Allow for Fn::Transform with other properties (#4137)

* Allow for Fn::Transform with other properties

Author: kddejong

src/cfnlint/helpers.py

@@ -203,6 +203,7 @@
 FUNCTION_VALUE_OF = "Fn::ValueOf"
 FUNCTION_VALUE_OF_ALL = "Fn::ValueOfAll"
 FUNCTION_FOR_EACH = re.compile(r"^Fn::ForEach::[a-zA-Z0-9]+$")
+FUNCTION_TRANSFORM = "Fn::Transform"
 
 FUNCTION_CONDITIONS = frozenset(
     [FUNCTION_AND, FUNCTION_OR, FUNCTION_NOT, FUNCTION_EQUALS]

src/cfnlint/jsonschema/_keywords_cfn.py

@@ -20,22 +20,49 @@
 
 from typing import Any
 
+import regex as re
+
 import cfnlint.jsonschema._keywords as validators_standard
-from cfnlint.helpers import BOOLEAN_STRINGS, ensure_list, is_function
+from cfnlint.helpers import (
+    BOOLEAN_STRINGS,
+    FUNCTION_FOR_EACH,
+    FUNCTION_TRANSFORM,
+    ensure_list,
+    is_function,
+)
 from cfnlint.jsonschema import ValidationError, Validator
 from cfnlint.jsonschema._typing import V, ValidationResult
 
+_ap_exception_fns = set([FUNCTION_TRANSFORM, FUNCTION_FOR_EACH])
+
 
 def additionalProperties(
     validator: Validator, aP: Any, instance: Any, schema: Any
 ) -> ValidationResult:
+    # is function will just return if one item is present
+    # as this is the standard. We will handle exceptions below
     k, _ = is_function(instance)
     if k in validator.context.functions:
         return
     for err in validators_standard.additionalProperties(
         validator, aP, instance, schema
     ):
-        yield err
+        # Some functions can exist at the same level
+        # so we need to validate that if those functions are
+        # currently supported by the context and are part of the
+        # error
+
+        # if the path is 0 just yield the error and return
+        # this should never happen
+        if not len(err.path) > 0:  # pragma: no cover
+            yield err  # pragma: no cover
+            return  # pragma: no cover
+
+        for fn in list(_ap_exception_fns & set(validator.context.functions)):
+            if re.fullmatch(fn, str(err.path[0])):  # type: ignore
+                break
+        else:
+            yield err
 
 
 def cfnContext(

test/unit/module/jsonschema/test_keywords_cfn.py

@@ -190,6 +190,13 @@ def resolve(self, ref):
                 )
             ],
         ),
+        # Test case where function matches and should be allowed
+        (
+            {"Foo": True, "Fn::Transform": {}},
+            {"additionalProperties": False, "properties": {"Foo": {}}},
+            ["Fn::Transform"],
+            [],
+        ),
         # Test with empty instance
         (
             {},