Aws-sam-cli: fork/exec /var/task/main: permission denied

[terrywarwar]

I successfully deployed a golang lambda api service using sam package and sam deploy.

And when I test the lambda function, I get the error below.
{ "errorMessage": "fork/exec /var/task/main: permission denied", "errorType": "PathError" }

[PaulMaddox]

Do you have a built binary called main in your directory when you run the package command?

Are you using Linux/Mac or Windows? The built binary needs to have execute permissions.

[terrywarwar]

Yes, built using GOOS=linux go build -o main on a Mac
-rwxr-xr-x 1 terry staff 8087634 24 Jan 14:37 main

[terrywarwar]

I downloaded the file that was packaged to S3 and it has different permission.
-rw-r--r--@ 1 terry staff 8087634 24 Jan 16:55 main

[sanathkr]

Here is a nifty little tool to zip up properly: https://github.com/aws/aws-lambda-go#for-developers-on-windows

[terrywarwar]

When I set the CodeUri: main the packaged file has permissions as -rw-r--r--@ but when I set the CodeUri: . to the code directory, the binary has the correct permission when packaged -rwxr-xr-x@

[neoadventist]

Hey @terrywarwar @PaulMaddox I have a similar situation but I get:

{
  "errorMessage": "fork/exec /var/task/main: no such file or directory",
  "errorType": "PathError"
}

when I run sam local start-api --template sam.yml

Handler is set to main

I think my problem is similar, but I hope to get to the permission problem :)

[terrywarwar]

@neoadventist have you done a build using GOOS=linux go build -o main?

[neoadventist]

@terrywarwar yes

[terrywarwar]

I had the same issue using aws cloudformation, I wonder if this causing the issue when CodeUri is set to a file instead of a directory.
https://github.com/aws/aws-cli/blob/e354da887af26c3a4546026e743f10bbf851eecb/awscli/customizations/cloudformation/artifact_exporter.py#L212

shutil.copyfile doesn't copy the meta-data.

[eggsbenjamin]

Not sure if this is the case here, but I found this issues page while debugging the fork/exec /var/task/main permission denied issue so thought I'd post here to help others in a similar position.

The issue was that I'd neglected to create a main function and my go package name wasn't main.

package main

import (
  "github.com/aws/aws-lambda-go/lambda"
)

func main() {
  lambda.Start(MyHandler)
}

[terrywarwar]

Created PR, https://github.com/aws/aws-cli/pull/3112

[charger88]

@neoadventist, did you find solution for your problem? I have the same issue.

[neoadventist]

@charger88 nah, still the same issue. My code seem to work okay on my mac vs the linux/WSL environment, so i'm using that. (plus the whole lambda experiment was put on hold for now) please be sure to comment here when you've solved it!

[charger88]

@neoadventist I just forgot about building step.
Run this (replace $1 to your actual filename without extension):
GOOS=linux go build -o $1 $1.go

[josephmcasey]

It seems like this issue persists due to file permissions specified by @terrywarwar and the missing argument specified by @charger88.

GOOS=linux go build -o main main.go
as opposed to
GOOS=linux go build -o main

and Read, Write, Execute permissions instead of simply Read or Write permissions.

---

This solves the problem issued here, but does anyone know why this failure occurs?

[jkrnak]

If anyone got here seeing the same error @neoadventist had

{
  "errorMessage": "fork/exec /var/task/main: no such file or directory",
  "errorType": "PathError"
}

Also make sure that your are building on glibc if you are using os, runtime or net.
Lambdas are executing with glibc runtime.

This could be relevant if you were building on alpine for example, which has musl instead of glibc.

This case you can also try to link your libs statically instead of dynamically.

This worked for me to build on alpine and run on aws.
(your musl-gcc might be in a different location)

CC=/usr/bin/x86_64-alpine-linux-musl-gcc GOOS=linux go build -x \
 -ldflags '-linkmode external -extldflags "-static"' -a -tags netgo \
 -installsuffix netgo -o main main.go

[rayhaanq]

what was the actual fix for this? I'm using windows and running this:

set GOOS=linux
set GOARCH=amd64
go build -ldflags="-s -w -v" -o bin/hello hello/main.go
go build -ldflags="-s -w -v" -o bin/world world/main.go

and my function looks like this:

package main

import (
    "fmt"
    "github.com/aws/aws-lambda-go/events"
    "github.com/aws/aws-lambda-go/lambda"
)


func Handler(request events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    fmt.Println("Received body: ", request.Body)

    return events.APIGatewayProxyResponse{Body: request.Body, StatusCode: 200}, nil
}

func main() {
    lambda.Start(Handler)
}

[mikeatlas]

Just leaving this here for anyone who happens to stumble across this:

My zip file had some of my full build path in it from my Makefile. I needed to add -j switch to zip to flatten out the file path inside the archive:

build:
    ${GOBUILD} -ldflags="-d -s -w" -o ${BINPATH}/hello ./cmd/hello/main.go
    chmod +x ${BINPATH}/hello
    zip -j ${BINPATH}/hello.zip ${BINPATH}/hello

This works when the Lambda handler is specified as hello.

[Shockem]

@mikeatlas That worked for me! I just added the -j flag to zip for junking the file path.

[EdisonGonzalez]

Hey @terrywarwar @PaulMaddox I have a similar situation but I get:

{
  "errorMessage": "fork/exec /var/task/main: no such file or directory",
  "errorType": "PathError"
}

when I run sam local start-api --template sam.yml

Handler is set to main

I think my problem is similar, but I hope to get to the permission problem :)

You should find this path manually, this error is simple, only to find path.

[zzerjae]

If you are still having this problem, see my case

# permission denied
.
├── bin
│   └── main
└── template
    └── template.yaml

# It works fine
.
├── bin
│   └── main
└── template.yaml

[maddinek]

build:
${GOBUILD} -ldflags="-d -s -w" -o ${BINPATH}/hello ./cmd/hello/main.go
chmod +x ${BINPATH}/hello
zip -j ${BINPATH}/hello.zip ${BINPATH}/hello
```

for me it was literally just the...

zip -j

thanks mate!

[rajendragosavi]

@maddinek , Where did you add this ? I am using AWS SAM hello-world application and getting. {"errorType":"exitError","errorMessage":"RequestId: 09bda008-f1ba-1f08-63cd-c9df843425e3 Error: fork/exec /var/task/hello-world: permission denied"} .

Any idea on this .

[rajendragosavi]

@jkrnak . Hey. I am also facing same issue. I did not understand what did you said.

[rajendragosavi]

@EdisonGonzalez , Hey , Even I am facing the permission denied issue.
{"errorType":"exitError","errorMessage":"RequestId: c7306307-98aa-1690-1fe1-1e411b065441 Error: fork/exec /var/task/hello-world: permission denied"}. When I execute - sam local invoke HelloWorldFunction --no-event

[brnlee]

build:
${GOBUILD} -ldflags="-d -s -w" -o ${BINPATH}/hello ./cmd/hello/main.go
chmod +x ${BINPATH}/hello
zip -j ${BINPATH}/hello.zip ${BINPATH}/hello

for me it was literally just the...

zip -j

thanks mate!

I am able to create the zip and upload manually through the AWS console to get the Lambda function working. However, how would one do this using sam package + sam deploy?

Update
For each Lambda function, I set the CodeUri property to be pointing to the respective .zip file of each lambda. After I did this, I no longer received the error quoted in the OP.