Chalice "chalice deploy" ClientError AccessDenied in CI
chalice deploy uses boto3 to create the Lambda, IAM role, and API Gateway for your app. When the deploy credentials are denied one of those actions, botocore raises a ClientError with AccessDenied naming the action.
What this error means
chalice deploy stops with "botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the <Action> operation" partway through creating resources.
botocore.exceptions.ClientError: An error occurred (AccessDeniedException)
when calling the CreateFunction operation: User: arn:aws:iam::123456789012:user/ci
is not authorized to perform: lambda:CreateFunctionCommon causes
The deploy principal lacks an action Chalice calls
Chalice creates Lambda functions, IAM roles, and API Gateway resources. A CI principal missing any of those actions is denied at the first one it hits.
IAM role creation is not permitted
By default Chalice manages the function role, which needs iam:CreateRole and iam:PutRolePolicy; without them the deploy fails on role setup.
How to fix it
Grant the denied action
- Read the operation named in the AccessDenied error.
- Add that action to the CI deploy policy.
- Re-run chalice deploy until all resource actions are permitted.
{ "Effect": "Allow",
"Action": ["lambda:CreateFunction", "iam:CreateRole", "iam:PutRolePolicy",
"apigateway:POST"], "Resource": "*" }Manage the IAM role yourself
If CI may not create roles, supply a precreated role and disable Chalice role management.
// .chalice/config.json
{ "manage_iam_role": false,
"iam_role_arn": "arn:aws:iam::123456789012:role/chalice-app-role" }How to prevent it
- Scope the CI policy to every action Chalice deploy performs.
- Precreate the function role when role creation is restricted.
- Use OIDC role assumption for the deploy identity.