I’m doing some cloud work, and I am working based off the official documentation, trying to automate the creation of an AWS Lambda. In order to allow me to quickly iterate, I’m basically creating the entire thing from scratch each time.
I have the following code:
- aws iam create-role --role-name $AWS_ROLE --assume-role-policy-document file://trust-policy.json
- aws iam attach-role-policy --role-name $AWS_ROLE --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
- aws lambda create-function --function-name $FUNC_NAME --zip-file fileb://lambda.zip --handler lambda_function.lambda_handler --runtime python3.8 --role $ARN_ROLE
So far, so good, and exactly like it shows in the docs. But if you’ll run it as a script, it will fail with:
An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda.
If I re-run the exact same command, however, it works properly.
There is this interesting command, which indicates that roles are using eventual consistency:
aws iam wait role-exists --role-name $AWS_ROLE
Except… that this doesn’t work. It looks like there is some additional delay between creating the role, validating that it was created and when it is actually available for Lambda to be used.
After looking around and feeling like a fool, I added a sleep for 10 seconds to the script, and the problem went away.
I’m posting this for posterity sake and in the hope that someone can tell me that there is a better way. For now, I think I need a shower.