anomalyco/sst · error

failed to put bucket policy for %s: %w

Error message

failed to put bucket policy for %s: %w

What it means

The SSL-enforcement step applies a bucket policy Denying non-HTTPS access via `s3:PutBucketPolicy`. If AWS rejects the call, this error wraps it. Common AWS-side rejections are malformed policy, missing `s3:PutBucketPolicy` permission, or a bucket-owner/account mismatch.

Source

Thrown at pkg/project/provider/aws.go:522

							"Bool": map[string]interface{}{
								"aws:SecureTransport": "false",
							},
						},
					},
				},
			}

			policyJSON, err := json.Marshal(policy)
			if err != nil {
				return fmt.Errorf("failed to marshal policy for bucket %s: %w", bucket, err)
			}

			_, err = s3Client.PutBucketPolicy(ctx, &s3.PutBucketPolicyInput{
				Bucket: aws.String(bucket),
				Policy: aws.String(string(policyJSON)),
			})
			if err != nil {
				return fmt.Errorf("failed to put bucket policy for %s: %w", bucket, err)
			}
		}

		return nil
	},

	// Step: add appsync events apis for live lambda - we no longer do this
	func(ctx context.Context, cfg aws.Config, data *AwsBootstrapData) error {
		return nil
	},
}

type AwsHome struct {
	provider *AwsProvider
	compress bool
}

func NewAwsHome(provider *AwsProvider, compress bool) *AwsHome {

View on GitHub (pinned to a0bd20f762)

Solutions

1. Check IAM/SCP permissions for `s3:PutBucketPolicy` on the asset/state buckets
2. If the bucket is policy-locked, remove the blocking policy via root account or an admin role, then re-run `sst deploy`
3. Verify credentials/region point at the account that owns the buckets

aws iam simulate-principal-policy --policy-source-arn <deploy-role-arn> --action-names s3:PutBucketPolicy --resource-arns arn:aws:s3:::sst-asset-bucket arn:aws:s3:::sst-state-bucket

err := sstDeploy(ctx)
if err != nil && strings.Contains(err.Error(), "failed to put bucket policy") {
    // likely AccessDenied or policy lock-out; inspect bucket policy with an admin role, then retry
    inspectAndRepairBucketPolicy("sst-asset-bucket")
    err = sstDeploy(ctx)
}

When it happens

Trigger: Deploy role lacks `s3:PutBucketPolicy`; a `Deny s3:PutBucketPolicy` condition on the bucket itself (policy lock-out); bucket is in a different account/region than configured; Object Ownership/ACL settings interfering in cross-account setups.

Common situations: Locked-out buckets after a previously applied bad policy; restricted production IAM; org SCPs restricting bucket policy changes.

Related errors

• At least one of function, queue, or topic is required for th
• Only one of function, queue, or topic is allowed for the "${
• Lifecycle rule at index ${index} has an empty or whitespace-
• failed to delete S3 bucket %s: %w
• failed to marshal policy for bucket %s: %w

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/f314983b2a7f49fd. Report an issue: GitHub.