Getting the following error: "Unresolved resource dependencies [GeneralPurposeContainerRole] in the Resources block of the template"

Upon testing my cloudformation template, I was receiving the following error:

An error occurred (ValidationError) when calling the ValidateTemplate operation: Template format error: Unresolved resource dependencies [GeneralPurposeContainerRole] in the Resources block of the template

I don’t understand what specifically this error is pointing to. Below is the part of the template that appears to be the source of the error:

Resources:
  GeneralPurposeContainerRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
            - sts:AssumeRole
      Path: '/'
      Policies:
        - PolicyName: ContainerS3Access
          PolicyDocument:
            Statement:
            - Effect: Allow
              Action:
              - s3:PutObject
              - s3:GetObject
              - s3:DeleteObject
              - s3:List*
              Resource:
                # TODO: Make these non psychcore-specific
              - arn:aws:s3:::pipeline-validation/*
              - arn:aws:s3:::wgs-pipeline-vqsr-test/*
              - arn:aws:s3:::test-references/*
              - arn:aws:s3:::psychcore-pipelines/output/*
              - arn:aws:s3:::psychcore-pipelines/validation/samples/*
              - arn:aws:s3:::psychcore-data/reference_indexs/*
              - arn:aws:s3:::psychcore-pipelines
              - arn:aws:s3:::psychcore-pipelines
              - arn:aws:s3:::psychcore-data
              - arn:aws:s3:::*
            - Effect: Allow
              Action:
              - s3:List*
              - s3:ListMultipartUploadParts
              - s3:AbortMultipartUpload
              - s3:ListBucketMultipartUploads
              Resource:
              - arn:aws:s3:::pipeline-validation
              - arn:aws:s3:::wgs-pipeline-vqsr-test
              - arn:aws:s3:::test-references
              - arn:aws:s3:::psychcore-pipelines/output/
              - arn:aws:s3:::psychcore-pipelines/validation/samples/
              - arn:aws:s3:::psychcore-data/reference_indexs/
              - arn:aws:s3:::psychcore-pipelines
              - arn:aws:s3:::psychcore-pipelines
              - arn:aws:s3:::psychcore-data
              - arn:aws:s3:::*

[svdgraaf]

I’m not an expert on these nested stacks, but isn’t it so, that the nested stacks only can use resources from their parents and not vice versa?

@claudiadast @HyperBrain This is not entirely correct. While you cannot reference the resources directly, you can reference the outputs from the substack. You will need to output the values that you need in the substack, and you can them reference in the main stack as a property of your substack (eg: mySubStack.myOutputtedValue. See the docs here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html

This is also how you can pass on references from substacks into other substacks within your main template, passing the outputs as parameters in the target substacks. Be aware that you can easily create circular references though 😄 Cloudformation will usually be very good in figuring out the order in which to create things.

I think this is also the problem here, but it’s hard to determine based on just this snippet. Double check that there is no reference to the resource in the main stack. If there is, you need to pass back the Arn of the role as an output in the substack. You can then reference that Arn where you need it in the main stack.

[pmuens]

Closing this issue since it’s quite stale. Please refer to the Serverless Forums or Gitter where issues like this can be discussed with our broad developer community.