Validate the parameter AllowedValue exists before we remove it (#2649)

Author: kddejong

src/cfnlint/conditions/conditions.py

@@ -115,9 +115,15 @@ def _build_cnf(
                     if param.hash not in allowed_values:
                         continue
                     if isinstance(equal_1.left, str):
-                        allowed_values[param.hash].remove(get_hash(equal_1.left))
+                        if get_hash(equal_1.left) in allowed_values[param.hash]:
+                            allowed_values[param.hash].remove(get_hash(equal_1.left))
+                        else:
+                            equal_vars[equal_1.hash] = BooleanFalse()
                     if isinstance(equal_1.right, str):
-                        allowed_values[param.hash].remove(get_hash(equal_1.right))
+                        if get_hash(equal_1.right) in allowed_values[param.hash]:
+                            allowed_values[param.hash].remove(get_hash(equal_1.right))
+                        else:
+                            equal_vars[equal_1.hash] = BooleanFalse()
 
             # iteration 2 builds the cnf formulas to make sure any empty lists
             # are now full not equals
@@ -157,10 +163,10 @@ def build_scenarios(self, condition_names: List[str]) -> Iterator[Dict[str, bool
             return
 
         # if only one condition we will assume its True/False
-        if len(condition_names) == 1:
-            yield {condition_names[0]: True}
-            yield {condition_names[0]: False}
-            return
+        # if len(condition_names) == 1:
+        #    yield {condition_names[0]: True}
+        #    yield {condition_names[0]: False}
+        #    return
 
         try:
             # build a large matric of True/False options based on the provided conditions

test/unit/module/conditions/test_conditions.py

@@ -127,7 +127,7 @@ def test_check_never_false(self):
             ],
         )
 
-    def test_check_can_be_salfe(self):
+    def test_check_can_be_false(self):
         """With allowed values two conditions can both be false"""
         template = decode_str(
             """
@@ -151,3 +151,32 @@ def test_check_can_be_salfe(self):
                 {"IsProd": False, "IsDev": False},
             ],
         )
+
+    def test_check_can_be_good_when_condition_value(self):
+        """Some times a condition Equals doesn't match to allowed values"""
+        template = decode_str(
+            """
+        Parameters:
+          Environment:
+            Type: String
+            AllowedValues: ["prod", "dev", "stage"]
+        Conditions:
+          IsGamma: !Equals [!Ref Environment, "gamma"]
+          IsBeta: !Equals ["beta", !Ref Environment]
+        """
+        )[0]
+
+        cfn = Template("", template)
+        self.assertEqual(len(cfn.conditions._conditions), 2)
+        self.assertListEqual(
+            list(cfn.conditions.build_scenarios(["IsGamma", "IsBeta"])),
+            [
+                {"IsBeta": False, "IsGamma": False},
+            ],
+        )
+        self.assertListEqual(
+            list(cfn.conditions.build_scenarios(["IsGamma"])),
+            [
+                {"IsGamma": False},
+            ],
+        )