AWS Static site but getting s3:PutBucketPolicy

[4integration]

Hi,

I am new at Serverless FW and Lift but trying to get a very simple static site deployed.

Having this serverless.yml

service: aws-somesite-serverless

frameworkVersion: '3'

provider:
  name: aws
  profile: devexp-sandbox
  region: eu-north-1 

plugins:
  - serverless-lift

constructs:
    landing:
        type: static-website
        path: site
        domain: somesite.devexp-sandbox.mydomain.cloud
        certificate: arn:aws:acm:us-east-1:829819178032:certificate/fad3476a-e589-49f0************

But when deploying I get:

CREATE_FAILED: landingBucketPolicy0F0F1F6B (AWS::S3::BucketPolicy)
API: s3:PutBucketPolicy Access Denied

What I can see there is no Put policy, right? Why is that?

.serverless/cloudformation-template-create-stack.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "The AWS CloudFormation template for this Serverless application",
  "Resources": {
    "ServerlessDeploymentBucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        }
      }
    },
    "ServerlessDeploymentBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "ServerlessDeploymentBucket"
        },
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "s3:*",
              "Effect": "Deny",
              "Principal": "*",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":s3:::",
                      {
                        "Ref": "ServerlessDeploymentBucket"
                      },
                      "/*"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":s3:::",
                      {
                        "Ref": "ServerlessDeploymentBucket"
                      }
                    ]
                  ]
                }
              ],
              "Condition": {
                "Bool": {
                  "aws:SecureTransport": false
                }
              }
            }
          ]
        }
      }
    }
  },
  "Outputs": {
    "ServerlessDeploymentBucketName": {
      "Value": {
        "Ref": "ServerlessDeploymentBucket"
      }
    }
  }
}

.serverless/cloudformation-template-update-stack.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "The AWS CloudFormation template for this Serverless application",
  "Resources": {
    "ServerlessDeploymentBucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        }
      }
    },
    "ServerlessDeploymentBucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "ServerlessDeploymentBucket"
        },
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "s3:*",
              "Effect": "Deny",
              "Principal": "*",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":s3:::",
                      {
                        "Ref": "ServerlessDeploymentBucket"
                      },
                      "/*"
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":s3:::",
                      {
                        "Ref": "ServerlessDeploymentBucket"
                      }
                    ]
                  ]
                }
              ],
              "Condition": {
                "Bool": {
                  "aws:SecureTransport": false
                }
              }
            }
          ]
        }
      }
    },
    "landingBucket2B5C7526": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "WebsiteConfiguration": {
          "IndexDocument": "index.html"
        }
      },
      "UpdateReplacePolicy": "Delete",
      "DeletionPolicy": "Delete"
    },
    "landingBucketPolicy0F0F1F6B": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "landingBucket2B5C7526"
        },
        "PolicyDocument": {
          "Statement": [
            {
              "Action": "s3:GetObject",
              "Effect": "Allow",
              "Principal": {
                "AWS": "*"
              },
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    {
                      "Fn::GetAtt": [
                        "landingBucket2B5C7526",
                        "Arn"
                      ]
                    },
                    "/*"
                  ]
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        }
      }
    },
