Lambda onError can't use CloudFormation "Ref", requires ARN string?

I’m trying to create an SNS topic in my serverless.yml Resources then reference it in my Lambda’s “onError” to use it as a DeadLetterQueue. I can create the topic and reference it in the iamRoleStatements fine. But when I try to use a CloudFormation “Ref” in the Lambda onError, I get a complaint “onError config must be provided as a string”.

That comes from the SLS code:

Is this due to restrictions in CloudFormation itself, so there’s no way SLS can implement it?The AWS docs imply only a string is possible, not a Ref:

Am I understanding this limitation correctly?

gmetzker created a plugin and I’m guessing it’s to get-around this limitation, is that correct?

My most minimal example code:

service: dlqtest

  name: aws
  runtime: python3.6
    - Effect: Allow
        - "sns:Publish"
        Ref: DeadLetterQueue

      Type: AWS::SNS::Topic
          - Endpoint:
            Protocol: email

    handler: dlqtest.handler
    onError: arn:aws:sns:us-east-1:########:dlqtest-dev-DeadLetterQueue-14HOO3X2AAUX7
    #   Ref: DeadLetterQueue  # doesn't work: "onError config must be provided as a string"
      - s3:
          bucket: cshenton-dlqtest
          event: s3:ObjectCreated:*

This looks like an issue with the implementation in Serverless to me. I would open an issue against the project to support Refs in that field - I also would’ve expected to be able to pass the Ref (or similar) through.

The other approach that comes to mind is to create your SNS topic in a separate stack that you deploy before your service. This has the added benefit of being able to be re-used between services without you needing to subscribe multiple times.

Note that the PR you linked is also adding the required sns:Publish permissions to the default role, so you don’t need the same thing in your serverless.yml's iamRoleStatements.

Thanks, rowanu, issue created