fix: Allow resource Refs in Update/CreationPolicy

Revert #4641, which added resources={} to the E3016/E3055 validator
context. Blanking the resource map to catch a bare intrinsic standing in
for the whole policy object also blanked it for nested leaf properties,
so a valid Ref to a template resource (e.g.
CodeDeployLambdaAliasUpdate.ApplicationName: !Ref MyApp) was rejected
with E1020 - a regression since 1.56.0.

Validated against live CloudFormation: resource Refs at leaf properties
deploy successfully (a real CodeDeploy deployment runs); a bare Ref as
the whole policy object is rejected by CFN ("Expected an object") and
is a follow-up to re-detect via Ref return-type modeling rather than a
blanked resource map.

This reverts commit 1a58c98.

Fixes #4669

Author: kddejong

src/cfnlint/jsonschema/_keywords.py

@@ -83,16 +83,36 @@ def additionalProperties(
 def allOf(
     validator: Validator, allOf: Any, instance: Any, schema: dict[str, Any]
 ) -> ValidationResult:
-    # allOf is conjunctive: every subschema must hold and there is no branch to
-    # select, so an unresolvable intrinsic function creates no ambiguity here
-    # (unlike anyOf/oneOf/if). Validate each subschema and yield all errors.
     validator = validator.evolve(
         function_filter=validator.function_filter.evolve(
             add_cfn_lint_keyword=False,
         ),
+        context=validator.context.evolve(
+            unresolvable_function_mode=True,
+        ),
     )
+    has_unknown = False
+    known_errors = []
+
     for index, subschema in enumerate(allOf):
-        yield from validator.descend(instance, subschema, schema_path=index)
+        errs = list(validator.descend(instance, subschema, schema_path=index))
+
+        if any(getattr(err, "unknown", False) for err in errs):
+            has_unknown = True
+        else:
+            known_errors.extend(errs)
+
+    # If we have unknown branches, we can't determine if allOf is satisfied
+    if has_unknown:
+        yield ValidationError(
+            f"Cannot determine allOf for {instance!r}",
+            unknown=True,
+        )
+        return
+
+    # Yield all known errors
+    for err in known_errors:
+        yield err
 
 
 def anyOf(

src/cfnlint/rules/functions/Ref.py

@@ -7,12 +7,7 @@
 
 from typing import Any
 
-from cfnlint.helpers import (
-    PSEUDOPARAMS_MULTIPLE,
-    PSEUDOPARAMS_SINGLE,
-    VALID_PARAMETER_TYPES,
-    VALID_PARAMETER_TYPES_LIST,
-)
+from cfnlint.helpers import VALID_PARAMETER_TYPES, VALID_PARAMETER_TYPES_LIST
 from cfnlint.jsonschema import ValidationError, Validator
 from cfnlint.rules.functions._BaseFn import BaseFn, all_types
 
@@ -73,29 +68,6 @@ def ref(
                     yield ValidationError(f"{instance!r} is not of type {reprs}")
                     return
 
-        elif value in PSEUDOPARAMS_SINGLE or value in PSEUDOPARAMS_MULTIPLE:
-            # Pseudo parameters resolve to a known type: the SINGLE set are
-            # strings, PSEUDOPARAMS_MULTIPLE (AWS::NotificationARNs) is a list.
-            # Validate that resolved type against the schema, the same way we
-            # do for named parameters.
-            schema_types = self.resolve_type(validator, subschema)
-            if not schema_types:
-                return
-            reprs = ", ".join(repr(type) for type in schema_types)
-            is_list = value in PSEUDOPARAMS_MULTIPLE
-
-            if all(
-                st not in ["string", "boolean", "integer", "number"]
-                for st in schema_types
-            ):
-                if not is_list:
-                    yield ValidationError(f"{instance!r} is not of type {reprs}")
-                    return
-            elif all(st not in ["array"] for st in schema_types):
-                if is_list:
-                    yield ValidationError(f"{instance!r} is not of type {reprs}")
-                    return
-
         for rule_id in self._all_refs:
             rule = self.child_rules.get(rule_id)
             if rule:

src/cfnlint/rules/resources/CreationPolicy.py

@@ -7,7 +7,6 @@
 
 from typing import Any
 
-from cfnlint.helpers import FUNCTIONS
 from cfnlint.jsonschema import Validator
 from cfnlint.rules.jsonschema.CfnLintJsonSchema import CfnLintJsonSchema
 
@@ -85,8 +84,13 @@ def validate(self, validator: Validator, dP: str, instance, schema):
 
         validator = validator.evolve(
             context=validator.context.evolve(
-                functions=list(FUNCTIONS),
-                resources={},
+                functions=[
+                    "Fn::Sub",
+                    "Fn::Select",
+                    "Fn::FindInMap",
+                    "Fn::If",
+                    "Ref",
+                ],
                 strict_types=False,
             ),
             schema=self._get_schema(resource_type),

src/cfnlint/rules/resources/updatepolicy/Configuration.py

@@ -6,6 +6,7 @@
 from typing import Any
 
 import cfnlint.data.schemas.other.resources
+import cfnlint.helpers
 from cfnlint.helpers import FUNCTIONS
 from cfnlint.jsonschema import Validator
 from cfnlint.rules.jsonschema.CfnLintJsonSchema import CfnLintJsonSchema, SchemaDetails
@@ -35,7 +36,6 @@ def validate(self, validator: Validator, keywords: Any, instance: Any, schema: A
         validator = validator.evolve(
             context=validator.context.evolve(
                 functions=list(FUNCTIONS),
-                resources={},
                 strict_types=False,
             ),
             schema=self._schema,

test/fixtures/results/integration/creationpolicy_yaml.json

@@ -133,20 +133,6 @@ class TestQuickStartTemplates(BaseCliTestCase):
             ),
             "exit_code": 0,
         },
-        {
-            "filename": "test/fixtures/templates/integration/creationpolicy.yaml",
-            "results_filename": (
-                "test/fixtures/results/integration/creationpolicy_yaml.json"
-            ),
-            "exit_code": 2,
-        },
-        {
-            "filename": "test/fixtures/templates/integration/updatepolicy.yaml",
-            "results_filename": (
-                "test/fixtures/results/integration/updatepolicy_yaml.json"
-            ),
-            "exit_code": 2,
-        },
     ]
 
     def test_templates(self):