Node Lambda Upload Error: "Cross-account pass role is not allowed"

aws.lambda.upload.error.output

Reading zip file to memory
Uploading zip file to AWS Lambda eu-west-1 with parameters:
{ FunctionName: 'xxx-staging-1-0-0',
  FunctionZip: <Buffer 50 478 0b 00 ...>,
  Handler: 'index.handler',
  Mode: 'event',
  Role: 'arn:aws:iam::xxx:role/xxx',
  Runtime: 'nodejs',
  Description: 'Resizes images for the xxx project.',
  MemorySize: '512',
  Timeout: '60' }
{ [AccessDeniedException: Cross-account pass role is not allowed.]
  message: 'Cross-account pass role is not allowed.',
  code: 'AccessDeniedException',
  time: Mon Jul 27 2015 12:10:03 GMT+0100 (BST),
  statusCode: 403,
  retryable: false,
  retryDelay: 30 }

SOLUTION

The node-lambda npm package creates an .env file for you which you can set the various environment variables that it will use to deploy. You can set the AWS acccess key & secret key in this file and it will use them.

However, if you already have AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY set in your environment, those will take precedent. Therefore the "Cross-account pass role is not allowed" is an error due to authenticating with the wrong account details. The simple solution if you wish to use the .env file to store authentication details is to unload your AWS auth environment variables as so:

unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
# Then run the deploy again and it will use the variables from .env

The solution is obvious but the error message from AWS is not and currently only returns 2 useless results; hopefully this gist will fix that when it gets indexed.

Cheers,
Darian

@djm Thank you very much, I spent good few hours trying to figure out what's wrong

Thanks! 👍 Me too!

The other handy thing here may be to set AWS_PROFILE in your environment to the profile containing the right set of credentials.

Thanks for the hint, BTW, I wouldn't have found that without a lot more digging!

thanks!

Still helpful 👍

Thank you!!

great

I didn't have those variables, but by moving my profile variables to [default], I was able to work around the problem. +1

thank you