fix: Raise correct exception when !Sub variable value (Parameter.Default) is not string

samtranslator/intrinsics/actions.py

@@ -382,6 +382,14 @@ def handler_method(full_ref, ref_value):
         substituted = text
         for match in re.finditer(ref_pattern, text):
             sub_value = handler_method(match.group(0), match.group(1))
+            if not isinstance(sub_value, str):
+                raise InvalidDocumentException(
+                    [
+                        InvalidTemplateException(
+                            f"Invalid Fn::Sub variable value {sub_value}. Fn::Sub expects all variables to be strings."
+                        )
+                    ]
+                )
             substituted = substituted.replace(match.group(0), sub_value, 1)
         return substituted
 

tests/translator/input/error_intrinsic_sub_with_list.yaml

@@ -0,0 +1,39 @@
+Parameters:
+  Parameter1:
+    Type: AWS::SSM::Parameter::Value<List<String>>
+    Default:
+    # This is invalid CFN template:
+    # "Template format error: Every Default member must be a string."
+    - a
+    - b
+
+  Parameter2:
+    Type: AWS::SSM::Parameter::Value<List<String>>
+    Default:
+    - a
+    - b
+
+Resources:
+  MyApi:
+    Type: AWS::Serverless::Api
+    Properties:
+      StageName: Prod
+      Auth:
+        ResourcePolicy:
+          CustomStatements:
+          - Principal: '*'
+            Effect: Allow
+            Action: execute-api:Invoke
+            Resource: execute-api:/*/*/*
+          - Principal: '*'
+            Effect: Deny
+            Action: execute-api:Invoke
+            Resource: execute-api:/*/*/*
+            Condition:
+              NotIpAddress:
+                aws:SourceIp:
+                  Fn::Join:
+                  - ','
+                  - - ''
+                    - Fn::Sub: ${Parameter1}
+                    - Fn::Sub: ${Parameter2}

tests/translator/output/error_intrinsic_sub_with_list.json

@@ -0,0 +1,3 @@
+{
+  "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. Structure of the SAM template is invalid. Invalid Fn::Sub variable value ['a', 'b']. Fn::Sub expects all variables to be strings."
+}