Skip to content

Lambda layers fails (access denied) to deploy in AWS Gov Cloud after 3.77.0 #689

@k-weaver

Description

@k-weaver

Describe what happened:
I had setup the datadog-forwarder lambda using IaC and pulling in the latest version of the template. Everything worked fine, deployment was successful.

Testing out some functionality, I downed the stack to have my IaC re-create everything. This forced an update to the template as a new version was released between my initial deploy and now my testing. The deployment failed with the following error:

["Resource handler returned message: \"User: arn:aws-us-gov:sts::<removed>:assumed-role/<removed> is not authorized to perform: lambda:GetLayerVersion on resource: arn:aws-us-gov:lambda:us-gov-west-1:002406178527:layer:Datadog-Forwarder:34 because no resource-based policy allows the lambda:GetLayerVersion action (Service: Lambda, Status Code: 403, Request ID: <removed>)\" (RequestToken: <removed>, HandlerErrorCode: AccessDenied)"]

Hard coding the version in the S3 URL to 3.77.0 and re-deploying the template works as expected. I also attempted version 3.79.0 and hit the same error as shown above that was seen with latest.

This seems to indicate a change between 3.77.0 and 3.79.0 broke this integration. Disabling the layers is also a workaround and using latest with layers disabled will deploy successfully.

Describe what you expected:
Successful deployment of the Cloudformation template.

Steps to reproduce the issue:
Deploy the latest version of the stack using the S3 URL (https://datadog-cloudformation-template.s3.amazonaws.com/aws/forwarder/latest.yaml) in either us-gov-west-1 or us-gov-east-1. When the stack gets to the Lambda deployment section an error will be thrown.

EDIT:
This is not an issue in commercial regions of AWS. I am able to deploy without issue to us-east-1, appears to be only gov cloud where the issue is being seen.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions