TemplateURL must reference a valid S3 object to which you have access.

[charlesguse]

This is a Bug Report

Description

I have a Serverless project that can be deployed from other machines but not my own. Other Serverless projects deploy for me.

For bug reports:

• What went wrong?
  When running serverless deploy --stage production I get the error TemplateURL must reference a valid S3 object to which you have access. I have full admin access in the AWS account.

• What did you expect should have happened?
  serverless deploy --stage production should have properly deployed.

• What was the config you used?

service: pinger

provider:
  name: aws
  runtime: nodejs4.3
  cfLogs: true
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "s3:ListBucket"
        - "s3:GetObject"
      Resource: "arn:aws:s3:::trek10-pinger*"

functions:
  ping:
    handler: events/handler.handler
    timeout: 60
    memory: 1024
    events:
      - schedule: 
          rate: rate(1 minute)
          enabled: true

• What stacktrace or error message from your provider did you see?

C:\sandbox\trek10\pingdar>serverless deploy --stage production
Serverless: Packaging service...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading service .zip file to S3 (6.38 MB)...
Serverless: Updating Stack...

  Serverless Error ---------------------------------------

     TemplateURL must reference a valid S3 object to which
     you have access.

  Stack Trace --------------------------------------------

ServerlessError: TemplateURL must reference a valid S3 object to which you have access.
    at Response.req.send (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\lib\plugins\aws\provider\awsProvider.js:167:20)
    at Request.<anonymous> (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:355:18)
    at Request.callListeners (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\sequential_executor.js:105:20)
    at Request.emit (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\sequential_executor.js:77:10)
    at Request.emit (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:668:14)
    at Request.transition (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:22:10)
    at AcceptorStateMachine.runTo (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\state_machine.js:14:12)
    at C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\state_machine.js:26:10
    at Request.<anonymous> (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:38:9)
    at Request.<anonymous> (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:670:12)
    at Request.callListeners (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\sequential_executor.js:115:18)
    at Request.emit (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\sequential_executor.js:77:10)
    at Request.emit (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:668:14)
    at Request.transition (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:22:10)
    at AcceptorStateMachine.runTo (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\state_machine.js:14:12)
    at C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\state_machine.js:26:10

  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues

  Your Environment Information -----------------------------
     OS:                 win32
     Node Version:       6.9.1
     Serverless Version: 1.2.0

Additional Data

• Serverless Framework Version you're using:
  Serverless Version: 1.2.0
• Operating System:
  Windows 10 Pro Version 10.0.14393 Build 14393
• Stack Trace:

ServerlessError: TemplateURL must reference a valid S3 object to which you have access.
    at Response.req.send (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\lib\plugins\aws\provider\awsProvider.js:167:20)
    at Request.<anonymous> (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:355:18)
    at Request.callListeners (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\sequential_executor.js:105:20)
    at Request.emit (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\sequential_executor.js:77:10)
    at Request.emit (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:668:14)
    at Request.transition (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:22:10)
    at AcceptorStateMachine.runTo (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\state_machine.js:14:12)
    at C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\state_machine.js:26:10
    at Request.<anonymous> (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:38:9)
    at Request.<anonymous> (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:670:12)
    at Request.callListeners (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\sequential_executor.js:115:18)
    at Request.emit (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\sequential_executor.js:77:10)
    at Request.emit (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:668:14)
    at Request.transition (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\request.js:22:10)
    at AcceptorStateMachine.runTo (C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\state_machine.js:14:12)
    at C:\Users\Charlie\AppData\Roaming\npm\node_modules\serverless\node_modules\aws-sdk\lib\state_machine.js:26:10

• Provider Error messages:
  TemplateURL must reference a valid S3 object to which you have access.

[pmuens]

Thanks for reporting this @charlesguse 👍

From looking at your config my first assumption is that the iamRoleStatements for the S3 bucket might overwrite the permissions to access the core deployment bucket. Could you be more specific for the Resource definition (e.g. define which bucket thise IAM role statements should be applied to) or remove it at all and try again?

Thanks!

[charlesguse]

Thanks for the quick response @pmuens!

One thing I mentioned but didn't go into depth with is that my coworker can deploy this fine from his machine (Mac) and it is also being deployed from our GitLab instance (Ubuntu).

Also, the S3 deployment bucket has a bit of a different name pinger-production-serverlessdeploymentbucket-*

That being said, I still tested it. I removed the iamRoleStatements altogether and tried deploying it and got the same error.

[pmuens]

@charlesguse thanks for the additional information! 👍

That's really strange. Seems like it's windows related. We'll look into it.

/cc @eahefnawy

[charlesguse]

Let me know if you guys want me to test anything else. Thanks for looking into it.

[pmuens]

@charlesguse can you remove the whole stack (including the bucket) and re-deploy from scratch?

Are the deployment artifacts uploaded in the bucket if you get the error (it seems so according to the logs you get)?

Could you also take a look at the bucket settings in the AWS browser console? It seems that there's something misconfigured...

[charlesguse]

Hey, sorry I haven't gotten back to you yet @pmuens.

That environment isn't one I can commit to regularly but I will let you know as soon as I can commit to it again. I recently noticed my AWS CLI was a bit out of date. Could that be a culprit in some way? I am curious if that was somehow an issue but I won't know until I can deploy again.

[evanstachowiak]

@pmuens I'm also having the same issue now.

I deleted the serverless created bucket and recreated it in the appropriate region and I'm having the same error. I don't really want to destroy the whole stack, as this will regenerate a new API Gateway id. Anything else I could do to troubleshoot?

If I deploy the functions individually it also seems to work fine.

[pmuens]

@evanstachowiak thanks for confirming that you also face this issue.

It seems like it has something to do with the CloudFormation template which is uploaded to the S3 bucket. The deploy function command will push the code directly into the Lambda function without uploading it to the bucket.

Can you take a look at the buckets to see if the deployment bucket for your stack appears there? If so can you declare this bucket as your deploymentBucket in the provider section of your serverless.yml file (see: https://serverless.com/framework/docs/providers/aws/guide/serverless.yml/#serverlessyml-reference) and re-deploy? Furthermore you might also want to check the permissions of this bucket in the web console...

[str3tch]

I have also just encountered this same error.

It seems to be to do with the AWS iam role that you are deploying serverless with.

I switched to an admin role, and the error disappeared. Using a role that did not have iam rights (and a lot of other rights), I had this same issue.

I am still investigating and will try and figure out exactly what is missing from my role - but perhaps take a look at the differences in your role and the developer next to you who can deploy ok.

[pmuens]

@str3tch thanks for the response.

Yes, the IAM user Serverless uses to deploy needs administrator rights (see: https://serverless.com/framework/docs/providers/aws/guide/credentials#creating-aws-access-keys). Otherwise the infrastructure setup and therefore the deployment will fail.

[evanstachowiak]

thanks for the help guys, looks like it was indeed a permissions error.

Perhaps a more useful error message with the specific access errors would be helpful? I could see the access that was missing when i manually applied the update cloudformation stack.

[pmuens]

@evanstachowiak thanks fro getting back! Glad to hear, that it works.

Yes, maybe it's a good idea to "translate" the error message. /cc @eahefnawy

I'll close this issue for now as it seems to be a permission error (the docs outline how this can be fixed: https://serverless.com/framework/docs/providers/aws/guide/credentials#creating-aws-access-keys).

Please let us know if this issue still persist and we'll reopen. Cheers!