anomalyco/sst · error

failed to delete SSM parameter %s: %w

Error message

failed to delete SSM parameter %s: %w

What it means

After migrating the asset bucket pointer, the cleanup step deletes the legacy `/sst/bootstrap/asset` SSM parameter. If `ssm:DeleteParameter` fails, this error wraps the AWS error. Most commonly this is an IAM permissions issue, since SST already confirmed the parameter exists via GetParameter.

Source

Thrown at pkg/project/provider/aws.go:470

			_, err := s3Client.DeleteBucket(ctx, &s3.DeleteBucketInput{
				Bucket: aws.String(data.Asset),
			})
			if err != nil {
				if !strings.Contains(err.Error(), "NoSuchBucket") {
					return fmt.Errorf("failed to delete S3 bucket %s: %w", data.Asset, err)
				}
			}

			// Assign the new bucket name
			data.Asset = value.Bucket
		}

		// Remove the SSM parameter
		_, err = ssmClient.DeleteParameter(ctx, &ssm.DeleteParameterInput{
			Name: aws.String(ssmKey),
		})
		if err != nil {
			return fmt.Errorf("failed to delete SSM parameter %s: %w", ssmKey, err)
		}

		return nil
	},

	// Step: enforce bucket requests to use SSL
	func(ctx context.Context, cfg aws.Config, data *AwsBootstrapData) error {
		s3Client := s3.NewFromConfig(cfg)

		// set partition based on region
		partition := "aws"
		if strings.HasPrefix(cfg.Region, "cn-") {
			partition = "aws-cn"
		} else if strings.HasPrefix(cfg.Region, "us-gov-") {
			partition = "aws-us-gov"
		}

		buckets := []string{data.Asset, data.State}

View on GitHub (pinned to a0bd20f762)

Solutions

1. Grant the deploy credentials `ssm:DeleteParameter` on `/sst/bootstrap/asset` (or run once with broader admin credentials)
2. If the parameter no longer exists, ignore — re-run `sst deploy` and the cleanup is a no-op
3. Confirm the AWS region/credentials match where the parameter was created

Example fix

// IAM policy addition
{
  "Effect": "Allow",
  "Action": "ssm:DeleteParameter",
  "Resource": "arn:aws:ssm:*:*:parameter/sst/bootstrap/*"
}

aws iam simulate-principal-policy --policy-source-arn <deploy-role-arn> --action-names ssm:DeleteParameter --resource-arns arn:aws:ssm:*:*:parameter/sst/bootstrap/*

When it happens

Trigger: The deploy role lacks `ssm:DeleteParameter` on `/sst/bootstrap/asset`; the parameter was concurrently deleted and the AWS error is surfaced here; region mismatch between client config and the parameter's region.

Common situations: Restricted IAM policies that allow `ssm:GetParameter` but not `ssm:DeleteParameter`; SCPs forbidding parameter deletion in production accounts.

Related errors

• failed to decode SSM parameter value: %w
• Bastion instance profile must be a name, not an ARN.
• Failed to publish event to bus
• Failed to describe task
• Failed to run task

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/6a9f951c83779848. Report an issue: GitHub.