search

mooyoul / serverless-latest-layer-version

A serverless plugin that replaces 'latest' version tag to actual lambda layer version
MIT License
25 stars 9 forks source link

Not working with cross-account lambda layers #31

Open yzAlvin opened 2 years ago

yzAlvin commented 2 years ago

hello, maybe aws changed something, but for me this is not working for cross-account lambda layers

This is the error I get when trying to deploy my serverless stack

arn:aws:sts::xxxxxxx:assumed-role/zzzzzzz/zzzzzzz is not authorized to perform: lambda:ListLayerVersions on resource: arn:aws:lambda:ap-southeast-2:yyyyyyyy:layer:layer-name because no resource-based policy allows the lambda:ListLayerVersions action

To try and fix the above error I have tried:

aws lambda add-layer-version-permission \
              --layer-name arn:aws:lambda:ap-southeast-2:yyyyyyyy:layer:layer-name \
              --statement-id ListVersions \
              --action lambda:ListLayerVersions  \
              --principal xxxxxxx \
              --version-number 1

we get this error: An error occurred (ValidationException) when calling the AddLayerVersionPermission operation: 1 validation error detected: Value 'ListLayerVersions' at 'action' failed to satisfy constraint: Member must satisfy regular expression pattern: lambda:GetLayerVersion, so not sure how we can fix that error with lambda:ListLayerVersions if we are only allowed to add lambda:GetLayerVersion