    "landingResponseFunctionA308C722": {
      "Type": "AWS::CloudFront::Function",
      "Properties": {
        "Name": "aws-somesite-serverless-dev-eu-north-1-landing-response",
        "AutoPublish": true,
        "FunctionCode": "function handler(event) {\n    var response = event.response;\n    response.headers = Object.assign({}, {\n    \"x-frame-options\": {\n        \"value\": \"SAMEORIGIN\"\n    },\n    \"x-content-type-options\": {\n        \"value\": \"nosniff\"\n    },\n    \"x-xss-protection\": {\n        \"value\": \"1; mode=block\"\n    },\n    \"strict-transport-security\": {\n        \"value\": \"max-age=63072000\"\n    }\n}, response.headers);\n    return response;\n}",
        "FunctionConfig": {
          "Comment": "aws-somesite-serverless-dev-eu-north-1-landing-response",
          "Runtime": "cloudfront-js-1.0"
        }
      }
    },
    "landingCDN3A699906": {
      "Type": "AWS::CloudFront::Distribution",
      "Properties": {
        "DistributionConfig": {
          "Aliases": [
            "somesite.devexp-sandbox.mydomain.cloud"
          ],
          "Comment": "aws-somesite-serverless-dev landing website CDN",
          "CustomErrorResponses": [
            {
              "ErrorCachingMinTTL": 0,
              "ErrorCode": 404,
              "ResponseCode": 200,
              "ResponsePagePath": "/index.html"
            }
          ],
          "DefaultCacheBehavior": {
            "AllowedMethods": [
              "GET",
              "HEAD",
              "OPTIONS"
            ],
            "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
            "Compress": true,
            "FunctionAssociations": [
              {
                "EventType": "viewer-response",
                "FunctionARN": {
                  "Fn::GetAtt": [
                    "landingResponseFunctionA308C722",
                    "FunctionARN"
                  ]
                }
              }
            ],
            "TargetOriginId": "landingCDNOrigin1FCED8263",
            "ViewerProtocolPolicy": "redirect-to-https"
          },
          "DefaultRootObject": "index.html",
          "Enabled": true,
          "HttpVersion": "http2",
          "IPV6Enabled": true,
          "Origins": [
            {
              "CustomOriginConfig": {
                "OriginProtocolPolicy": "http-only",
                "OriginSSLProtocols": [
                  "TLSv1.2"
                ]
              },
              "DomainName": {
                "Fn::Select": [
                  2,
                  {
                    "Fn::Split": [
                      "/",
                      {
                        "Fn::GetAtt": [
                          "landingBucket2B5C7526",
                          "WebsiteURL"
                        ]
                      }
                    ]
                  }
                ]
              },
              "Id": "landingCDNOrigin1FCED8263"
            }
          ],
          "ViewerCertificate": {
            "AcmCertificateArn": "arn:aws:acm:us-east-1:829819178032:certificate/fad3476a-e589-49f0************",
            "MinimumProtocolVersion": "TLSv1.2_2021",
            "SslSupportMethod": "sni-only"
          }
        }
      }
    }
  },
  "Outputs": {
    "ServerlessDeploymentBucketName": {
      "Value": {
        "Ref": "ServerlessDeploymentBucket"
      },
      "Export": {
        "Name": "sls-aws-somesite-serverless-dev-ServerlessDeploymentBucketName"
      }
    },
    "landingBucketName4FF24876": {
      "Description": "Name of the bucket that stores the static website.",
      "Value": {
        "Ref": "landingBucket2B5C7526"
      }
    },
    "landingDomain37625960": {
      "Description": "Website domain name.",
      "Value": "somesite.devexp-sandbox.mydomain.cloud"
    },
    "landingCloudFrontCName00BB4C9F": {
      "Description": "CloudFront CNAME.",
      "Value": {
        "Fn::GetAtt": [
          "landingCDN3A699906",
          "DomainName"
        ]
      }
    },
    "landingDistributionId9079C8BD": {
      "Description": "ID of the CloudFront distribution.",
      "Value": {
        "Ref": "landingCDN3A699906"
      }
    }
  }
}

