Next js deploy error [AccessDenied] #1876

sudarshann · 2021-05-25T00:09:50Z

Region=ap-south-1
Id=d3rx4fur1b76fm

2021-05-23T11:46:38.872Z [INFO]: Done in 24.98s.
2021-05-23T11:46:38.876Z [INFO]: Starting SSR Build...
2021-05-23T11:47:56.230Z [INFO]: AccessDenied

I am trying to deploy a starter next js app which I just created and added amplify I get the above error. Everything else deployed perfectly. Even it built successfully. But I get the above error. I have followed all steps as per this https://aws.amazon.com/blogs/mobile/host-a-next-js-ssr-app-with-real-time-data-on-aws-amplify/

I have double checked the IAM role too its perfectly set up with full permission. I think its an issue with configuring cloudfront probably ?

Any clues ?

Originally posted by @sudarshann in #412 (comment)

The text was updated successfully, but these errors were encountered:

github-actions · 2021-05-25T00:10:35Z

Hi 👋, thanks for opening! While we look into this...

If this issue is related to custom domains, be sure to check the custom domains troubleshooting guide to see if that helps. Also, there is a more general troubleshooting FAQ that may be helpful for other questions.

Lastly, please make sure you've specified the App ID and Region in the issue!

nimacks · 2021-05-25T16:39:53Z

Hi @sudarshann, you mentioned that you have the IAM role setup. Can you confirm this is the service role. Also, how many CloudFront distributions in your account have Lambda@Edge distributions attached. There is a limit documented here.
https://docs.aws.amazon.com/amplify/latest/userguide/server-side-rendering-amplify.html#troubleshooting-ssr-deployment

CloudFront service quotas limit your AWS account to 25 distributions with attached Lambda@Edge functions. 
If you exceed this quota, you can either delete any unused CloudFront distributions from your account or
 request a quota increase. For more information, see Requesting a quota increase 
in the Service Quotas User Guide.

sudarshann · 2021-05-25T16:44:35Z

I have no cloudfront services created across my entire account across all regions

sunglee · 2021-06-05T01:13:25Z

Any updates on this? I got the same message too.

AppId: d1mck1hjqmgmt9
Region: us-west-2

2021-06-05T01:10:51.872Z [INFO]: Starting SSR Build...
2021-06-05T01:11:45.333Z [INFO]: AccessDenied

Thanks!

JimLiu · 2021-06-19T04:04:21Z

same error too

zugger14 · 2021-07-24T07:36:46Z

i am facing the same issue my app id = d3dh32c6fp1s0y

Athena96 · 2021-07-27T17:19:42Z

Hi all, we've recently made improvements to our SSR error logging and have added support for Next.js 10/11.
Please follow this guide to upgrade to our latest support of Next.js: https://docs.aws.amazon.com/amplify/latest/userguide/server-side-rendering-amplify.html#update-app-nextjs-version

zugger14 · 2021-07-28T03:40:46Z

hi @Athena96 i am still getting AccessDenied while starting my SSR Build..Can you please help me on this. my app id =d3dh32c6fp1s0y and region=eu-central-1.

tmrclark · 2021-09-06T18:47:29Z

Any updates on this? I am running into this too.

swaminator · 2021-09-08T04:04:11Z

@timclark97 can you try this: https://github.com/aws-amplify/amplify-console/blob/master/FAQ.md#error-accessdenied-access-denied

tmrclark · 2021-09-08T16:38:47Z

@swaminator I changed the app to SSG so it is working now. Prior to doing that though, I followed this tutorial to create an IAM role with the AdministratorAccess-Amplify policy, which I assume had all the permissions listed in that FAQ you shared. Does that policy not have all the necessary permissions?

ferdingler · 2021-09-08T21:27:25Z

@timclark97 the AdministratorAccess-Amplify policy is useful for creating your backend environments via the Amplify CLI. But with SSR apps we create a CloudFront distribution, an S3 bucket and Lambda@Edge functions in your account without using CloudFormation, which is why that policy doesn't work.

