aws / aws/aws-sam-cli

`sam deploy` fails when using SSM Parameter for a Lambda Layer ARN

Open
#2,474 15 comments 5 reactions 0 assignees View on GitHub
area/deploy maintainer/need-followup
Dominant language
Python
Stars
6.7k
Forks
1.2k
Avg merge
1d 10h
Merged PRs (30d)
52

Description

### Description:
When you have a template that is set up using the following structure:

```yaml
...
Parameters:
MyLayerParameter:
Description: The SSM parameter name of the ARN of the Lambda Layer shared across components.
Type: AWS::SSM::Parameter::Value
....
Resources:
HelloWorld:
Type: AWS::Serverless::Function
Properties:
Runtime: python3.7
Handler: index.handler
CodeUri: ./src/hello_world
Layers: [ !Ref MyLayerParameter ]
```

This is perfectly deployable using `aws cloudformation deploy` however `sam deploy` will raise the following error:

```bash
Error: /environment/service/MyLayerArn is an Invalid Layer Arn.
```

So my guess is that sam expects the Layer to be an ARN (which is fair) but the type of the parameter is: `AWS::SSM::Parameter::Value` so, in this case, it should first resolve the SSM Parameter (or ignore it at all)

It looks similar to #1069 but there the `build` fails on the resolution of the parameter and a workaround is to provide a "dummy" ARN that would cause the build to run. This cannot be used with the `deploy` command because we actually want to point to the actual SSM Parameter.

### Steps to reproduce:

* Store the LayerARN in a parameter
* Deploy a stack with passing the SSM Parameter path and not the ARN

### Observed result:

> 2020-12-11 13:34:05,177 | 27 resources found in the template
> 2020-12-11 13:34:05,178 | Sending Telemetry: {'metrics': [{'commandRun': {'awsProfileProvided': False, 'debugFlagProvided': True, 'region': 'eu-west-1', 'commandName': 'sam deploy', 'duration': 1375, 'exitReason': 'InvalidLayerVersionArn', 'exitCode': 1, 'requestId': 'd7ae766c-2183-4b8b-a690-4eeb47ee2382', 'installationId': 'e741b3c2-9523-4a05-821d-de8ee1f419de', 'sessionId': '3f2f89cc-9c45-48b3-b58a-9443de63e98a', 'executionEnvironment': 'CLI', 'pyversion': '3.7.7', 'samcliVersion': '1.13.2'}}]}
2020-12-11 13:34:05,884 | HTTPSConnectionPool(host='aws-serverless-tools-telemetry.us-west-2.amazonaws.com', port=443): Read timed out. (read timeout=0.1)
> Error: /foo/core/ModelsLambdaLayerArn is an Invalid Layer Arn.

### Expected result:

I would expect that if the parameter is an SSM Parameter that is being resolved by CloudFormation, either sam does this before evaluation as well or it would skip the check when performing a deploy.

### Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: Mac OS X 11.0.1
2. `sam --version`: SAM CLI, version 1.13.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.