Unresolved resource dependencies [ServerlessDeploymentBucket]

Bug Report

Description

I started receiving a Template format error: Unresolved resource dependencies [ServerlessDeploymentBucket] in the Resources block of the templat error on my CD pipeline, probably after the https://github.com/serverless/serverless/commit/7b351c7ada543cd3af8713f62942009beb6ed7ef release. (I know that because I was using npx serverless deploy and it stopped working around 30 minutes ago. 🤔)

1. What did you do? Simply npx serverless deploy on my CD pipeline as we always do 2. What happened? Started to fail because of a Unresolved resource dependency on the ServerlessDeploymentBucket even after successfully uploading the package to AWS S3 3. What should’ve happened? A successful deployment 4. What’s the content of your serverless.yml file?

service: ze-support-service

plugins:
  - serverless-python-requirements

provider:
  name: aws
  runtime: python3.7
  stage: dev
  tracing: true
  deploymentBucket: ${env:DEPLOYMENT_BUCKET}
  region: us-west-2
  endpointType: private
  environment:
    stage: ${opt:stage}
    db_user: ${env:DB_USER}
    db_password: ${env:DB_PASSWORD}
    db_host: ${env:DB_HOST}
    db_port: ${env:DB_PORT}
    db_name: ${env:DB_NAME}
  vpc:
    securityGroupIds:
      - Ref: lambdaSg
    subnetIds:
      - ${env:SUBNET_A}
      - ${env:SUBNET_B}
      - ${env:SUBNET_C}
  resourcePolicy:
    - Effect: Allow
      Principal: '*'
      Action: execute-api:Invoke
      Resource: 'arn:aws:execute-api:*'
      Condition:
        StringEquals:
          'aws:sourceVpce': !Ref privateApiGatewayEndpoint
  iamRoleStatements:
    - Effect: Allow
      Action:
      - ec2:CreateNetworkInterface
      - ec2:DescribeNetworkInterfaces
      - ec2:DeleteNetworkInterface
      Resource: '*'

resources:
  Resources:
    privateApiGatewayEndpointSecurityGroup:
      Type: 'AWS::EC2::SecurityGroup'
      Properties:
        GroupDescription: ${self:service} lambda functions security group
          SecurityGroupIngress:
            - CidrIp: ${env:SUBNET_A_CIDR}
              IpProtocol: tcp
              ToPort: '443'
              FromPort: '443'
            - CidrIp: ${env:SUBNET_B_CIDR}
              IpProtocol: tcp
              ToPort: '443'
              FromPort: '443'
            - CidrIp: ${env:SUBNET_C_CIDR}
              IpProtocol: tcp
              ToPort: '443'
              FromPort: '443'
          SecurityGroupEgress:
            - CidrIp: '0.0.0.0/0'
              ToPort: '-1'
              IpProtocol: '-1'
        VpcId: ${env:VPC_ID}
    privateApiGatewayEndpoint:
      Type: 'AWS::EC2::VPCEndpoint'
      Properties:
        PrivateDnsEnabled: true
        SecurityGroupIds:
          - Ref: privateApiGatewayEndpointSecurityGroup
        ServiceName: 'com.amazonaws.${self:provider.region}.execute-api'
        VpcEndpointType: 'Interface'
        SubnetIds:
          - ${env:SUBNET_A}
          - ${env:SUBNET_B}
          - ${env:SUBNET_C}
        VpcId: ${env:VPC_ID}
    lambdaSg:
      Type: 'AWS::EC2::SecurityGroup'
      Properties:
        GroupDescription: ${self:service} lambda functions security group
        SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: '0.0.0.0/0'
        VpcId: ${env:VPC_ID}

package:
  exclude:
    - .cache/**
    - .git/**
    - .pytest_cache/**
    - node_modules/**
    - deploy/**
    - .env
    - alembic.ini
    - docker-compose.yml
    - Makefile
    - travis.yml
    - coverage.xml
    - .coverage
    - README.md
    - package.json
    - package-lock.json
    - Pipfile
    - Pipfile.lock
    - setup.cfg
    - test_*.py
    - '*_test_factory.py'

functions:

  helloWorld:
    handler: application/hello.handle
    memorySize: 128
    timeout: 20
    reservedConcurrency: 20
    tracing: true
    events:
      - http:
          path: /health
          method: get

