CloudFormation fails to create AlexaSkill - Resource not found

Question

I am trying to create an Alexa skill using AWS CloudFormation with the template below. I have generated a refresh token using the process described here with --scope alexa::ask:skills:readwrite. However, when I try to create the stack it fails on the Alexa::ASK::Skill with the cryptic error message:

Error occurred while updating the skill. Cause: Resource not found.

All the other resources in the stack create successfully before it fails on the AlexaSkill. What could be causing that error message?

Please note: I've tried this multiple times, so it was not a one off CloudFormation error.

Edit: This is in us-east-1 (North Virginia) region.

Update: I believe the issue is related to the uri lambda endpoint in the skill manifest because if I hardcode the uri to a function that doesn't exist, I get the same error.

Parameters:
  SkillName:
    Type: String
  BucketName:
    Type: String
  AlexaDeveloperClientId:
    Type: String
  AlexaDeveloperClientSecret:
    Type: String
  AlexaDeveloperRefreshToken:
    Type: String
  AlexaDeveloperVendorId:
    Type: String

Resources:
  AlexaS3ReadRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - alexa-appkit.amazon.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

  AlexaSkill:
    Type: Alexa::ASK::Skill
    Properties:
      AuthenticationConfiguration:
        ClientId: !Ref AlexaDeveloperClientId
        ClientSecret: !Ref AlexaDeveloperClientSecret
        RefreshToken: !Ref AlexaDeveloperRefreshToken
      SkillPackage:
        Overrides:
          Manifest:
            apis:
              custom:
                endpoint:
                  uri: !GetAtt LambdaFunction.Arn
        S3Bucket: !Ref BucketName
        S3BucketRole: !GetAtt AlexaS3ReadRole.Arn
        S3Key: !Sub ${SkillName}_skill_package.zip
      VendorId: !Ref AlexaDeveloperVendorId

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole

  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: !Ref BucketName
        S3Key: !Sub ${SkillName}_lambda_package.zip
      FunctionName: !Sub bp_alexa_${SkillName}
      Handler: main.lambda_handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: python3.7

Here is the stack event history:

2019-09-24 17:21:53 UTC-0400    bp-alexa-play-fortnite-stack    ROLLBACK_COMPLETE   -   AWS::CloudFormation::Stack
2019-09-24 17:21:52 UTC-0400    LambdaExecutionRole DELETE_COMPLETE -   AWS::IAM::Role
2019-09-24 17:21:50 UTC-0400    LambdaExecutionRole DELETE_IN_PROGRESS  -   AWS::IAM::Role
2019-09-24 17:21:50 UTC-0400    AlexaS3ReadRole DELETE_COMPLETE -   AWS::IAM::Role
2019-09-24 17:21:49 UTC-0400    LambdaFunction  DELETE_COMPLETE -   AWS::Lambda::Function
2019-09-24 17:21:49 UTC-0400    LambdaFunction  DELETE_IN_PROGRESS  -   AWS::Lambda::Function
2019-09-24 17:21:49 UTC-0400    AlexaS3ReadRole DELETE_IN_PROGRESS  -   AWS::IAM::Role
2019-09-24 17:21:48 UTC-0400    AlexaSkill  DELETE_COMPLETE -   Alexa::ASK::Skill
2019-09-24 17:21:46 UTC-0400    AlexaSkill  DELETE_IN_PROGRESS  -   Alexa::ASK::Skill
2019-09-24 17:21:45 UTC-0400    bp-alexa-play-fortnite-stack    ROLLBACK_IN_PROGRESS    The following resource(s) failed to create: [AlexaSkill]. . Rollback requested by user. AWS::CloudFormation::Stack
2019-09-24 17:21:44 UTC-0400    AlexaSkill  CREATE_FAILED   Error occurred while updating the skill. Cause: Resource not found. Alexa::ASK::Skill
2019-09-24 17:21:32 UTC-0400    AlexaSkill  CREATE_IN_PROGRESS  Resource creation Initiated Alexa::ASK::Skill
2019-09-24 17:21:29 UTC-0400    AlexaSkill  CREATE_IN_PROGRESS  -   Alexa::ASK::Skill
2019-09-24 17:21:27 UTC-0400    LambdaFunction  CREATE_COMPLETE -   AWS::Lambda::Function
2019-09-24 17:21:27 UTC-0400    LambdaFunction  CREATE_IN_PROGRESS  Resource creation Initiated AWS::Lambda::Function
2019-09-24 17:21:26 UTC-0400    LambdaFunction  CREATE_IN_PROGRESS  -   AWS::Lambda::Function
2019-09-24 17:21:23 UTC-0400    LambdaExecutionRole CREATE_COMPLETE -   AWS::IAM::Role
2019-09-24 17:21:23 UTC-0400    AlexaS3ReadRole CREATE_COMPLETE -   AWS::IAM::Role
2019-09-24 17:20:13 UTC-0400    LambdaExecutionRole CREATE_IN_PROGRESS  Resource creation Initiated AWS::IAM::Role
2019-09-24 17:20:12 UTC-0400    LambdaExecutionRole CREATE_IN_PROGRESS  -   AWS::IAM::Role
2019-09-24 17:20:12 UTC-0400    AlexaS3ReadRole CREATE_IN_PROGRESS  Resource creation Initiated AWS::IAM::Role
2019-09-24 17:20:11 UTC-0400    AlexaS3ReadRole CREATE_IN_PROGRESS  -   AWS::IAM::Role
2019-09-24 17:20:08 UTC-0400    bp-alexa-play-fortnite-stack    CREATE_IN_PROGRESS  User Initiated  AWS::CloudFormation::Stack

Answer 1

I've spent nearly all day fighting this, and I think I've narrowed it down.

Whenever I perform the stack initial creation, I have to leave out the endpoint URI altogether (from both the skill.json manifest and the Alexa::ASK::Skill Overrides). This enables CloudFormation to successfully create the skill without any setting for endpoint. Then, I am able to push an update to the template.yml containing the Overrides as in your template

That enables CloudFormation to successfully update the ASK skill to use the specified endpoint (ARN). The catch is that if I ever have to delete and recreate the stack from scratch, I have to insert a commit that comments out the Overrides section, followed by a commit that rolls just that change back, after the stack creation is successful. I can only guess there is a bug whereby the !GetAtt is somehow not correctly resolved, or the referenced function is not made visible to the ASK resource by the time it is created.

Answer 2

You may not want/need the overrides section declared. Especially if you plan on using things like the ASK CLI for updates and such, because every time you re-deploy with the CLI you will need to send an arbitrary update on the cloudformation to override your ARN that would be defined in the skill manifest. This can create confusion on what the real endpoint is at a given time. I would say, just declare that endpoint in the Skill Manifest. Rather, you can put the lambda ARN in the outputs section and put that into your manifest or on the console.

Another suggestion is the use of Aliases and Versions when you are using lambda for Alexa skills. Using Aliases and Versions helps a ton when you are doing updates and you need two versions of code running (live and development).

Answer 3

Most likely you are trying to deploy the stack in a region, where the resource is not available. If possible, try to deploy it in N.Virginia first.