Allow Fn::Sub to be used for OutputKey in Fn::ForEach

[Minitour]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request

I have a set of lambdas, which all have a separate security group. I want to create an ingress for each lambda to join a set of VPC Endpoint security groups. To me, this seemed like a perfect case of two for loops:

ForEach VPC Endpoint Security Group:
     ForEach Lambda Security Group:
          Create an Ingress

And so went on to implement it:

Resources:
  'Fn::ForEach::VpcEndpoints':
    - 'VpcEndpointId'
    - !Ref VpcEndpointIds
    - 'Fn::ForEach::LambdaSecurityGroups':
        - 'LambdaSG'
        - !Ref LambdaSgs
        - 'EndpointIngress${VpcEndpointId}${LambdaSgs}'
            Type: 'AWS::EC2::SecurityGroupIngress'
            Properties:
              GroupId: !Ref VpcEndpointId
              IpProtocol: tcp
              FromPort: 443
              ToPort: 443
              SourceSecurityGroupId: !Ref LambdaSG

(Assume the security groups are defined outside of this stack)

I quickly encountered the following error:

Transform AWS::LanguageExtensions failed with: OutputKey 'EndpointIngresssg-0fbdec85********sg-09ad258580******' should be alphanumeric. Rollback requested by user.

Makes sense - since the security group id follows the following pattern: sg-123abc.
So I thought to myself - Okay I will get rid of the sg- part.

Resources:

  'Fn::ForEach::VpcEndpoints':
    - 'VpcEndpointId'
    - !Ref VpcEndpointIds
    - 'Fn::ForEach::LambdaSecurityGroups':
        - 'LambdaSG'
        - !Ref LambdaSgs
        - Fn::Sub:
            - 'EndpointIngress${Var1}${Var2}'
            - Var1: !Select [ 1, !Split [ "-", !Ref VpcEndpointId ] ]
              Var2: !Select [ 1, !Split [ "-", !Ref LambdaSG ] ]
            Type: 'AWS::EC2::SecurityGroupIngress'
            Properties:
              GroupId: !Ref VpcEndpointId
              IpProtocol: tcp
              FromPort: 443
              ToPort: 443
              SourceSecurityGroupId: !Ref LambdaSG

This part however did not work, and I got the following error:

Transform AWS::LanguageExtensions failed with: Fn::Sub layout is incorrect. Rollback requested by user.

At this point, I gave up and decided to open this issue to get some help.

This request does not seem to be exceptional as many outputs of AWS resources contain non-alphanumeric characters, and it seems the most logical to allow the use of intrinsic functions to transform the OutputKey.

Tell us about the problem you are trying to solve. What are you trying to do, and why is it hard?

I am trying to reduce the amount of boilerplate in my template by making use of for-loops.

Are you currently working around this issue?

Defining each resource separately without using ForEach.

What is the expected behavior with this new feature

To simply allow the use of intrinsic functions when declaring the value of the OutputKey.

[ashleigh-gray]

Similar situation here, I'm trying to create multiple subscriptions to an SNS topic, driven by a comma separated list parameter giving all the email addresses to subscribe.

  'Fn::ForEach::Subscriptions':
    - Email
    - !Ref EmailAddresses
    - 'Subscription${Email}':
        Type: 'AWS::SNS::Subscription'
        Properties:
          Endpoint: !Ref Email
          Protocol: email
          TopicArn: !Ref SNSTopic

But of course, my list of email addresses contain characters such as @ and -, which break the alphanumeric condition on the OutputKey. I'd love to be able to use a !Sub or something to modify the value.