{"record":{"id":"6a9f951c83779848","repo":"anomalyco/sst","slug":"failed-to-delete-ssm-parameter-s-w","errorCode":null,"errorMessage":"failed to delete SSM parameter %s: %w","messagePattern":"failed to delete SSM parameter (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/project/provider/aws.go","lineNumber":470,"sourceCode":"\t\t\t_, err := s3Client.DeleteBucket(ctx, &s3.DeleteBucketInput{\n\t\t\t\tBucket: aws.String(data.Asset),\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\tif !strings.Contains(err.Error(), \"NoSuchBucket\") {\n\t\t\t\t\treturn fmt.Errorf(\"failed to delete S3 bucket %s: %w\", data.Asset, err)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Assign the new bucket name\n\t\t\tdata.Asset = value.Bucket\n\t\t}\n\n\t\t// Remove the SSM parameter\n\t\t_, err = ssmClient.DeleteParameter(ctx, &ssm.DeleteParameterInput{\n\t\t\tName: aws.String(ssmKey),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to delete SSM parameter %s: %w\", ssmKey, err)\n\t\t}\n\n\t\treturn nil\n\t},\n\n\t// Step: enforce bucket requests to use SSL\n\tfunc(ctx context.Context, cfg aws.Config, data *AwsBootstrapData) error {\n\t\ts3Client := s3.NewFromConfig(cfg)\n\n\t\t// set partition based on region\n\t\tpartition := \"aws\"\n\t\tif strings.HasPrefix(cfg.Region, \"cn-\") {\n\t\t\tpartition = \"aws-cn\"\n\t\t} else if strings.HasPrefix(cfg.Region, \"us-gov-\") {\n\t\t\tpartition = \"aws-us-gov\"\n\t\t}\n\n\t\tbuckets := []string{data.Asset, data.State}","sourceCodeStart":452,"sourceCodeEnd":488,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/project/provider/aws.go#L452-L488","documentation":"After migrating the asset bucket pointer, the cleanup step deletes the legacy `/sst/bootstrap/asset` SSM parameter. If `ssm:DeleteParameter` fails, this error wraps the AWS error. Most commonly this is an IAM permissions issue, since SST already confirmed the parameter exists via GetParameter.","triggerScenarios":"The deploy role lacks `ssm:DeleteParameter` on `/sst/bootstrap/asset`; the parameter was concurrently deleted and the AWS error is surfaced here; region mismatch between client config and the parameter's region.","commonSituations":"Restricted IAM policies that allow `ssm:GetParameter` but not `ssm:DeleteParameter`; SCPs forbidding parameter deletion in production accounts.","solutions":["Grant the deploy credentials `ssm:DeleteParameter` on `/sst/bootstrap/asset` (or run once with broader admin credentials)","If the parameter no longer exists, ignore — re-run `sst deploy` and the cleanup is a no-op","Confirm the AWS region/credentials match where the parameter was created"],"exampleFix":"// IAM policy addition\n{\n  \"Effect\": \"Allow\",\n  \"Action\": \"ssm:DeleteParameter\",\n  \"Resource\": \"arn:aws:ssm:*:*:parameter/sst/bootstrap/*\"\n}","handlingStrategy":"validation","validationCode":"aws iam simulate-principal-policy --policy-source-arn <deploy-role-arn> --action-names ssm:DeleteParameter --resource-arns arn:aws:ssm:*:*:parameter/sst/bootstrap/*","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Allow ssm:GetParameter, PutParameter, DeleteParameter on parameter/sst/bootstrap/* for the deploy role","Verify region matches where the bootstrap parameters live","Avoid SCPs that block SSM deletion in the deploy account"],"tags":["aws","ssm","iam","bootstrap-migration"],"backgroundTag":"access-denied-iam","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}