E3009: AWS::CloudFormation::Init commands entry without command is not reported #4874

CloudFormation Lint Version

1.58.0

What operating system are you using?

Linux

Describe the bug

E3009 validates Metadata/AWS::CloudFormation::Init against src/cfnlint/data/schemas/other/resources/cfn_init.json. In the commands definition, each entry is an object with additionalProperties: false and the properties command, cwd, env, ignoreErrors, test and waitAfterCompletion, but no required list, so an entry that leaves out command passes. CloudFormation does not validate Metadata, so the template deploys, and cfn-init then stops on the instance with 000_reload does not specify the 'command' attribute, which is required (cfnbootstrap/command_tool.py in aws-cfn-bootstrap). In the template below the instance reports that failure to a WaitCondition and the stack fails. #4801 is a different defect in the same definition (the type of command, array form reported).

Expected behavior

E3009 on Metadata/AWS::CloudFormation::Init/config/commands/000_reload. The AWS::CloudFormation::Init reference, Commands lists command as Required: "Either an array or a string specifying the command to run."

Reproduction template

AWSTemplateFormatVersion: "2010-09-09"
Description: cfn-init commands entry with no command key
Parameters:
  ImageId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-arm64
Resources:
  Handle:
    Type: AWS::CloudFormation::WaitConditionHandle
  Instance:
    Type: AWS::EC2::Instance
    Metadata:
      AWS::CloudFormation::Init:
        config:
          commands:
            "000_reload":
              cwd: /tmp
    Properties:
      ImageId: !Ref ImageId
      InstanceType: t4g.nano
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          dnf install -y aws-cfn-bootstrap > /dev/null 2>&1
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource Instance --region ${AWS::Region}
          rc=$?
          cat /var/log/cfn-init.log
          reason=$(grep -m1 -o "Error encountered.*" /var/log/cfn-init.log || echo "cfn-init exit $rc")
          /opt/aws/bin/cfn-signal -e $rc -r "$reason" '${Handle}'
  Wait:
    Type: AWS::CloudFormation::WaitCondition
    DependsOn: Instance
    Properties:
      Handle: !Ref Handle
      Timeout: "600"

cfn-lint --regions us-east-1 -- template.yaml: no findings (exit 0).

CloudFormation, us-east-1, 2026-10-22: Wait CREATE_FAILED; WaitCondition received failed message: 'Error encountered during build of config: 000_reload does not specify the 'command' attribute, which is required'