aws-profile | Wrapper script to generate & pass AWS AssumeRole keys | Continuous Backup library

IoTDataPlane does not have resource. You can only use client with the IoTDataPlane:

The error likely isn't occuring in your provisioner execution per se, because if you remove the provisioner block the error still occurs on apply--but confusingly only the first time after a destroy. Removing the data "aws_secretsmanager_secret_version" "rds-secret" block as well "resolves" the error completely.

I'm guessing there is some sort of config delay issue here...but adding a 20 second delay provisioner to the aws_secretsmanager_secret.rds-secret resource block didn't help. And the value from the data block can be successfully output on subsequent apply runs, so maybe it's not just timing.

Even if you resolve the above more basic issue, it's likely your provisioner will still be confusing things by modifying a resource that Terraform is trying to manage in the same run. I'm not sure there's a way to get around that except perhaps by splitting into two separate operations.

Update:

It turns out that on the first run the data sources are read before the aws_secretsmanager_secret_version resource is created. Just adding depends_on = [aws_secretsmanager_secret_version.rds-secret-version] to the data "aws_secretsmanager_secret_version" block resolves this fully and makes the interpolation for your provisioner work as well. I haven't tested the actual provisioner.

Also you may need to consider this (which I take to not always apply to 0.13):

NOTE: In Terraform 0.12 and earlier, due to the data resource behavior of deferring the read until the apply phase when depending on values that are not yet known, using depends_on with data resources will force the read to always be deferred to the apply phase, and therefore a configuration that uses depends_on with a data resource can never converge. Due to this behavior, we do not recommend using depends_on with data resources.

The .serverless folder is created by serverless to alocate the cloud formation files. You should not handle them manually (and the folder and it’s content should not be included in source control).

The serverless.yml is the source of truth for the deployment, so it should do the same if running with the same environments.

The AWS account/profile can be set using the AWS cli. Given all the devs use the same account or use accounts with the same level of permissions, each one of you should be able to run deploy/remove.

If you project uses a .env file or environmental variables, each member of the team has to include them in their environment.

It sounds like you already know what to do but need a sanity check. So I'll tell you how I, and everyone else I know, handles this.

We prefix commands with AWS_PROFILE env var declared and we use --stage names.

E.g. AWS_PROFILE=mycompany sls deploy --stage shailendra.

Google aws configure for examples on how to set up awscli that uses the AWS_PROFILE var.

We also name the --stage with a unique ID, e.g. your name. This way, you and your colleagues all have individual CloudFormation stacks that work independently of eachother and there will be no conflicts.

You can do it in provider section:

Although not recommeneded. Have you tried using sudo sls deploy --aws-profile my_id --stage dev --region eu-west-1

This error can be also created by using the wrong password or ssh key.

Try passing in your AccessKeyId, SecretAccessKey, and Region directly to the constructor as a test (you don't ever want to hard code these in a real release). Make sure the user associated with these credentials has a policy configured to allow access to Kinesis.

Also use async/await.

I was able to pass the URL and unique ID for the API Gateway endpoint to a Lambda function as environment variables as follows:

When deploying the service you used a non-default AWS profile by passing the argument --aws-profile numpy-serverless-agent. It means that it is deployed to the account specified by this profile.

When trying to inovke the lambda, you didn't pass this argument, thus using the default profile, which is probably specifying a different AWS account.