Only replace parameter values in Resources (#3908)

Author: kddejong

src/cfnlint/template/transforms/_sam.py

@@ -158,7 +158,9 @@ def _replace_variables_with_language_extension(self):
                 if isinstance(v, dict) and v.get("Default"):
                     parameters[k] = v.get("Default")
 
-            self._template = self._find_and_replace(self._template, parameters)
+            self._template["Resources"] = self._find_and_replace(
+                self._template.get("Resources", {}), parameters
+            )
 
     def transform_template(self):
         """

src/cfnlint/template/transforms/transform.py

@@ -49,6 +49,11 @@ def transform(self, cfn: Any) -> list[Match]:
                 continue
 
             matches, template = transform(cfn)
+            LOGGER.debug(
+                "Transformed template from %s: \n%s",
+                name,
+                format_json_string(cfn.template),
+            )
             if matches:
                 return matches
             cfn.template = template

test/fixtures/templates/good/transform/language_extension.yaml

@@ -13,12 +13,21 @@ Parameters:
   VpcId:
     Type: "AWS::SSM::Parameter::Value<AWS::EC2::VPC::Id>"
     Default: "/network/vpc/primary/id"
+  Environment:
+    Type: String
+    Default: Prod
 Mappings:
   StackIdMap01:
     teststack1:
       DeletionPolicy: Retain
     teststack2:
       DeletionPolicy: Delete
+Rules:
+  IsAutPublishAliasParameterProd:
+    RuleCondition: !Equals [ !Ref Environment, "Prod" ]
+    Assertions:
+      - Assert: !Not
+          - !Equals [ !Ref DBPolicy, "" ]
 Resources:
   WaitHandleRef:
     Type: AWS::CloudFormation::WaitConditionHandle

test/unit/module/transform/test_transform.py

@@ -117,6 +117,21 @@ def test_sam_with_language_extension(self):
         template = cfn_yaml.load(filename)
         transformed_template = Transform(filename, template, region)
         results = transformed_template.transform_template()
+        self.assertDictEqual(
+            transformed_template._template.get("Rules"),
+            {
+                "IsAutPublishAliasParameterProd": {
+                    "Assertions": [
+                        {
+                            "Assert": {
+                                "Fn::Not": [{"Fn::Equals": [{"Ref": "DBPolicy"}, ""]}]
+                            }
+                        }
+                    ],
+                    "RuleCondition": {"Fn::Equals": [{"Ref": "Environment"}, "Prod"]},
+                }
+            },
+        )
         self.assertEqual(results, [])
 
     def test_parameter_for_autopublish_code_sha256(self):