CloudFormation特定账号取消Lambda VPC配置属性校验报错如何解决

错误原因 #

报错是两个配置错误共同导致的：

1. VpcConfig字段后多余的短横线把整个配置逻辑包装成了数组，而Lambda的VpcConfig属性要求接收对象类型，直接触发类型校验失败
2. Fn::If的语法格式和逻辑写反：你要求账号为123456780976时不配置VPC，原来的逻辑是符合账号条件时返回VPC配置，和需求相反，同时Fn::If的参数缩进错误，参数结构不符合要求

修复后的模板代码 #

AWSTemplateFormatVersion: '2010-09-09'
Description: VPC function.
Mappings:
  "129921924252":
    "ap-southeast-1":
      Subnets:
        - "vpc-PrivateSubnetId1"
        - "vpc-PrivateSubnetId2"
Conditions:
  CheckAccount: {"Fn::Equals": [ !Ref AWS::AccountId, "123456780976"]}
Resources:
  Function:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handler
      Role: arn:aws:iam::129921924252:role/service-role/ASG-Lambda-role-n27an6nj
      Code:
        ZipFile:
          Fn::Sub: |
            import json
            import boto3
            import os
            from botocore.exceptions import ClientError
      Runtime: nodejs12.x
      Timeout: 5
      TracingConfig:
        Mode: Active
      VpcConfig:
        Fn::If:
          - CheckAccount
          - !Ref AWS::NoValue
          - SecurityGroupIds:
              - sg-0305baf25b2dd4891
            SubnetIds:
              - Fn::ImportValue:
                  Fn::Select: [0, Fn::FindInMap : [!Ref AWS::AccountId, !Ref AWS::Region, Subnets]]
              - Fn::ImportValue:
                  Fn::Select: [1, Fn::FindInMap : [!Ref AWS::AccountId, !Ref AWS::Region, Subnets]]

关键修改点 #

• 去掉了VpcConfig后的短横线，确保返回值是对象类型而非数组
• 修正Fn::If的逻辑顺序：符合目标账号条件时返回AWS::NoValue跳过VPC配置，不符合时返回VPC配置对象
• 修正Fn::If的参数缩进，确保三个参数（条件名、成立返回值、不成立返回值）结构符合CloudFormation语法要求

内容的提问来源于stack exchange，提问作者Abhinaya