{"action":"created","issue":{"url":"https://api.github.com/repos/serverless/serverless/issues/3967","repository_url":"https://api.github.com/repos/serverless/serverless","labels_url":"https://api.github.com/repos/serverless/serverless/issues/3967/labels{/name}","comments_url":"https://api.github.com/repos/serverless/serverless/issues/3967/comments","events_url":"https://api.github.com/repos/serverless/serverless/issues/3967/events","html_url":"https://github.com/serverless/serverless/issues/3967","id":244556972,"number":3967,"title":"iamRoleStatement/Resource with pseudo-parametes/intrinsic functions ${AWS::Region} and ${AWS::AccountId} creates invalid Cloudformation template","user":{"login":"BjoernSimon","id":1069754,"avatar_url":"https://avatars3.githubusercontent.com/u/1069754?v=4","gravatar_id":"","url":"https://api.github.com/users/BjoernSimon","html_url":"https://github.com/BjoernSimon","followers_url":"https://api.github.com/users/BjoernSimon/followers","following_url":"https://api.github.com/users/BjoernSimon/following{/other_user}","gists_url":"https://api.github.com/users/BjoernSimon/gists{/gist_id}","starred_url":"https://api.github.com/users/BjoernSimon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BjoernSimon/subscriptions","organizations_url":"https://api.github.com/users/BjoernSimon/orgs","repos_url":"https://api.github.com/users/BjoernSimon/repos","events_url":"https://api.github.com/users/BjoernSimon/events{/privacy}","received_events_url":"https://api.github.com/users/BjoernSimon/received_events","type":"User","site_admin":false},"labels":[{"id":511594798,"url":"https://api.github.com/repos/serverless/serverless/labels/help%20wanted","name":"help wanted","color":"0e8a16","default":true},{"id":417327117,"url":"https://api.github.com/repos/serverless/serverless/labels/kind/bug","name":"kind/bug","color":"FF8C94","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-07-21T03:47:59Z","updated_at":"2018-04-03T07:37:46Z","closed_at":null,"author_association":"NONE","body":"# This is a Bug Report\r\n\r\n## Description\r\nDefining iamRoleStatements/Resource with pseudo-parameters/instrinsic functions ${AWS::Region} and ${AWS::AccountId} leads to  invalid Cloudformation in cloudformation-template-update-stack.json\r\nSee also http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html#cfn-pseudo-param-accountid\r\n\r\n* What went wrong?\r\nDeploying attached serverless.yml causes AWS error: \"An error occurred while provisioning your stack: IamRoleLambdaExecution - The policy failed legacy parsing.\"\r\n\r\nReason is that some policies are created as\r\n```\r\n\"Resource\": [\r\n   \"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/iamParsingTest-dev-hello:*:*\"\r\n]\r\n```\r\ninstead of: \r\n```\r\n\"Resource\": [\r\n  {\r\n    \"Fn::Sub\": \"arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/iamParsingTest-dev-hello:*:*\"\r\n  }\r\n]\r\n```\r\nThe error only occurred when a function and a resource were defined as well.\r\n\r\n* What did you expect should have happened?\r\nExpected correct variable replacement and correct deployment\r\n\r\n* What was the config you used?\r\nSee files below\r\n\r\n* What stacktrace or error message from your provider did you see?\r\nSee above: \"An error occurred while provisioning your stack: IamRoleLambdaExecution - The policy failed legacy parsing.\"\r\n\r\nSimilar or dependent issues:\r\n* #3824\r\n\r\n## Additional Data\r\nserverless.yml (derived from https://github.com/serverless/serverless/pull/3111):\r\n```service: iamParsingTest\r\n\r\n## Workaround attempt:\r\ncustom:\r\n  acc: ${AWS::AccountId}\r\n\r\nprovider:\r\n  name: aws\r\n  runtime: nodejs6.10\r\n  region: us-east-1\r\n  # https://serverless.com/framework/docs/providers/aws/guide/variables/\r\n  variableSyntax: \"\\\\${{([ :a-zA-Z0-9._,\\\\-\\\\/\\\\(\\\\)]+?)