17

I'm following this tutorial to learn how to use SAM.

Here's the code I have:

template.yml:

AWSTemplateFormatVersion : '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs8.10

index.js

exports.handler = async function(event, context) {
    return 'Hello World!';
};

When I run 

sam package \
  --template-file template.yml \
  --output-template-file package.yml \
  --s3-bucket brian-test-sam

I got the error saying Unable to upload artifact None referenced by CodeUri parameter of HelloWorldFunction resource. An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

Why does this happen?

I've created the S3 bucket brian-test-sam on my AWS account. I've checked that my IAM user has AmazonS3FullAccess permission.

The command 

sam --debug package \                                                                                           <aws:dev-bionime>
  --template-file template.yml \
  --output-template-file package.yml \
  --s3-bucket brian-test-sam

says that the error was generated by aws cloudformation package --output-template-file package.yml --s3-bucket brian-test-sam --template-file /path/to/my/files/helloworld/template.yml

What is wrong with my cloudformation?

My aws cli version is aws-cli/1.16.169 Python/3.7.3 Darwin/18.6.0 botocore/1.12.159. And my npm version is 6.10.1.

Brian
  • 12,145
  • 20
  • 90
  • 153

10 Answers10

11

Even I faced this issue, I took following action.

Issue was due to mismatch of bucket in app.py and in sam package command, so corrected bucket name and run the "sam build" and "sam package" commands again, it worked for me !

One more care, If you face time related issue while running "sam package", then there should be invalid system time, get it corrected and run "sam package" again.

Omkar
  • 3,253
  • 3
  • 20
  • 36
5

I found this error was because I hadn't added S3 access to the service role that runs the build

On the Permissions tab of Role, Select the button "Attach policies" and choose "AmazonS3FullAccess", attach it via "Attach policy" button.

Now re-run your build.

Jiminy James
  • 105
  • 2
  • 5
3

For me the issue was my aws credentials were from the wrong account. aws s3 ls showed the issue pretty quickly.

David Boshton
  • 2,555
  • 5
  • 30
  • 51
1

I faced same issue, while running the below command:

sam package \
  --template-file template.yml \
  --output-template-file package.yml \
  --s3-bucket <your_bucket_name>

Above command was missing AWS credentials with default profile. [I did not have a default profile in AWS configurations] If default profile is not located, you may need to provide profile name in the command as below

sam package \
  --template-file template.yml \
  --output-template-file package.yml \
  --s3-bucket brian-test-sam \
  --profile <profile_name>
Amit Kaneria
  • 5,466
  • 2
  • 35
  • 38
1

In general this type of issue is likely to be caused by the account being used for the CloudFormation deployment not having access to a specified S3 bucket that resources need to be uploaded to during the deployment. You can try the following:

  • Create a new S3 bucket using the same account that the deployment is being run under, and ensure that this is the bucket that's used in the deployment
  • Ensure the account has full access to S3 as explained in the answer by @JiminyJames - https://stackoverflow.com/a/63532472/1549918
Chris Halcrow
  • 28,994
  • 18
  • 176
  • 206
1

I have just updated my AWS Profile credentials and it worked for me.

Bernard Doci
  • 739
  • 3
  • 14
  • 23
0

You need to provide the CodeUri property pointing your local directory.

AWSTemplateFormatVersion : '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs8.10
      CodeUri: ./code
Pubudu Jayawardana
  • 2,250
  • 1
  • 13
  • 18
  • 3
    The error message becomes `Unable to upload artifact ./index.js referenced by CodeUri parameter of HelloWorldFunction resource. An error occurred (AccessDenied) when calling the PutObject operation: Access Denied` after I add `CodeUri: ./index.js` to `template.yml`. – Brian Jul 20 '19 at 08:21
0
Uploading to 5ede295b3d735d7cadf2a5368bcff051  124068 / 124068.0  (100.00%)
Successfully packaged artifacts and wrote output template to file package.yaml.
Execute the following command to deploy the packaged template..........

worked for me by applying bucket policies as below

{
    "Version": "2012-10-17",
    "Id": "Policy1624441771081",
    "Statement": [
        {
            "Sid": "Stmt1624441768741",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "<your_bucket_arn>/*"
        }
    ]
}
Rahul Bhargave
  • 11
  • 1
0

This can also happen when you do a sam build followed by a sam deploy and you don't specify the template file that the build step created. If you remove the --template-file or point it to the .aws file that was created in sam build, it fixes this problem.

Brett Bim
  • 3,190
  • 4
  • 28
  • 26
0

If you have this issue, and it also shows these error messages: Error: Unable to upload artifact HelloWorldFunction referenced by CodeUri parameter of HelloWorldFunction resource.

ZIP does not support timestamps before 1980

Then the issue is because the file timestamps are earlier than 1980. It's an easy fix, in terminal, in the folder you are attempting to run "sam deploy" from, just run this to update the timestamps:

touch `find . -type f`
Andrew J Hanlon
  • 9
  • 1
  • 4