no resource-based policy allows the lambda:ListLayerVersions action

[almoehi]

Hi,
I'm trying to use the published layers to deploy a php function on AWS lambda. But I run into the following issue:

An error occurred (AccessDeniedException) when calling the ListLayerVersions operation: User: arn:aws:sts::xxxx:assumed-role/OrganizationAccountAccessRole/botocore-session-xxxx is not authorized to perform: lambda:ListLayerVersions on resource: arn:aws:lambda:us-east-1:534081306603:layer:arm-php-82-fpm because no resource-based policy allows the lambda:ListLayerVersions action

I tried to add the lambda:ListLayerVersions via an ALLOW policy to that role - but no difference.

Ran this command to verify the issue (in the same us-east-1 region - same with any other layer ARN)
aws lambda list-layer-versions --layer-name arn:aws:lambda:us-east-1:534081306603:layer:arm-php-82-fpm

Is there anything specific I need to set up in my AWS account to use/get access to the published bref layers ?

Any pointers appreciated !

[mnapoli]

You shouldn't need to list layers to deploy with Bref, any reason you are trying to do that?

I.e. when does the error happen?

[mnapoli]

Ah that must be Pulumi's behavior indeed 🤔 I have no idea how to work around that. Maybe you could try deploying using Docker images instead?

[almoehi]

Yeah I was hoping to avoid that 🫠

Out of curiosity: would this require to allow list versions action on the layer resources on your end? (Because adding it to my AWS role did not help)

[mnapoli]

Yes exactly, the limitation is on the Bref account, not yours AFAICT.

[almoehi]

Alright cool thx.

When I use and build from the Dockerfile - do I need to use the qemu setup or are there "real" arm base images ?

[mnapoli]

You can find ARM images there: https://hub.docker.com/u/bref?page=1&search=arm