graphql
graphql copied to clipboard
Incorrect account ids in lambda policy
graphql 3.0.3
I have graphql components configured to deploy to different stages each with a different provider defined in the serverless web ui with each provider being a different aws account.
When I deploy to the different stages the resources are created in the correct account, but about 50% of the time the account id in the lambda's role for invokeFunction is incorrect. When this happens making a graphql call returns an error that appsync is not able to call the lambda.
When the account id is incorrect it is an account id from one of the other 2 accounts.
{
"Effect": "Allow",
"Action": [
"lambda:invokeFunction"
],
"Resource": "arn:aws:lambda:us-west-2:<wrong account id>:function:api-v8-stagename-appname-s2229lk*"
}
When deploying to one account with one configured provider in the serverless UI it successfully created lambda invokeFunction policies with the correct account ids.
I believe I ran into this multiple times as well.
And customer support like this is why we leave the serverless ecosystem after being there since version 0.2 (or 0.4).