search

seasketch / geoprocessing

Serverless geoprocessing system
https://seasketch.github.io/geoprocessing
BSD 3-Clause "New" or "Revised" License
14 stars 3 forks source link

Error when deploying to a new AWS account #375

Open underbluewaters opened 4 days ago

underbluewaters commented 4 days ago

Looks like there are some permissions or setup-related work that isn't being handled by the CDK stack. Investigating...

gp-kiribati-reports: deploying... [1/1] gp-kiribati-reports: creating CloudFormation changeset... 6:05:40 PM | CREATE_FAILED | AWS::ApiGatewayV2::Stage | GpSocketApiStageD8D179F5 CloudWatch Logs role ARN must be set in account settings to enable logging (Service: AmazonApiGatewayV2; Status Code: 400; Error Code: BadRequestException; Request ID: 9d4c542d-0341-47df-b829-30e806837ef0; Proxy: null)

❌ gp-kiribati-reports failed: Error: The stack named gp-kiribati-reports failed creation, it may need to be manually deleted from the AWS console: ROLLBACK_COMPLETE: CloudWatch Logs role ARN must be set in account settings to enable logging (Service: AmazonApiGatewayV2; Status Code: 400; Error Code: BadRequestException; Request ID: 9d4c542d-0341-47df-b829-30e806837ef0; Proxy: null)

underbluewaters commented 4 days ago

I was able to resolve this by following these instructions (though they are a little out of date). https://coady.tech/aws-cloudwatch-logs-arn/

twelch commented 3 days ago

Thanks, couple questions, was this your first deploy that the error was produced? Did you do anything or enable any service or setting manually or otherwise that might have triggered it? How did you fix it exactly did you manually set something?

I’ve never seen this in my deploys even a week ago to test bleeding edge v7 code. I can see if it comes up on my next round, if not I might need more info to reproduce it. Thanks

underbluewaters commented 3 days ago

Sorry I didn't realize that probably wasn't clear from the description. This is with a brand-new AWS account, not the SeaSketch one. So there was some general CDK setup that I wasn't expecting, though it's API Gateway specific so it's not something that CDK calls out to the user. I should probably just make a note in the docs myself since I had to go through it recently. Something like:

In order for CDK to deploy geoprocessing functions on your AWS Account, it is necessary to specify 
an IAM Role which allows API Gateway to log debugging information to AWS CloudWatch. This can be 
accomplished by logging into the AWS console, switching to the region where you would like to deploy 
your geoprocessing function, and configuring this role 
[as described here](https://coady.tech/aws-cloudwatch-logs-arn/).
twelch commented 3 days ago

Makes sense, the words were in the title I just didn’t pick up on what it meant.