AWS SAM CLI: Deploy AWS Lambda with least privilege access

Question

I'm trying to deploy the hello world quickstart AWS Lambda function created by AWS SAM ClI template with least priviliege access. For this I have created an IAM Policy, and assigned this policy to a user whose access_key_id and aws_secret_access_key is being used by SAM CLI. Also, I have created an private S3 bucket.

When I'm trying to use 'sam deploy --guided --s3-bucket 'name-of-already-created-bucket' command, I'm getting an error which says:

`
Error: Failed to create managed resources: Waiter StackCreateComplete failed: Waiter encountered a terminal failure state: For expression "Stacks[].StackStatus" we matched expected path: "ROLLBACK_COMPLETE" at least once

Can anyone please help me to understand, what can be the cause of this error, and how can it be resolved.

IAM Permissions granted to SAM CLI:
1. CloudFormation: DescribeStacks, DescribeChangeSet, GetTemplate, CreateChangeSet, DeleteStack, ExecuteChangeSet
2. Lambda: CreateFunction
3. S3: PutObject

Answer

There are likely to be other permissions required. If you look at the CloudFormation console (or use the `aws cloudformation describe-stack-events --stack-name ` command) you will be able to see which resource failed to create and that should point to the permission that you require.

AWS SAM CLI: Deploy AWS Lambda with least privilege access

Relevanter Inhalt