We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
NoEcho password warning on a Lambda Function named AccountPassword
*cfn-lint version: 0.25.1*

*Description of issue.*

I'm getting this warning:

```
W2501 Inappropriate map found for password on Resources/AccountPassword
```

on this Resource in my SAM template:

```yaml
  AccountPassword:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${RepositoryName}-account-password-${StageName}
      Runtime: nodejs10.x
      Layers:
        - !Ref LambdaDependencyLayer
      CodeUri: dist/account
      Handler: password.handler
      Description: Reset User Password
      Timeout: 20
      Events:
        GET:
          Type: Api
          Properties:
            RestApiId:
              Ref: RestApi
            Path: /account/password
            Method: get
      Role: !GetAtt LambdaExecutionRole.Arn
    DeploymentPreference:
      Alarms:
        - !Ref AccountPasswordLatestVersionErrorMetricGreaterThanZeroAlarm
```

I'm guessing the resolution would be to make sure this check is only done on Parameters and not Resouces.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `src/cfnlint/rules/resources/properties/Password.py`
Content:
```
1 """
2 Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 SPDX-License-Identifier: MIT-0
4 """
5 import re
6 import six
7 from cfnlint.rules import CloudFormationLintRule
8 from cfnlint.rules import RuleMatch
9 from cfnlint.helpers import REGEX_DYN_REF_SSM, REGEX_DYN_REF
10 
11 
12 class Password(CloudFormationLintRule):
13     """Check if Password Properties are properly configured"""
14     id = 'W2501'
15     shortdesc = 'Check if Password Properties are correctly configured'
16     description = 'Password properties should be strings and if parameter using NoEcho'
17     source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#creds'
18     tags = ['parameters', 'passwords', 'security']
19 
20     def match(self, cfn):
21         """Check CloudFormation Password Parameters"""
22 
23         matches = []
24         password_properties = ['AccountPassword', 'AdminPassword', 'ADDomainJoinPassword', 'CrossRealmTrustPrincipalPassword',
25                                'KdcAdminPassword', 'Password', 'DbPassword', 'MasterUserPassword', 'PasswordParam']
26 
27         parameters = cfn.get_parameter_names()
28         fix_params = []
29         for password_property in password_properties:
30             # Build the list of refs
31             refs = cfn.search_deep_keys(password_property)
32             trees = [tree for tree in refs if tree[0] == 'Resources']
33 
34             for tree in trees:
35                 obj = tree[-1]
36                 if isinstance(obj, (six.string_types)):
37                     if re.match(REGEX_DYN_REF, obj):
38                         if re.match(REGEX_DYN_REF_SSM, obj):
39                             message = 'Password should use a secure dynamic reference for %s' % (
40                                 '/'.join(map(str, tree[:-1])))
41                             matches.append(RuleMatch(tree[:-1], message))
42                     else:
43                         message = 'Password shouldn\'t be hardcoded for %s' % (
44                             '/'.join(map(str, tree[:-1])))
45                         matches.append(RuleMatch(tree[:-1], message))
46                 elif isinstance(obj, dict):
47                     if len(obj) == 1:
48                         for key, value in obj.items():
49                             if key == 'Ref':
50                                 if value in parameters:
51                                     param = cfn.template['Parameters'][value]
52                                     if 'NoEcho' in param:
53                                         if not param['NoEcho']:
54                                             fix_params.append(
55                                                 {'Name': value, 'Use': password_property})
56                                     else:
57                                         fix_params.append({'Name': value, 'Use': password_property})
58                     else:
59                         message = 'Inappropriate map found for password on %s' % (
60                             '/'.join(map(str, tree[:-1])))
61                         matches.append(RuleMatch(tree[:-1], message))
62 
63         for paramname in fix_params:
64             message = 'Parameter {} used as {}, therefore NoEcho should be True'.format(
65                 paramname['Name'], paramname['Use'])
66             tree = ['Parameters', paramname['Name']]
67             matches.append(RuleMatch(tree, message))
68         return matches
69
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/src/cfnlint/rules/resources/properties/Password.py b/src/cfnlint/rules/resources/properties/Password.py