.serverless/serverless-state.json

{
  "service": {
    "service": "aws-somesite-serverless",
    "serviceObject": {
      "name": "aws-somesite-serverless"
    },
    "provider": {
      "name": "aws",
      "profile": "devexp-sandbox",
      "region": "eu-north-1",
      "stage": "dev",
      "versionFunctions": true,
      "compiledCloudFormationTemplate": {
        "AWSTemplateFormatVersion": "2010-09-09",
        "Description": "The AWS CloudFormation template for this Serverless application",
        "Resources": {
          "ServerlessDeploymentBucket": {
            "Type": "AWS::S3::Bucket",
            "Properties": {
              "BucketEncryption": {
                "ServerSideEncryptionConfiguration": [
                  {
                    "ServerSideEncryptionByDefault": {
                      "SSEAlgorithm": "AES256"
                    }
                  }
                ]
              }
            }
          },
          "ServerlessDeploymentBucketPolicy": {
            "Type": "AWS::S3::BucketPolicy",
            "Properties": {
              "Bucket": {
                "Ref": "ServerlessDeploymentBucket"
              },
              "PolicyDocument": {
                "Statement": [
                  {
                    "Action": "s3:*",
                    "Effect": "Deny",
                    "Principal": "*",
                    "Resource": [
                      {
                        "Fn::Join": [
                          "",
                          [
                            "arn:",
                            {
                              "Ref": "AWS::Partition"
                            },
                            ":s3:::",
                            {
                              "Ref": "ServerlessDeploymentBucket"
                            },
                            "/*"
                          ]
                        ]
                      },
                      {
                        "Fn::Join": [
                          "",
                          [
                            "arn:",
                            {
                              "Ref": "AWS::Partition"
                            },
                            ":s3:::",
                            {
                              "Ref": "ServerlessDeploymentBucket"
                            }
                          ]
                        ]
                      }
                    ],
                    "Condition": {
                      "Bool": {
                        "aws:SecureTransport": false
                      }
                    }
                  }
                ]
              }
            }
          },
          "landingBucket2B5C7526": {
            "Type": "AWS::S3::Bucket",
            "Properties": {
              "WebsiteConfiguration": {
                "IndexDocument": "index.html"
              }
            },
            "UpdateReplacePolicy": "Delete",
            "DeletionPolicy": "Delete"
          },
          "landingBucketPolicy0F0F1F6B": {
            "Type": "AWS::S3::BucketPolicy",
            "Properties": {
              "Bucket": {
                "Ref": "landingBucket2B5C7526"
              },
              "PolicyDocument": {
                "Statement": [
                  {
                    "Action": "s3:GetObject",
                    "Effect": "Allow",
                    "Principal": {
                      "AWS": "*"
                    },
                    "Resource": {
                      "Fn::Join": [
                        "",
                        [
                          {
                            "Fn::GetAtt": [
                              "landingBucket2B5C7526",
                              "Arn"
                            ]
                          },
                          "/*"
                        ]
                      ]
                    }
                  }
                ],
                "Version": "2012-10-17"
              }
            }
          },
          "landingResponseFunctionA308C722": {
            "Type": "AWS::CloudFront::Function",
            "Properties": {
              "Name": "aws-somesite-serverless-dev-eu-north-1-landing-response",
              "AutoPublish": true,
              "FunctionCode": "function handler(event) {\n    var response = event.response;\n    response.headers = Object.assign({}, {\n    \"x-frame-options\": {\n        \"value\": \"SAMEORIGIN\"\n    },\n    \"x-content-type-options\": {\n        \"value\": \"nosniff\"\n    },\n    \"x-xss-protection\": {\n        \"value\": \"1; mode=block\"\n    },\n    \"strict-transport-security\": {\n        \"value\": \"max-age=63072000\"\n    }\n}, response.headers);\n    return response;\n}",
              "FunctionConfig": {
                "Comment": "aws-somesite-serverless-dev-eu-north-1-landing-response",
                "Runtime": "cloudfront-js-1.0"
              }
            }
          },
          "landingCDN3A699906": {
            "Type": "AWS::CloudFront::Distribution",
            "Properties": {
              "DistributionConfig": {
                "Aliases": [
                  "somesite.devexp-sandbox.mydomain.cloud"
                ],
                "Comment": "aws-somesite-serverless-dev landing website CDN",
                "CustomErrorResponses": [
                  {
                    "ErrorCachingMinTTL": 0,
                    "ErrorCode": 404,
                    "ResponseCode": 200,
                    "ResponsePagePath": "/index.html"
                  }
                ],
                "DefaultCacheBehavior": {
                  "AllowedMethods": [
                    "GET",
                    "HEAD",
                    "OPTIONS"
                  ],
                  "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
                  "Compress": true,
                  "FunctionAssociations": [
                    {
                      "EventType": "viewer-response",
                      "FunctionARN": {
                        "Fn::GetAtt": [
                          "landingResponseFunctionA308C722",
                          "FunctionARN"
                        ]
                      }
                    }
                  ],
                  "TargetOriginId": "landingCDNOrigin1FCED8263",
