Deploy individual function, role arn normalisation fails on imported role ARN

[TimTimT]

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest v3 release?

• Yes, I'm using the latest v3 release

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

Ever since I have used serverless framework (a couple of years, since early v2 versions), deploying individual functions did not work for me. The same error always occurs, for all my stacks, even though full stack deployments of the exact same configuration are not a problem.
Concretely, on deploying an individual function, the following message appears: Cannot read properties of undefined (reading '0')

It appears that "deploy-function.js" "normalizeArnRole" accepts a role, and attempts to extract the arn of the role. It does so based on this line:

    const data = await this.provider.request('IAM', 'getRole', {
      RoleName: role['Fn::GetAtt'][0],
    });

However, when I log the input received for my function, it is: { 'Fn::ImportValue': 'myRoleArnReference' }
If I hardcode the ARN into the configuration instead of using the !ImportValue statement, the deployment works fine.

Any help is very much appreciated.

Service configuration (serverless.yml) content

frameworkVersion: "3"
configValidationMode: error

projectDir: ../

provider:
  versionFunctions: false
  name: aws
  endpointType: REGIONAL
  runtime: python3.11
  stage: ${opt:stage}  
  region: ${opt:region, 'my_region'}
  timeout: 10
  memorySize: 500
  logRetentionInDays: ${file(../a_file.yml):env.${opt:stage}.logRetentionInDays}
  environment: ${file(../a_file.yml):env.${opt:stage}}


functions:
  my_function: ${file(./function_file.yml):my_function} 



function_file.yml:

my_function:
  name: my_name
  handler: my_handler
  timeout: 10
  memorySize: 512
  vpc: ${file(../a_file.yml):##}
  layers:
    - ${file(../a_file.yml):##}
    - ${file(../a_file.yml):##}
  role: !ImportValue myRoleArnReference
  events:
    - http:
        path: ${file(../a_file.yml):version}/path
        method: get
        cors: true
        private: false
        authorizer: ${file(../a_file.yml):authorizer-${opt:stage}}

Command name and used flags

sls deploy function --stage dev -f my_function

Command output

(.venv) [ec2-user@ip-10-0-2-64 STACK]$ sls deploy function --stage dev -f my_function
Running "serverless" from node_modules

Deploying function my_function to stage dev (eu-central-1)

✔ Function code deployed (7s)
Environment: linux, node 17.6.0, framework 3.34.0 (local) 3.34.0v (global), plugin 6.2.3, SDK 4.3.2
Credentials: Local, "default" profile
Docs:        docs.serverless.com
Support:     forum.serverless.com
Bugs:        github.com/serverless/serverless/issues

Error:
TypeError: Cannot read properties of undefined (reading '0')
    at AwsDeployFunction.normalizeArnRole (/home/ec2-user/corp-mob/node_modules/serverless/lib/plugins/aws/deploy-function.js:146:35)
    at AwsDeployFunction.updateFunctionConfiguration (/home/ec2-user/corp-mob/node_modules/serverless/lib/plugins/aws/deploy-function.js:413:32)
    at deploy:function:deploy (/home/ec2-user/corp-mob/node_modules/serverless/lib/plugins/aws/deploy-function.js:60:20)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async PluginManager.runHooks (/home/ec2-user/corp-mob/node_modules/serverless/lib/classes/plugin-manager.js:530:9)
    at async PluginManager.invoke (/home/ec2-user/corp-mob/node_modules/serverless/lib/classes/plugin-manager.js:564:9)
    at async PluginManager.run (/home/ec2-user/corp-mob/node_modules/serverless/lib/classes/plugin-manager.js:604:7)
    at async Serverless.run (/home/ec2-user/corp-mob/node_modules/serverless/lib/serverless.js:179:5)
    at async /home/ec2-user/corp-mob/node_modules/serverless/scripts/serverless.js:834:9

1 deprecation found: run 'serverless doctor' for more details

Environment information

Framework Core: 3.34.0 (local) 3.34.0 (global)
Plugin: 6.2.3
SDK: 4.3.2

[TimTimT]

I found this related issue: #12238

[TimTimT]

A local fix for me is to edit the "deploy_function.js" as folllows:

Add resolve import value function:
const resolveCfImportValue = require('./utils/resolve-cf-import-value');

On line 419 of the same file:

if (executionRole) {
      if (executionRole?.['Fn::ImportValue'] != null) { 
        params.Role = await resolveCfImportValue(this.provider, executionRole['Fn::ImportValue'])
      } else {
        params.Role = await this.normalizeArnRole(executionRole);
      }
    }