{"record":{"id":"1ba1b3ec4768b3e4","repo":"anomalyco/sst","slug":"failed-to-marshal-policy-for-bucket-s-w","errorCode":null,"errorMessage":"failed to marshal policy for bucket %s: %w","messagePattern":"failed to marshal policy for bucket (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/project/provider/aws.go","lineNumber":514,"sourceCode":"\t\t\t\t\t\t\"Effect\":    \"Deny\",\n\t\t\t\t\t\t\"Principal\": \"*\",\n\t\t\t\t\t\t\"Action\":    \"s3:*\",\n\t\t\t\t\t\t\"Resource\": []string{\n\t\t\t\t\t\t\tfmt.Sprintf(\"arn:%s:s3:::%s\", partition, bucket),\n\t\t\t\t\t\t\tfmt.Sprintf(\"arn:%s:s3:::%s/*\", partition, bucket),\n\t\t\t\t\t\t},\n\t\t\t\t\t\t\"Condition\": map[string]interface{}{\n\t\t\t\t\t\t\t\"Bool\": map[string]interface{}{\n\t\t\t\t\t\t\t\t\"aws:SecureTransport\": \"false\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t}\n\n\t\t\tpolicyJSON, err := json.Marshal(policy)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to marshal policy for bucket %s: %w\", bucket, err)\n\t\t\t}\n\n\t\t\t_, err = s3Client.PutBucketPolicy(ctx, &s3.PutBucketPolicyInput{\n\t\t\t\tBucket: aws.String(bucket),\n\t\t\t\tPolicy: aws.String(string(policyJSON)),\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to put bucket policy for %s: %w\", bucket, err)\n\t\t\t}\n\t\t}\n\n\t\treturn nil\n\t},\n\n\t// Step: add appsync events apis for live lambda - we no longer do this\n\tfunc(ctx context.Context, cfg aws.Config, data *AwsBootstrapData) error {\n\t\treturn nil\n\t},","sourceCodeStart":496,"sourceCodeEnd":532,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/project/provider/aws.go#L496-L532","documentation":"The SSL-enforcement bootstrap step builds an IAM policy document that Denies non-TLS (`aws:SecureTransport=false`) requests to the asset and state buckets, then `json.Marshal`s it. Marshal failure is practically impossible for this in-memory map unless a value is unencodable (e.g. NaN float or channel injected by modification), so this indicates the bootstrap step code or data was altered.","triggerScenarios":"Essentially only when the policy map contains a value `encoding/json` cannot serialize — e.g. custom-modified bootstrap steps or a fork that inserts unsupported types.","commonSituations":"Custom forks of SST bootstrap steps; locally patched provider code.","solutions":["Revert any local modifications to `pkg/project/provider/aws.go` bootstrap steps","Rebuild the CLI/platform from a clean checkout and retry `sst deploy`","If reproducible on stock SST, file an issue with the Go version and stack trace"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := sstDeploy(ctx)\nif err != nil && strings.Contains(err.Error(), \"failed to marshal policy\") {\n    // rebuild CLI from a clean checkout and retry\n}","preventionTips":["Don't fork/patch bootstrap steps with non-JSON-encodable values","Keep the CLI built from a clean tree"],"tags":["aws","s3","json","bootstrap"],"backgroundTag":"json-marshal-failed","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}