TL;DR: cfn-lint catches a broken CloudFormation Ref before deployment: it reports rule E1020 and exits with code 2. You can reproduce it from two public commits without an AWS account, fix the reference, and run cfn-lint on every pull request. A clean lint run proves the references resolve, not that the stack is safe or will deploy.

By Prateek Singh, founder of Ganak AI Labs. Updated 6 October 2026.

A one-line change to an Auto Scaling group swaps !Ref PrivateSubnetB for !Ref MissingPrivateSubnetB . The YAML is valid, the diff looks harmless, and in a busy review it gets approved.

The mistake only shows up later, when CloudFormation tries to resolve a resource that doesn't exist.

This kind of error is cheap to catch before anything touches AWS.…