parameter should be of type [{0}] for {1}'\n                matches.append(\n                    RuleMatch(\n                        path_error,\n                        message.format(\n                            ', '.join(map(str, allowed_types)),\n                            '/'.join(map(str, path_error)))))\n        return matches\n\n    def check_cidr_value(self, value, path):\n        \"\"\"Check CIDR Strings\"\"\"\n        matches = []\n\n        if not re.match(REGEX_CIDR, value):\n            message = 'CidrBlock needs to be of x.x.x.x/y at {0}'\n            matches.append(RuleMatch(path, message.format(('/'.join(['Parameters', value])))))\n        return matches\n\n    def check_cidr_ref(self, value, path, parameters, resources):\n        \"\"\"Check CidrBlock for VPC\"\"\"\n        matches = []\n\n        allowed_types = [\n            'String'\n        ]\n        if value in resources:\n            resource_obj = resources.get(value, {})\n            if resource_obj:\n                resource_type = resource_obj.get('Type', '')\n                if not resource_type.startswith('Custom::'):\n                    message = 'CidrBlock needs to be a valid Cidr Range at {0}'\n                    matches.append(RuleMatch(path, message.format(('/'.join(['Parameters', value])))))\n        if value in parameters:\n            parameter = parameters.get(value, {})\n            parameter_type = parameter.get('Type', None)\n            if parameter_type not in allowed_types:\n                path_error = ['Parameters', value, 'Type']\n                message = 'Security Group Id Parameter should be of type [{0}] for {1}'\n                matches.append(\n                    RuleMatch(\n                        path_error,\n                        message.format(\n                            ', '.join(map(str, allowed_types)),\n                            '/'.join(map(str, path_error)))))\n        return matches\n\n    def match(self, cfn):\n        \"\"\"Check EC2 VPC Resource Parameters\"\"\"\n\n        matches = []\n        matches.extend(\n            cfn.check_resource_property(\n                'AWS::EC2::VPC', 'InstanceTenancy',\n                check_value=self.check_vpc_value,\n                check_ref=self.check_vpc_ref,\n            )\n        )\n        matches.extend(\n            cfn.check_resource_property(\n                'AWS::EC2::VPC', 'CidrBlock',\n                check_value=self.check_cidr_value,\n                check_ref=self.check_cidr_ref,\n            )\n        )\n\n        return matches\n", "path": "src/cfnlint/rules/resources/ectwo/Vpc.py"}, {"content": "\"\"\"\n  Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.\n\n  Permission is hereby granted, free of charge, to any person obtaining a copy of this\n  software and associated documentation files (the \"Software\"), to deal in the Software\n  without restriction, including without limitation the rights to use, copy, modify,\n  merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n  permit persons to whom the Software is furnished to do so.\n\n  THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\"\"\"\nfrom cfnlint import CloudFormationLintRule\nfrom cfnlint import RuleMatch\n\nfrom cfnlint.helpers import REGEX_CIDR\n\n\nclass Cidr(CloudFormationLintRule):\n    \"\"\"Check Availability Zone parameter checks \"\"\"\n    id = 'W2509'\n    shortdesc = 'CIDR Parameters have allowed values'\n    description = 'Check if a parameter is being used as a CIDR. ' \\\n                  'If it is make sure it has allowed values regex comparisons'\n    source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html'\n    tags = ['parameters', 'availabilityzone']\n\n    def __init__(self):\n        \"\"\"Init\"\"\"\n        super(Cidr, self).