SAM cannot access its generated build output

WHAT IT MEANS

Generated files are locked or owned by another user

sam build --debug failed: Error: [WinError 5] Access is denied: '.aws-sam\build'

SAM writes transformed templates and packaged function artifacts under .aws-sam/build. A previous elevated build, another user, an editor or watcher, or antivirus software can leave that generated directory unreadable or locked.

NEXT CHECK

Repair the local build directory

1. Close processes that may hold generated files. Stop editors, file watchers, local emulators, antivirus scans, and other SAM builds, then rerun sam build --debug to capture the first complete error.
2. Inspect ownership and permissions.

   # Windows
   icacls .aws-sam\build
   
   # macOS/Linux
   ls -ld .aws-sam/build

   Compare the directory and named file with the account running SAM.
3. Recreate only generated output. After confirming the source template and function directories are safe, move or remove .aws-sam/build and run sam build again. Do not delete source code or broaden AWS permissions for this local error.

AUTOMATE THE TRIAGE

Keep the handoff in your normal workflow

SAM Doctor recognizes this generated-output permission marker with medium confidence and points at local ownership and file-lock checks. It runs locally; no AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED

Related errors

• SAM build requires Docker — use when the container daemon itself cannot be reached.
• SAM build cannot find esbuild — use when the local JavaScript bundler dependency is missing.
• SAM could not upload a build artifact — a later packaging or deployment-bucket failure.