"Enabled" field in "DeploymentPreference" for "AWS::Serverless::Function" is ignored if it is a Condition

[ksskarthik628]

I have a SAM template with Parameters, API, and Lambda, and I have three stacks with "Stage" parameter set as "dev-user1", "alpha", or "beta". Now, I am trying to update my lambda to support traffic shifting based on what stack it is as follows:

Conditions:
  IsBetaStage:
    Fn::Equals: [Ref: Stage, beta]
  IsServiceStage:
    Fn::Or: ["Fn::Equals": [Ref: Stage, alpha], Condition: IsBetaStage]
Resources:
  LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: "LambdaFunction"
      Handler: 'com.company.lambda.LambdaHandler::handleRequest'
      Runtime: java8
      Timeout: 30
      Tracing: Active
      AutoPublishAlias: live
      DeploymentPreference:
        Enabled: IsServiceStage
        Type:
          Fn::If: [IsBetaStage, Linear10PercentEvery10Minutes, AllAtOnce]
        Alarms:
          - { Ref: IncreasedFaults }
          - { Ref: IncreasedLatency }

According to the template, "Enabled" should result to false in stack with "Stage" parameter set to "dev-user1" and true in every other stack, and hence there should be no traffic shifting in this stack. But I am observing the opposite of this, i.e, I am seeing traffic shifting in the stack with "Stage" parameter set to "dev-user1"

[ksskarthik628]

I even tried this and it still didn't work:

Parameters:
  DevStage:
    Type: String
    Default: dev-user1
Conditions:
  IsBetaStage:
    Fn::Equals: [Ref: Stage, beta]
  IsServiceStage:
    Fn::Or: ["Fn::Equals": [Ref: Stage, alpha], Condition: IsBetaStage]
  IsNotDevStage:
    Fn::Not: ["Fn::Equals": [Ref: DevStage, dev-user1]]
Resources:
  LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: "LambdaFunction"
      Handler: 'com.company.lambda.LambdaHandler::handleRequest'
      Runtime: java8
      Timeout: 30
      Tracing: Active
      AutoPublishAlias: live
      DeploymentPreference:
        Enabled: IsNotDevStage
        Type:
          Fn::If: [IsBetaStage, Linear10PercentEvery10Minutes, AllAtOnce]
        Alarms:
          - { Ref: IncreasedFaults }
          - { Ref: IncreasedLatency }

[digioak-zz]

@ksskarthik628 Sorry about the confusion. The value of the "Enabled" property currently must be a boolean and cannot be an intrinsic function that returns a boolean. This is because at the stage where the SAM transformation happens, it cannot evaluate the return value of the intrinsic function and the 'Enabled' flag determines whether resources are added to the template or not. We will make this more clear in our documentation.

[ksskarthik628]

@digioak is there any recommended approach for my use case? Can this be raised as a feature request?

[brettstack]

For now you could pass in a parameter which has a default value of empty string '' which will evaluate as false, and pass in a value (e.g 'True') when you want it enabled. Then Enabled: !Ref IsDeploymentPreferenceEnabled

[jamesandersen]

I've just encountered a very similar issue where I'm trying to use Fn::If to pass two distinct lists of rollback alarms. Instead of evaluating the Fn::If function as expected I end up with this:

Oddly, I have a Fn::If for DeploymentPreference.Type just like @ksskarthik628 's example above and that does work.

We either need to support intrinsic functions consistently or at least document clearly where they can and can't be used. I'm still experimenting for a workaround to this particular roadblock.

[BasmaBoulekhras-zz]

@ksskarthik628 Did you find out a solution to your use case at the end?

I have kind of the same problem, I want to control the deploymentPreference based on the branch.

Please give a feedback,

Thanks,

[keetonian]

I took a look into the Alarm error.

I replicated the reported issue by using an Fn::If intrinsic in the Alarms section of my template:

...
        Alarms:
          Fn::If:
            - IsBetaStage:
            - - { Ref: IncreasedFaults }
              - { Ref: IncreasedLatency }
            - - { Ref: IncreasedFaults2 }
              - { Ref: IncreasedLatency2 }
...

This resulted in the following JSON definition:

        "AlarmConfiguration": {
          "Alarms": [
            {
              "Name": "Fn::If"
            }
          ], 
          "Enabled": true
        }, 

It looks like SAM is trying to provide shorthand syntax for supporting alarms; when SAM transforms this section, it needs to transform the alarms to be Name: <alarm-name>.

SAM does this transformation here: https://github.com/awslabs/serverless-application-model/blob/master/samtranslator/model/preferences/deployment_preference_collection.py#L104

A possible fix might be to explicitly add support for Fn::If for this property. If Fn::If is encountered here, we need to do the Name: <alarm-name> transformation on all items inside of the conditional. This would also need to be aware of other values common to Fn::If, like AWS::NoValue.

[keetonian]

Released!

[vibhav3008]

I am still facing the issue on Enabled. Having an Fn::If condition on that property is not having any difference and my deployment preferences are applied regardless.

Hardcoding it to either true or false works.