| 122 | } |
| 123 | |
| 124 | async fn try_assume_role(client: &StsClient, role_arn: &str) -> Result<()> { |
| 125 | sleep(Duration::from_secs(5)).await; |
| 126 | |
| 127 | for attempt in 1..3 { |
| 128 | let session_id = format!("cargo_lambda_session_{}", uuid::Uuid::new_v4()); |
| 129 | |
| 130 | let result = client |
| 131 | .assume_role() |
| 132 | .role_arn(role_arn) |
| 133 | .role_session_name(session_id) |
| 134 | .send() |
| 135 | .await |
| 136 | .map_err(Error::from); |
| 137 | |
| 138 | tracing::trace!(attempt = attempt, result = ?result, "attempted to assume new role"); |
| 139 | |
| 140 | match result { |
| 141 | Ok(_) => return Ok(()), |
| 142 | Err(err) if attempt < 3 => match err.code() { |
| 143 | Some("AccessDenied") => { |
| 144 | tracing::trace!( |
| 145 | ?err, |
| 146 | "role might not be fully propagated yet, waiting before retrying" |
| 147 | ); |
| 148 | sleep(Duration::from_secs(attempt * 5)).await |
| 149 | } |
| 150 | _ => { |
| 151 | return Err(err) |
| 152 | .into_diagnostic() |
| 153 | .wrap_err("failed to assume new lambda role"); |
| 154 | } |
| 155 | }, |
| 156 | Err(err) => { |
| 157 | return Err(err) |
| 158 | .into_diagnostic() |
| 159 | .wrap_err("failed to assume new lambda role"); |
| 160 | } |
| 161 | } |
| 162 | } |
| 163 | |
| 164 | Err(miette::miette!( |
| 165 | "failed to assume new lambda role.\nTry deploying using the flag `--iam-role {}`", |
| 166 | role_arn |
| 167 | )) |
| 168 | } |
| 169 | |
| 170 | #[cfg(test)] |
| 171 | mod tests { |