CF functions for fileSystemConfig missing in Typescript

[BrentFarese]

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest v3 release?

• Yes, I'm using the latest v3 release

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

fileSystemConfig.arn says it only supports string in TS, but #8265 implemented support for CF functions. We need to use CF functions to reference the arn of EFS created in the same stack.

Service configuration (serverless.yml) content

import type { Serverless } from 'serverless/aws';

import { serverlessEnv } from './src/services/config';

const isCI = serverlessEnv.ENV === 'ci';
const isDev = serverlessEnv.ENV === 'dev';
const isNoVPCNeeded = isDev || isCI;

const securityGroupIds = [serverlessEnv.LAMBDA_SECURITY_GROUP_ID];
const subnetIds = [serverlessEnv.AWS_SUBNET_PUBLIC_ID, serverlessEnv.AWS_SUBNET_PRIVATE_ID];

const serverlessConfiguration = {
  custom: {
    esbuild: {
      external: ['canvas'],
      minify: true,
      packager: 'yarn',
      treeShaking: true,
    },
    localstack: {
      debug: false,
      edgePort: 4566,
      host: 'http://localhost',
      lambda: {
        mountCode: false,
      },
      stages: ['local'],
    },
    sentry: {
      dsn: serverlessEnv.SENTRY_DSN_LAMBDA,
    },
  },
  frameworkVersion: '3',
  functions: {
    clearDocumentSignatures: {
      handler: 'src/functions/clearDocumentSignatures.clearDocumentSignatures',
      name: 'clearDocumentSignatures-${opt:stage}',
      timeout: 600,
    },
    createDocumentVersions: {
      events: [
        { sqs: { arn: { 'Fn::GetAtt': ['CreateDocumentVersionQueue', 'Arn'] }, batchSize: 10 } },
      ],
      handler: 'src/functions/createDocumentVersions.createDocumentVersions',
      name: 'createDocumentVersions-${opt:stage}',
      timeout: 600,
    },
    extractFileJSON: {
      dependsOn: ['FileSystem'],
      fileSystemConfig: {
        arn: { 'Fn::GetAtt': ['FileSystem', 'Arn'] } as any,
        localMountPath: '/mnt/tmp',
      },
      handler: 'src/functions/extractFileJSON.extractFileJSON',
      name: 'extractFileJSON-${opt:stage}',
      timeout: 600,
    },
    flushDocumentVersions: {
      handler: 'src/functions/flushDocumentVersions.flushDocumentVersions',
      name: 'flushDocumentVersions-${opt:stage}',
      timeout: 600,
    },
    scheduleCreateDocumentHistoryVersions: {
      environment: {
        // Seems like this injects CREATE_DOCUMENT_VERSION_QUEUE_URL onto process.env...
        CREATE_DOCUMENT_VERSION_QUEUE_URL: { Ref: 'CreateDocumentVersionQueue' },
      },
      events: [{ schedule: { rate: 'rate(1 minute)' } }],
      handler:
        'src/functions/scheduleCreateDocumentHistoryVersions.scheduleCreateDocumentHistoryVersions',
      name: 'scheduleCreateDocumentHistoryVersions-${opt:stage}',
      timeout: 600,
    },
    setDocumentState: {
      handler: 'src/functions/setDocumentState.setDocumentState',
      name: 'setDocumentState-${opt:stage}',
      timeout: 600,
    },
  },
  plugins: ['serverless-esbuild', 'serverless-localstack', 'serverless-sentry'],
  provider: {
    environment: serverlessEnv,
    name: 'aws',
    runtime: 'nodejs16.x',
    vpc: {
      securityGroupIds: isNoVPCNeeded ? [] : securityGroupIds,
      subnetIds: isNoVPCNeeded ? [] : subnetIds,
    },
  },
  resources: {
    Resources: {
      CreateDocumentVersionQueue: {
        Properties: { QueueName: 'create-document-version-${opt:stage}', VisibilityTimeout: 3600 },
        Type: 'AWS::SQS::Queue',
      },
      FileSystem: { Properties: {}, Type: 'AWS::EFS::FileSystem' },
      FileSystemAccessPoints: {
        DependsOn: 'FileSystemMountTarget',
        Properties: {
          FileSystemId: { Ref: 'FileSystem' },
          Path: '/',
          PosixUser: { Gid: '1000', Permissions: 777, Uid: '1000' },
          RootDirectory: { CreationInfo: { OwnerGid: '1000', OwnerUid: '1000', Permissions: 755 } },
        },
        Type: 'AWS::EFS::AccessPoint',
      },
      FileSystemMountTarget: {
        Properties: {
          FileSystemId: { Ref: 'FileSystem' },
          SecurityGroups: securityGroupIds,
          SubnetId: serverlessEnv.AWS_SUBNET_PUBLIC_ID,
        },
        Type: 'AWS::EFS::MountTarget',
      },
    },
  },
  service: 'collab-worker',
} satisfies Serverless;

Command name and used flags

serverless deploy

Command output

Error:
CREATE_FAILED: IamRoleLambdaExecution (AWS::IAM::Role)
An error occurred (MalformedPolicyDocument) when calling the PutRolePolicy operation: Resource FileSystem.arn must be in ARN format or "*".

Environment information

Environment: darwin, node 18.19.0, framework 3.33.0 (local), plugin 6.2.3, SDK 4.3.2
Credentials: Local, environment variables
Docs:        docs.serverless.com
Support:     forum.serverless.com
Bugs:        github.com/serverless/serverless/issues