This repository was archived by the owner on Feb 5, 2024. It is now read-only.
This repository was archived by the owner on Feb 5, 2024. It is now read-only.
FIRST.LAST-admin : Insufficient permissions to delete CF Stack #54
Description
Steps to reproduce:
- Create a lambda deployment for first time (where no existing CF Stack)
STAGE=sandbox aws-vault exec FIRST.LAST-admin --no-session -- yarn lambda:deploy - Destroy the lambda stack.
STAGE=sandbox aws-vault exec FIRST.LAST-admin --no-session -- yarn lambda:_delete
STAGE=sandbox aws-vault exec FIRST.LAST-admin --no-session -- yarn lambda:_delete yarn run v1.21.1 $ yarn run lambda:sls remove $ eval $(yarn -s env) && sls -s ${STAGE} remove Serverless: Getting all objects in S3 bucket... Serverless: Removing objects in S3 bucket... Serverless: Removing Stack... Serverless: Checking Stack removal progress... .................................... Serverless: Operation failed! Serverless: View the full error output: https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stack/detail?stackId=sls-simple-reference-sandbox Serverless Error --------------------------------------- An error occurred: ServerlessDeploymentBucketPolicy - API: s3:DeleteBucketPolicy Access Denied. Get Support -------------------------------------------- Docs: docs.serverless.com Bugs: github.com/serverless/serverless/issues Issues: forum.serverless.com Your Environment Information --------------------------- Operating System: darwin Node Version: 8.10.0 Framework Version: 1.59.2 Plugin Version: 3.2.5 SDK Version: 2.2.1 Components Core Version: 1.1.2 Components CLI Version: 1.4.0 error Command failed with exit code 1. info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command. error Command failed with exit code 1. info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command. Looking in the AWS Console for more detail two resources failed to delete.
So there are two issues
-
s3:DeleteBucketPolicy
- This appears to be missing from terraform-aws-serverless https://github.com/FormidableLabs/terraform-aws-serverless/blob/master/policy-admin.tf#L43
-
ec2:DescribeNetworkInterfaces
- This should be granted here I believe: https://github.com/FormidableLabs/terraform-aws-serverless/blob/master/modules/vpc/policy-developer.tf