AWS cloudformation error: Template validation error: Template error: resource NotificationsTopic does not support attribute type Arn in Fn::GetAtt

Question

I am trying to create an AWS cloudformation stack using a yaml template. The goal is to create a sns topic for some notifications. I want to output the topic arn, to be able to subscribe multiple functions to that topic by just specifying the topic arn.

However I am getting an error when I try to create the stack from the aws console:

"Template validation error: Template error: resource NotificationsTopic does not support attribute type Arn in Fn::GetAtt"

I have done exactly the same for s3 buckets, dynamodb tables, and all working good, but for some reason, with SNS topic I cannot get the ARN.

I want to avoid hardcoding the topic arn in all functions that are subscribed. Because if one day the the ARN topic changes, I'll need to change all functions, instead I want to import the topic arn in all functions and use it. This way I will have to modify nothing if for any reason I have a new arn topic in the future.

This is the template:

    Parameters:   stage:     Type: String     Default: dev     AllowedValues:       - dev       - int       - uat       - prod  Resources:    NotificationsTopic:         Type: AWS::SNS::Topic         Properties:           DisplayName: !Sub 'notifications-${stage}'           Subscription:             - SNS Subscription           TopicName: !Sub 'notifications-${stage}' Outputs:   NotificationsTopicArn:     Description: The notifications topic Arn.     Value: !GetAtt NotificationsTopic.Arn     Export:       Name: !Sub '${AWS::StackName}-NotificationsTopicArn'   NotificationsTopicName:     Description: Notifications topic name.     Value: !Sub 'notifications-${stage}'     Export:       Name: !Sub '${AWS::StackName}-NotificationsTopicName' 

Answer 1

Not all resources are the same. Always check the documentation for the particular resource. It has the "Return Values" section and you can easily verify that SNS topic has ARN as a Ref value, so you don't have to use GetAtt function

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sns-topic.html

Edit: Thanks for the comment which points out that not every resource provides its ARN. A notable example is the Autoscaling group. Sure, the key thing in my answer was "check the documentation for each resource", this is an example that not every resource has every attribute. Having said that, ARN missing for the ASG output is a really strange thing. It cannot be also constructed easily, because the ARN also contains GroupId which is a random hash. There is probably some effort to solve this at least for the use-case of ECS Capacity Providers https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap/issues/548 and https://github.com/aws/containers-roadmap/issues/631#issuecomment-648377011 but I think that is is an significant enough issue that it should be mentioned here.

Answer 2

For resources that don't directly return ARN, I found a workaround which consists of building the ARN myself.

For instance, to get the ARN of my codepipeline:

!Join [ ':', [ "arn:aws:codepipeline", !Ref AWS::Region, !Ref AWS::AccountId, !Ref StackDeletePipeline ] ]