AWS Lambda: Support Fn::Split in `vpc.securityGroupIds` and `vpc.subnetIds` configurations

sls produces correct CloudFormation, but issues a configuration warning. This has been discussed and fixed in issue #8282 but I guess Split function slipped the radar.

serverless.yml

service: hello-world
frameworkVersion: '2'

provider:
  name: aws
  runtime: nodejs12.x
  vpc:
    subnetIds: !Split
      - ','
      - "sn1,sn2"
    securityGroupIds: !Split
      - ','
      - "sg1,sg2"

functions:
  hello:
    handler: handler.hello

output

✔ ~/src/testing/serverless-fw/hello-world ➭ sls package
Serverless: Configuration warning:
Serverless:   at 'provider.vpc.securityGroupIds': should be array
Serverless:   at 'provider.vpc.subnetIds': should be array
Serverless:
Serverless: Learn more about configuration validation here: http://slss.io/configuration-validation
Serverless:
Serverless: Packaging service...
Serverless: Excluding development dependencies...

Installed version

Framework Core: 2.11.1 (local)
Plugin: 4.1.2
SDK: 2.3.2
Components: 3.3.0

[takeda]

@vmj this is just a nitpick, because I seen this everywhere, you wrote:

    subnetIds:
      Fn::Split: [',', "sn1,sn2"]
    securityGroupIds:
      Fn::Split:
        - ','
        - "sg1,sg2"

it’s probably better to write it like this:

    subnetIds: {"Fn::Split": [",", "sn1,sn2"]}
    securityGroupIds: {"Fn::Split": [",", "sg1,sg2"]}

I doubt this will solve the original issue (I think it will require serverless code change), but it makes easier to read when the long form is used.

@medikoo to answer your question here’s what I’m doing in my configuration:

    vpc:
      subnetIds: !Split [",", !ImportValue PrivateSubnets]
      securityGroupIds:
      - !ImportValue DefaultSecurityGroup

Ideally I think all functions should be supported. I also think this will be a problem for validation. For example if I use !Ref it typically is a string, but I believe it could also be an array if I would use a parameter of an array type (it doesn’t look to me like it makes sense to use parameters, but maybe there actually is a use case where it would be beneficial)

[medikoo]

@younghoonk17 in terms of Fn::GetAtt, it is supported, but on item level not array level, so following will work:

vpc:
  subnetIds: 
    - "Fn::GetAtt":
      - CustomResourcesLookup
      - ResourceId