You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix Lambda layer region resolution for us-west-2 deployment (#206)
## Summary
Fixes the CDK deployment failure in `us-west-2` region caused by
incorrect Lambda layer region resolution.
## Problem
The CDK deployment was failing in `us-west-2` with the error:
```
User: arn:aws:sts::385139013756:assumed-role/cdk-hnb659fds-cfn-exec-role-385139013756-us-west-2/AWSCloudFormation is not authorized to perform: lambda:GetLayerVersion on resource: arn:aws:lambda:us-east-1:615299751070:layer:AWSOpenTelemetryDistroPython:5
```
This occurred because the code was falling back to the `us-east-1` layer
ARN instead of using the correct `us-west-2` layer ARN.
## Root Cause
The issue was in the region detection logic in
`lambda-petclinic-stack.ts`. The original code used:
```typescript
const regionName = cdk.Stack.of(this).region;
const layerArn = layerArns[regionName] || layerArns['us-east-1']; // Problematic fallback
```
When CDK tokens weren't resolved properly, this would fall back to
`us-east-1`, causing cross-region layer access attempts.
## Solution
1. **Improved region detection**: Use `this.region` instead of
`cdk.Stack.of(this).region` for more reliable region resolution
2. **Added validation**: Ensure the layer ARN exists for the target
region before proceeding
3. **Enhanced error handling**: Throw descriptive errors for unsupported
regions instead of silent fallbacks
4. **Cross-region validation**: Verify that the layer ARN matches the
deployment region
5. **Added debugging outputs**: Include region and layer ARN in
CloudFormation outputs for troubleshooting
## Changes Made
- **Fixed region detection logic** to use `this.region` for better CDK
token resolution
- **Removed dangerous fallback** that could cause cross-region layer
access
- **Added comprehensive validation** to catch region mismatches early
- **Enhanced error messages** to help users identify unsupported regions
- **Added CloudFormation outputs** for debugging deployment issues
## Testing
This fix ensures that:
- ✅ `us-west-2` deployments use the correct layer ARN
(`arn:aws:lambda:us-west-2:615299751070:layer:AWSOpenTelemetryDistroPython:12`)
- ✅ All supported regions use their respective layer ARNs
- ✅ Unsupported regions fail fast with clear error messages
- ✅ No cross-region layer access attempts occur
## Impact
- **Fixes deployment failures** in `us-west-2` and other regions
- **Prevents silent fallbacks** that could cause runtime issues
- **Improves error visibility** for unsupported regions
- **Maintains backward compatibility** for all currently supported
regions
Fixes#202
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
0 commit comments