5. What’s the output you get when you use the SLS_DEBUG=* environment variable (e.g. SLS_DEBUG=* serverless deploy)

npx serverless deploy --stage zdca106
259Serverless: Load command interactiveCli
260Serverless: Load command config
261Serverless: Load command config:credentials
262Serverless: Load command config:tabcompletion
263Serverless: Load command config:tabcompletion:install
264Serverless: Load command config:tabcompletion:uninstall
265Serverless: Load command create
266Serverless: Load command install
267Serverless: Load command package
268Serverless: Load command deploy
269Serverless: Load command deploy:function
270Serverless: Load command deploy:list
271Serverless: Load command deploy:list:functions
272Serverless: Load command invoke
273Serverless: Load command invoke:local
274Serverless: Load command info
275Serverless: Load command logs
276Serverless: Load command metrics
277Serverless: Load command print
278Serverless: Load command remove
279Serverless: Load command rollback
280Serverless: Load command rollback:function
281Serverless: Load command slstats
282Serverless: Load command plugin
283Serverless: Load command plugin
284Serverless: Load command plugin:install
285Serverless: Load command plugin
286Serverless: Load command plugin:uninstall
287Serverless: Load command plugin
288Serverless: Load command plugin:list
289Serverless: Load command plugin
290Serverless: Load command plugin:search
291Serverless: Load command config
292Serverless: Load command config:credentials
293Serverless: Load command rollback
294Serverless: Load command rollback:function
295Serverless: Load command requirements
296Serverless: Load command requirements:clean
297Serverless: Load command requirements:install
298Serverless: Load command requirements:cleanCache
299Serverless: Load command login
300Serverless: Load command logout
301Serverless: Load command generate-event
302Serverless: Load command test
303Serverless: Load command dashboard
304Serverless: Invoke deploy
305Serverless: Invoke package
306Serverless: Invoke aws:common:validate
307Serverless: Invoke aws:common:cleanupTempDir
308Serverless: Generating requirements.txt from Pipfile...
309Serverless: Parsed requirements.txt from Pipfile in /home/travis/build/[**REDACTED**]/.serverless/requirements.txt...
310Serverless: Installing requirements from /home/travis/.cache/serverless-python-requirements/d7ff83f3cbb5294e25a890d093a2ea03d99e98491f44d5ac1d3e586b52d38b61_slspyc/requirements.txt ...
311Serverless: Using download cache directory /home/travis/.cache/serverless-python-requirements/downloadCacheslspyc
312Serverless: Running ...
313Serverless: Packaging service...
314Serverless: Excluding development dependencies...
315Serverless: Injecting required Python packages to package...
316Serverless: Invoke aws:package:finalize
317Serverless: Invoke aws:common:moveArtifactsToPackage
318Serverless: Invoke aws:common:validate
319Serverless: [AWS s3 200 0.304s 0 retries] getBucketLocation({ Bucket: '[secure]-serverless-deployment' })
320Serverless: Invoke aws:deploy:deploy
321Serverless: [AWS cloudformation 200 0.382s 0 retries] describeStacks({ StackName: '[**REDACTED**]' })
322Serverless: [AWS s3 200 0.276s 0 retries] listObjectsV2({ Bucket: '[secure]-serverless-deployment',
323  Prefix: 'serverless/[**REDACTED**]' })
324Serverless: [AWS s3 200 0.26s 0 retries] headObject({ Bucket: '[secure]-serverless-deployment',
325  Key: 'serverless/[**REDACTED**]/1572470072458-2019-10-30T21:14:32.458Z/[**REDACTED**].zip' })
326Serverless: [AWS s3 200 0.266s 0 retries] headObject({ Bucket: '[secure]-serverless-deployment',
327  Key: 'serverless/[**REDACTED**]/1572470072458-2019-10-30T21:14:32.458Z/compiled-cloudformation-template.json' })
328Serverless: [AWS lambda 200 0.322s 0 retries] getFunction({ FunctionName: '[**REDACTED**]-helloWorld' })
329Serverless: [AWS sts 200 0.202s 0 retries] getCallerIdentity({})
330Serverless: Uploading CloudFormation file to S3...
331Serverless: [AWS s3 200 0.266s 0 retries] putObject({ Body: <Buffer 7b 22 41 57 53 54 65 6d 70 6c 61 74 65 46 6f 72 6d 61 74 56 65 72 73 69 6f 6e 22 3a 22 32 30 31 30 2d 30 39 2d 30 39 22 2c 22 44 65 73 63 72 69 70 74 ... >,
332  Bucket: '[secure]-serverless-deployment',
333  Key: 'serverless/[**REDACTED**]/1572520858967-2019-10-31T11:20:58.967Z/compiled-cloudformation-template.json',
