An error occurred: CustomDashresourceDashapigwDashcwDashroleLambdaFunction - AccessDeniedExceptionnull (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException; Request ID: b797d580-4a94-4211-9e4c-42d291606654; Proxy: null).

[yeukfei02]

An error occurred: CustomDashresourceDashapigwDashcwDashroleLambdaFunction - AccessDeniedExceptionnull (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException; Request ID: b797d580-4a94-4211-9e4c-42d291606654; Proxy: null).

I just change my sls dashboard provider and set to each project in sls dashboard..and I already set to correct aws accesskey and secret access key in to ~/.aws/credential

btw how to fix that???

thanks.

[yeukfei02]

another error

An error occurred: GetJokeByTypeLambdaVersionKCZ9ZhZlsotSAqUK3fbFMZGkAjkeuISEXhLnM3utoc - AccessDeniedExceptionnull (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException; Request ID: f73072ae-9899-4489-b780-64e84c19c5a0; Proxy: null).

[yeukfei02]

how to enable back my lambda access???
btw i m using my root aws account

[yeukfei02]

looks like it is because i remove the old deployment profile..and now using the provider in sls dashboard.

Your Profiles have been converted into Providers, a simpler way to store your AWS account credentials. Please relink your Providers to your AWS accounts and use the latest version of the Serverless Framework.

the dashboard says..but I already update to the latest sls framework in my project and deploy

[yeukfei02]

update: finally I decide to move all my serverless project to another dashboard + aws account

not sure why..before the original dashboard just remove the existing key and added a new key to the provider..
sls deploy not working..then I do sls remove..and getting lots of error...

now my original aws account still stuck cannot remove the lambda func..keep saying access denied..

[yeukfei02]

what I guess would be deployment profile is now deprecated..and move to new provider and parameters in sls dashboard
if we don't change manually is all ok, because sls already handled for us.
in my case, because I manually modify and re add a new aws accesskey + secretkey to provider

and my project are using an old version of sls like in v2.2x.0, so that's may face this error......

[pgrzesik]

Hello @yeukfei02 - did you change the AWS account when setting up provider with access and secret keys?

[yeukfei02]

@pgrzesik

no basically same aws account..just remove old access and secret keys from aws and then add a new one
after that, i go sls dashboard and remove the aws connection and add a new one

[astuyve]

@yeukfei02 Thanks for reaching out! Unfortunately I'm having a very difficult time understanding your bug report.

Put simply: this error is occurring because the configured credentials for AWS are either missing or invalid.

A few things that would help me assist you:

• Can you share your serverless.com organization name?
• Can you share the output of serverless --version? Please try updating to the latest version of the framework and plugin (npm i -g serverless) and trying again.
• Are you using the providers built in to the dashboard? Or a local ~/.aws/credentials file? Both?

If you're having trouble setting up your AWS provider in the dashboard, you can always use local credentials with the --use-local-credentials flag (supported on plugin version 4.5.0 and newer)

Once you've upgraded, I'd suggest creating a new AWS provider via the role arn feature in the dashboard, and linking it to your application. This allows our backend to interact with your AWS account using temporary, short-term credentials. You can learn more about that in our documentation

Finally, I noticed you opened another issue
I see you've created an AWS access key ID and AWS secret access key as parameters for your app.

I'd strongly urge you to remove those credentials and instead rely on granting permissions to the IAM execution role for your function. This is a security issue, because as you stated in this ticket, your provider credentials have root access.

If somehow the function inadvertently exposed those variables, an adversary could gain complete control of your AWS account. The best practice is that your lambda function execution role contains the minimum permissions necessary to perform its function.

[yeukfei02]

@astuyve

Thanks for your reply!

I have another question, do I need to add role arn provider if I already add the aws access and secret key provider?

I have configured the ~/.aws/credentials and sls providers.

My organisation name is yeukfei02..but today I just try remove the acct and re create it.. This looks like the relink provider to aws account..the blue div message disappear.

But I still unable to manually delete lambda function in aws console.. because if I rerun sls deploy, the cloudformation stack I see the error would be the lambda func already exists.

So it needs to be delete the lambda function first..and I already created an aws support ticket.

Finally thanks for the iamrole advice to replace the environment variables..I will consider change it.

Thanks for your help!

[astuyve]

@yeukfei02 Absolutely, thanks for your detailed reply!

I have another question, do I need to add role arn provider if I already add the aws access and secret key provider?
Nope, either will work. Role ARNs are simply preferred as they offer stronger security guarantees.

I have configured the ~/.aws/credentials and sls providers.
Okay, and were you able to upgrade your version of the framework and plugin?

But I still unable to manually delete lambda function in aws console.. because if I rerun sls deploy, the cloudformation stack I see the error would be the lambda func already exists.
Hmmm, it seems that somehow your lambda function was perhaps created outside of the cloudformation stack which Serverless is attempting to provision, hence the error. I can't make any real recommendation here, as I lack the context of this lambda function and the API it implements.

My first suggestion would be to try creating a brand new app using the provider you created. The CLI will output a message telling you if it is using the Provider you configured, or local credentials from your machine:

If that works, and you can deploy a new app, then my best guess would be that you need to remove the orphaned resources that your previous application left, and then redeploy your new stack. But I can't really recommend that without understanding the context (IE: is this serving production traffic or other mission-critical applications).

Best to work with AWS support, who can peek inside your account and give better advice.

[Jonniedev]

Turn out this is amazon bug.

Anyone that stumbles upon this issue,
try to use AWS console, and manually create a Lambda function.

In my case I got the same error - which means this has nothing to do with serverless ( or cloudformation). and this is Amazon bug.
I would suggest:

• to try contacting amazon support
• or just move everything to another AWS sub account.

(moving region does not helps, I tried.)

[yeukfei02]

@Jonniedev

Yes I tried to deploy my lambda func from ap-southeast-1 to us-east1 still fail

So I decide use another aws account..