# Lambda onError can't use CloudFormation "Ref", requires ARN string?

**URL:** <https://forum.serverless.com/t/lambda-onerror-cant-use-cloudformation-ref-requires-arn-string/2476>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [August 11, 2017, 2:55pm UTC](https://forum.serverless.com/t/lambda-onerror-cant-use-cloudformation-ref-requires-arn-string/2476 "2017-08-11T14:55:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shentonfreude](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/shentonfreude/32/346_2.png) [@shentonfreude](https://forum.serverless.com/u/shentonfreude)\
**Post date:** [August 11, 2017, 2:55pm UTC](https://forum.serverless.com/t/lambda-onerror-cant-use-cloudformation-ref-requires-arn-string/2476/1 "2017-08-11T14:55:12Z")

</div>

I’m trying to create an SNS topic in my serverless.yml Resources then reference it in my Lambda’s “onError” to use it as a DeadLetterQueue. I can create the topic and reference it in the iamRoleStatements fine. But when I try to use a CloudFormation “Ref” in the Lambda onError, I get a complaint “onError config must be provided as a string”.

That comes from the SLS code: [https://github.com/serverless/serverless/pull/3609/files](https://github.com/serverless/serverless/pull/3609/files)

Is this due to restrictions in CloudFormation itself, so there’s no way SLS can implement it?The AWS docs imply only a string is possible, not a Ref:  
[http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-deadletterconfig.html](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-deadletterconfig.html)

Am I understanding this limitation correctly?

gmetzker created a plugin and I’m guessing it’s to get-around this limitation, is that correct?  
[http://forum.serverless.com/t/published-a-lambda-dead-letter-queue-plugin/1200](http://forum.serverless.com/t/published-a-lambda-dead-letter-queue-plugin/1200)

My most minimal example code:

```
service: dlqtest

provider:
  name: aws
  runtime: python3.6
  iamRoleStatements:
    - Effect: Allow
      Action:
        - "sns:Publish"
      Resource: 
        Ref: DeadLetterQueue

resources:
  Resources:
    DeadLetterQueue:
      Type: AWS::SNS::Topic
      Properties:
        Subscription:
          - Endpoint: chris+dlqtest@example.com
            Protocol: email

functions:
  DlqTest:
    handler: dlqtest.handler
    onError: arn:aws:sns:us-east-1:########:dlqtest-dev-DeadLetterQueue-14HOO3X2AAUX7
    # Ref: DeadLetterQueue # doesn't work: "onError config must be provided as a string"
    events:
      - s3:
          bucket: cshenton-dlqtest
          event: s3:ObjectCreated:*
```

---

<div class="post-metadata">

**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\
**Post date:** [August 13, 2017, 8:11pm UTC](https://forum.serverless.com/t/lambda-onerror-cant-use-cloudformation-ref-requires-arn-string/2476/2 "2017-08-13T20:11:42Z")

</div>

This looks like an issue with the implementation in Serverless to me. I would open an issue against [the project](https://github.com/serverless/serverless/issues/) to support `Ref`s in that field - I also would’ve expected to be able to pass the Ref (or similar) through.

The other approach that comes to mind is to create your SNS topic in a separate stack that you deploy _before_ your service. This has the added benefit of being able to be re-used between services without you needing to subscribe multiple times.

Note that the PR you linked is also adding the required `sns:Publish` permissions to the default role, so you don’t need the same thing in your `serverless.yml`'s `iamRoleStatements`.

---

<div class="post-metadata">

**Author:** ![shentonfreude](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/shentonfreude/32/346_2.png) [@shentonfreude](https://forum.serverless.com/u/shentonfreude)\
**Post date:** [August 15, 2017, 2:32pm UTC](https://forum.serverless.com/t/lambda-onerror-cant-use-cloudformation-ref-requires-arn-string/2476/3 "2017-08-15T14:32:15Z")

</div>

Thanks, rowanu, issue created

> <https://github.com/serverless/serverless/issues/4094>