Localstack: cloudformation could not determine a constructor for the tag "!Sub ..."

[asnowfix]

Uploading my CloudFormation templates fails with the error backtrace below:

2017-10-17T09:59:36:ERROR:localstack.services.generic_proxy: Error forwarding request: could not determine a constructor for the tag '!Sub'
  in "<string>", line 194, column 12:
        Value: !Sub "${EmsDbCluster.Endpoint.Ad ...
               ^ Traceback (most recent call last):
  File "/opt/code/localstack/localstack/services/generic_proxy.py", line 171, in forward
    path=path, data=data, headers=forward_headers)
  File "/opt/code/localstack/localstack/services/cloudformation/cloudformation_listener.py", line 141, in forward_request
    return execute_change_set(req_data)
  File "/opt/code/localstack/localstack/services/cloudformation/cloudformation_listener.py", line 89, in execute_change_set
    template = template_deployer.template_to_json(cs_details.get('TemplateBody')[0])
  File "/opt/code/localstack/localstack/utils/cloudformation/template_deployer.py", line 186, in template_to_json
    template = parse_template(template)
  File "/opt/code/localstack/localstack/utils/cloudformation/template_deployer.py", line 182, in parse_template
    return yaml.load(template)
  File "/opt/code/localstack/.venv/lib/python2.7/site-packages/yaml/__init__.py", line 71, in load
    return loader.get_single_data()
  File "/opt/code/localstack/.venv/lib/python2.7/site-packages/yaml/constructor.py", line 39, in get_single_data
    return self.construct_document(node)
  File "/opt/code/localstack/.venv/lib/python2.7/site-packages/yaml/constructor.py", line 48, in construct_document
    for dummy in generator:
  File "/opt/code/localstack/.venv/lib/python2.7/site-packages/yaml/constructor.py", line 398, in construct_yaml_map
    value = self.construct_mapping(node)
  File "/opt/code/localstack/.venv/lib/python2.7/site-packages/yaml/constructor.py", line 208, in construct_mapping
    return BaseConstructor.construct_mapping(self, node, deep=deep)
  File "/opt/code/localstack/.venv/lib/python2.7/site-packages/yaml/constructor.py", line 133, in construct_mapping
    value = self.construct_object(value_node, deep=deep)
  File "/opt/code/localstack/.venv/lib/python2.7/site-packages/yaml/constructor.py", line 88, in construct_object
    data = constructor(self, node)
  File "/opt/code/localstack/.venv/lib/python2.7/site-packages/yaml/constructor.py", line 414, in construct_undefined
    node.start_mark)
ConstructorError: could not determine a constructor for the tag '!Sub'
  in "<string>", line 194, column 12:
        Value: !Sub "${EmsDbCluster.Endpoint.Ad ...

Here is the template:

AWSTemplateFormatVersion: "2010-09-09"
Description: used by EMS Service
Parameters:
  KubernetesSecurityGroupId: 
    Description: the origin ingress SecurityGroup
    Type: AWS::EC2::SecurityGroup::Id
  EmsDbVpcId: 
    Description: the VpcId
    Type: AWS::EC2::VPC::Id
  EmsEnvironment: 
    Type: String
    Default: dev
    AllowedValues: 
      - dev
      - qa
      - staging
      - production
    Description: Default is dev.
Resources:
  EmsDbSecurityGroup:
    Type: "AWS::EC2::SecurityGroup"
    Properties: 
      GroupName: !Sub "emsdb-sg-${EmsEnvironment}"
      GroupDescription: Security Group allowing the Kubernetes Cluster to reach the EMS Database.
      SecurityGroupEgress:
        # Allow outgoing plain http requests to anywhere XXX
        - IpProtocol: tcp
          FromPort: '80'  # port range start...
          ToPort: '80'    # ...port range end
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        # Allow incoming mysql requests from Orange
        - IpProtocol: tcp
          FromPort: '3306'  # port range start...
          ToPort: '3306'    # ...port range end
          CidrIp: 90.0.0.0/8
        # Allow mysql traffic from Kubernetes
        - IpProtocol: tcp
          FromPort: '3306'  # port range start...
          ToPort: '3306'    # ...port range end
          #SourceSecurityGroupName: nodes.heapster.hpid-dev.hpccp.net
          SourceSecurityGroupId:
            Ref: KubernetesSecurityGroupId
      VpcId:
        Ref: EmsDbVpcId

[XieX]

Ditto for Ref

EDIT: As a workaround, you can try using the longhand version, e.g. instead of

GroupName: !Sub "emsdb-sg-${EmsEnvironment}"

you could try

GroupName:
  Sub: "emsdb-sg-${EmsEnvironment}"

[TDA]

@XieX Did you ever discover why this was happening?

[whummer]

Closing this issue as outdated. Please re-open or create a follow-up issue if the problem persists. Thanks