Deploy failed: AccessDeniedException: Resource is not in the state updateFunctionPropertiesToFinish

[Ryce]

Greetings,

We have been using github actions to continuously deploy our CDK infrastructure onto AWS.

Previously, we had the root aws access key and secret configured in the GH Secrets in order to deploy but I have now changed these to have special purpose IAM User accounts to lock down the permissions to reduce risk of someone potentially getting access to those keys.

The deployment works fine and the new Infra is up and running but the deployment fails with the error below.

❌  dev failed: AccessDeniedException: Resource is not in the state updateFunctionPropertiesToFinish
    at Object.extractError (/usr/lib/node_modules/aws-cdk/lib/index.js:31:20584)
    at Request.extractError (/usr/lib/node_modules/aws-cdk/lib/index.js:31:39947)
    at Request.callListeners (/usr/lib/node_modules/aws-cdk/lib/index.js:31:76551)
    at Request.emit (/usr/lib/node_modules/aws-cdk/lib/index.js:31:75999)
    at Request.emit (/usr/lib/node_modules/aws-cdk/lib/index.js:31:1[82](https://github.com/MavaApp/cdk/actions/runs/4026821071/jobs/6921794878#step:17:83)276)
    at Request.transition (/usr/lib/node_modules/aws-cdk/lib/index.js:31:175828)
    at AcceptorStateMachine.runTo (/usr/lib/node_modules/aws-cdk/lib/index.js:31:140700)
    at /usr/lib/node_modules/aws-cdk/lib/index.js:31:141030
    at Request.<anonymous> (/usr/lib/node_modules/aws-cdk/lib/index.js:31:176120)
    at Request.<anonymous> (/usr/lib/node_modules/aws-cdk/lib/index.js:31:182351) {
  code: 'ResourceNotReady',
  time: 2023-01-27T17:39:40.136Z,
  requestId: '62d62592-0d71-436c-820d-[84](https://github.com/***/***/actions/runs/***/jobs/***#step:17:85)35a0c7ccc3',
  retryable: false,
  originalError: [Object],
  statusCode: 403,
  retryDelay: 5000
}

The only info I could find is this #21305 - I am guessing this is some waiter function that is supposed to keep the CDK process running until the new stack has been deployed but for some reason it does not have access to it? How would I add that permission?

[Ryce]

I had a hunch so I just tried to grant full lambda permissions. Now the error looks like this:

❌  dev failed: AccessDeniedException: Resource is not in the state deploymentToFinish
    at Request.extractError (/usr/lib/node_modules/aws-cdk/lib/index.js:31:20584)
    at Request.callListeners (/usr/lib/node_modules/aws-cdk/lib/index.js:31:76551)
    at Request.emit (/usr/lib/node_modules/aws-cdk/lib/index.js:31:75999)
    at Request.emit (/usr/lib/node_modules/aws-cdk/lib/index.js:31:1[82](https://github.com/MavaApp/cdk/actions/runs/4027155349/jobs/6922538647#step:17:83)276)
    at Request.transition (/usr/lib/node_modules/aws-cdk/lib/index.js:31:175828)
    at AcceptorStateMachine.runTo (/usr/lib/node_modules/aws-cdk/lib/index.js:31:140700)
    at /usr/lib/node_modules/aws-cdk/lib/index.js:31:141030
    at Request.<anonymous> (/usr/lib/node_modules/aws-cdk/lib/index.js:31:176120)
    at Request.<anonymous> (/usr/lib/node_modules/aws-cdk/lib/index.js:31:182351)
    at Request.callListeners (/usr/lib/node_modules/aws-cdk/lib/index.js:31:76719) {
  code: 'ResourceNotReady',
  time: 2023-01-27T18:28:14.136Z,
  requestId: '2a6c06ad-[90](https://github.com/***/***/actions/runs/***/jobs/***#step:17:91)[91](https://github.com/***/***/actions/runs/***/jobs/***#step:17:92)-4dbd-acc4-24d4f2f1a82c',
  retryable: false,
  originalError: [Object],
  statusCode: 400,
  retryDelay: 10000
}

[peterwoodworth]

Answer: I'm not sure which resource is throwing this error, but regardless this seems to be a strange service error. If you have steps to reproduce I'd love to hear, otherwise there's not much we can help you with here since this error isn't thrown by us.

[github-actions]

Hello! A team member has marked the above comment as the likely answer to this discussion thread.

• If you agree, please upvote that comment, or click on Mark as answer. I will automatically mark the comment as the answer next time I check.

• If this answer does not help you, please downvote the answer instead and let us know why it was not helpful. I will add a label to this discussion to gain attention from the team.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[richardgroves]

Getting the same error: working through the CDK workshop (https://cdkworkshop.com/30-python/30-hello-cdk/300-cdk-watch.html ) - at the cdk watch section. Only difference is that I've been trying to get the minimal permissions - so the user being used does not have 'PowerUser' or 'AdminAccess' etc. - each bootstrap/deploy/hotswap I've manually added the minimum (or about minimum) permission needed to progress, but the error here doesn't indicate which permission is missing.

Changing the lambda function code triggers the problem, so some permission error there as mentioned above is probably the cause. My user has this specific lambda permission (needed to get cdk deploy --hotswap working):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "lambda:UpdateFunctionCode",
            "Resource": "*"
        }
    ]
}

 ❌ Deployment failed: AccessDeniedException: Resource is not in the state updateFunctionPropertiesToFinish
    at Object.extractError (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:33432)
    at Request.extractError (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:52797)
    at Request.callListeners (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:91437)
    at Request.emit (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:90885)
    at Request.emit (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:199281)
    at Request.transition (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:192833)
    at AcceptorStateMachine.runTo (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:157705)
    at /opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:158035
    at Request.<anonymous> (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:193125)
    at Request.<anonymous> (/opt/homebrew/lib/node_modules/aws-cdk/lib/index.js:379:199356) {
  code: 'ResourceNotReady',
  '[Message]': 'See error.Message for details.',
  time: 2024-03-26T17:37:50.522Z,
  requestId: 'b26c41a4-f79f-4eb6-b797-6e8f9f89a8a9',
  retryable: false,
  originalError: [Object],
  statusCode: 403,
  retryDelay: 1000
}

[seanmcclory]

I was getting the same error with cdk watch. Adding the action lambda:GetFunction to the IAM policy appears to have fixed it for me.

 ❌ Deployment failed: AccessDeniedException: Resource is not in the state updateFunctionPropertiesToFinish
    at Object.extractError (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:33432)
    at Request.extractError (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:52797)
    at Request.callListeners (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:91452)
    at Request.emit (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:90900)
    at Request.emit (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:199296)
    at Request.transition (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:192848)
    at AcceptorStateMachine.runTo (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:157720)
    at /home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:158050
    at Request.<anonymous> (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:193140)
    at Request.<anonymous> (/home/me/.nvm/versions/node/v20.12.0/lib/node_modules/aws-cdk/lib/index.js:382:199371) {
  code: 'ResourceNotReady',
  '[Message]': 'See error.Message for details.',
  time: 2024-03-30T20:01,
  requestId: '5bcb5b53-60b2-44e6-966e-37cbd6e',
  retryable: false,
  originalError: [Object],
  statusCode: 403,
  retryDelay: 1000
}

$ cdk --version
2.134.0 (build 265d769)