Terraform-provider-aws: Error finding Lambda policy statement: Failed to find statement

[hashibot[bot]]

_This issue was originally opened by @wubigo as hashicorp/terraform#23480. It was migrated here as a result of the provider split. The original body of the issue is below._

---

Terraform Version

Terraform v0.12.16
+ provider.aws v2.39.0

Terraform Configuration Files

...

Debug Output

https://gist.github.com/wubigo/0c7afe6822135b917d9fedc2ca5916a3

Crash Output

Expected Behavior

Actual Behavior

Steps to Reproduce

https://learn.hashicorp.com/terraform/aws/lambda-api-gateway

Additional Context

References

[SantiEich]

Same error
2019/12/17 14:39:13 [TRACE] EvalWriteState: writing current state object for aws_cloudwatch_metric_alarm.orange_low_cpu
2019/12/17 14:39:13 [TRACE] [walkRefresh] Exiting eval tree: aws_cloudwatch_metric_alarm.orange_low_cpu
2019/12/17 14:39:13 [TRACE] vertex "aws_cloudwatch_metric_alarm.orange_low_cpu": visit complete
2019/12/17 14:39:13 [TRACE] vertex "aws_cloudwatch_metric_alarm.orange_low_cpu": dynamic subgraph completed successfully
2019/12/17 14:39:13 [TRACE] vertex "aws_cloudwatch_metric_alarm.orange_low_cpu": visit complete
2019/12/17 14:39:13 [TRACE] dag/walk: upstream of "provider.aws (close)" errored, so skipping
2019/12/17 14:39:13 [TRACE] dag/walk: upstream of "root" errored, so skipping

Error: Error finding Lambda policy statement: Failed to find statement "AllowExecutionFromCloudWatch" in Lambda policy:

[adamo57]

Same Error

```
aws_lambda_permission.allow_bucket: Refreshing state... [id=AllowExecutionFromS3Bucket]

Error: Error finding Lambda policy statement: Failed to find statement "AllowExecutionFromS3Bucket" in Lambda policy:

[s4ntos]

Also getting the same error with provider aws_v2.41.0_x4

[allan-simon]

could it be a problem that happens after a certain number of lambda / lambda permission ? as I have a several lambda in several workspace (dev/staging/prod) and I only got the error for one

[allan-simon]

seems to not be related to the quantity, for some reason the permission was no more present (or was never there in the first place), I worked-around the problem by first manually adding the statement using aws lambda add-permission (check https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html#permissions-resource-serviceinvoke for the syntax for your case)

in my case it was related to cloudwatch calling the lambda (so it does not seem to be specific to APIGW)

[raymondwclark]

Getting the same error on Terraform v0.12.20 + provider.aws v2.47.0

[dannyburke1]

Hi all,

Any idea when this might be resolved or having the PR that is raised above will be merged in?

Alternatively, does anybody have a workaround?

Thanks

[allan-simon]

@dannyburke1 , have you tried the one of my post above ?

[dannyburke1]

@dannyburke1 , have you tried the one of my post above ?

Hi Allan - I've not tried this, as these permissions are already set, however running a Terraform plan on some older code is causing me this issue when the plan is running.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!