 <p>The issue is that DeletionPolicy must be set to one of three strings. And, though your If check will return one of them, from a systematic perspective, it only knows that it's returning a String - but is not guaranteed to be a valid string (same with your map and parameter checks), and thus it only accepts a string literal and not something that resolves to string.</p> <p>I believe that this limitation has been raised to the AWS Engineering team previously, as it is a nuisance. </p>