SAM Doctor

ERROR REFERENCE

CloudFormation cannot read a Lambda layer artifact from S3

The layer's ContentUri points at an S3 object the creating service cannot GetObject. The layer zip exists — probably — but the read back out of S3 is denied.

WHAT IT MEANS

What this error means

Layer content is fetched from S3 at create time. The denial comes from one of: a bucket in another account without a bucket policy granting the read, SSE-KMS encryption whose key the reading identity cannot use, or a hardcoded ContentUri pointing at an object that was rotated away while the reference stayed.

FIX

How to fix it

  1. Confirm the object exists and you can read it (read-only): 
    aws s3api head-object --bucket layer-bucket --key path/to/layer.zip
    A 404 here means the reference is stale, not the permissions.
  2. For cross-account layer buckets, the bucket owner grants s3:GetObject on the artifact prefix via bucket policy; check any SSE-KMS key policy alongside it.
  3. Prefer letting sam build + deploy manage the artifact: a local ContentUri path uploads to the deployment bucket with permissions that already work, eliminating the hand-managed reference.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes the layer-read denial (high confidence) and keeps it apart from deployment-bucket denials, which have a different fix. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED