How to properly map an SSM parameter store StringList to a Lambda VpcConfig section

Question

I'm new to Cloudformation (coming from Terraform). I have a parameter in SSM

Key: /qa0/myService/lambda/subnetIds
Value: subnet-1234abcd, subnet-5678abcd
Type: StringList

I want to dynamically reference this parameter in the VpcConfig section of a Lambda in a Cloudformation template, but I'm not getting something right. I've tried a bunch of different things. Also, I'm using a StackEnv parameter to allow for reuse through multiple environments, so this parameter will be populated as qa0, qa1, etc.

VpcConfig:
    SecurityGroupIds: !Ref VpcSecurityGroupIds
    SubnetIds: !Sub '{{resolve:ssm:/${StackEnv}/myService/lambda/subnetIds:1}}'

Result: "Value of property SubnetIds must be of type List of String"

VpcConfig:
    SecurityGroupIds: !Ref VpcSecurityGroupIds
    SubnetIds: [!Split [",", !Sub '{{resolve:ssm:/${StackEnv}/myService/lambda/subnetIds:1}}']]

Result: "The subnet ID 'subnet-1234abcd,subnet-5678abcd' does not exist". For some reason it's not splitting the StringList here.

edit: taking Split out of the array here (SubnetIds: !Split [ ",", !Sub '{{resolve:ssm:/${StackEnv}/myService/lambda/subnetIds:1}}']) as 404 suggested in the comments gets me the same result.

If I try defining the SSM parameter as a Cloudformation template parameter (AWS::SSM::Parameter::Value<List<String>>), I get stuck because I need the Default to substitute in StackEnv and not be a static string, which isn't supported. The template complains that Default must be a string.

I've tried various versions of nesting the dynamic lookup result in square brackets, with no luck:

SubnetIds: [ !Sub '{{resolve:ssm:/${StackEnv}/myService/lambda/subnetIds:1}}' ]

What am I doing wrong here?

Split returns an array, so don't put it in an array: SubnetIds: [!Split -> SubnetIds: !Split — 404
Doesn't seem to matter. Edited my question to cover !Split outside of an array. — bluescores

bluescores bluescores · Accepted Answer · 2019-09-18T16:43:01

I confirmed with AWS official support - CloudFormation is "executing the intrinsic functions before the inline references here, which is a buggy behavior from CloudFormation." (their words) To be clear, the buggy behavior is 100% consistent for me and this SubnetIds field.

How to properly map an SSM parameter store StringList to a Lambda VpcConfig section

1 Answers