Exception while deploying lambda function using ASK CLI

Question

I was trying to Build a fact skill as per instructions given in https://github.com/alexa/skill-sample-nodejs-fact.

Cloned repository, initialized the ASK CLI and installed npm dependencies.

Then I tried to deploy the skill and the lambda function in one step by running the command ask deploy. But it shows AccessDeniedException. Please help me to resolve the issue

-------------------- Create Skill Project --------------------

Profile for the deployment: [default] Skill Id: amzn1.ask.skill.1234ab-1234

Skill deployment finished. Model deployment finished. Create Lambda error. AccessDeniedException: User: arn:aws:iam::12345678:user/ASK_CLI_USER is not authorized to perform: lambda:CreateFunction on resource: arn:aws:lambda:us-east-1:12345678:function:what_name_you_want_to_name_the_lambda

Please Note:

Installed and set up ASK CLI following instructions in the below link: https://developer.amazon.com/docs/smapi/quick-start-alexa-skills-kit-command-line-interface.html
Set Up Credentials for an Amazon Web Services (AWS) Account CLI following instructions in the below link: https://developer.amazon.com/docs/smapi/set-up-credentials-for-an-amazon-web-services-account.html

Created a user ASK_CLI_USER and created a new policy with the permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:GetRole",
        "iam:AttachRolePolicy",
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam:::role/ask-"
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:AddPermission",
        "lambda:CreateFunction",
        "lambda:GetFunction",
        "lambda:UpdateFunctionCode",
        "lambda:ListFunctions"
      ],
      "Resource": "arn:aws:lambda:::function:ask-"
    },
    {
      "Effect": "Allow",    
      "Action": [
        "logs:FilterLogEvents",
        "logs:getLogEvents",
        "logs:describeLogStreams"
      ],
      "Resource": "arn:aws:logs:::log-group:/aws/lambda/ask-"
    }
  ]
}

Viren · Accepted Answer · 2018-04-12 04:01:03Z

1

The resource you should be restricting to is "arn:aws:lambda:*:*:function:ask-*". It looks like you're missing the asterisks.

answered Apr 12, 2018 at 4:01

Viren

111 bronze badge

Sign up to request clarification or add additional context in comments.

Comments

FelixEnescu · Accepted Answer · 2018-01-25 09:42:04Z

0

It says pretty clear:

AccessDeniedException: User: arn:aws:iam::12345 678:user/ASK_CLI_USER is not authorized to perform: lambda:CreateFunction on resource: arn:aws:lambda:us-east-1:12345678:function:what_name_you_want_to_name_the_lambda

Go into your console and add proper permissions to user ASK_CLI_USER

answered Jan 25, 2018 at 9:42

FelixEnescu

5,2122 gold badges35 silver badges34 bronze badges

1 Comment

Sruthy Over a year ago

"lambda:CreateFunction" permission is already added to ASK_CLI_USER. { "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:GetFunction", "lambda:UpdateFunctionCode", "lambda:ListFunctions" ], "Resource": "arn:aws:lambda:::function:ask-" }

Collectives™ on Stack Overflow

Exception while deploying lambda function using ASK CLI

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related