Policy malformed when deploying serverless application - amazon-web-services

Question

I have a lambda function created using the serverless framework that is running into an error when deploying it to a dev environment. Issue seems to be IAM related and isn't a perissions issue so much as AWS says it's a malformed policy. I've included the error message seen in the cloudformation console as well as the entire serverless.yml file. Was hoping some could help me fix it, I had it working on another account though have made changes like memory limit and specifying the resource for iam policy. Should add to that, I have confirmed the sqs queue referenced in the iam part does in fact exist and I've tried the exact arn without the opt:accID part.
Error message
The policy failed legacy parsing (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument;
Serverless.yaml file
provider:
name: aws
runtime: nodejs10.x
region: us-east-1
vpc:
securityGroupIds:
- ${ssm:/${opt:stage}/securityGroupIds}
subnetIds:
- ${ssm:/${opt:stage}/subnetIds}
iamRoleStatements:
- Effect: 'Allow'
Resource: arn:aws:sqs:us-east-1:{opt:accID}:influxdb_perf_mon
Action:
- 'sqs:*'
environment:
tsQueue: https://sqs.us-east-1.amazonaws.com/${opt:accID}/influxdb_perf_mon
functions:
perf:
handler: handler.perf
memorySize: 128 # in MB
events:
- sqs:
arn: arn:aws:sqs:us-east-1:{opt:accID}:influxdb_perf_mon
batchSize: 1
Cloudformation in S3
"IamRoleLambdaExecution": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"lambda.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
},
"Policies": [
{
"PolicyName": {
"Fn::Join": [
"-",
[
"timeseries-lambda",
"dev",
"lambda"
]
]
},
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:CreateLogGroup"
],
"Resource": [
{
"Fn::Sub": "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/timeseries-lambda-dev*:*"
}
]
},
{
"Effect": "Allow",
"Action": [
"logs:PutLogEvents"
],
"Resource": [
{
"Fn::Sub": "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/timeseries-lambda-dev*:*:*"
}
]
},
{
"Effect": "Allow",
"Resource": "arn:aws:sqs:us-east-1:100525853236:influxdb_perf_mon",
"Action": [
"sqs:*"
]
},
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Resource": [
"arn:aws:sqs:us-east-1:{opt:accID}:influxdb_perf_mon"
]
}
]
}
}
],
"Path": "/",
"RoleName": {
"Fn::Join": [
"-",
[
"timeseries-lambda",
"dev",
{
"Ref": "AWS::Region"
},
"lambdaRole"
]
]
},
"ManagedPolicyArns": [
{
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
]
]
}
]
}
},

Answer 1

The line that defines the resource for the IAM premissions you have listed has a small typo and is missing the $:
Resource: arn:aws:sqs:us-east-1:{opt:accID}:influxdb_perf_mon
should be
Resource: arn:aws:sqs:us-east-1:${opt:accID}:influxdb_perf_mon
That may fix your issue

Answer 2

I redeployed your role in my sandabox account. I found that the issue comes from:
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Resource": [
"arn:aws:sqs:us-east-1:{opt:accID}:influxdb_perf_mon"
]
}
Specifically, from {opt:accID}. Changing the Resource to (real account number) fixed the issue in my verification:
"arn:aws:sqs:us-east-1:324124214:influxdb_perf_mon"
Thus the question is, where does this policy come from? Its not listed in your Serverless.yaml provided in the question? Are you sure this is the most recent Serverless.yaml you use?