                  "ViewerProtocolPolicy": "redirect-to-https"
                },
                "DefaultRootObject": "index.html",
                "Enabled": true,
                "HttpVersion": "http2",
                "IPV6Enabled": true,
                "Origins": [
                  {
                    "CustomOriginConfig": {
                      "OriginProtocolPolicy": "http-only",
                      "OriginSSLProtocols": [
                        "TLSv1.2"
                      ]
                    },
                    "DomainName": {
                      "Fn::Select": [
                        2,
                        {
                          "Fn::Split": [
                            "/",
                            {
                              "Fn::GetAtt": [
                                "landingBucket2B5C7526",
                                "WebsiteURL"
                              ]
                            }
                          ]
                        }
                      ]
                    },
                    "Id": "landingCDNOrigin1FCED8263"
                  }
                ],
                "ViewerCertificate": {
                  "AcmCertificateArn": "arn:aws:acm:us-east-1:829819178032:certificate/fad3476a-e589-49f0************",
                  "MinimumProtocolVersion": "TLSv1.2_2021",
                  "SslSupportMethod": "sni-only"
                }
              }
            }
          }
        },
        "Outputs": {
          "ServerlessDeploymentBucketName": {
            "Value": {
              "Ref": "ServerlessDeploymentBucket"
            },
            "Export": {
              "Name": "sls-aws-somesite-serverless-dev-ServerlessDeploymentBucketName"
            }
          },
          "landingBucketName4FF24876": {
            "Description": "Name of the bucket that stores the static website.",
            "Value": {
              "Ref": "landingBucket2B5C7526"
            }
          },
          "landingDomain37625960": {
            "Description": "Website domain name.",
            "Value": "somesite.devexp-sandbox.mydomain.cloud"
          },
          "landingCloudFrontCName00BB4C9F": {
            "Description": "CloudFront CNAME.",
            "Value": {
              "Fn::GetAtt": [
                "landingCDN3A699906",
                "DomainName"
              ]
            }
          },
          "landingDistributionId9079C8BD": {
            "Description": "ID of the CloudFront distribution.",
            "Value": {
              "Ref": "landingCDN3A699906"
            }
          }
        }
      },
      "coreCloudFormationTemplate": {
        "AWSTemplateFormatVersion": "2010-09-09",
        "Description": "The AWS CloudFormation template for this Serverless application",
        "Resources": {
          "ServerlessDeploymentBucket": {
            "Type": "AWS::S3::Bucket",
            "Properties": {
              "BucketEncryption": {
                "ServerSideEncryptionConfiguration": [
                  {
                    "ServerSideEncryptionByDefault": {
                      "SSEAlgorithm": "AES256"
                    }
                  }
                ]
              }
            }
          },
          "ServerlessDeploymentBucketPolicy": {
            "Type": "AWS::S3::BucketPolicy",
            "Properties": {
              "Bucket": {
                "Ref": "ServerlessDeploymentBucket"
              },
              "PolicyDocument": {
                "Statement": [
                  {
                    "Action": "s3:*",
                    "Effect": "Deny",
                    "Principal": "*",
                    "Resource": [
                      {
                        "Fn::Join": [
                          "",
                          [
                            "arn:",
                            {
                              "Ref": "AWS::Partition"
                            },
                            ":s3:::",
                            {
                              "Ref": "ServerlessDeploymentBucket"
                            },
                            "/*"
                          ]
                        ]
                      },
                      {
                        "Fn::Join": [
                          "",
                          [
                            "arn:",
                            {
                              "Ref": "AWS::Partition"
                            },
                            ":s3:::",
                            {
                              "Ref": "ServerlessDeploymentBucket"
                            }
                          ]
                        ]
                      }
                    ],
                    "Condition": {
                      "Bool": {
                        "aws:SecureTransport": false
                      }
                    }
                  }
                ]
              }
            }
          }
        },
        "Outputs": {
          "ServerlessDeploymentBucketName": {
            "Value": {
              "Ref": "ServerlessDeploymentBucket"
            }
          }
        }
      }
    },
    "plugins": [
      "serverless-lift"
    ],
    "pluginsData": {},
    "functions": {},
    "resources": {
      "Resources": {
        "landingBucket2B5C7526": {
          "Type": "AWS::S3::Bucket",
          "Properties": {
            "WebsiteConfiguration": {
              "IndexDocument": "index.html"
            }
          },
          "UpdateReplacePolicy": "Delete",
          "DeletionPolicy": "Delete"
        },
        "landingBucketPolicy0F0F1F6B": {
          "Type": "AWS::S3::BucketPolicy",
          "Properties": {
            "Bucket": {
              "Ref": "landingBucket2B5C7526"
            },
            "PolicyDocument": {
              "Statement": [
                {
                  "Action": "s3:GetObject",
                  "Effect": "Allow",
                  "Principal": {
                    "AWS": "*"
                  },
                  "Resource": {
                    "Fn::Join": [
                      "",
                      [
                        {
                          "Fn::GetAtt": [
                            "landingBucket2B5C7526",
                            "Arn"
                          ]
