question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Wrong S3 bucket name in IAM custom policy for imageLambda execution role

See original GitHub issue

First of all, thanks for making this great project that makes our life so easy!

Describe the bug

I am new for both Next JS and serverless component. I started play with both with a simple project with one single page and deployed to AWS. During my experimental, I removed and re-deployed the same project couple times. After added couple images using Nextjs 10 new Image component, and those images were missing in the browser and CloudFront returned 500 errors.

Actual behavior

After couple hours of debugging, checking previous issues and making sure configuring my project correctly, I realized that the policy of the IAM execution role for the imageLabmda contains a wrong AWS S3 resource.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Resource": "*",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ]
        },
        {
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::w11807j-dqy0qu/*",  <==== Wrong name
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ]
        }
    ]
}

After change the wrong value to the actual S3 bucket name, update the policy, everything works as expected, images were returned correctly.

Expected behavior

After each deployment, the correct S3 resource name should be reflected in the corresponding Lambda IAM custom policy correctly.

Steps to reproduce

Not sure exactly how to re-produce this problem, most likely it was caused by the removed/re-deployed actions.

Versions

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:9

github_iconTop GitHub Comments

2reactions
dphangcommented, Feb 11, 2021

Cool, closing this then. I published the fix in the latest alpha version. (The original problem seemed to be due to switching between multiple versions, and this fix should also help the custom role issue. @jackywxd do let us know if you are still facing issues).

2reactions
dphangcommented, Feb 11, 2021

Thanks, yeah I had forgotten to update that part as the custom role change was merged around the same time. I can update it tonight.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Configuring IAM policies for Object Lambda access points
Configure AWS Identity and Access Management (IAM) resource policies so that you can control the use of Object Lambda access points in Amazon...
Read more >
Serverless Next.js Component - Serverless Framework: Plugins
NOTE: Specify bucketName and give permissions to access that bucket via policy or roleArn so default and API lambdas can access static resources....
Read more >
Amazon Lambda - Quarkus
View the Getting Started Guide for deploying a lambda with AWS CLI. Specifically, make sure you have created an Execution Role .
Read more >
How do I allow my Lambda execution role to ... - YouTube
Upload to S3 From Lambda Tutorial | Step by Step Guide · Cross Account Accessing an AWS S3 Bucket · How do I...
Read more >
Option 2: Configuring an AWS IAM Role to Access Amazon S3
The role is granted limited access to an S3 bucket through IAM policies you ... a successful load or execute REMOVE statements to...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found