Bug: sam deploy - collisions between parameter name and logical IDs for CommaDelimitedLists

[RitikaLaddha5]

Description:

Command used:

sam deploy \
    --guided \
    --template-file template/template.yml \
    --capabilities CAPABILITY_AUTO_EXPAND CAPABILITY_IAM

Observed result:

Read timed out. (read timeout=0.1)

Error: unhashable type: 'list'
Traceback:
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\click\core.py", line 1082, in main
rv = self.invoke(ctx)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\click\core.py", line 1697, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\click\core.py", line 1443, in invoke
return ctx.invoke(self.callback, **ctx.params)
~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\click\core.py", line 788, in invoke
return __callback(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\cli\cli_config_file.py", line 366, in wrapper
return func(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\cli_validation\image_repository_validation.
py", line 111, in wrapped
return func(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\click\decorators.py", line 92, in new_func
return ctx.invoke(f, obj, *args, **kwargs)
~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\click\core.py", line 788, in invoke
return __callback(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\telemetry\metric.py", line 190, in wrapped
raise exception # pylint: disable=raising-bad-type
^^^^^^^^^^^^^^^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\telemetry\metric.py", line 155, in wrapped
return_value = func(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\utils\version_checker.py", line 43, in wrap
ped
actual_result = func(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\cli\main.py", line 95, in wrapper
return func(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\commands_utils\cdk_support_decorators.py", lin
e 40, in wrapped
return func(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\commands_utils\command_exception_handler.py",
line 89, in wrapper_command_exception_handler
raise ex
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\commands_utils\command_exception_handler.py",
line 69, in wrapper_command_exception_handler
return func(*args, **kwargs)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\commands\deploy\command.py", line 208, in cli
do_cli(
~~~~~~^
template_file,
^^^^^^^^^^^^^^
...<28 lines>...
max_wait_duration,
^^^^^^^^^^^^^^^^^^
) # pragma: no cover
^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\commands\deploy\command.py", line 304, in do_cl
i
guided_context.run()
~~~~~~~~~~~~~~~~~~^^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\commands\deploy\guided_context.py", line 572, i
n run
self.guided_prompts(_parameter_override_keys)
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\commands\deploy\guided_context.py", line 140, i
n guided_prompts
stacks, _ = SamLocalStackProvider.get_stacks(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
self.template_file,
^^^^^^^^^^^^^^^^^^^
parameter_overrides=sanitize_parameter_overrides(input_parameter_overrides),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
global_parameter_overrides=global_parameter_overrides,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\providers\sam_stack_provider.py", line 281,
in get_stacks
stacks_in_child, remote_stack_full_paths_in_child = SamLocalStackProvider.get_stacks(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
child_stack.location,
^^^^^^^^^^^^^^^^^^^^^
...<5 lines>...
use_sam_transform=use_sam_transform,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\providers\sam_stack_provider.py", line 270,
in get_stacks
current = SamLocalStackProvider(
template_file,
...<4 lines>...
use_sam_transform=use_sam_transform,
)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\providers\sam_stack_provider.py", line 62,
in init
self._template_dict = self.get_template(
~~~~~~~~~~~~~~~~~^
template_dict,
^^^^^^^^^^^^^^
SamLocalStackProvider.merge_parameter_overrides(parameter_overrides, global_parameter_overrides),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
use_sam_transform=use_sam_transform,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\providers\sam_base_provider.py", line 200,
in get_template
template_dict = resolver.resolve_template(ignore_errors=True)
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\intrinsic_resolver\intrinsic_property_resol