                        },
                        "/*"
                      ]
                    ]
                  }
                }
              ],
              "Version": "2012-10-17"
            }
          }
        },
        "landingResponseFunctionA308C722": {
          "Type": "AWS::CloudFront::Function",
          "Properties": {
            "Name": "aws-somesite-serverless-dev-eu-north-1-landing-response",
            "AutoPublish": true,
            "FunctionCode": "function handler(event) {\n    var response = event.response;\n    response.headers = Object.assign({}, {\n    \"x-frame-options\": {\n        \"value\": \"SAMEORIGIN\"\n    },\n    \"x-content-type-options\": {\n        \"value\": \"nosniff\"\n    },\n    \"x-xss-protection\": {\n        \"value\": \"1; mode=block\"\n    },\n    \"strict-transport-security\": {\n        \"value\": \"max-age=63072000\"\n    }\n}, response.headers);\n    return response;\n}",
            "FunctionConfig": {
              "Comment": "aws-somesite-serverless-dev-eu-north-1-landing-response",
              "Runtime": "cloudfront-js-1.0"
            }
          }
        },
        "landingCDN3A699906": {
          "Type": "AWS::CloudFront::Distribution",
          "Properties": {
            "DistributionConfig": {
              "Aliases": [
                "somesite.devexp-sandbox.mydomain.cloud"
              ],
              "Comment": "aws-somesite-serverless-dev landing website CDN",
              "CustomErrorResponses": [
                {
                  "ErrorCachingMinTTL": 0,
                  "ErrorCode": 404,
                  "ResponseCode": 200,
                  "ResponsePagePath": "/index.html"
                }
              ],
              "DefaultCacheBehavior": {
                "AllowedMethods": [
                  "GET",
                  "HEAD",
                  "OPTIONS"
                ],
                "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
                "Compress": true,
                "FunctionAssociations": [
                  {
                    "EventType": "viewer-response",
                    "FunctionARN": {
                      "Fn::GetAtt": [
                        "landingResponseFunctionA308C722",
                        "FunctionARN"
                      ]
                    }
                  }
                ],
                "TargetOriginId": "landingCDNOrigin1FCED8263",
                "ViewerProtocolPolicy": "redirect-to-https"
              },
              "DefaultRootObject": "index.html",
              "Enabled": true,
              "HttpVersion": "http2",
              "IPV6Enabled": true,
              "Origins": [
                {
                  "CustomOriginConfig": {
                    "OriginProtocolPolicy": "http-only",
                    "OriginSSLProtocols": [
                      "TLSv1.2"
                    ]
                  },
                  "DomainName": {
                    "Fn::Select": [
                      2,
                      {
                        "Fn::Split": [
                          "/",
                          {
                            "Fn::GetAtt": [
                              "landingBucket2B5C7526",
                              "WebsiteURL"
                            ]
                          }
                        ]
                      }
                    ]
                  },
                  "Id": "landingCDNOrigin1FCED8263"
                }
              ],
              "ViewerCertificate": {
                "AcmCertificateArn": "arn:aws:acm:us-east-1:829819178032:certificate/fad3476a-e589-49f0************",
                "MinimumProtocolVersion": "TLSv1.2_2021",
                "SslSupportMethod": "sni-only"
              }
            }
          }
        }
      },
      "Outputs": {
        "landingBucketName4FF24876": {
          "Description": "Name of the bucket that stores the static website.",
          "Value": {
            "Ref": "landingBucket2B5C7526"
          }
        },
        "landingDomain37625960": {
          "Description": "Website domain name.",
          "Value": "somesite.devexp-sandbox.mydomain.cloud"
        },
        "landingCloudFrontCName00BB4C9F": {
          "Description": "CloudFront CNAME.",
          "Value": {
            "Fn::GetAtt": [
              "landingCDN3A699906",
              "DomainName"
            ]
          }
        },
        "landingDistributionId9079C8BD": {
          "Description": "ID of the CloudFront distribution.",
          "Value": {
            "Ref": "landingCDN3A699906"
          }
        }
      }
    },
    "configValidationMode": "warn",
    "serviceFilename": "serverless.yml",
    "initialServerlessConfig": {
      "service": "aws-somesite-serverless",
      "frameworkVersion": "3",
      "provider": {
        "name": "aws",
        "profile": "devexp-sandbox",
        "region": "eu-north-1",
        "stage": "dev",
        "versionFunctions": true
      },
      "plugins": {
        "$ref": "$[\"service\"][\"plugins\"]"
      },
      "constructs": {
        "landing": {
          "type": "static-website",
          "path": "site",
          "domain": "somesite.devexp-sandbox.mydomain.cloud",
          "certificate": "arn:aws:acm:us-east-1:829819178032:certificate/fad3476a-e589-49f0************"
        }
      }
    },
    "layers": {},
    "isDashboardMonitoringPreconfigured": false
  },
  "package": {
    "artifactDirectoryName": "serverless/aws-somesite-serverless/dev/1662716091301-2022-09-09T09:34:51.301Z",
    "artifact": ""
  }
}

[mnapoli]

Is this a freshly new created AWS account? Or could there be restrictions put in place by an admin in your organization?

[4integration]

It is a pretty new account and we have applied restrictions but I have done more or less the same thing with CDK (creating certificate, S3 bucket, CloudFront distribution, upload content to S3 etc...).

In the above I can see allow for s3:GetObject but not s3:PutObject, is that correct?

[mnapoli]

In the above I can see allow for s3:GetObject but not s3:PutObject, is that correct?

Yes, I agree that this part is weird, I cannot figure this out either.

Do you get the same error when deploying a simple Serverless Framework app? Maybe the problem is with the bucket created by SF itself? (the serverlessdeploymentbucket)