"region: us-gov-west-1" generates ARNs for standard region "arn:aws:..." not arn:aws-us-gov:...

This is a Bug Report

Description

We are deploying in GovCloud, so we specify that in the provider.region. However, the template generated creates PolicyDocument referencing logs with non-govcloud ARNs.

For bug reports:

• What went wrong?

In serverless.yml:

provider:
  name: aws
  region: us-gov-west-1    # need ARNs arn:aws-us-gov:...
  deploymentBucket:
    name: eva-ocr-deployment-${self:custom.stage}

If I do a “sls package” and see the cloudformation-template-update-stack.json has reference to standard region ARN like “arn:aws:…”:

            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogStream"
                  ],
                  "Resource": [
                    {
                      "Fn::Sub": "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/eva-ocr-izdev-DocPdfSplit:*"
                    },

• What did you expect should have happened?

The generated ARNs for GovCloud should start with "arn:aws-us-gov:… " like:

                      "Fn::Sub": "arn:aws-us-gov:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/eva-ocr-izdev-PagePdfOcr:*"

• What was the config you used?

(I don’t understand the question)

• What stacktrace or error message from your provider did you see?

When I try to deploy, I see it complain about using “aws” instead of “aws-us-gov”:

CREATE_FAILED 
AWS::IAM::Role
IamRoleLambdaExecution
Partition "aws" is not valid for resource "arn:aws:logs:us-gov-west-1:644832730935:log-group:/aws/lambda/eva-ocr-dev-DocPdfSplit:*".

For feature proposals:

• What is the use case that should be solved. The more detail you describe this in the easier it is to understand for us.
• If there is additional config how would it look

Similar or dependent issues:

• #4040
• #4048
• #3748

Additional Data

• Serverless Framework Version you’re using: 1.9.0 patched with fix for #4040 #4048 because I don’t yet have access to GC for SLS to access the bucket.
• Operating System: OSX El Capitan
• Stack Trace: none
• Provider Error messages: Partition “aws” is not valid for resource “arn:aws:logs:us-gov-west-1:644832730935:log-group:/aws/lambda/eva-ocr-dev-DocPdfSplit:*”.

If the ARNs aren’t being tweaked for GC, then SLS may not be handling other non-standard regions; sorry, I don’t know the code well enough yet.

FYI AWS GC ARNs: http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-arns.html

[earlrob]

I am trying deploy to AWS govcloud and I see this error. Using v2.41.2

PR 6615 should have fixed this issue. You may want to open a new issue and provide details of your setup and the arn output that is causing an error.

[maplion]

I’m with @digitalageexperts : this needs to be resolved or serverless is not usable in govcloud.

Here’s my error:

Expected ARN arn:aws-us-gov:apigateway:us-gov-east-1::/... for Stage <stage> on RestApi <api id>, not arn:aws:apigateway:us-gov-east-1::/...