Circular dependency when adding s3 upload event

Description:

I’m trying to do just as what you have here in this example, I always encounter this error:

Error: Failed to create changeset for the stack: sls-my-sample-app, ex: Waiter ChangeSetCreateComplete failed: Waiter encountered a terminal failure state Status: FAILED. Reason: Circular dependency between resources: [forgotPasswordConfirmApiEventPermissionStage, mainBackendApi, changeProfilePictureApiEventPermissionStage, resendEmailCodeApiEventPermissionStage, verifyEmailApiEventPermissionStage, profilePictureUploadedUploadPermission, mainBackendApiDeploymentad50fa5e91, forgotPasswordSendApiEventPermissionStage, changeProfilePicture, loginApiEventPermissionStage, changePersonalInfoApiEventPermissionStage, usersS3Bucket, mainBackendApiStage, profilePictureUploaded, profilePictureUploadedRole, changeProfilePictureRole, registerApiEventPermissionStage]

This is what my template looks like:

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  sls-my-sample-app

  Sample SAM Template for sls-my-sample-app
  
Parameters:
  Stage:
    Description: Required staged of the current build
    Type: String
    Default: dev

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    MemorySize: 512
    Timeout: 60
    Runtime: nodejs12.x
    Environment:
      Variables:
        STAGE: !Ref Stage
        USERS_BUCKET: !Ref usersS3Bucket
  Api:
    OpenApiVersion: 3.0.1

Resources:
  register:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/functions/guest/register.handler
      Layers:
        - !Ref dependencies
      Policies:
        - Statement:
          - Action:
              - ses:SendEmail
            Effect: Allow
            Resource: "*"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: post
            Path: /register
            RestApiId:
              Ref: mainBackendApi
  forgotPasswordSend:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/functions/guest/forgotPasswordSend.handler
      Layers:
        - !Ref dependencies
      Policies:
        - Statement:
            - Action:
                - ses:SendEmail
              Effect: Allow
              Resource: "*"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: post
            Path: /forgot-password-send
            RestApiId:
              Ref: mainBackendApi
  forgotPasswordConfirm:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/functions/guest/forgotPasswordConfirm.handler
      Layers:
        - !Ref dependencies
      Policies:
        - Statement:
            - Action:
                - ses:SendEmail
              Effect: Allow
              Resource: "*"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: post
            Path: /forgot-password-confirm
            RestApiId:
              Ref: mainBackendApi
  login:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/functions/guest/login.handler
      Layers:
        - !Ref dependencies
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: post
            Path: /login
            RestApiId:
              Ref: mainBackendApi
  verifyEmail:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/functions/auth/verifyEmail.handler
      Layers:
        - !Ref dependencies
      Policies:
        - Statement:
          - Action:
              - ses:SendEmail
            Effect: Allow
            Resource: "*"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: post
            Path: /verify-email
            RestApiId:
              Ref: mainBackendApi
  resendEmailCode:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/functions/auth/resendEmailCode.handler
      Layers:
        - !Ref dependencies
      Policies:
        - Statement:
          - Action:
              - ses:SendEmail
            Effect: Allow
            Resource: "*"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: post
            Path: /resend-email-code
            RestApiId:
              Ref: mainBackendApi
  changePersonalInfo:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/functions/auth/changePersonalInfo.handler
      Layers:
        - !Ref dependencies
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: post
            Path: /change-personal-info
            RestApiId:
              Ref: mainBackendApi
  changeProfilePicture:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/functions/auth/changeProfilePicture.handler
      Layers:
        - !Ref dependencies
      Policies:
        - Statement:
          - Action:
              - s3:PutObject
              - s3:PutObjectAcl
            Effect: Allow
            Resource:
              - !Join
                - ""
                - - !GetAtt usersS3Bucket.Arn
                  - "/*.jpg"
              - !Join
                - ""
                - - !GetAtt usersS3Bucket.Arn
                  - "/*.jpeg"
              - !Join
                - ""
                - - !GetAtt usersS3Bucket.Arn
                  - "/*.png"
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: post
            Path: /change-profile-picture
            RestApiId:
              Ref: mainBackendApi
  profilePictureUploaded:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/events/s3/profilePictureUploaded.handler
      MemorySize: 2048
      Layers:
        - !Ref dependencies
      Policies:
        - Statement:
          - Action:
              - s3:GetObject
            Effect: Allow
            Resource:
              - !Join
                - ""
                - - !GetAtt usersS3Bucket.Arn
                  - "/*.jpg"
              - !Join
                - ""
                - - !GetAtt usersS3Bucket.Arn
                  - "/*.jpeg"
              - !Join
                - ""
                - - !GetAtt usersS3Bucket.Arn
                  - "/*.png"
      Events:
        Upload:
          Type: S3
          Properties:
            Bucket: !Ref usersS3Bucket
            Events: s3:ObjectCreated:Put
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: newProfilePicture_
  dependencies:
    Type: AWS::Serverless::LayerVersion
    Properties:
      CompatibleRuntimes:
        - nodejs12.x
      ContentUri: src/dependencies
      LayerName: sls-my-sample-app
      RetentionPolicy: Retain
  mainBackendApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: !Ref Stage
  usersS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
        - "-"
        - - "sls-my-sample-app-users"
          - !Ref Stage
      CorsConfiguration:
        CorsRules:
        - AllowedHeaders:
            - "*"
          AllowedMethods:
            - GET
            - PUT
            - HEAD
          AllowedOrigins:
            - "*"
      Tags:
        - Key: "what"
          Value: "sls-my-sample-app users s3 bucket"

The error is coming from profilePictureUploaded function, probably because of the S3 event, can you help me out?

Steps to reproduce:

Follow the template above.

Observed result:

Throws circular dependency.

Expected result:

Should not throw circular dependency

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: ubuntu-latest on Github Actions
2. sam --version: SAM CLI, version 1.15.0

Add --debug flag to command you are running

[aprilmintacpineda]

I changed the policy to:

Policies:
  - S3ReadPolicy:
      BucketName: !Join
        - "-"
        - - "my-app-users-s3-bucket"
          - !Ref Stage

And on the environment variable to:

usersBucket: !Join
  - "-"
  - - "my-app-users-s3-bucket"
    - !Ref Stage

And it worked, I can see the function there now. I still don’t know what went wrong there, how come when I added an s3 event the !Ref myBucket just fails…

Also, I’ve been looking for a way to declare variables, so I don’t have to copy-paste

!Join
  - "-"
  - - "my-app-users-s3-bucket"
    - !Ref Stage

multiple times.

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.