Attaching Lambda Triggers to a Cognito UserPool in Cloudformation

I'm looking to customise the email message Cognito sends out to a new user when you call adminCreateUser()

I can see you do this via Lambda functions, eg -

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-message.html

exports.handler = (event, context, callback) => {
    if(event.userPoolId === "theSpecialUserPool") {
        if(event.triggerSource === "CustomMessage_AdminCreateUser") {
            event.response.smsMessage = "Welcome to the service. Your user name is " + event.request.usernameParameter + " Your temporary password is " + event.request.codeParameter;
            event.response.emailSubject = "Welcome to the service";
            event.response.emailMessage = "Welcome to the service. Your user name is " + event.request.usernameParameter + " Your temporary password is " + event.request.codeParameter;
        }
    }
    callback(null, event);
};

I can also see that AWS::Cognito::UserPool has a LambdaConfig object, with a CustomMessage field

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-lambdaconfig.html

So is looks like this is the attachment point :)

However what I can't see is the precise attachment mechanism :(

The CustomMessage field definition is cryptic -

CustomMessage

A custom Message AWS Lambda trigger.

Required: No
Type: String
Minimum: 20
Maximum: 2048
Pattern: arn:[\w+=/,.@-]+:[\w+=/,.@-]+:([\w+=/,.@-]*)?:[0-9]+:[\w+=/,.@-]+(:[\w+=/,.@-]+)?(:[\w+=/,.@-]+)?

Update requires: No interruption

ie it's just a String - but is that String

• an ARN ?
• a Ref ?
• an inline Lambda body declaration ?

Anyone know which of the above format the LambdaConfig.CustomMessage binding supports ?