try to check: s3 -> bucket -> configuration -> events delete existing events it helps when you cannot deploy sls application

@jazwiecki - The error you’re seeing it unrelated to S3 bucket - if you don’t specify a role for Lambda functions to use, one will be created for you by Serverless Framework and used by your functions. You can avoid that by specifying an existing role. You can read more about it here: https://www.serverless.com/framework/docs/providers/aws/guide/iam#iam

@d3m0n1n it appears that role you list at iam.deploymentRole doesn’t have "lambda.amazonaws.com" listed as one of the trusted principal services

Hi All,

I have something like that error, my configuration serverless it’s the following:

service: NAMESERVICE

provider:
  name: aws
  runtime: dotnetcore3.1
  timeout: 10
  autoPublishAlias: live
  region: us-east-2 # AWS region

  deploymentBucket:
    name: BUCKETDEPLOY

  iam: 
    role: NAMEROLE
    deploymentRole: DEPLOYROLE

  vpc:
    securityGroupIds:
      - SECURITYGROUPID
    subnetIds:
      - SUBNETIDID

package:
    artifact: CACHEPACKAGE
  
functions:
  eventRequest:
    name: NAMELAMBDA
    handler: HANDLERAPI
    events:
      - s3:
          bucket: NAMES3
          event: s3:ObjectCreated:*
          rules:
            - prefix: waves/
            - suffix: .csv
          existing: true

But at the time of deploying it gave me the following error:

Serverless Error ----------------------------------------

An error occurred: CustomDashresourceDashexistingDashs3LambdaFunction - Resource handler returned message: “The role defined for the function cannot be assumed by Lambda. (Service: Lambda, Status Code: 400, Request ID: f079df33-4ddf-4543-bb49-517b2fd43fc7, Extended Request ID: null)” (RequestToken: bff75f0e-1f65-795c-3b03-84f7192b2913, HandlerErrorCode: InvalidRequest).

Please, i need your help

If anybody faces the issue bellow AND is using custom cfn role for deployment, please read solution here after.

Serverless Error ---------------------------------------

ServerlessError: An error occurred: S3uploadedCustomS31 - Failed to create resource. Access Denied See details in CloudWatch Log: 2019/10/01/[$LATEST]0d3cb59b1731410db457c06299c4df35.

Ensure your custom cfn role has the following actions allowed :

• the following 4 actions related to lambda trigger configuration handled by the customResource lambda doing provisioning.

  • s3:PutBucketNotification
  • s3:GetBucketNotification
  • lambda:AddPermission
  • lambda:RemovePermission

• the following 2 actions to ensure cfn can create a role for the lambda above and pass its allowed actions to the newly created role

  • iam:CreateRole
  • iam:PassRole

In my case I had to change

    events:
      - s3:
        existing: true

to

    events:
      - s3:
          existing: true

(notice the two extra spaces)

It’s weird how the error message is so cryptic though

We are facing same error with existing:true , seems like current workaround is only using manual trigger creation in AWS Lambda console

We ran into this issue. Our deployment role does not have iam:CreateRole so if we try to create triggers on an existing bucket we get an error when SLS tries to create IamRoleCustomResourcesLambdaExecution.

It looks like this role is created as the lambda execution role for a custom lambda that adds the event trigger to S3. It is always created if you’re using an existing bucket. See here and here.

There’s an analogous feature in the console where it grant S3 the permissions to invoke the bucket.

We solved this problem by manually adding the event triggers after deploying the lambda.

If you are looking for future features it would be nice if there was a way to specify the execution role for the custom lambda.

Hm I guess this is in relation with https://github.com/serverless/serverless/issues/12133 and PR https://github.com/serverless/serverless/pull/12146

Hi @medikoo,

But the truth is that the doploymentrole has the trust permissions

the problem is when I remove “existing: true” in serverless.yml, cloudformation try to create resource s3 that exists, right now and when I use “existing: true”, cloudformation fails giving the above mentioned error

Did you manage to solve this? I still have this issue

I am getting an error when existing:true creating the internal Iam role, as all roles created in my aws account should have the permission boundary defined. An error occurred: IamRoleCustomResourcesLambdaExecution - API: iam:CreateRole User: arn:aws:sts::xxx is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::yyy:role/xxx-IamRoleCustomResourcesLa-ZZZZ

Did anyone find a solution?

My apologies, figured out my issue was our CI server had an old version of serverless on it before the existing property was supported. It works as expected.