IamRoleStateMachineExecution - Policy statement must contain resources

[spongeboy]

This is a Bug Report

Description

Also reported in Serverless forums

Using version 1.7.0 of plugin caused a deployment error of
IamRoleStateMachineExecution - Policy statement must contain resources

We resolved the issue by downgrading back to version 1.6.1.

Apologies, but at the moment I am unable to supply a sample config, as I need strip out sensitive information.

Our step function uses parallel steps, and the same function is referenced in multiple steps.

Environment

OS:                     linux
Node Version:           8.9.4
Serverless Version:     1.25.0

[chinatti]

II am having the same issue. I did two different deploys with 1.6.1 and 1.7.0. 1.7.0 is giving me this error on a deploy:

Serverless: Checking Stack update progress...
...............................................................
Serverless: Operation failed!
  Serverless Error ---------------------------------------
  An error occurred: IamRoleStateMachineExecution - Policy statement must contain resources. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 13a5b028-aab8-11e8-bccd-afb9d41290c5).

The difference that I suspect is causing me the problem with 1.7.0 is, I believe, this:

1.6.1 cloudformation-template-update-stack.json:

      "Type": "AWS::IAM::Role",
      "Properties": {
        "Policies": [
          {
            "PolicyName": {
              "Fn::Sub": "dev-${AWS::Region}-rg-lead-pilot-v2-statemachine"
            },
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "lambda:InvokeFunction"
                  ],
                  "Resource": "*"
                }
              ]
            }
          }
        ]

1.7.0 cloudformation-template-update-stack.json:

      "Type": "AWS::IAM::Role",
      "Properties": {
        "Policies": [
          {
            "PolicyName": {
              "Fn::Sub": "dev-${AWS::Region}-rg-lead-pilot-v2-statemachine"
            },
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "lambda:InvokeFunction"
                  ],
                  "Resource": []
                }
              ]
            }
          }
        ]

Note the difference in the Resource item...

Here is the stepfunction related section of my serverless.yml:

stepFunctions:
  stateMachines:
    feedingFrenzyTimeout:
      name: ${self:service}-${opt:stage}-feedingFrenzyTimeout
      definition:
        Comment: "Checks Feeding Frenzy Leads were dispositioned"
        StartAt: Wait
        States:
          Wait:
            Type: Wait
            SecondsPath: "$.waitseconds"
            Next: FinalState
          FinalState:
            Type: Task
            Resource: arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-feeding-frenzy-timeout
            End: true

[lolbyte-code]

There is a bug in the regex here: f55a547#diff-60425c3006015f918176a0be211f414bR15

The regex does not allow * or any numbers which are probably apart of most people's function arn's (wildcard and account id/region, respectively). As a result, the resources field is set to an empty array and CloudFormation complains.

If you change the function arn to something like arn:aws:lambda:::function:name, it'll work just fine.

Threw up a PR: #147

[kabo]

We're still having this issue in 1.7.2.

Our Resource line in serverless.yml:

Resource: "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${self:custom.stage}-flow161cfetchFromSystemPlus"

[uris77]

Has anyone solved this issue. I just bumped into it with version 1.8

[bouiboui]

Many people are still affected by this:
https://forum.serverless.com/t/iamrolestatemachineexecution-policy-statement-must-contain-resources/5594/9

[jimmyn]

I'm having the same issue. Had to revert to 1.6.1. Any update on this?

[nakamine-ts]

I have the same issue with version >= 1.7.2. But in my case, the cause was wrongly written resource definition (serverless.yml) . By fixing serverless.yml, the problem was solved.

serverless.yml (having the issue)

I dropped stateMachines between stepFunctions and hellostepfunc, which cause the issue:

functions:
  hellofunc:
    handler: handler.hello

stepFunctions:
  hellostepfunc:
    Comment: "A Hello World example of the Amazon States Language using an AWS Lambda Function"
    StartAt: HelloWorld
    States:
      HelloWorld:
        Type: Task
            Resource: "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-hellofunc"
        End: true

plugins:
  - serverless-step-functions
  - serverless-pseudo-parameters

standard output:

...
CloudFormation - CREATE_FAILED - AWS::IAM::Role - IamRoleStateMachineExecution
CloudFormation - CREATE_FAILED - AWS::IAM::Role - IamRoleLambdaExecution
...
 Serverless Error ---------------------------------------
  An error occurred: IamRoleStateMachineExecution - Policy statement must contain resources. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: f72192b2-dc10-11e8-ae70-8d0f09bb39be).
  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Issues:        forum.serverless.com

serverless.yml (Successfully deployed)

Fixing serverless.yml, the deploy succeeds:

stepFunctions:
  stateMachines:
    hellostepfunc:
      definition:
        Comment: "A Hello World example of the Amazon States Language using an AWS Lambda Function"
        StartAt: HelloWorld
        States:
          HelloWorld:
            Type: Task
            Resource: "arn:aws:lambda:#{AWS::Region}:#{AWS::AccountId}:function:${self:service}-${opt:stage}-hellofunc"
            End: true

In my opinion, although it was obvious I was just careless, the error message I got was confusing which can make developers difficult to detect the cause.
I think it will be nice if the framework detects the broken resource definition, then notify the developer which definition is wrong.

[horike37]

This problem would be fixed on #154 PR.
Will anyone tests whether it is fixed properly? If so, I will cut a patch release.

[StevenWolfe]

I've also encountered this error with a hello-world setup that doesn't involve an ARN. Using v1.8.0. Pinning to v1.6.1 succeeds.

This config is intended to create a simple step function with a single Pass step, rather than executing a lambda:

serverless.yml

service: StepFnHelloWorld

provider:
  name: aws
  runtime: nodejs8.10
  
stepFunctions:
  stateMachines:
    hellostepfunc1:
      definition:
        Comment: "A Hello World example of the Amazon States Language using an AWS Lambda Function"
        StartAt: HelloWorld1
        States:
          HelloWorld1:
            Type: Pass
            End: true

plugins:
  - serverless-step-functions

Output from sls deploy:

Serverless: Packaging service...
Serverless: Creating Stack...
Serverless: Checking Stack create progress...
.....
Serverless: Stack create finished...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading artifacts...
Serverless: Validating template...
Serverless: Updating Stack...
Serverless: Checking Stack update progress...
.....
Serverless: Operation failed!

  Serverless Error ---------------------------------------

  An error occurred: IamRoleStateMachineExecution - Policy statement must contain resources. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: [removed]).

  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Issues:        forum.serverless.com

  Your Environment Information -----------------------------
     OS:                     darwin
     Node Version:           8.10.0
     Serverless Version:     1.33.0

[gekitsuu]

Still having this problem in version 1.9.0

[tripper54]

I too still have this problem. Pinning to 1.6.1 succeeds.

[g-pelletier]

The problem is still there in 1.10.0.