We are working on making this experience with IAM permissions and SSR apps smoother. In the meantime, I recommend to create your own policy with these permissions if you need to deploy an SSR app again: https://github.com/aws-amplify/amplify-console/blob/master/FAQ.md#error-accessdenied-access-denied.

kenchoong · 2021-12-22T16:04:54Z

My app details:
appId: dcuydyh2ys8c4
region: ap-southeast-1

Triple check my CloudFront distrubution, only have 7 distrubution, not exceed 25

I using Nextjs SSR, but the deployment always failed, with Access Denied error

I already create a new policy named: Amplify-additional-policy as below, which I follow this, literally copy and paste from here: https://github.com/aws-amplify/amplify-console/blob/main/FAQ.md#error-accessdenied-access-denied

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "lambda:CreateFunction",
                "iam:UpdateAssumeRolePolicy",
                "lambda:TagResource",
                "cloudfront:ListFieldLevelEncryptionConfigs",
                "iam:CreateRole",
                "s3:CreateBucket",
                "iam:AttachRolePolicy",
                "lambda:GetFunctionConfiguration",
                "iam:PutRolePolicy",
                "route53:ListHostedZonesByName",
                "cloudfront:CreateInvalidation",
                "lambda:EnableReplication",
                "cloudfront:GetDistribution",
                "acm:RequestCertificate",
                "route53:ListResourceRecordSets",
                "lambda:DeleteFunction",
                "cloudfront:GetDistributionConfig",
                "amplify:GetApp",
                "iam:GetRole",
                "cloudfront:TagResource",
                "route53:ChangeResourceRecordSets",
                "sqs:GetQueueAttributes",
                "lambda:UpdateFunctionCode",
                "s3:PutObject",
                "s3:GetObject",
                "acm:DescribeCertificate",
                "cloudfront:ListTagsForResource",
                "cloudfront:ListInvalidations",
                "lambda:ListEventSourceMappings",
                "sqs:DeleteQueue",
                "lambda:PublishVersion",
                "cloudfront:ListDistributionsByWebACLId",
                "cloudfront:ListCloudFrontOriginAccessIdentities",
                "s3:GetBucketTagging",
                "s3:PutAccelerateConfiguration",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "lambda:CreateEventSourceMapping",
                "lambda:UntagResource",
                "cloudfront:CreateCloudFrontOriginAccessIdentity",
                "amplify:GetBranch",
                "iam:PassRole",
                "lambda:ListTags",
                "s3:PutBucketTagging",
                "iam:DeleteRolePolicy",
                "acm:ListCertificates",
                "cloudfront:UpdateDistribution",
                "sqs:SetQueueAttributes",
                "amplify:UpdateApp",
                "cloudfront:UntagResource",
                "lambda:GetFunction",
                "cloudfront:ListDistributionsByLambdaFunction",
                "lambda:UpdateFunctionConfiguration",
                "amplify:UpdateBranch",
                "cloudfront:CreateDistribution",
                "cloudfront:ListPublicKeys",
                "iam:CreateServiceLinkedRole",
                "cloudfront:ListDistributions",
                "cloudfront:ListFieldLevelEncryptionProfiles",
                "s3:PutBucketPolicy",
                "sqs:CreateQueue",
                "cloudfront:ListStreamingDistributions"
            ],
            "Resource": "*"
        }
    ]
}

Then I attached this newly created policy into the role. So the role look like this:

Build the stuff then get the following error

2021-12-22T15:33:14.842Z [INFO]: Done in 97.04s.
2021-12-22T15:33:14.846Z [INFO]: Starting SSR Build...
2021-12-22T15:37:55.449Z [ERROR]: AccessDenied: Access Denied
                                  at Request.extractError (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/services/s3.js:699:35)
                                  at Request.callListeners (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
                                  at Request.emit (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
                                  at Request.emit (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/request.js:686:14)
                                  at Request.transition (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/request.js:22:10)
                                  at AcceptorStateMachine.runTo (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/state_machine.js:14:12)
                                  at /root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/state_machine.js:26:10
                                  at Request.<anonymous> (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/request.js:38:9)
                                  at Request.<anonymous> (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/request.js:688:12)
                                  at Request.callListeners (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/sequential_executor.js:116:18)
                                  at Request.emit (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
                                  at Request.emit (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/request.js:686:14)
                                  at Request.transition (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/request.js:22:10)
                                  at AcceptorStateMachine.runTo (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/state_machine.js:14:12)
                                  at /root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/state_machine.js:26:10
                                  at Request.<anonymous> (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/request.js:38:9)
                                  at Request.<anonymous> (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/request.js:688:12)
                                  at Request.callListeners (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/sequential_executor.js:116:18)
                                  at callNextListener (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/sequential_executor.js:96:12)
                                  at IncomingMessage.onEnd (/root/.//node_modules/@sls-next/aws-s3/node_modules/aws-sdk/lib/event_listeners.js:335:13)
                                  at IncomingMessage.emit (events.js:412:35)
                                  at IncomingMessage.emit (domain.js:475:12)
                                  at endReadableNT (internal/streams/readable.js:1334:12)
                                  at processTicksAndRejections (internal/process/task_queues.js:82:21) {
                                  code: 'AccessDenied',
                                  region: null,
                                  time: 2021-12-22T15:37:55.189Z,
                                  requestId: '7YG3Y9H22YZY92YZ',
                                  extendedRequestId: 'e61XrGC0bWdFvy7vBWuTZh+yQvKjcdi2aih58fKSrh3xG1t75R5CzV/XuZqomjv72CJUiVOAxqc=',
                                  cfId: undefined,
                                  statusCode: 403,
                                  retryable: false,
                                  retryDelay: 45.0836004027408
                                  }
Terminating logging...