__init__()\n        resource_type_specs = [\n            'AWS::EC2::Subnet',\n            'AWS::EC2::VPC',\n            'AWS::RDS::DBSecurityGroupIngress',\n            'AWS::EC2::NetworkAclEntry',\n            'AWS::EC2::SecurityGroupIngress',\n            'AWS::EC2::SecurityGroupEgress',\n            'AWS::Redshift::ClusterSecurityGroupIngress',\n            'AWS::EC2::VPCCidrBlock',\n        ]\n\n        property_type_specs = [\n            'AWS::RDS::DBSecurityGroup.Ingress',\n            'AWS::EC2::SecurityGroup.Egress',\n            'AWS::SES::ReceiptFilter.IpFilter',\n            'AWS::EC2::SecurityGroup.Ingress',\n        ]\n\n        for resource_type_spec in resource_type_specs:\n            self.resource_property_types.append(resource_type_spec)\n        for property_type_spec in property_type_specs:\n            self.resource_sub_property_types.append(property_type_spec)\n\n    # pylint: disable=W0613\n    def check_cidr_ref(self, value, path, parameters, resources):\n        \"\"\"Check ref for VPC\"\"\"\n        matches = []\n\n        if value in parameters:\n            parameter = parameters.get(value, {})\n            allowed_pattern = parameter.get('AllowedPattern', None)\n            allowed_values = parameter.get('AllowedValues', None)\n            if not allowed_pattern and not allowed_values:\n                param_path = ['Parameters', value]\n                full_param_path = '/'.join(param_path)\n                message = 'AllowedPattern and/or AllowedValues for Parameter should be specified at {1}. ' \\\n                          'Example for AllowedPattern: \"{0}\"'\n                matches.append(RuleMatch(param_path, message.format(REGEX_CIDR.pattern, full_param_path)))\n\n        return matches\n\n    def check(self, properties, resource_type, path, cfn):\n        \"\"\"Check itself\"\"\"\n        matches = []\n\n        matches.extend(\n            cfn.check_value(\n                properties, 'CIDRIP', path,\n                check_value=None, check_ref=self.check_cidr_ref,\n                check_find_in_map=None, check_split=None, check_join=None\n            )\n        )\n        matches.extend(\n            cfn.check_value(\n                properties, 'Cidr', path,\n                check_value=None, check_ref=self.check_cidr_ref,\n                check_find_in_map=None, check_split=None, check_join=None\n            )\n        )\n        matches.extend(\n            cfn.check_value(\n                properties, 'CidrBlock', path,\n                check_value=None, check_ref=self.check_cidr_ref,\n                check_find_in_map=None, check_split=None, check_join=None\n            )\n        )\n        matches.extend(\n            cfn.check_value(\n                properties, 'CidrIp', path,\n                check_value=None, check_ref=self.check_cidr_ref,\n                check_find_in_map=None, check_split=None, check_join=None\n            )\n        )\n\n        return matches\n\n    def match_resource_sub_properties(self, properties, property_type, path, cfn):\n        \"\"\"Match for sub properties\"\"\"\n        matches = []\n\n        matches.extend(self.check(properties, property_type, path, cfn))\n\n        return matches\n\n    def match_resource_properties(self, properties, resource_type, path, cfn):\n        \"\"\"Check CloudFormation Properties\"\"\"\n        matches = []\n\n        matches.extend(self.check(properties, resource_type, path, cfn))\n\n        return matches\n", "path": "src/cfnlint/rules/parameters/Cidr.py"}], "after_files": [{"content": "\"\"\"\n  Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.\n\n  Permission is hereby granted, free of charge, to any person obtaining a copy of this\n  software and associated documentation files (the \"Software\"), to deal in the Software\n  without restriction, including without limitation the rights to use, copy, modify,\n  merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n  permit persons to whom the Software is furnished to do so.\n\n  THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\"\"\"\nimport re\nfrom cfnlint import CloudFormationLintRule\nfrom cfnlint import RuleMatch\n\nfrom cfnlint.helpers import REGEX_CIDR\n\n\nclass Vpc(CloudFormationLintRule):\n    \"\"\"Check if EC2 VPC Resource Properties\"\"\"\n    id = 'E2505'\n    shortdesc = 'Resource EC2 VPC Properties'\n    description = 'Check if the default tenancy is default or dedicated and ' \\\n                  'that CidrBlock is a valid CIDR range.'