[iankhou]

Reason for this change

Second of three stacked PRs that add an unstable evaluate action to toolkit-lib (#2066). EvaluateCloudFormationTemplate
evaluates one expression and throws on the first failure. The action needs a whole template evaluated, with
every expression that can be evaluated replaced by its value, and the others reported instead of failing.

Stack:

1. fix(toolkit-lib): stricter, opt-in evaluation modes for EvaluateCloudFormationTemplate #2074: evaluator changes
2. This PR: best-effort evaluation of a whole template (internal, not used until feat(toolkit-lib): unstable evaluate action to resolve a stack's template against its deployed stack #2066)
3. feat(toolkit-lib): unstable evaluate action to resolve a stack's template against its deployed stack #2066: the unstable evaluate action

Description of changes

Adds evaluateTemplateBestEffort(evaluator, template, { unavailableParameters }), an internal function in
lib/api/cloudformation (no public API). It evaluates every expression in Resources and Outputs, one at a
time, and returns the template with the evaluated values and a list of unresolved expressions
({ path, intrinsic, reason }).

• Evaluates the template's Conditions (Fn::Equals, Fn::And, Fn::Or, Fn::Not, Condition), Fn::If
  and AWS::NoValue, which EvaluateCloudFormationTemplate doesn't support, and drops resources and outputs
  whose condition is false, as CloudFormation does. Fn::Equals compares scalars as strings, as CloudFormation
  does (a deployed '10' equals 10).
• An expression that can't be evaluated is kept in place, with its arguments evaluated where possible. Only
  the innermost failure is reported, and an unsupported function is reported itself.
• Expressions that use unavailable (e.g. NoEcho) parameters, and dynamic references ({{resolve:...}}), are
  reported rather than evaluated.
• An expression that evaluates to no value, or a function whose whole argument is AWS::NoValue, is reported
  instead of dropping the property or leaking the placeholder.
• Each distinct expression is evaluated once per template, and the attribute lookups the walk will make
  (Fn::GetAtt and ${Resource.Attribute} in Fn::Sub, only in resources, outputs and Fn::If branches that
  CloudFormation creates) are run up front, 8 at a time.
• Only evaluation failures are reported. A lookup counts as one when its cause is a not-found / unsupported /
  can't-read error (ResourceNotFoundException, TypeNotFoundException, UnsupportedActionException,
  InvalidRequestException, ValidationException, Cloud Control handler failures, AccessDeniedException).
  Anything else (expired credentials, throttling, network errors, bugs) is thrown.

Describe any new or updated permissions being added

None.

Description of how you validated changes

Unit tests with a fake evaluator: resolved and unresolved expressions, innermost-failure reporting, conditions,
Fn::If and AWS::NoValue, NoEcho and dynamic references, error classification (including wrapped causes),
caching, the bounded and reachable-only prefetch, and untouched template sections. The full stack (#2066) was
run against three apps deployed to a test account and to an emulator.

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None