#8585·moto

Moto Server allows deploying invalid CFN templates

Author: jabalazsCreated Feb 11, 2025Updated Aug 17, 2026

Labelsenhancement

Running moto v5.0.28

Replication Steps

Run moto_server
Deploy an invalid template:

$ aws --endpoint-url http://127.0.0.1:5000 cloudformation create-stack --stack-name test-stack --template-body file://template.json

where template.json is:

json

{
  "Resources": {
    "MyTopic": {
      "Type": "AWS::SNS::Topic",
      "Properties": {
        "TopicName": "MySNSTopic",
        "asdfasdf": true,
        "qweqweqwe": true
      },
      "Foo": {"Bar": 0}
    }
  }
}

The template gets successfully deployed:

bash

$ aws --endpoint-url http://127.0.0.1:5000 cloudformation get-template --stack-name test-stack
{
    "TemplateBody": {
        "Resources": {
            "MyTopic": {
                "Type": "AWS::SNS::Topic",
                "Properties": {
                    "TopicName": "MySNSTopic",
                    "asdfasdf": true,
                    "qweqweqwe": true
                },
                "Foo": {
                    "Bar": 0
                }
            }
        }
    }
}

Expectation

When trying to deploy an invalid template we should get an error. For example running cfn-lint returns:

bash

$ cfn-lint template.json
E3002 Additional properties are not allowed ('asdfasdf' was unexpected)
final_template.json:7:9

E3002 Additional properties are not allowed ('qweqweqwe' was unexpected)
final_template.json:8:9

E3001 Additional properties are not allowed ('Foo' was unexpected)
final_template.json:10:7

Trying to deploy this template to a real account returns

An error occurred (ValidationError) when calling the UpdateStack operation: Invalid template resource property 'Foo'

Additional info

If I modify the template slightly by removing the top-level Foo:

json

{
  "Resources": {
    "MyTopic": {
      "Type": "AWS::SNS::Topic",
      "Properties": {
        "TopicName": "MySNSTopic",
        "asdfasdf": true,
        "qweqweqwe": true
      }
    }
  }
}

and try to deploy the stack to a real account, the CLI doesn't return an error anymore, but the creation is triggered and fails with the following CREATE_FAILED event:

json

{
    "StackId": "arn:aws:cloudformation:us-east-1:<accountid>:stack/test-stack/f1ce07b0-e894-11ef-a9bd-0affcc3fac61",
    "EventId": "MyTopic-CREATE_FAILED-2025-02-11T16:26:31.105Z",
    "StackName": "test-stack",
    "LogicalResourceId": "MyTopic",
    "PhysicalResourceId": "",
    "ResourceType": "AWS::SNS::Topic",
    "Timestamp": "2025-02-11T16:26:31.105000+00:00",
    "ResourceStatus": "CREATE_FAILED",
     "ResourceStatusReason": "Resource handler returned message: \"Model validation failed (#: extraneous key [asdfasdf] is not permitted)\" (RequestToken: bb2ea196-a4c5-c177-a4df-d21016441acd, HandlerErrorCode: InvalidRequest)",
            "ResourceProperties": "{\"asdfasdf\":\"true\",\"qweqweqwe\":\"true\",\"TopicName\":\"MySNSTopic\"}"
}

Source: getmoto/moto

View original on GitHub View discussion on GitHub