Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Layers shared in multiple stacks cause build/deploy to fail

See original GitHub issue

The issue I am facing seems to be because of a recent update to SAM cli. Since my SAM templates did not change recently and my deploy was running fine up until a few days ago. Possibly a bug introduced in 1.21.x or 1.20.0.

Description:

sam build errors out with following message: Error: L is an Invalid Layer Arn.

The following steps will help replicate the issue, but please refer to the “debug” output at the bottom. Because I think the underlying problem is exposed there.

I create a nested application in this case. In the parent application’s template there are 2 layers defined. I pass the layer ARNs from parent to child template using Parameters. The error origins where the layer ARNs are specified inside a lambda function resource definition.

Steps to reproduce:

Parent template:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Parameters:
  AWSAccountId:
    Type: String
    Default: "123"
  IAMRoleName:
    Type: String
    Default: "role"

Resources:
  OneLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: "one-layer"
      ContentUri: ../layers/one/
      CompatibleRuntimes:
        - python3.8
      RetentionPolicy: Delete

  AnotherLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: "another-layer"
      ContentUri: ../layers/another/
      CompatibleRuntimes:
        - python3.8
      RetentionPolicy: Delete

  SomeLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ../lambdas/example/
      FunctionName: "SomeLambdaName"
      Handler: test.lambda_handler
      Role: !Ref IAMRole
      Layers:
        - !Ref OneLayer
        - !Ref AnotherLayer

  TestApp:
    Type: AWS::Serverless::Application
    Properties:
      Location: apps/test.yaml
      Parameters:
        IAMRole: !Join ['', ["arn:aws:iam::", !Ref AWSAccountId, ":role/", !Ref IAMRoleName]]
        Layers: !Join [",", [!Ref OneLayer, !Ref AnotherLayer]]

Nested App template:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Parameters:
  IAMRole:
    Type: String
  Layers:
    Type: CommaDelimitedList

Resources:
  NestedLambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ../lambdas/example/
      FunctionName: "NestedLambdaName"
      Handler: nested.lambda_handler
      Role: !Ref IAMRole
      Layers: !Ref Layers

Observed result:

Error: L is an Invalid Layer Arn.

Expected result:

Build Succeeded

Built Artifacts  ...
.
.

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

OS: MacOS/Ubuntu
sam --version: 1.21.1/1.21.0
AWS region: us-east-1

With the --debug flag the log statement in output that stands out is: Unable to resolve property Layers: {'Fn::Join': [',', [{'Ref': 'OneLayer'}, {'Ref': 'AnotherLayer'}]]}. Leaving as is.

In my actual template I can see more statements like this for other parameters which use Join function in value.