Cloudformation Template format error: Every DeletionPolicy member must be a string

Question

Hi I am trying to use the "IF" Function just like mentioned in cloud formation documentation for RDS DeletionPolicy, but for some reason it says that my function does not return a string.

AWS Documentation on conditional statements

here is the condition:

 "DeletionPolicy" : {     "Fn::If" : [       "CreateProdResources",       "Snapshot",       "Delete"     ]} 

And the error is the one in the title:

Template validation error: Template format error: Every DeletionPolicy member must be a string. 

Other attempts that didn't work:

With a map:

 "RdsDeletionPolicyMap" :{       "production" : {           "policy" : "Snapshot"       },       "staging" : {           "policy" : "Delete"       }    } 

And then:

   "DeletionPolicy" : {       "Fn::FindInMap" : [ "RdsDeletionPolicyMap", {"Ref": "RailsEnvironment"}, "policy" ]    } 

As well as a Simple "Ref": ... didn't work as well. I highly suspect this is a bug with cloudformation

Answer 1

The issue is that DeletionPolicy must be set to one of three strings. And, though your If check will return one of them, from a systematic perspective, it only knows that it's returning a String - but is not guaranteed to be a valid string (same with your map and parameter checks), and thus it only accepts a string literal and not something that resolves to string.

I believe that this limitation has been raised to the AWS Engineering team previously, as it is a nuisance.

Answer 2

According to intrensic-function-referece https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference.html

You can use intrinsic functions only in specific parts of a template. Currently, you can use intrinsic functions in resource properties, outputs, metadata attributes, and update policy attributes. You can also use intrinsic functions to conditionally create stack resources.

So you cannot use them for the DeletionPolicy

However, one workaround for this is Cloudformation conditionals: https://www.unixdaemon.net/cloud/intro-to-cloudformations-conditionals/

You can add two resources with the condition and each having snapshot and delete in each resource.