Deploy failed: AccessDeniedException: Resource is not in the state updateFunctionPropertiesToFinish #23882
-
Greetings, We have been using github actions to continuously deploy our CDK infrastructure onto AWS. Previously, we had the root aws access key and secret configured in the GH Secrets in order to deploy but I have now changed these to have special purpose IAM User accounts to lock down the permissions to reduce risk of someone potentially getting access to those keys. The deployment works fine and the new Infra is up and running but the deployment fails with the error below.
The only info I could find is this #21305 - I am guessing this is some waiter function that is supposed to keep the CDK process running until the new stack has been deployed but for some reason it does not have access to it? How would I add that permission? |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 1 reply
-
I had a hunch so I just tried to grant full lambda permissions. Now the error looks like this:
|
Beta Was this translation helpful? Give feedback.
-
Answer: I'm not sure which resource is throwing this error, but regardless this seems to be a strange service error. If you have steps to reproduce I'd love to hear, otherwise there's not much we can help you with here since this error isn't thrown by us. |
Beta Was this translation helpful? Give feedback.
-
Hello! Reopening this discussion to make it searchable. |
Beta Was this translation helpful? Give feedback.
-
Getting the same error: working through the CDK workshop (https://cdkworkshop.com/30-python/30-hello-cdk/300-cdk-watch.html ) - at the Changing the lambda function code triggers the problem, so some permission error there as mentioned above is probably the cause. My user has this specific lambda permission (needed to get
|
Beta Was this translation helpful? Give feedback.
-
I was getting the same error with
|
Beta Was this translation helpful? Give feedback.
Answer: I'm not sure which resource is throwing this error, but regardless this seems to be a strange service error. If you have steps to reproduce I'd love to hear, otherwise there's not much we can help you with here since this error isn't thrown by us.