I attach my amplify.yml as well, not sure is it because of this(Note: This is work previously):

version: 1
frontend:
  phases:
    preBuild:
      commands:
        - yarn install
        - nvm install 14.18.1
        - nvm use 14.18.1
        - |-
          if [ -f yarn.lock ]; then
           yarn
          elif [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
           npm ci
          else
           npm install
          fi
    build:
      commands:
        - yarn run build
  artifacts:
    baseDirectory: .next
    files:
      - "**/*"
  cache:
    paths:
      - node_modules/**/*
      - $(npm root --global)/**/*

My code is able to build in local and also the build logs shown my code is done being built. Just when deploy it keep ACCESS DENIED. I even add AdministratorAccess policy into the role, but still the same.

The very funny part is, before this, I have deploy Nextjs endless of time using the same role, different project, all successfully deployed, but TODAY, it have this error, I dont know why.

Can anybody tell me why it is still Access denied even though I already attached the policy stated here https://github.com/aws-amplify/amplify-console/blob/main/FAQ.md#error-accessdenied-access-denied? This is VERY PAINFUL, cause it happened suddenly

kenchoong · 2021-12-22T16:45:54Z

@timclark97 can you try this: https://github.com/aws-amplify/amplify-console/blob/master/FAQ.md#error-accessdenied-access-denied

Already try this sir, I even detached AdministratorAccess to the role, but still not success

kenchoong · 2021-12-22T19:10:19Z

I think found the root cause, which is this #2086 (comment).

The problem is my account cannot enable Transfer Acceleration at all for ANY BUCKET. Even a newly created bucket in S3 console, also cannot enabled that, having the same ACCESS Denied error in S3 console. Therefore the SSR deployment always cannot deploy to CloudFront although the service role having AdminstratorAccess.

So the question now is, where to get help to solve this? How to solve this? What should I do? Can I disable the transfer acceleration thing?

kenchoong · 2021-12-22T20:30:09Z

I think found the root cause, which is this #2086 (comment).

The problem is my account cannot enable Transfer Acceleration at all for ANY BUCKET. Even a newly created bucket in S3 console, also cannot enabled that, having the same ACCESS Denied error in S3 console. Therefore the SSR deployment always cannot deploy to CloudFront although the service role having AdminstratorAccess.

So the question now is, where to get help to solve this? How to solve this? What should I do? Can I disable the transfer acceleration thing?

Ok, for anyone who experience this, fastest way to solve this is: Deploy your app into Amplify of a new AWS account (found out after 5 hours pulling the hair off). And the S3 Transfer Acceleration problem seems no way to solve. Good luck

nathantqn · 2022-02-08T10:32:02Z

I've just created my new AWS account and followed exactly what is suggested above with no luck. I use the recommended permissions and attached the new created policy to the role. Hi @ferdingler, could you please help us to check this issue?

nallibtermatrac · 2022-02-10T04:07:05Z

Same here. I followed every step in Amplify Studio.
When I deploy... permission denied.
AccessDenied
Access Denied

GabrielOnike · 2022-02-17T02:03:29Z

Same Issue; ACCESS DENIED during FrontEnd Stage build

GabrielOnike · 2022-02-28T07:14:31Z

Same Issue; ACCESS DENIED during FrontEnd Stage build

If your build works locally but fails on Amplify, you probably need to try it on a new account. That was my final solution.

Sucks especially when you're hosting an app suite under one account.
In my case i tried different policies and roles and also used the policy in the troubleshoot. Also, Tried changing the regions, Tried changing basedirectory, Tried Full Admin privileges for s3, tried to rework the transfer Acceleration but some things are not fully accessible for free Tier such as that and Support.

I suspect that if one has another installation on the account such as a separate private VPS instance like LightSail or such, its rules might affect other installations on the same account. In that case, this is an internal problem. I had to escalate to support.

ferdingler · 2022-04-20T01:16:04Z

Hi, this issue happens only for new AWS accounts, as it turns out that S3 transfer acceleration takes a while to be available for a new account to prevent abuse of the feature. While we figure out a solution, please contact AWS Support and ask them to enable S3 Transfer Acceleration for you.

antoniogiordano · 2022-07-13T09:09:58Z

I want to share my experience as well, since nothing worked for me until an AWS assistance guy helped me.
Basically I was using a different pair of AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in my .env file.
Since I was not setting them by the Amplify Console, they passed their checks (you cannot use AWS_ keys as env vars).
Since my pair of keys had only some specific permissions, these keys of mine were replacing the ones set by Amplify in order to deploy the application (because amplify environment to deploy and the nextjs app share it).
To fix I only had to rename my keys in my .env file to something else, and it worked as a charm!
I'm using node 14.18.1 and next 12.1.6 btw.

calavera · 2022-12-22T18:55:29Z

Hi folks,

We launched better support for Next applications back in October. The new stack eliminates the problem described in this issue.