ver.py", line 253, in resolve_template
processed_template["Outputs"] = self.resolve_attribute(self._outputs, ignore_errors)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Program Files\Amazon\AWSSAMCLI\runtime\Lib\site-packages\samcli\lib\intrinsic_resolver\intrinsic_property_resol
ver.py", line 277, in resolve_attribute
processed_dict[processed_key] = processed_resource
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^

An unexpected error was encountered while executing "sam deploy".
Search for an existing issue:
https://github.com/aws/aws-sam-cli/issues?q=is%3Aissue+is%3Aopen+Bug%3A%20sam%20deploy%20-%20TypeError
Or create a bug report:
https://github.com/aws/aws-sam-cli/issues/new?template=Bug_report.md&title=Bug%3A%20sam%20deploy%20-%20TypeError
2026-02-05 01:09:40,197 | HTTPSConnectionPool(host='aws-serverless-tools-telemetry.us-west-2.amazonaws.com', port=443):
Read timed out. (read timeout=0.1)

Expected result:

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: Windows
2. sam --version: 1.153.1
3. AWS region: Sydney

# Paste the output of `sam --info` here

Add --debug flag to command you are running

[reedham-aws]

Thank you for raising this issue. Could you provide an example of the template that gives you this issue? That would help to determine what is causing the malformed structure.

[reedham-aws]

I think this might also be a similar issue to what we saw in #8499, although I haven't investigated too deeply.

[RitikaLaddha5]

Thank you for raising this issue. Could you provide an example of the template that gives you this issue? That would help to determine what is causing the malformed structure.

Here is the example template.yml

AWSTemplateFormatVersion: 2010-09-09
Description: Buildkite On-Demand 

Transform: AWS::Serverless-2016-10-31

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: Buildkite
        Parameters:
          - BuildkiteQueue
          - BuildkiteClusterName
          - DeployAgentVersion
      -
        Label:
          default: AWS
        Parameters:
          - VpcSubnetIds
    ParameterLabels:
      VpcSubnetIds:
        default: "(Optional) Which VPC subnets should agent containers run in?"

Parameters:
  SharedAccountId:
    Type: String
    Description: The AWS Account ID of the SHARED ACCOUNT that hosts the central event bus
    AllowedPattern: ^\d{12}$
    Default: '123456789012'
  BuildkiteQueue:
    Type: String
    Description: Queue name that agents will be scheduled for on-demand, targeted in pipeline steps using an agent query rule "queue={value}".
    AllowedPattern: ^[a-zA-Z0-9\-_]{1,255}
  BuildkiteClusterName:
    Type: String
    Description: The Buildkite cluster that this queue belongs to
    AllowedPattern: ^[a-z-]+$
  VpcSubnetIds:
    Type: CommaDelimitedList
    Default: ''
    Description: Comma separated list of VPC subnets to launch agent containers in. If left blank a simple VPC with public subnets, suitable for most use cases, will be created.
  Environment:
    Type: String
    Description: Deployment environment type for this agent
    AllowedValues:
      - dev
      - uat
      - prod
    Default: dev
  CreateArtifactsBucket:
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "true"
  SharedArtifactsBucket:
    Type: String
    Description: The centralised Buildkite artifacts bucket in services-shared
    Default: buildkite-artifacts-region-123456789012
  DeployAgentVersion:
    Type: String
    Description: The container version to use for the deploy agent

Conditions:
  IsTestEnvironment: !Or
    - !Equals [ !Ref Environment, "dev" ]
    - !Equals [ !Ref Environment, "uat" ]

  CreateArtifactsResource:
    !Equals [true, !Ref CreateArtifactsBucket]

Resources:
  ArtifactoryBucket:
    Type: AWS::S3::Bucket
    Condition: CreateArtifactsResource
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Sub "artifactory-${AWS::Region}-${AWS::AccountId}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      Tags:
        - Key: StackName
          Value: !Sub ${AWS::StackName}
        - Key: governance:department
          Value: IT Services
        - Key: governance:environment
          Value: !Ref Environment
        - Key: governance:provisioner
          Value: Cloudformation

  ArtifactsBucketParameter:
    Type: AWS::SSM::Parameter
    Condition: CreateArtifactsResource
    Properties:
