Layer not assignable to lambda when using Terraform

[viorel-ognean]

I am using Terraform to create my Lambda in eu-west-1.

If I try to use the vault-lambda-extension version 20 , then I get the following error:

Error: creating Lambda Function (function-name): operation error Lambda: CreateFunction, https response error StatusCode: 403, RequestID: redacted, api error AccessDeniedException: User: redacted is not authorized to perform: lambda:GetLayerVersion on resource: arn:aws:lambda:eu-west-1:634166935893:layer:vault-lambda-extension:20 because no resource-based policy allows the lambda:GetLayerVersion action with module.function_name.aws_lambda_function.generic, on .terraform/modules/function_name/main.tf line 177, in resource "aws_lambda_function" "generic": 177: resource "aws_lambda_function" "generic" {

Everything is working fine with vault-lambda-extension version 19

[fairclothjm]

Hello @viorel-ognean @tmatilai I am sorry you are having trouble. Can you confirm that this occurs in all regions for version 20 or is it only in eu-west-1? I don't see this happening in us-east-1 for example. Any more info would be appreciated! Thanks!

[tmatilai]

Hi @fairclothjm ,

This doesn't seem to be region specific. Version 20 fails for me also in the us-east-1. I haven't managed any Lambda layers, but feels like some resource policy issue.

And the issue is not Terraform specific. This works:

aws lambda --region us-east-1 get-layer-version --layer-name arn:aws:lambda:us-east-1:634166935893:layer:vault-lambda-extension --version-number 19

This fails with the access error:

aws lambda --region us-east-1 get-layer-version --layer-name arn:aws:lambda:us-east-1:634166935893:layer:vault-lambda-extension --version-number 20

Maybe you were testing with credentials in that 634166935893 account hosting the layer?

[fairclothjm]

@viorel-ognean @tmatilai Can you please try again? This should be resolved now.

[juancarlosjr97]

@fairclothjm I was getting the same error and now it is working. Thank you :)

[viorel-ognean]

this issue is now fixed, thanks for the help.

[tmatilai]

Confirmed, works here, too. Thanks! 🙌