Getting error while deploying a maven project as service in AWS Lambda

0

I am trying to deploy a Maven project as a service in AWS. The following is the project's yaml file.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2023-04-14

Globals:
  Function:
    Timeout: 30

Resources:
  function:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: com.poc.AsyncLambdaHandler::handleRequest
      Runtime: java11
      AutoPublishAlias: production
      SnapStart:
        ApplyOn: PublishedVersions
      Architectures:
        - x86_64
      MemorySize: 2048
      Environment:
        Variables:
          JAVA_TOOL_OPTIONS: -XX:+TieredCompilation -XX:TieredStopAtLevel=1
      Policies:
        - AWSSecretsManagerGetSecretValuePolicy:
            SecretArn: !Sub arn:aws:secretsmanager:us-west-2:573665728121:secret:WXJTXQk/ETN7dZtaNOnFrnZy0lGrkPCMWHEzs+v2
        - Statement:
            -Effect: "Allow"
            Action:
              - "cloudformation:CreateChangeSet"
            Resource:
              - "arn:aws:cloudformation:us-east-1:258644786104:stack/xyz/*"
              - "arn:aws:cloudformation:us-east-1:aws:transform/Serverless-2023-04-14"
      Events:
        HelloWorld:
          Type: Api
          Properties:
            Path: /{proxy+}
            Method: ANY

When I use sam deploy --guided, I receive the following error.

Error: Failed to create changeset for the stack: xyz, ex: Waiter ChangeSetCreateComplete failed: Waiter encountered a terminal failure state: For expression "Status" we matched expected path: "FAILED" Status: FAILED. Reason: User: arn:aws:iam::258644786104:user/demo is not authorized to perform: cloudformation:CreateChangeSet on resource: arn:aws:cloudformation:us-east-1:aws:transform/Serverless-2023-04-14

Although I have given AdministratorAccess to the demo user.

1개 답변
0

I think "arn:aws:cloudformation:us-east-1:aws:transform/Serverless-2023-04-14" is wrong.
Shouldn't it be "arn:aws:cloudformation:us-east-1:aws:transform/Serverless-2016-10-31"?
The following document shows an example policy.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

To allow AWS::Serverless transforms to create a change set, the policy should include the arn:aws:cloudformation:<region>:aws:transform/Serverless-2016-10-31 resource-level permission, as shown in the following policy:

profile picture
전문가
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