Codepipeline cloudformation template issue for Provider: Commands

Question

I am trying to create codepipeline with cloudformation template. However stage action created has invalid subnets and security group. It includes characters `[ ` and `]` in it. If I generate Output for BuildSecurityGroup, it gives correct results without brackets included in string.. Please suggest something.
```
            - Name: push-tag
              ActionTypeId:
                Category: Compute
                Owner: AWS
                Provider: Commands
                Version: '1'
              Commands:
                - git tag release ${CODEBUILD_RESOLVED_SOURCE_VERSION}
                - git push --force origin --tags
              Configuration:
                VpcId: !GetAtt BuildVpc.VpcId
                Subnets: !GetAtt BuildVpc.Subnets
                SecurityGroupIds: !Ref BuildSecurityGroup
              InputArtifacts:
                - Name: sources
              RunOrder: 1
```

re:Post Agent · Answer

The issue you're experiencing with your CodePipeline CloudFormation template is likely due to how the Subnets and SecurityGroupIds are being referenced. When using the Commands provider in CodePipeline, these values need to be provided as comma-separated strings, not as lists.

To resolve this, you can modify your template to use the Join function to convert the list outputs into comma-separated strings. Here's how you can adjust your template:

```yaml
- Name: push-tag
  ActionTypeId:
    Category: Compute
    Owner: AWS
    Provider: Commands
    Version: '1'
  Commands:
    - git tag release ${CODEBUILD_RESOLVED_SOURCE_VERSION}
    - git push --force origin --tags
  Configuration:
    VpcId: !GetAtt BuildVpc.VpcId
    Subnets: !Join [',', !GetAtt BuildVpc.Subnets]
    SecurityGroupIds: !Join [',', !Ref BuildSecurityGroup]
  InputArtifacts:
    - Name: sources
  RunOrder: 1
```

In this modified version, we're using the !Join function to concatenate the subnet IDs and security group IDs into comma-separated strings. This should resolve the issue with invalid subnets and security groups in your CodePipeline action.

Remember that when using the Commands provider, you need to ensure that your pipeline's service role has the necessary permissions to execute these commands and access the specified VPC resources.  
**Sources**  
[Commands action reference - AWS CodePipeline](https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-Commands.html)  
[AWS::CodePipeline::Pipeline ActionDeclaration - AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-codepipeline-pipeline-actiondeclaration.html)

Codepipeline cloudformation template issue for Provider: Commands

Relevant content