--- a/src/cfnlint/rules/resources/properties/Password.py
+++ b/src/cfnlint/rules/resources/properties/Password.py
@@ -29,7 +29,11 @@
         for password_property in password_properties:
             # Build the list of refs
             refs = cfn.search_deep_keys(password_property)
-            trees = [tree for tree in refs if tree[0] == 'Resources']
+            trees = []
+            for tree in refs:
+                if len(tree) > 2:
+                    if tree[0] == 'Resources' and tree[2] == 'Properties':
+                        trees.append(tree)
 
             for tree in trees:
                 obj = tree[-1]

{"golden_diff": "diff --git a/src/cfnlint/rules/resources/properties/Password.py b/src/cfnlint/rules/resources/properties/Password.py\n--- a/src/cfnlint/rules/resources/properties/Password.py\n+++ b/src/cfnlint/rules/resources/properties/Password.py\n@@ -29,7 +29,11 @@\n         for password_property in password_properties:\n             # Build the list of refs\n             refs = cfn.search_deep_keys(password_property)\n-            trees = [tree for tree in refs if tree[0] == 'Resources']\n+            trees = []\n+            for tree in refs:\n+                if len(tree) > 2:\n+                    if tree[0] == 'Resources' and tree[2] == 'Properties':\n+                        trees.append(tree)\n \n             for tree in trees:\n                 obj = tree[-1]\n", "issue": "NoEcho password warning on a Lambda Function named AccountPassword\n*cfn-lint version: 0.25.1*\r\n\r\n*Description of issue.*\r\n\r\nI'm getting this warning:\r\n\r\n```\r\nW2501 Inappropriate map found for password on Resources/AccountPassword\r\n```\r\n\r\non this Resource in my SAM template:\r\n\r\n```yaml\r\n  AccountPassword:\r\n    Type: AWS::Serverless::Function\r\n    Properties:\r\n      FunctionName: !Sub ${RepositoryName}-account-password-${StageName}\r\n      Runtime: nodejs10.x\r\n      Layers:\r\n        - !Ref LambdaDependencyLayer\r\n      CodeUri: dist/account\r\n      Handler: password.handler\r\n      Description: Reset User Password\r\n      Timeout: 20\r\n      Events:\r\n        GET:\r\n          Type: Api\r\n          Properties:\r\n            RestApiId:\r\n              Ref: RestApi\r\n            Path: /account/password\r\n            Method: get\r\n      Role: !GetAtt LambdaExecutionRole.Arn\r\n    DeploymentPreference:\r\n      Alarms:\r\n        - !Ref AccountPasswordLatestVersionErrorMetricGreaterThanZeroAlarm\r\n```\r\n\r\nI'm guessing the resolution would be to make sure this check is only done on Parameters and not Resouces.\n", "before_files": [{"content": "\"\"\"\nCopyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.\nSPDX-License-Identifier: MIT-0\n\"\"\"\nimport re\nimport six\nfrom cfnlint.rules import CloudFormationLintRule\nfrom cfnlint.rules import RuleMatch\nfrom cfnlint.helpers import REGEX_DYN_REF_SSM, REGEX_DYN_REF\n\n\nclass Password(CloudFormationLintRule):\n    \"\"\"Check if Password Properties are properly configured\"\"\"\n    id = 'W2501'\n    shortdesc = 'Check if Password Properties are correctly configured'\n    description = 'Password properties should be strings and if parameter using NoEcho'\n    source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#creds'\n    tags = ['parameters', 'passwords', 'security']\n\n    def match(self, cfn):\n        \"\"\"Check CloudFormation Password Parameters\"\"\"\n\n        matches = []\n        password_properties = ['AccountPassword', 'AdminPassword', 'ADDomainJoinPassword', 'CrossRealmTrustPrincipalPassword',\n                               'KdcAdminPassword', 'Password', 'DbPassword', 'MasterUserPassword', 'PasswordParam']\n\n        parameters = cfn.get_parameter_names()\n        fix_params = []\n        for password_property in password_properties:\n            # Build the list of refs\n            refs = cfn.search_deep_keys(password_property)\n            trees = [tree for tree in refs if tree[0] == 'Resources']\n\n            for tree in trees:\n                obj = tree[-1]\n                if isinstance(obj, (six.string_types)):\n                    if re.match(REGEX_DYN_REF, obj):\n                        if re.match(REGEX_DYN_REF_SSM, obj):\n                            message = 'Password should use a secure dynamic reference for %s' % (\n                                '/'.join(map(str, tree[:-1])))\n                            matches.append(RuleMatch(tree[:-1], message))\n                    else:\n                        message = 'Password shouldn\\'t be hardcoded for %s' % (\n                            '/'.join(map(str, tree[:-1])))\n                        matches.append(RuleMatch(tree[:-1], message))\n                elif isinstance(obj, dict):\n                    if len(obj) == 1:\n                        for key, value in