As found here
While waiting for AWS to implement the pending feature request for {{resolve: ...
dynamic references to resolve to ‘List of String’ type, you can work around this currently using the SSM parameter type of AWS::SSM::Parameter::Value<List<String>>
with a default value corresponding to the SSM parameter you want to reference:
Parameters: SecurityGroups: Type: AWS::SSM::Parameter::Value<List<String>> Default: security-groups Resources: Type: AWS::EC2::Instance Properties: SecurityGroupIds: !Ref SecurityGroups