      Name: !Sub /${AWS::StackName}/S3/ArtifactsBucket
      Type: String
      Value: !Ref ArtifactoryBucket
      Description: "Name of the Artifacts S3 bucket"

  Macro:
    Type: AWS::Serverless::Application
    Properties:
      Location: ../agent-composer/transform/template.yaml

  Agents:
    Type: AWS::CloudFormation::Stack
    DependsOn: Macro
    Properties:
      TemplateURL: agents.yml
      Parameters:
        ExecutionRolePrefix: !Sub /${AWS::StackName}/BuildkiteExecutionRole/
        TaskRolePrefix: !Sub /${AWS::StackName}/BuildkiteTaskRole/
        Environment: !Ref Environment
        SharedAccountId: !Ref SharedAccountId
        BuildkiteClusterName: !Ref BuildkiteClusterName
        SharedArtifactsBucket: !Ref SharedArtifactsBucket
        DeployAgentVersion: !Ref DeployAgentVersion
        BuildkiteQueue: !Ref BuildkiteQueue

  Cluster:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: cluster.yml
      Parameters:
        VpcSubnetIds: !Join [ ',', !Ref VpcSubnetIds ]

  BuildkiteECSFargateSubnetIDs:
    Type: AWS::SSM::Parameter
    Condition: IsTestEnvironment
    Properties:
      Name: /buildkite/FargateSubnetIDs
      Description: Buildkite ECS Fargate Subnet IDs
      Type: String
      Value: !Select [ 0, !Split [',', !GetAtt Cluster.Outputs.VpcSubnetIds] ]

  BuildkiteECSFargateSecurityGroupIDs:
    Type: AWS::SSM::Parameter
    Condition: IsTestEnvironment
    Properties:
      Name: /buildkite/FargateSecurityGroupIDs
      Description: Buildkite Fargate security group IDs
      Type: String
      Value: !GetAtt Cluster.Outputs.EcsHostSecurityGroup

  BuildkiteECSFargateClusterName:
    Type: AWS::SSM::Parameter
    Condition: IsTestEnvironment
    Properties:
      Name: /buildkite/BuildkiteECSFargateClusterName
      Description: Buildkite ECS Fargate Cluster Name
      Type: String
      Value: !GetAtt Cluster.Outputs.EcsClusterName

  Scheduler:
    Type: AWS::Serverless::Application
    Properties:
      Location: ../agent-scheduler/template.yml
      Parameters:
        BuildkiteClusterName: !Ref BuildkiteClusterName
        BuildkiteQueue: !Ref BuildkiteQueue
        SharedAccountId: !Ref SharedAccountId
        VpcSubnetIds: !GetAtt Cluster.Outputs.VpcSubnetIds
        EcsClusterName: !GetAtt Cluster.Outputs.EcsClusterName
        EcsLaunchType: !GetAtt Cluster.Outputs.EcsLaunchType
        ExecutionRolePrefix: !Sub /${AWS::StackName}/BuildkiteExecutionRole/
        TaskRolePrefix: !Sub /${AWS::StackName}/BuildkiteTaskRole/

Outputs:
  StackName:
    Description: Stack Name
    Value: !Ref AWS::StackName

[reedham-aws]

I think the issue is coming from your nested stack Cluster. What's happening is that we are trying to resolve the attributes of the Outputs section of the template. I see that you have VpcSubnetIds as an output of that template, and also as a parameter with type CommaSeparatedList.

In the resolve_attribute() function where the error is occuring, we're getting processed_key from a function called get_translation(), which returns a list when there's a CommaSeparatedList:

aws-sam-cli/samcli/lib/intrinsic_resolver/intrinsics_symbol_table.py

Lines 345 to 347 in e0bf888

	# If the reference is a comma-delimited list represented as a string,
	# return the reference as a list of items instead
	return [item.strip() for item in logical_id_item.split(",")]

I believe that is what is ultimately causing the issue; the fact that the Parameter and Output have the same name is colliding in the resolution. The output name gets resolved incorrectly as the parameter, which causes it to break.

I think this is a bug in the SAM CLI code with how we're resolving things. At the very least, we could not use the value if it's a list, but I think we shouldn't be resolving the output name like this at all. For now, I think a workaround for you would be to change the output name so there's no collision (even though it should be valid). Could you try that and let me know if it works?

[reedham-aws]

Also, for reference, I was able to reproduce with

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Parameters:
  AppName:
    Type: CommaDelimitedList
    Default: "hello, world"

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: python3.12
      Handler: index.handler
      InlineCode: |
        def handler(event, context):
            return "hi"

Outputs:
  AppName:
    Value: !Ref AppName