There was a problem creating a default IAM role for Lambda. Check your configuration.

[tmaiaroto]

There was a problem creating a default IAM role for Lambda. Check your configuration.

[tmaiaroto]

I believe this should be in good shape now, please re-open of comment if you continue to experience issues.

[tmaiaroto]

I see, it's a problem with the default policy that's getting created. You can set your own in aegis.yaml to use for now, but I'll have a fix soon.

[tmaiaroto]

Give 1.15.1 a try https://github.com/tmaiaroto/aegis/releases/tag/1.15.1

Should resolve the issue, I was able to create a new role to quickly test that it was working and then was able to log into the protected API via Cognito. Note you will need to setup a Cognito Pool.

I still need to add integration tests around the CLI tool, sorry about that.

Side note: I'm thinking about leveraging some other tools for resource management. It's clearly becoming not only a time consuming and intricate thing, but a completely separate concern of its own. That is to say, without broader community support here, I'd rather focus on the application framework over infrastructure management.

[agorman]

Thanks so much for the quick response. I'm getting a different error now.

Created a new execution role for Lambda: arn:aws:iam::171733487074:role/aegis_lambda_role
There was a problem updating the Lambda function.
ValidationException: 1 validation error detected: Value '' at 'role' failed to satisfy constraint: Member must satisfy regular expression pattern: arn:(aws[a-zA-Z-]*)?:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@\-_/]+
	status code: 400, request id: 609b687f-7fd1-11e8-a3f7-ad2f99a490cc
exit status 255

However, running it a second time it seems to work

Using existing execution role for Lambda: arn:aws:iam::171733487074:role/aegis_lambda_role
Created Lambda function: arn:aws:lambda:us-west-2:171733487074:function:aegis_cognito_example

prod API URL: https://x8m5l1fzrg.execute-api.us-west-2.amazonaws.com/prod

[tmaiaroto]

I’ll take a look into this empty string role issue too.

…

On Wed, Jul 4, 2018 at 2:37 PM Andy Gorman ***@***.***> wrote: Thanks so much for the quick response. I'm getting a different error now. Created a new execution role for Lambda: arn:aws:iam::171733487074:role/aegis_lambda_role There was a problem updating the Lambda function. ValidationException: 1 validation error detected: Value '' at 'role' failed to satisfy constraint: Member must satisfy regular expression pattern: arn:(aws[a-zA-Z-]*)?:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@\-_/]+ status code: 400, request id: 609b687f-7fd1-11e8-a3f7-ad2f99a490cc exit status 255 However, running it a second time it seems to work Using existing execution role for Lambda: arn:aws:iam::171733487074:role/aegis_lambda_role Created Lambda function: arn:aws:lambda:us-west-2:171733487074:function:aegis_cognito_example prod API URL: https://x8m5l1fzrg.execute-api.us-west-2.amazonaws.com/prod — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#33 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAMXndmuoDCdLSCzSyBPbpsZX46zZSugks5uDTW1gaJpZM4VC039> .

[tmaiaroto]

So I had another tiny bug (as in one character) that created an issue there. However, even after fixing that, I ran into yet another issue...This time with AWS. When you create new IAM roles, they aren't immediately available to assign to your Lambda functions.

I put in a wait for a few seconds which I thought had solved the issue before. Apparently not in testing this again here.

So I'm going to put in a retry in a very specific case (when this error is seen and when a new role was created).

Obviously since its timing, running deploy a second time works. Just poor UX.

[tmaiaroto]

I added retries for this step. It'll try 5 times and wait 5 seconds between each attempt with a total of 1 minute timeout for the entire event of trying to associate the IAM to the Lambda. In limited testing it works. However, it is a known "issue" with AWS (quotes on issue because it's really just a fact of life I suppose). Tools like Terraform run into this too, you'll see it in their output to the console too. I believe Terraform just waits forever. I've seen waiting messages for 30 minutes or more before.

It shouldn't really take that long in this case. That's why I originally had it at 4 seconds. So I think it should be good now. This fix will be released in the next patch version (hopefully along with the Cognito issue you raised). In the meantime, run deploy a second time. It should not ever be an issue again after you have that IAM role created though. So you probably only need to run deploy once now for every change you make.