334  ContentType: 'application/json',
335  Metadata: { filesha256: '07Ad/Vq+k4c5X/5AM/RBp0cEcILLTafSFpNgjGROKvw=' } })
336Serverless: Uploading artifacts...
337Serverless: Uploading service [**REDACTED**].zip file to S3 (10.55 MB)...
338Serverless: [AWS s3 200 0.38s 0 retries] createMultipartUpload({ Bucket: '[secure]-serverless-deployment',
339  Key: 'serverless/[**REDACTED**]/1572520858967-2019-10-31T11:20:58.967Z/[**REDACTED**].zip',
340  ContentType: 'application/zip',
341  Metadata: { filesha256: 'xz2qfySxTWMMyHwRA5G2fcJXa3qbvtqHVQOkmyTPtbk=' } })
342Serverless: [AWS s3 200 0.557s 0 retries] uploadPart({ Body: <Buffer a7 78 b6 ff a2 e0 44 29 5a f5 43 32 66 9a f5 7b 24 c3 24 99 21 b5 26 53 37 ca c9 f1 c0 d5 06 a1 54 6d 87 21 bc 12 7a 82 10 0b e3 91 b1 3a 9e a2 e7 81 ... >,
343  ContentLength: 573434,
344  PartNumber: 3,
345  Bucket: '[secure]-serverless-deployment',
346  Key: 'serverless/[**REDACTED**]/1572520858967-2019-10-31T11:20:58.967Z/[**REDACTED**].zip',
347  UploadId: 'TLyUcYWGJoFXl9jAOmd9KSCj.YmjjpHxI2WZYtELBy2YYAyQg3cbKjF8_5r.CjAboYUrotKhKZ4FyS17hOzYWIJIc_hUDlxFWqZ2iJwbsVun0hPmYQkovTNlCxw1Zk8a' })
348Serverless: [AWS s3 200 0.86s 0 retries] uploadPart({ Body: <Buffer 9e 49 af 6d ac 3f db d2 4e d6 ab a3 7b bd df 96 d6 5f e3 bd ce 42 cf a1 33 50 b5 d5 62 b0 6d 94 21 aa 3d f6 d0 19 83 ea d9 40 f1 cd 96 76 2f 38 66 55 ... >,
349  ContentLength: 5242880,
350  PartNumber: 2,
351  Bucket: '[secure]-serverless-deployment',
352  Key: 'serverless/[**REDACTED**]/1572520858967-2019-10-31T11:20:58.967Z/[**REDACTED**].zip',
353  UploadId: 'TLyUcYWGJoFXl9jAOmd9KSCj.YmjjpHxI2WZYtELBy2YYAyQg3cbKjF8_5r.CjAboYUrotKhKZ4FyS17hOzYWIJIc_hUDlxFWqZ2iJwbsVun0hPmYQkovTNlCxw1Zk8a' })
354Serverless: [AWS s3 200 0.918s 0 retries] uploadPart({ Body: <Buffer 50 4b 03 04 0a 00 00 00 08 00 00 00 21 00 08 dd cc f2 4c 01 00 00 44 02 00 00 0b 00 00 00 2e 74 72 61 76 69 73 2e 79 6d 6c b5 52 cb 4e c3 30 10 bc fb ... >,
355  ContentLength: 5242880,
356  PartNumber: 1,
357  Bucket: '[secure]-serverless-deployment',
358  Key: 'serverless/[**REDACTED**]/1572520858967-2019-10-31T11:20:58.967Z/[**REDACTED**].zip',
359  UploadId: 'TLyUcYWGJoFXl9jAOmd9KSCj.YmjjpHxI2WZYtELBy2YYAyQg3cbKjF8_5r.CjAboYUrotKhKZ4FyS17hOzYWIJIc_hUDlxFWqZ2iJwbsVun0hPmYQkovTNlCxw1Zk8a' })
360Serverless: [AWS s3 200 0.339s 0 retries] completeMultipartUpload({ MultipartUpload: 
361   { Parts: 
362      [ { ETag: '"69dc83c0b00b60d0d4466736be63e5c6"', PartNumber: 1 },
363        { ETag: '"2d40acd21a5290a85b5cb1b213be6083"', PartNumber: 2 },
364        { ETag: '"a648d0f19fb86dbf2e2e217b9ff9bff2"', PartNumber: 3 },
365        [length]: 3 ] },
366  Bucket: '[secure]-serverless-deployment',
367  Key: 'serverless/[**REDACTED**]/1572520858967-2019-10-31T11:20:58.967Z/[**REDACTED**].zip',
368  UploadId: 'TLyUcYWGJoFXl9jAOmd9KSCj.YmjjpHxI2WZYtELBy2YYAyQg3cbKjF8_5r.CjAboYUrotKhKZ4FyS17hOzYWIJIc_hUDlxFWqZ2iJwbsVun0hPmYQkovTNlCxw1Zk8a' })
369Serverless: Validating template...
370Serverless: [AWS cloudformation 400 0.525s 0 retries] validateTemplate({ TemplateURL: 'https://s3.amazonaws.com/[secure]-serverless-deployment/serverless/[**REDACTED**]/1572520858967-2019-10-31T11:20:58.967Z/compiled-cloudformation-template.json' })
371 
372  Error --------------------------------------------------
373 
374  Error: The CloudFormation template is invalid: Template format error: Unresolved resource dependencies [ServerlessDeploymentBucket] in the Resources block of the template
375      at provider.request.catch.error (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/plugins/aws/deploy/lib/validateTemplate.js:20:13)
376  From previous event:
377      at AwsDeploy.validateTemplate (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/plugins/aws/deploy/lib/validateTemplate.js:16:85)
378  From previous event:
379      at AwsDeploy.BbPromise.bind.then (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/plugins/aws/deploy/index.js:119:39)
380  From previous event:
381      at Object.aws:deploy:deploy:validateTemplate [as hook] (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/plugins/aws/deploy/index.js:115:30)
382      at BbPromise.reduce (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/classes/PluginManager.js:489:55)
383  From previous event:
384      at PluginManager.invoke (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/classes/PluginManager.js:489:22)
