Wrong S3 bucket name in IAM custom policy for imageLambda execution role
See original GitHub issueFirst of all, thanks for making this great project that makes our life so easy!
Describe the bug
I am new for both Next JS and serverless component. I started play with both with a simple project with one single page and deployed to AWS. During my experimental, I removed and re-deployed the same project couple times. After added couple images using Nextjs 10 new Image component, and those images were missing in the browser and CloudFront returned 500 errors.
Actual behavior
After couple hours of debugging, checking previous issues and making sure configuring my project correctly, I realized that the policy of the IAM execution role for the imageLabmda contains a wrong AWS S3 resource.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": "*",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
},
{
"Effect": "Allow",
"Resource": "arn:aws:s3:::w11807j-dqy0qu/*", <==== Wrong name
"Action": [
"s3:GetObject",
"s3:PutObject"
]
}
]
}
After change the wrong value to the actual S3 bucket name, update the policy, everything works as expected, images were returned correctly.
Expected behavior
After each deployment, the correct S3 resource name should be reflected in the corresponding Lambda IAM custom policy correctly.
Steps to reproduce
Not sure exactly how to re-produce this problem, most likely it was caused by the removed/re-deployed actions.
Versions
- OS/Environment: macOS Big Sur
- @sls-next/serverless-component version: 1.19.0-alpha.21
- Next.js version: 10.0.4
Issue Analytics
- State:
- Created 3 years ago
- Comments:9
Top GitHub Comments
Cool, closing this then. I published the fix in the latest alpha version. (The original problem seemed to be due to switching between multiple versions, and this fix should also help the custom role issue. @jackywxd do let us know if you are still facing issues).
Thanks, yeah I had forgotten to update that part as the custom role change was merged around the same time. I can update it tonight.