diff --git a/samtranslator/intrinsics/actions.py b/samtranslator/intrinsics/actions.py index fc2fc9c7c..ca21c5c54 100644 --- a/samtranslator/intrinsics/actions.py +++ b/samtranslator/intrinsics/actions.py @@ -382,6 +382,14 @@ def handler_method(full_ref, ref_value): substituted = text for match in re.finditer(ref_pattern, text): sub_value = handler_method(match.group(0), match.group(1)) + if not isinstance(sub_value, str): + raise InvalidDocumentException( + [ + InvalidTemplateException( + f"Invalid Fn::Sub variable value {sub_value}. Fn::Sub expects all variables to be strings." + ) + ] + ) substituted = substituted.replace(match.group(0), sub_value, 1) return substituted diff --git a/tests/translator/input/error_intrinsic_sub_with_list.yaml b/tests/translator/input/error_intrinsic_sub_with_list.yaml new file mode 100644 index 000000000..a1bc160ed --- /dev/null +++ b/tests/translator/input/error_intrinsic_sub_with_list.yaml @@ -0,0 +1,39 @@ +Parameters: + Parameter1: + Type: AWS::SSM::Parameter::Value> + Default: + # This is invalid CFN template: + # "Template format error: Every Default member must be a string." + - a + - b + + Parameter2: + Type: AWS::SSM::Parameter::Value> + Default: + - a + - b + +Resources: + MyApi: + Type: AWS::Serverless::Api + Properties: + StageName: Prod + Auth: + ResourcePolicy: + CustomStatements: + - Principal: '*' + Effect: Allow + Action: execute-api:Invoke + Resource: execute-api:/*/*/* + - Principal: '*' + Effect: Deny + Action: execute-api:Invoke + Resource: execute-api:/*/*/* + Condition: + NotIpAddress: + aws:SourceIp: + Fn::Join: + - ',' + - - '' + - Fn::Sub: ${Parameter1} + - Fn::Sub: ${Parameter2} diff --git a/tests/translator/output/error_intrinsic_sub_with_list.json b/tests/translator/output/error_intrinsic_sub_with_list.json new file mode 100644 index 000000000..04d8ace3d --- /dev/null +++ b/tests/translator/output/error_intrinsic_sub_with_list.json @@ -0,0 +1,3 @@ +{ + "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. Structure of the SAM template is invalid. Invalid Fn::Sub variable value ['a', 'b']. Fn::Sub expects all variables to be strings." +}