title: AWS Cloud Formation !Sub & !Ref functions inside AWS::Serverless::Function Policies
body: <p>I have been using the !Sub function in my CloudFormation Yaml templates just fine. And when used it as an object property value it works for me</p>
  
  <pre><code>Object:
    Property1: !Sub some-value-with-a-${variable}-in-it
  </code></pre>
  
  <p>The value of variable gets replaced as expected.</p>
  
  <p>However, I can't figure out how to use the !Sub function in an element of a string array</p>
  
  <pre><code>Array:
    - !Sub some-value-with-a-${variable}-in-it
  </code></pre>
  
  <p>That array element just gets ignored.</p>
  
  <p>I am trying this in the context of a SAM template creating a AWS::Serverless::Function type resource. The Policies property can take an array of strings:</p>
  
  <pre><code>lambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: api
      FunctionName: !Sub api-${MyStageName}
      Handler: Lambda:Api.Function::HandleAsync
      Runtime: dotnetcore1.0
      Policies: 
      - AWSLambdaBasicExecutionRole
      - !Sub arn:aws:iam::${AWS::AccountId}:policy/some-policy
      - arn:aws:iam::123456789:policy/another-policy
  </code></pre>
  
  <p>The !Sub function works in the <code>FunctionName</code> property in this example. But I only end up with 2 Policies attached to my generated role - <code>AWSLambdaBasicExecutionRole</code> and <code>arn:aws:iam::123456789:policy/another-policy</code>. The one including the <code>!Sub</code> function gets ignored.</p>
  
  <p>I have tried options like putting the function on a new line:</p>
  
  <pre><code>Array:
    - 
      !Sub some value with a ${variable} in it
  </code></pre>
  
  <p>Can anyone help?</p>
  
  <h1>Update</h1>
  
  <p>@Tom Melo pointed out that this is not a array problem so I have adjusted my question.</p>
  
  <p>Further investigation has revealed it is not a Cloud Formation issue exactly, but very specific to the <code>AWS::Serverless::Function</code> resource type, and the <code>Policies</code> property within in. I suspect it has something to do with the fact that the <code>Policies</code> property is so flexible in what it can accept. It can accept strings referring to policy names or Arns, and it can also accept policy documents describing new policy. I suspect this means it is not able to support the functions.</p>