As found here

https://stackoverflow.com/questions/55539412/can-cloudformation-ssm-dynamic-reference-with-type-stringlist-resolve-to-list

While waiting for AWS to implement the pending feature request for {{resolve: ... dynamic references to resolve to ‘List of String’ type, you can work around this currently using the SSM parameter type of AWS::SSM::Parameter::Value<List<String>> with a default value corresponding to the SSM parameter you want to reference:

Parameters:
  SecurityGroups:
    Type: AWS::SSM::Parameter::Value<List<String>>
    Default: security-groups
Resources:
  Type: AWS::EC2::Instance
  Properties:
    SecurityGroupIds: !Ref SecurityGroups