anomalyco/sst · warning

failed to marshal policy for bucket %s: %w

Error message

failed to marshal policy for bucket %s: %w

What it means

The SSL-enforcement bootstrap step builds an IAM policy document that Denies non-TLS (`aws:SecureTransport=false`) requests to the asset and state buckets, then `json.Marshal`s it. Marshal failure is practically impossible for this in-memory map unless a value is unencodable (e.g. NaN float or channel injected by modification), so this indicates the bootstrap step code or data was altered.

Source

Thrown at pkg/project/provider/aws.go:514

						"Effect":    "Deny",
						"Principal": "*",
						"Action":    "s3:*",
						"Resource": []string{
							fmt.Sprintf("arn:%s:s3:::%s", partition, bucket),
							fmt.Sprintf("arn:%s:s3:::%s/*", partition, bucket),
						},
						"Condition": map[string]interface{}{
							"Bool": map[string]interface{}{
								"aws:SecureTransport": "false",
							},
						},
					},
				},
			}

			policyJSON, err := json.Marshal(policy)
			if err != nil {
				return fmt.Errorf("failed to marshal policy for bucket %s: %w", bucket, err)
			}

			_, err = s3Client.PutBucketPolicy(ctx, &s3.PutBucketPolicyInput{
				Bucket: aws.String(bucket),
				Policy: aws.String(string(policyJSON)),
			})
			if err != nil {
				return fmt.Errorf("failed to put bucket policy for %s: %w", bucket, err)
			}
		}

		return nil
	},

	// Step: add appsync events apis for live lambda - we no longer do this
	func(ctx context.Context, cfg aws.Config, data *AwsBootstrapData) error {
		return nil
	},

View on GitHub (pinned to a0bd20f762)

Solutions

1. Revert any local modifications to `pkg/project/provider/aws.go` bootstrap steps
2. Rebuild the CLI/platform from a clean checkout and retry `sst deploy`
3. If reproducible on stock SST, file an issue with the Go version and stack trace

err := sstDeploy(ctx)
if err != nil && strings.Contains(err.Error(), "failed to marshal policy") {
    // rebuild CLI from a clean checkout and retry
}

When it happens

Trigger: Essentially only when the policy map contains a value `encoding/json` cannot serialize — e.g. custom-modified bootstrap steps or a fork that inserts unsupported types.

Common situations: Custom forks of SST bootstrap steps; locally patched provider code.

Related errors

• At least one of function, queue, or topic is required for th
• Only one of function, queue, or topic is allowed for the "${
• Lifecycle rule at index ${index} has an empty or whitespace-
• failed to decode SSM parameter value: %w
• failed to delete S3 bucket %s: %w

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/1ba1b3ec4768b3e4. Report an issue: GitHub.