obj.items():\n                            if key == 'Ref':\n                                if value in parameters:\n                                    param = cfn.template['Parameters'][value]\n                                    if 'NoEcho' in param:\n                                        if not param['NoEcho']:\n                                            fix_params.append(\n                                                {'Name': value, 'Use': password_property})\n                                    else:\n                                        fix_params.append({'Name': value, 'Use': password_property})\n                    else:\n                        message = 'Inappropriate map found for password on %s' % (\n                            '/'.join(map(str, tree[:-1])))\n                        matches.append(RuleMatch(tree[:-1], message))\n\n        for paramname in fix_params:\n            message = 'Parameter {} used as {}, therefore NoEcho should be True'.format(\n                paramname['Name'], paramname['Use'])\n            tree = ['Parameters', paramname['Name']]\n            matches.append(RuleMatch(tree, message))\n        return matches\n", "path": "src/cfnlint/rules/resources/properties/Password.py"}], "after_files": [{"content": "\"\"\"\nCopyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.\nSPDX-License-Identifier: MIT-0\n\"\"\"\nimport re\nimport six\nfrom cfnlint.rules import CloudFormationLintRule\nfrom cfnlint.rules import RuleMatch\nfrom cfnlint.helpers import REGEX_DYN_REF_SSM, REGEX_DYN_REF\n\n\nclass Password(CloudFormationLintRule):\n    \"\"\"Check if Password Properties are properly configured\"\"\"\n    id = 'W2501'\n    shortdesc = 'Check if Password Properties are correctly configured'\n    description = 'Password properties should be strings and if parameter using NoEcho'\n    source_url = 'https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#creds'\n    tags = ['parameters', 'passwords', 'security']\n\n    def match(self, cfn):\n        \"\"\"Check CloudFormation Password Parameters\"\"\"\n\n        matches = []\n        password_properties = ['AccountPassword', 'AdminPassword', 'ADDomainJoinPassword', 'CrossRealmTrustPrincipalPassword',\n                               'KdcAdminPassword', 'Password', 'DbPassword', 'MasterUserPassword', 'PasswordParam']\n\n        parameters = cfn.get_parameter_names()\n        fix_params = []\n        for password_property in password_properties:\n            # Build the list of refs\n            refs = cfn.search_deep_keys(password_property)\n            trees = []\n            for tree in refs:\n                if len(tree) > 2:\n                    if tree[0] == 'Resources' and tree[2] == 'Properties':\n                        trees.append(tree)\n\n            for tree in trees:\n                obj = tree[-1]\n                if isinstance(obj, (six.string_types)):\n                    if re.match(REGEX_DYN_REF, obj):\n                        if re.match(REGEX_DYN_REF_SSM, obj):\n                            message = 'Password should use a secure dynamic reference for %s' % (\n                                '/'.join(map(str, tree[:-1])))\n                            matches.append(RuleMatch(tree[:-1], message))\n                    else:\n                        message = 'Password shouldn\\'t be hardcoded for %s' % (\n                            '/'.join(map(str, tree[:-1])))\n                        matches.append(RuleMatch(tree[:-1], message))\n                elif isinstance(obj, dict):\n                    if len(obj) == 1:\n                        for key, value in obj.items():\n                            if key == 'Ref':\n                                if value in parameters:\n                                    param = cfn.template['Parameters'][value]\n                                    if 'NoEcho' in param:\n                                        if not param['NoEcho']:\n                                            fix_params.append(\n                                                {'Name': value, 'Use': password_property})\n                                    else:\n                                        fix_params.append({'Name': value, 'Use': password_property})\n                    else:\n                        message = 'Inappropriate map found for password on %s' % (\n                            '/'.join(map(str, tree[:-1])))\n                        matches.append(RuleMatch(tree[:-1], message))\n\n        for paramname in fix_params:\n            message = 'Parameter {} used as {}, therefore NoEcho should be True'.format(\n                paramname['Name'], paramname['Use'])\n            tree = ['Parameters', paramname['Name']]\n            matches.append(RuleMatch(tree, message))\n        return matches\n", "path": "src/cfnlint/rules/resources/properties/Password.py"}]}