385      at PluginManager.spawn (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/classes/PluginManager.js:509:17)
386      at AwsDeploy.BbPromise.bind.then (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/plugins/aws/deploy/index.js:93:48)
387  From previous event:
388      at Object.deploy:deploy [as hook] (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/plugins/aws/deploy/index.js:89:30)
389      at BbPromise.reduce (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/classes/PluginManager.js:489:55)
390  From previous event:
391      at PluginManager.invoke (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/classes/PluginManager.js:489:22)
392      at getHooks.reduce.then (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/classes/PluginManager.js:524:24)
393  From previous event:
394      at PluginManager.run (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/classes/PluginManager.js:524:8)
395      at variables.populateService.then (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/Serverless.js:115:33)
396      at runCallback (timers.js:810:20)
397      at tryOnImmediate (timers.js:768:5)
398      at processImmediate [as _immediateCallback] (timers.js:745:5)
399  From previous event:
400      at Serverless.run (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/lib/Serverless.js:102:74)
401      at serverless.init.then (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/bin/serverless.js:72:30)
402      at /home/travis/.npm/_npx/4162/lib/node_modules/serverless/node_modules/graceful-fs/graceful-fs.js:111:16
403      at /home/travis/build/[**REDACTED**]/node_modules/graceful-fs/graceful-fs.js:57:14
404      at /home/travis/.npm/_npx/4162/lib/node_modules/serverless/node_modules/graceful-fs/graceful-fs.js:45:10
405      at FSReqWrap.oncomplete (fs.js:135:15)
406  From previous event:
407      at initializeErrorReporter.then (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/bin/serverless.js:72:8)
408      at runCallback (timers.js:810:20)
409      at tryOnImmediate (timers.js:768:5)
410      at processImmediate [as _immediateCallback] (timers.js:745:5)
411  From previous event:
412      at Object.<anonymous> (/home/travis/.npm/_npx/4162/lib/node_modules/serverless/bin/serverless.js:61:4)
413      at Module._compile (module.js:653:30)
414      at Object.Module._extensions..js (module.js:664:10)
415      at Module.load (module.js:566:32)
416      at tryModuleLoad (module.js:506:12)
417      at Function.Module._load (module.js:498:3)
418      at Function.Module.runMain (module.js:694:10)
419      at findNodeScript.then.existing (/home/travis/.nvm/versions/node/v8.12.0/lib/node_modules/npm/node_modules/libnpx/index.js:268:14)
420      at <anonymous>
421 
422  Get Support --------------------------------------------
423     Docs:          docs.serverless.com
424     Bugs:          github.com/serverless/serverless/issues
425     Issues:        forum.serverless.com
426 
427  Your Environment Information ---------------------------
428     Operating System:          linux
429     Node Version:              8.12.0
430     Framework Version:         1.56.0
431     Plugin Version:            3.2.1
432     SDK Version:               2.1.2
433     Components Core Version:   1.1.2
434     Components CLI Version:    1.4.0```

[medikoo]

@flpStrri great thanks for report! Indeed it’s a regression introduced with #6823. Fix is on the way

[technicallyfeasible]

The issue seems to be with the newly added deployment bucket policy that references an export that doesn’t exist.

"ServerlessDeploymentBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "ServerlessDeploymentBucket"
        },
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "s3:*",
              "Effect": "Deny",
              "Principal": "*",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:aws:s3:::",
                      {
                        "Ref": "ServerlessDeploymentBucket"
                      },
                      "/*"
                    ]
                  ]
                }
              ],
              "Condition": {
                "Bool": {
                  "aws:SecureTransport": false
                }
              }
            }
          ]
        }
      }
    },

The only existing output is this:

    "ServerlessDeploymentBucketName": {
      "Value": "xxx"
    },