Cloudformation RDS template cannot resolve security group id - mysql

Question

I have a CF that deploys a MySql database and some resources to AWS. I want the script to be general and should be able to use it for different environments. For one of those resources (master db), I have a different security group configuration which is environment-specific. I create security groups for each environment conditional and are called VaultSecurityGroupInEnv1, VaultSecurityGroupInEnv2, etc. There is map that saves names of security groups for each environment. here are my configurations:
Mappings:
RegionMap:
environment1:
VaultSG: VaultSecurityGroupInEnv1
environment2:
VaultSG: VaultSecurityGroupInEnv2
Resources:
VaultSecurityGroupInEnv1:
Condition: IsEnv1Environment
VaultSecurityGroupInEnv2:
Condition: IsEnv2Environment
MasterDB:
Type: AWS::RDS::DBInstance
Properties:
VPCSecurityGroups:
- !ImportValue DbSgId
- !Sub
- '${vGroup}'
- vGroup: !FindInMap
- RegionMap
- !Ref Environment
- VaultSG
for which I get the following error:
Invalid security group , groupId= vaultsecuritygroupinF.groupid, groupName=. (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterValue;
The output from !Sub is retrieved and resolved as a name string, not as a resource. Using !Ref vaultsecuritygroupinF.GroupId works fine. any idea how to use map and sub correctly?
Thanks

Answer 1

You can't use FindInMap the way you are trying. It will just resolve to the literal strings VaultSecurityGroupInEnv1 or VaultSecurityGroupInEnv2. It will not resolve to the actual resources of the same name.
Instead, I think the following should be possible:
MasterDB:
Type: AWS::RDS::DBInstance
Properties:
VPCSecurityGroups:
- !ImportValue DbSgId
- !If
- IsEnv1Environment
- !Ref VaultSecurityGroupInEnv1
- !Ref "AWS::NoValue"
- !If
- IsEnv2Environment
- !Ref VaultSecurityGroupInEnv2
- !Ref "AWS::NoValue"