CDK "Failed to publish asset" - Fix Asset Upload in CI
CDK packaged your assets but could not upload them to the bootstrap S3 bucket or ECR repo. The publish step failed on permissions, a missing bucket, or a transient upload error before the stack could deploy.
What this error means
cdk deploy reaches the asset-publishing phase and fails with Failed to publish asset. A permissions/missing-bucket cause fails identically each run; a network/throttling cause during the upload often succeeds on retry.
Failed to publish asset 4f3c...:current_account-us-east-1
❌ MyStack failed: Error: Failed to publish one or more assets.
AccessDenied: Access Denied (Service: S3, Status Code: 403)Common causes
Publish role lacks bucket/ECR access
The deploy identity cannot write to the bootstrap asset bucket or push to the ECR repo - a missing s3:PutObject/ecr permission, or a bucket policy/KMS key that denies it.
Transient upload or throttling error
A reset connection, an S3/ECR throttle, or a flaky network during a large asset upload fails the publish for this run only and clears on retry.
How to fix it
Grant publish access, then re-deploy
- Confirm the deploy role can assume the CDK file/image publishing roles created by bootstrap.
- Ensure write access to the bootstrap S3 bucket and ECR repo (and decrypt on the bootstrap KMS key).
- Re-run - if the failure was a transient upload error, the retry publishes cleanly.
Verify the bootstrap stack exists and is current
A missing or stale bootstrap means there is no bucket/repo to publish to. Re-bootstrap the account/region.
cdk bootstrap aws://123456789012/us-east-1
cdk deploy MyStack --require-approval neverHow to prevent it
- Bootstrap the account/region so the asset bucket and ECR repo exist.
- Grant the deploy identity the publish-role and KMS permissions CDK needs.
- Retry the deploy on transient publish failures rather than treating them as fatal.