`AWS::Events::Rule` - Verify `Targets` is not `iam`

[r-heimann]

Is this feature request related to a new rule or cfn-lint capabilities?

New capability

Describe the feature you'd like to request

Currently cfn-lint does not warn the user about a potential wrong Eventbridge Rule Target. The following CloudFormation template

AWSTemplateFormatVersion: 2010-09-09
Description: Test

Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole

  Rule:
    Type: AWS::Events::Rule
    Properties:
      State: ENABLED
      ScheduleExpression: "cron(0/15 * * * ? *)"
      Targets:
        - Id: Test
          Arn: !GetAtt Role.Arn

will cause the error:

iam is not a supported service for a target.
(Service: EventBridge, Status Code: 400, Request ID: 9...f)
(SDK Attempt Count: 1)

Describe the solution you'd like

It would be great if cfn-lint could verify if !Refs/!GetAtts are valid targets for AWS::Events::Rule

Additional context

No response

Is this something that you'd be interested in working on?

• 👋 I may be able to implement this feature request

Would this feature include a breaking change?

• ⚠️ This feature might incur a breaking change

[VishalGawade1]

Happy to take a look at this one. I was thinking of adding a rule under rules/resources/events/ that looks at each Target's Arn, whether it's a literal, a !Ref, or a !GetAtt , figures out the service behind it, and flags it if it's not something EventBridge actually supports as a target (an IAM role being the obvious one). we can also follow the existing CfnLintKeyword rules so it fits the codebase. does that sound like the right approach to you, and any preference on the rule id? Don't want to go build it and find out you'd rather handle it differently.