}}\"\r\n  stage:  dev\r\n  \r\n  iamRoleStatements:\r\n    - Effect: \"Allow\"\r\n      Action: \r\n        - \"dynamodb:GetRecords\"\r\n        - \"dynamodb:GetShardIterator\"\r\n        - \"dynamodb:DescribeStream\"\r\n        - \"dynamodb:ListStreams\"\r\n      Resource:\r\n        # Next line causes \"IamRoleLambdaExecution - The policy failed legacy parsing.\"\r\n        #- \"arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/myTable/stream/*\"\r\n        ## Workaround does not work as ${AWS:AccountId} is not resolved, just passed on to CloudFormation without resolving it\r\n        - \"arn:aws:dynamodb:${{self:provider.region}}:${{self:custom.acc}}:table/myTable/stream/*\"\r\n        \r\n# Note: error only occurs if function/resource is defined\r\nfunctions:\r\n  hello:\r\n    handler: handler.hello\r\n    events:\r\n      - stream:\r\n          type: dynamodb\r\n          arn:\r\n            Fn::GetAtt:\r\n              - ResourcesDynamoDBStream\r\n              - StreamArn\r\n          batchSize: 1\r\n\r\nresources:\r\n  Resources:\r\n    ResourcesDynamoDBStream:\r\n      Type: AWS::DynamoDB::Table\r\n      Properties:\r\n        TableName: ResourcesDynamoDBStream\r\n        AttributeDefinitions:\r\n          - AttributeName: id\r\n            AttributeType: S\r\n        KeySchema:\r\n          - AttributeName: id\r\n            KeyType: HASH\r\n        ProvisionedThroughput:\r\n          ReadCapacityUnits: 1\r\n          WriteCapacityUnits: 1\r\n        StreamSpecification:\r\n          StreamViewType: NEW_AND_OLD_IMAGES\r\n```\r\n\r\nhandler.js (auto-generated):\r\n```\r\n'use strict';\r\nmodule.exports.hello = (event, context, callback) => {\r\n  const response = {\r\n    statusCode: 200,\r\n    body: JSON.stringify({\r\n      message: 'Go Serverless v1.0! Your function executed successfully!',\r\n      input: event,\r\n    }),\r\n  };\r\n  callback(null, response);\r\n};\r\n```\r\n\r\n* ***Serverless Framework Version you're using***: 1 .17.0\r\n* ***Operating System***: Win10\r\n* ***Stack Trace***: none\r\n* ***Provider Error messages***: \"An error occurred while provisioning your stack: IamRoleLambdaExecution - The policy failed legacy parsing.\"\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/serverless/serverless/issues/comments/378157139","html_url":"https://github.com/serverless/serverless/issues/3967#issuecomment-378157139","issue_url":"https://api.github.com/repos/serverless/serverless/issues/3967","id":378157139,"user":{"login":"mrowles","id":1400563,"avatar_url":"https://avatars3.githubusercontent.com/u/1400563?v=4","gravatar_id":"","url":"https://api.github.com/users/mrowles","html_url":"https://github.com/mrowles","followers_url":"https://api.github.com/users/mrowles/followers","following_url":"https://api.github.com/users/mrowles/following{/other_user}","gists_url":"https://api.github.com/users/mrowles/gists{/gist_id}","starred_url":"https://api.github.com/users/mrowles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrowles/subscriptions","organizations_url":"https://api.github.com/users/mrowles/orgs","repos_url":"https://api.github.com/users/mrowles/repos","events_url":"https://api.github.com/users/mrowles/events{/privacy}","received_events_url":"https://api.github.com/users/mrowles/received_events","type":"User","site_admin":false},"created_at":"2018-04-03T07:37:46Z","updated_at":"2018-04-03T07:37:46Z","author_association":"NONE","body":"Also experiencing this. It seems to only error when I use `#{AWS.AccountId}` somewhere in settings e.g., referencing an ARN. This which works fine in other pre-existing function settings."}}
{"actor":{"display_login":"mrowles"}}