search

aws-samples / cloudfront-authorization-at-edge

Protect downloads of your content hosted on CloudFront with Cognito authentication using cookies and Lambda@Edge
https://aws.amazon.com/blogs/networking-and-content-delivery/authorizationedge-using-cookies-protect-your-amazon-cloudfront-content-from-being-downloaded-by-unauthenticated-users/
MIT No Attribution
461 stars 157 forks source link

Function must be in an Active state error on deploying the solution #245

Closed john-morton-smg closed 9 months ago

john-morton-smg commented 10 months ago

On deploying the solution I am receiving the error:

Resource handler returned message: "Invalid request provided: AWS::CloudFront::Distribution: The function must be in an Active state. The current state for function arn:aws:lambda:us-east-1:275504355335:function:serverlessrepo-smg-mihub-prod-HttpHeadersHandler-VmHTiYmHTEru:1 is Pending (Service: CloudFront, Status Code: 400, Request ID: 7ab44d1d-ec37-4223-9537-97554dfaccc7)" (RequestToken: 13051b14-fba8-1292-7938-e8c68f39b04f, HandlerErrorCode: InvalidRequest)

Screenshot:

20230830_AuthenicationAtEdgeError

This is happening with deployments to two different User Pools and App Clients. I am deploying in the region eu-west-1. The error was not occurring last week when doing a very similar deployment, so I believe it a general error affecting all deployments (at least in eu-west-1).

Could this be looked in to?

John Morton Science Museum Group

ottokruse commented 10 months ago

Thanks for the report! Will look into it

anthony-watkins commented 10 months ago

I am seeing the same error deploying from the serverless repo in us-east-2. I was able to deploy from the serverless repo successfully last month in the same region.

anthony-watkins commented 9 months ago

FYI, you can get around this by turning it into a two step deploy.

First run the template with Application Settings CreateCloudFrontDistribution = false. This will build all the lambdas and get them ready.

Then update the CloudFormation with CreateCloudFrontDistribution = true. This will create the CloudFront, attaching the now ready lambdas.

ottokruse commented 9 months ago

Nicely found. At least a work around until we fix this

john-morton-smg commented 9 months ago

Thanks for alerting me to the workaround. I have successfully deployed using that.

oynek commented 9 months ago

Same here! But thanks for the workaround! Seems to me that there is a timeout somewhere while creating the dependent resources.

ottokruse commented 9 months ago

Fixed as per release https://github.com/aws-samples/cloudfront-authorization-at-edge/releases/tag/v2.1.8

Thanks for your patience!