As found here
While waiting for AWS to implement the pending feature request for {{resolve: ...
dynamic references to resolve to ‘List of String’ type, you can work around this currently using the SSM parameter type of AWS::SSM::Parameter::Value<List<String>>
with a default value corresponding to the SSM parameter you want to reference:
Parameters:
SecurityGroups:
Type: AWS::SSM::Parameter::Value<List<String>>
Default: security-groups
Resources:
Type: AWS::EC2::Instance
Properties:
SecurityGroupIds: !Ref SecurityGroups