I'd recommend you to check out the blog post and update your apps to take advantage of new Next features:

https://aws.amazon.com/blogs/mobile/amplify-next-js-13/

github-actions · 2022-12-22T18:55:53Z

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

github-actions · 2022-12-22T19:02:07Z

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

siegerts added the ssr Server Side Rendering feature label May 25, 2021

siegerts added the pending-investigation label May 25, 2021

swaminator changed the title ~~Next js deploy error~~ Next js deploy error [AccessDenied] Sep 8, 2021

This was referenced Dec 22, 2021

Build fails with "Starting SSR Build... ERROR: AccessDenied: Access Denied" #2192

Closed

Amplify frontend build returns Starting SSR Build... [ERROR]: AccessDenied: Access Denied #2086

Closed

ferdingler self-assigned this Apr 20, 2022

calavera closed this as completed Dec 22, 2022

github-actions bot added the archived This issue has been locked. label Dec 22, 2022

github-actions bot locked and limited conversation to collaborators Dec 22, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Next js deploy error [AccessDenied] #1876

Next js deploy error [AccessDenied] #1876

sudarshann commented May 25, 2021

github-actions bot commented May 25, 2021

nimacks commented May 25, 2021 •

edited

Loading

sudarshann commented May 25, 2021

sunglee commented Jun 5, 2021 •

edited

Loading

JimLiu commented Jun 19, 2021

zugger14 commented Jul 24, 2021

Athena96 commented Jul 27, 2021

zugger14 commented Jul 28, 2021

tmrclark commented Sep 6, 2021

swaminator commented Sep 8, 2021

tmrclark commented Sep 8, 2021

ferdingler commented Sep 8, 2021

kenchoong commented Dec 22, 2021 •

edited

Loading

kenchoong commented Dec 22, 2021

kenchoong commented Dec 22, 2021 •

edited

Loading

kenchoong commented Dec 22, 2021 •

edited

Loading

nathantqn commented Feb 8, 2022

nallibtermatrac commented Feb 10, 2022

GabrielOnike commented Feb 17, 2022

GabrielOnike commented Feb 28, 2022

ferdingler commented Apr 20, 2022 •

edited

Loading

antoniogiordano commented Jul 13, 2022

calavera commented Dec 22, 2022

github-actions bot commented Dec 22, 2022

github-actions bot commented Dec 22, 2022

Next js deploy error [AccessDenied] #1876

Next js deploy error [AccessDenied] #1876

Comments

sudarshann commented May 25, 2021

github-actions bot commented May 25, 2021

nimacks commented May 25, 2021 • edited Loading

sudarshann commented May 25, 2021

sunglee commented Jun 5, 2021 • edited Loading

JimLiu commented Jun 19, 2021

zugger14 commented Jul 24, 2021

Athena96 commented Jul 27, 2021

zugger14 commented Jul 28, 2021

tmrclark commented Sep 6, 2021

swaminator commented Sep 8, 2021

tmrclark commented Sep 8, 2021

ferdingler commented Sep 8, 2021

kenchoong commented Dec 22, 2021 • edited Loading

kenchoong commented Dec 22, 2021

kenchoong commented Dec 22, 2021 • edited Loading

kenchoong commented Dec 22, 2021 • edited Loading

nathantqn commented Feb 8, 2022

nallibtermatrac commented Feb 10, 2022

GabrielOnike commented Feb 17, 2022

GabrielOnike commented Feb 28, 2022

ferdingler commented Apr 20, 2022 • edited Loading

antoniogiordano commented Jul 13, 2022

calavera commented Dec 22, 2022

github-actions bot commented Dec 22, 2022

⚠️COMMENT VISIBILITY WARNING⚠️

github-actions bot commented Dec 22, 2022

nimacks commented May 25, 2021 •

edited

Loading

sunglee commented Jun 5, 2021 •

edited

Loading

kenchoong commented Dec 22, 2021 •

edited

Loading

kenchoong commented Dec 22, 2021 •

edited

Loading

kenchoong commented Dec 22, 2021 •

edited

Loading

ferdingler commented Apr 20, 2022 •

edited

Loading