0

My AWS devops concepts are still fuzzy and I could use some help. Here is what I am tyring to do - I have a CloudFormation nested stack which contains few lambdas, eventbridge, api gateways etc. I pushed my code to CodeCommit and set up a ci/cd pipeline with cross-account roles etc. I have two accounts set up – dev and QA. The code, pipeline and CodeCommit are all set up in dev account and whenever a change is pushed to CodeCommit in dev, the pipeline will run to push the changes to QA. I have followed the steps mentioned here: https://docs.aws.amazon.com/codepipeline/latest/userguide/pipelines-create-cross-account.html#pipelines-create-cross-account-create

The pipeline is working. However, the deployment is failing because the stack is failing to create. This could be due to incorrect access set up. Here is my question and this is where I am not very clear on the concepts:

  1. I am uploading all the code for lambdas (in zip files) and the nested stack templates into an S3 bucket and pushing the same code to CodeCommit. Is it required to put this code in two places? If I just choose CodeCommit – how do I rewrite the following code which is currently pointing to an S3 bucket?
 CreateOrder:
    Type: AWS::Serverless::Function
    Properties:
        CodeUri: 
          Bucket: my-code-bucket
          Key: lambdas/create-order/index.js.zip
        FunctionName: createOrder
        Handler: index.handler
        Runtime: nodejs14.x
        Role: !Ref LambdaExecutionRole

My guess is the stack is failing to create in QA because it is looking for 'my-code-bucket' in QA which doesn't exist. Is that a correct guess?

  1. Can the pipeline create a new stack in a QA environment or do I need to create the stack manually for the first time and then execute a changeset in the subsequent deploys? What is the best approach to handle this? Thanks.
mywn9
  • 107
  • 12
  • For question 1, you can consider using 'sam package' or 'aws cloudformation package' to package your code and nested stacks. Can you add the error message you are getting for your stack deployment failure? – Kaustubh Khavnekar Jan 20 '22 at 17:54
  • @KaustubhKhavnekar - the stack is being created successfully in dev. I am having issues deploying it to QA. Stack creation starts and then fails and rolls back. My question is - do I need to save the code in Code Commit as well as S3 bucket in dev. – mywn9 Jan 20 '22 at 19:14
  • @KaustubhKhavnekar - this is the error message I am getting when I deploying my stack to QA - Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied. What am I missing? Thanks. – mywn9 Jan 21 '22 at 03:57
  • 1
    Your error message indicates that the [service role](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html) for your CloudFormation stack (or the IAM entity which is doing the deployment action if you aren't using a service role) doesn't have permissions to access the S3 bucket where you are uploading the Lambda code zips and nested stacks – Kaustubh Khavnekar Jan 21 '22 at 14:58

0 Answers0