anomalyco/sst · error

failed to update function %s: %s

Error message

failed to update function %s: %s

What it means

While publishing new Lambda function code, SST polls `GetFunctionConfiguration` waiting for `LastUpdateStatus` to succeed. If the status becomes `Failed`, it raises this error embedding the `LastUpdateStatusReasonCode` and reason string from AWS. It means AWS rejected or aborted the code update itself.

Source

Thrown at pkg/server/resource/aws-function-code-updater.go:130

	for {
		ret, err := client.GetFunction(r.context, &lambda.GetFunctionInput{
			FunctionName: aws.String(input.FunctionName),
		})
		if err != nil {
			return err
		}

		if ret.Configuration.LastUpdateStatus == types.LastUpdateStatusSuccessful {
			return nil
		}

		if ret.Configuration.LastUpdateStatus == types.LastUpdateStatusFailed {
			reason := "Unknown"
			if ret.Configuration.LastUpdateStatusReason != nil {
				reason = *ret.Configuration.LastUpdateStatusReason
			}
			return fmt.Errorf("failed to update function %s: %s", ret.Configuration.LastUpdateStatusReasonCode, reason)
		}

		time.Sleep(300 * time.Millisecond)
	}
}

View on GitHub (pinned to a0bd20f762)

Solutions

1. Check the reason string in the error — fix the underlying AWS issue it names (often IAM permissions on the code S3 object)
2. Ensure no other deploy/dev session is updating the same function simultaneously, then retry
3. Verify the deployment package size/contents are valid for the function architecture
4. Check CloudTrail/function logs for the failed `UpdateFunctionCode` to pinpoint the AWS-side cause

// before deploying function code, ensure no update is in flight and package is valid
const cfg = await lambda.send(new GetFunctionConfigurationCommand({ FunctionName: name }));
if (cfg.LastUpdateStatus === "InProgress") throw new Error("function update already in progress");
const zipBytes = fs.readFileSync(zipPath);
if (zipBytes.length > 50 * 1024 * 1024) throw new Error("zip exceeds direct-upload limit");

try {
  await run("sst", ["deploy"]);
} catch (e) {
  const m = /failed to update function (\S+): (.*)/.exec(String(e));
  if (m) {
    console.error(`Lambda update failed for ${m[1]}: ${m[2]}. Fix permissions/package, wait for in-flight ops, then retry.`);
    await sleep(15000);
    await run("sst", ["deploy"]);
  } else throw e;
}

When it happens

Trigger: `waitForUpdate` observes `LastUpdateStatus == Failed` during Create/Update — most commonly `Failed` due to a permission error on the S3 code object, or the function being stuck in another operation, or a bad deployment package.

Common situations: IAM role lacking `s3:GetObject` on the deployment bucket; concurrent updates (another deploy/dev run in flight); zip package too large or corrupted; KMS key access issues on environment variables.

Related errors

• You must provide a KMS key via `kmsKey` when configuring `cu
• Cannot set both "logging.retention" and "logging.logGroup"
• Durable functions require "logging.format" to be set to "jso
• Copy destination path "${to}" must be relative
• The "vpc.subnets" property has been renamed to "vpc.privateS

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/6a04aab923362719. Report an issue: GitHub.