\n    source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-vpc.html'\n    tags = ['properties', 'vpc']\n\n    def check_vpc_value(self, value, path):\n        \"\"\"Check VPC Values\"\"\"\n        matches = []\n\n        if value not in ('default', 'dedicated'):\n            message = 'DefaultTenancy needs to be default or dedicated for {0}'\n            matches.append(RuleMatch(path, message.format(('/'.join(map(str, path))))))\n        return matches\n\n    def check_vpc_ref(self, value, path, parameters, resources):\n        \"\"\"Check ref for VPC\"\"\"\n        matches = []\n        allowed_types = [\n            'String',\n            'AWS::SSM::Parameter::Value<String>',\n        ]\n        if value in resources:\n            message = 'DefaultTenancy can\\'t use a Ref to a resource for {0}'\n            matches.append(RuleMatch(path, message.format(('/'.join(map(str, path))))))\n        elif value in parameters:\n            parameter = parameters.get(value, {})\n            parameter_type = parameter.get('Type', None)\n            if parameter_type not in allowed_types:\n                path_error = ['Parameters', value, 'Type']\n                message = 'DefaultTenancy parameter should be of type [{0}] for {1}'\n                matches.append(\n                    RuleMatch(\n                        path_error,\n                        message.format(\n                            ', '.join(map(str, allowed_types)),\n                            '/'.join(map(str, path_error)))))\n        return matches\n\n    def check_cidr_value(self, value, path):\n        \"\"\"Check CIDR Strings\"\"\"\n        matches = []\n\n        if not re.match(REGEX_CIDR, value):\n            message = 'CidrBlock needs to be of x.x.x.x/y at {0}'\n            matches.append(RuleMatch(path, message.format(('/'.join(['Parameters', value])))))\n        return matches\n\n    def check_cidr_ref(self, value, path, parameters, resources):\n        \"\"\"Check CidrBlock for VPC\"\"\"\n        matches = []\n\n        allowed_types = [\n            'String',\n            'AWS::SSM::Parameter::Value<String>',\n        ]\n        if value in resources:\n            resource_obj = resources.get(value, {})\n            if resource_obj:\n                resource_type = resource_obj.get('Type', '')\n                if not resource_type.startswith('Custom::'):\n                    message = 'CidrBlock needs to be a valid Cidr Range at {0}'\n                    matches.append(RuleMatch(path, message.format(('/'.join(['Parameters', value])))))\n        if value in parameters:\n            parameter = parameters.get(value, {})\n            parameter_type = parameter.get('Type', None)\n            if parameter_type not in allowed_types:\n                path_error = ['Parameters', value, 'Type']\n                message = 'CidrBlock parameter should be of type [{0}] for {1}'\n                matches.append(\n                    RuleMatch(\n                        path_error,\n                        message.format(\n                            ', '.join(map(str, allowed_types)),\n                            '/'.join(map(str, path_error)))))\n        return matches\n\n    def match(self, cfn):\n        \"\"\"Check EC2 VPC Resource Parameters\"\"\"\n\n        matches = []\n        matches.extend(\n            cfn.check_resource_property(\n                'AWS::EC2::VPC', 'InstanceTenancy',\n                check_value=self.check_vpc_value,\n                check_ref=self.check_vpc_ref,\n            )\n        )\n        matches.extend(\n            cfn.check_resource_property(\n                'AWS::EC2::VPC', 'CidrBlock',\n                check_value=self.check_cidr_value,\n                check_ref=self.check_cidr_ref,\n            )\n        )\n\n        return matches\n", "path": "src/cfnlint/rules/resources/ectwo/Vpc.py"}, {"content": "\"\"\"\n  Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.\n\n  Permission is hereby granted, free of charge, to any person obtaining a copy of this\n  software and associated documentation files (the \"Software\"), to deal in the Software\n  without restriction, including without limitation the rights to use, copy, modify,\n  merge, publish, distribute, sublicense, and/or sell copies of the Software, and to\n  permit persons to whom the Software is furnished to do so.