Role property for AWS::Serverless::Function reports as invalid

[aap69]

When linting an AWS SAM output file, we get this error:

Error: No such property type AWS::Serverless::Function.#Role

Resource definition:

RegisterErrorLambdaFunction: DependsOn: RegisterErrorStackLogGroup Properties: CodeUri: s3://tri-deploy/lambda/api-register/1e0866c6ab4fafa3e64718bc35a3cef2 Environment: Variables: ALERT_SNS_TOPIC: Ref: RegisterAlertSnsTopic LOG_LEVEL: Ref: logLevel Handler: Lambda-DeviceRegistration-ErrorEndState::Lambda_DeviceRegistration_ErrorEndState.ErrorStateFunction::FunctionHandler Policies: - Statement: - Action: - sns:Publish Effect: Allow Resource: Fn::Sub: arn:aws:sns:${AWS::Region}:${AWS::AccountId}:${RegisterAlertSnsTopic.TopicName} Runtime: dotnetcore2.1 Timeout: 300 Type: AWS::Serverless::Function

Property Role is a valid property

[martysweet]

Hi @aap69, could you pop that in a code block?

Looks like this is due to the new SAM support @RazzM13. @aap69, I assume you are not defining a role and letting the SAM framework do it for you?

[RazzM13]

Hey @martysweet, I'm having a look at it now.

[RazzM13]

Hello @aap69, could you please provide a full template sample, preferably within a code block, as I have attempted to reproduce this issue by cleaning up your example a bit and I ended up with:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Issue 206
Parameters:
  logLevel:
    Type: string
    Default: someLogLevel

Resources:
  RegisterAlertSnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: someTopicName

  RegisterErrorStackLogGroup:
    Type: AWS::Logs::LogGroup

  RegisterErrorLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      # Role: arn:aws:iam::123456789012:role/S3Access
      CodeUri: s3://some-example/lambda/api-register/ffffffffffffffffffffffffffffffff
      Environment:
        Variables:
          ALERT_SNS_TOPIC:
            Ref: RegisterAlertSnsTopic
          LOG_LEVEL:
            Ref: logLevel
      Handler: Lambda-DeviceRegistration-ErrorEndState::Lambda_DeviceRegistration_ErrorEndState.ErrorStateFunction::FunctionHandler
      # Policies:
      #   - Statement:
      #     -
      #       Action:
      #         - sns:Publish
      #       Effect: Allow
      #       Resource:
      #         Fn::Sub: arn:aws:sns:${AWS::Region}:${AWS::AccountId}:${RegisterAlertSnsTopic.TopicName}
      Runtime: dotnetcore2.1
      Timeout: 300
    DependsOn: RegisterErrorStackLogGroup

Unfortunately, the above does not trigger the issue you described however, it does reflect another issue in regards to the handling of the Policies property and we should probably open up a separate issue about that.

I have tried even inserting a Role myself within the definition however that did not work either and, apparently, that property is not supported by SAM Globals so even though I'm 100% sure that the issue is valid, without a full template sample, I can't easily figure out where it's coming from...

[RazzM13]

In regards to the handling of the Policies property, just opened #207.