Default value AWS replace with pseudo parameter reference

user_7162941 0
Viewed 1353

I have a parameter in an aws cloudformation template 

 Parameters:
   ExecRole:
     Type: String
     Description: Required. Lambda exec role ARN
     Default: arn:aws:iam::123456789:role/lambdaExecRole

Assuming the 123456789 is the AcountId I want to use the pseudo parameter reference but I cannot do it, I try the followings without success

Default: arn:aws:iam::!Ref{AWS::AccountId}:role/exLambdaExecRole
Default: !Sub 'arn:aws:iam::${AWS::AccountId}:role/exLambdaExecRole'

In the last case is throwing me an error

Default member must be a string.

amazon-cloudformation amazon-web-services
2 Answers

Assuming this will always be role, why can't you as a parameter ask for the nae to be passed in then use the Sub intrinsic function to replace in the Resources section of your CloudFormation template.

That way your arn:aws:iam::${AWS::AccountId}:role part of the arn would not need to be part of the parameter.

user_134609330

It seems like functions (ex. !Sub) are not supported in default values of Parameters.

Here's a workaround we're using.

We have a separate stack called Parameters which exports whatever parameters needed in other stacks. For instance:

Outputs:
  VpcId:
    Description: Id of the VPC.
    Value: !Ref VpcId
    Export:
      Name: !Sub 'stk-${EnvType}-${EnvId}-VpcId'

In other stacks we simply import these exported values:

  VpcId: !ImportValue
    'Fn::Sub': 'stk-${EnvType}-${EnvId}-VpcId'

EnvType and EnvId are the same for all the stacks of one environment.

With roles you might want to do the following. Create a separate Roles template, implement your roles there and export their ARNs:

Outputs:
  LambdaExecutionRoleArn:
    Description: ARN of the execution role for the log-and-pass function.
    Value: !GetAtt
      - LambdaExecutionRole
      - Arn
    Export:
      Name: !Sub 'stk-${EnvType}-${EnvId}-roles-LambdaExecutionRole-Arn'

Again, in other stack you could simply ImportValue:

    Role: !ImportValue
      'Fn::Sub': 'stk-${EnvType}-${EnvId}-roles-LogAndPassFunctionExecutionRole-Arn'
user_3038100
Related