\n\n  THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n  PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n  OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\"\"\"\nfrom cfnlint import CloudFormationLintRule\nfrom cfnlint import RuleMatch\n\nfrom cfnlint.helpers import REGEX_CIDR\n\n\nclass Cidr(CloudFormationLintRule):\n    \"\"\"Check Availability Zone parameter checks \"\"\"\n    id = 'W2509'\n    shortdesc = 'CIDR Parameters have allowed values'\n    description = 'Check if a parameter is being used as a CIDR. ' \\\n                  'If it is make sure it has allowed values regex comparisons'\n    source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html'\n    tags = ['parameters', 'availabilityzone']\n\n    def __init__(self):\n        \"\"\"Init\"\"\"\n        super(Cidr, self).__init__()\n        resource_type_specs = [\n            'AWS::EC2::Subnet',\n            'AWS::EC2::VPC',\n            'AWS::RDS::DBSecurityGroupIngress',\n            'AWS::EC2::NetworkAclEntry',\n            'AWS::EC2::SecurityGroupIngress',\n            'AWS::EC2::SecurityGroupEgress',\n            'AWS::Redshift::ClusterSecurityGroupIngress',\n            'AWS::EC2::VPCCidrBlock',\n        ]\n\n        property_type_specs = [\n            'AWS::RDS::DBSecurityGroup.Ingress',\n            'AWS::EC2::SecurityGroup.Egress',\n            'AWS::SES::ReceiptFilter.IpFilter',\n            'AWS::EC2::SecurityGroup.Ingress',\n        ]\n\n        for resource_type_spec in resource_type_specs:\n            self.resource_property_types.append(resource_type_spec)\n        for property_type_spec in property_type_specs:\n            self.resource_sub_property_types.append(property_type_spec)\n\n    # pylint: disable=W0613\n    def check_cidr_ref(self, value, path, parameters, resources):\n        \"\"\"Check ref for VPC\"\"\"\n        matches = []\n\n        if value in parameters:\n            parameter = parameters.get(value, {})\n            parameter_type = parameter.get('Type')\n            allowed_pattern = parameter.get('AllowedPattern', None)\n            allowed_values = parameter.get('AllowedValues', None)\n            if parameter_type not in ['AWS::SSM::Parameter::Value<String>']:\n                if not allowed_pattern and not allowed_values:\n                    param_path = ['Parameters', value]\n                    full_param_path = '/'.join(param_path)\n                    message = 'AllowedPattern and/or AllowedValues for Parameter should be specified at {1}. ' \\\n                              'Example for AllowedPattern: \"{0}\"'\n                    matches.append(RuleMatch(param_path, message.format(REGEX_CIDR.pattern, full_param_path)))\n\n        return matches\n\n    def check(self, properties, resource_type, path, cfn):\n        \"\"\"Check itself\"\"\"\n        matches = []\n\n        matches.extend(\n            cfn.check_value(\n                properties, 'CIDRIP', path,\n                check_value=None, check_ref=self.check_cidr_ref,\n                check_find_in_map=None, check_split=None, check_join=None\n            )\n        )\n        matches.extend(\n            cfn.check_value(\n                properties, 'Cidr', path,\n                check_value=None, check_ref=self.check_cidr_ref,\n                check_find_in_map=None, check_split=None, check_join=None\n            )\n        )\n        matches.extend(\n            cfn.check_value(\n                properties, 'CidrBlock', path,\n                check_value=None, check_ref=self.check_cidr_ref,\n                check_find_in_map=None, check_split=None, check_join=None\n            )\n        )\n        matches.extend(\n            cfn.check_value(\n                properties, 'CidrIp', path,\n                check_value=None, check_ref=self.check_cidr_ref,\n                check_find_in_map=None, check_split=None, check_join=None\n            )\n        )\n\n        return matches\n\n    def match_resource_sub_properties(self, properties, property_type, path, cfn):\n        \"\"\"Match for sub properties\"\"\"\n        matches = []\n\n        matches.extend(self.check(properties, property_type, path, cfn))\n\n        return matches\n\n    def match_resource_properties(self, properties, resource_type, path, cfn):\n        \"\"\"Check CloudFormation Properties\"\"\"\n        matches = []\n\n        matches.extend(self.check(properties, resource_type, path, cfn))\n\n        return matches\n", "path": "src/cfnlint/rules/parameters/Cidr.py"}]}