-
Notifications
You must be signed in to change notification settings - Fork 390
Description
Describe what happened:
I had setup the datadog-forwarder lambda using IaC and pulling in the latest
version of the template. Everything worked fine, deployment was successful.
Testing out some functionality, I downed the stack to have my IaC re-create everything. This forced an update to the template as a new version was released between my initial deploy and now my testing. The deployment failed with the following error:
["Resource handler returned message: \"User: arn:aws-us-gov:sts::<removed>:assumed-role/<removed> is not authorized to perform: lambda:GetLayerVersion on resource: arn:aws-us-gov:lambda:us-gov-west-1:002406178527:layer:Datadog-Forwarder:34 because no resource-based policy allows the lambda:GetLayerVersion action (Service: Lambda, Status Code: 403, Request ID: <removed>)\" (RequestToken: <removed>, HandlerErrorCode: AccessDenied)"]
Hard coding the version in the S3 URL to 3.77.0
and re-deploying the template works as expected. I also attempted version 3.79.0
and hit the same error as shown above that was seen with latest
.
This seems to indicate a change between 3.77.0 and 3.79.0 broke this integration. Disabling the layers is also a workaround and using latest with layers disabled will deploy successfully.
Describe what you expected:
Successful deployment of the Cloudformation template.
Steps to reproduce the issue:
Deploy the latest version of the stack using the S3 URL (https://datadog-cloudformation-template.s3.amazonaws.com/aws/forwarder/latest.yaml) in either us-gov-west-1 or us-gov-east-1. When the stack gets to the Lambda deployment section an error will be thrown.
EDIT:
This is not an issue in commercial regions of AWS. I am able to deploy without issue to us-east-1, appears to be only gov cloud where the issue is being seen.