A staging CloudFormation deploy for a clerk fee API reports CREATEC…

Question

A staging CloudFormation deploy for a clerk fee API reports CREATECOMPLETE, but the first runtime GetItem against DynamoDB fails with AccessDenied. Integration tests catch it before promotion. What does this validate about environment testing?

Accepted Answer

Successful stack deploy is not enough; integration tests must exercise runtime IAM authorization paths the application uses. — Building the house is not the same as unlocking the front door. The stack can finish while the Lambda role still lacks dynamodb:GetItem. Integration tests that call the real path catch that—do not treat CREATECOMPLETE as permission proof.

Answer

AccessDenied at runtime means CloudFormation cannot create IAM roles, so the deploy status was wrong.

Answer

Integration tests should be skipped once CloudFormation returns CREATECOMPLETE.

Answer

GetItem failures in staging should be fixed only after the same code is live in production.

A staging CloudFormation deploy for a clerk fee API reports CREATE_COMPLETE, but the first runtime GetItem against DynamoDB fails with AccessDenied. Integration tests catch it before promotion. What does this validate about environment testing?

Short Explanation

Full Explanation