Specify Array of VPC SubnetID / SecurityGroupIds to aws cli cloudformation deploy

Question

I am using aws-cli to deploy my stack across several environments and need to parametrize the subnets / security groups available to my stack.

I have a section in my SAM template defining the subnets and security groups as such:

  EnvSubnets:
    Description: Define subnet ids
    Type: 'List<AWS::EC2::Subnet::Id>'
  EnvSecGroups:
    Description: Security Groups
    Type: 'List<AWS::EC2::SecurityGroup::Id>'

I specify the arguments using `aws cloudformation deploy... --parameter-overrides file://env.json' but cannot find a single format that passes the arrays to cloudformation.

I keep getting the followign errors: #/VpcConfig/SecurityGroupIds: expected type: JSONArray, found: String #/VpcConfig/SubnetIds: expected type: JSONArray, found: String

Any hints?

Answer 1

It seems that at the current time this is not supported - I ended-up using a nested template driven by a user-overridable parameter:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: 'SAM Template for XXXXX XXXXX'

Parameters:
  LambdaRole:
    Description: Define exiting Lambda role to provide permissions
    Type: String
  LambdaImage:
    Description: Define Lambda image URI
    Type: String
  LambdaVPCInclude:
    Description: S3 URI of the YAML for the S3 VPC section
    Type: String

Resources:
  FOO:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Image
      ImageUri: !Ref LambdaImage
      Architectures:
        - x86_64
      MemorySize: 1024
      Timeout: 900  
      Role: !Ref LambdaRole
      'Fn::Transform':
        Name: 'AWS::Include'
        Parameters:
          Location: !Ref LambdaVPCInclude
    Metadata:
      SamResourceId: FOO
Outputs:
  QuantUniverse:
    Description: FOO Lambda Function ARN
    Value: !GetAtt FOO.Arn

and in an S3 bucket I have a file with my VPC config:

VpcConfig:
  SubnetIds:
    - subnet-*****************
    - subnet-*****************
    - subnet-*****************
  SecurityGroupIds:
    - sg-*****************
    - sg-*****************

and pass the S3 URI of this file as the override for LambdaVPCInclude in aws cloudformation deploy

Hope this helps others.