# Serverless Error ... Policy statement must contain resources

**URL:** <https://forum.serverless.com/t/serverless-error-policy-statement-must-contain-resources/2802>\
**Category:** Serverless Framework\
**Created:** [October 2, 2017, 10:12pm UTC](https://forum.serverless.com/t/serverless-error-policy-statement-must-contain-resources/2802 "2017-10-02T22:12:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![whendry](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/whendry/32/1103_2.png) [@whendry](https://forum.serverless.com/u/whendry)\
**Post date:** [October 2, 2017, 10:12pm UTC](https://forum.serverless.com/t/serverless-error-policy-statement-must-contain-resources/2802/1 "2017-10-02T22:12:19Z")

</div>

Hello Friends,

Googled my best and tried a fix that worked on a different serverless project, but getting this error on a new project and am stumped with a tight timeline. Would be grateful for your perspective.

Serverless Error ---------------------------------------

```
 An error occurred while provisioning your stack: myDefaultRole
 - Policy statement must contain resources..

```

The serverless.yml I’m using is a copy from another working project that deploys successfully to our dev and prod AWS accounts, with of course only the bits refering to the name of the new project being changed.  
I checked the yaml with an online linter and it came back green.

This is the content of the serverless.yml:  
service: WayCoolLambda  
frameworkVersion: “=1.10.2”

custom:  
stage: ${opt:stage, self:provider.stage}  
version: ${env:BUILD\_VERSION, env:RV, self:custom.stage}  
aws\_account:  
dev:  
accountid: 12345678910  
securityGroupIds:  
- sg-XXXXXXX #allow\_all\_http\_in  
- sg-XXXXXXX #allow\_all\_https\_in  
- sg-XXXXXXX #allow\_all\_out  
subnetIds:  
- subnet-XXXXXXX #private  
- subnet-XXXXXXX #private  
dev:  
accountid: ${self:custom.aws\_account.dev.accountid}  
securityGroupIds: ${self:custom.aws\_account.dev.securityGroupIds}  
subnetIds: ${self:custom.aws\_account.dev.subnetIds}  
qa:  
accountid: ${self:custom.aws\_account.dev.accountid}  
securityGroupIds: ${self:custom.aws\_account.dev.securityGroupIds}  
subnetIds: ${self:custom.aws\_account.dev.subnetIds}  
preprod:  
accountid: ${self:custom.aws\_account.dev.accountid}  
securityGroupIds: ${self:custom.aws\_account.dev.securityGroupIds}  
subnetIds: ${self:custom.aws\_account.dev.subnetIds}  
production:  
accountid: 12345678910  
securityGroupIds:  
- sg-XXXXXXX  
subnetIds:  
- subnet-XXXXXXX  
- subnet-XXXXXXX

provider:  
name: aws  
runtime: java8  
region: us-east-1  
role: myDefaultRole  
vpc:  
securityGroupIds: ${self:custom.${self:custom.stage}.securityGroupIds}  
subnetIds: ${self:custom.${self:custom.stage}.subnetIds}

package:  
artifact: target/WayCoolLambda-${self:custom.version}.jar

functions:  
handleRequest:  
handler: com.manheim.waycool.WayCoolHandler::handleRequest  
description: WayCool Lambda  
environment: ${file(environment-${self:custom.stage}.yml)}

resources:  
Resources:  
myDefaultRole:  
Type: AWS::IAM::Role  
Properties:  
Path: /  
RoleName: ${self:service}-${self:custom.stage}  
AssumeRolePolicyDocument:  
Version: '2012-10-17’  
Statement:  
- Effect: Allow  
Principal:  
Service:  
- [lambda.amazonaws.com](http://lambda.amazonaws.com)  
Action: sts:AssumeRole  
Policies:  
- PolicyName: defaultPolicy  
PolicyDocument:  
Version: '2012-10-17’  
Statement:  
- Effect: Allow  
Action:  
- logs:CreateLogGroup  
- logs:CreateLogStream  
- logs:PutLogEvents  
Resource: arn:aws:logs:_:_:log-group:/aws/lambda/_:_:\*  
- Effect: "Allow"  
Action:  
- "s3:PutObject"  
Resource:  
Fn::Join:  
- “”  
- - “arn:aws:s3:::”  
- “Ref” : “ServerlessDeploymentBucket”  
- Effect: Allow  
Action:  
- ec2:CreateNetworkInterface  
- ec2:DescribeNetworkInterfaces  
- ec2:DetachNetworkInterface  
- ec2:DeleteNetworkInterface  
Resource: “\*”

It doesn’t look like the formatter for the forum preserves the yaml spacing, but as I said, I checked the yaml in an online linter and it came back OK.

If this is a total gooberhead easy question, please forgive me, but for the life of me, I can’t imagine what could be out of whack. Thank you for taking a moment to look at it with me.

---

<div class="post-metadata">

**Author:** ![whendry](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/whendry/32/1103_2.png) [@whendry](https://forum.serverless.com/u/whendry)\
**Post date:** [October 2, 2017, 10:33pm UTC](https://forum.serverless.com/t/serverless-error-policy-statement-must-contain-resources/2802/2 "2017-10-02T22:33:31Z")

</div>

I apologize for possibly wasting anyone’s time.

It turned out to not be a serverless error. Even though I had updated the file with the correct yaml formatting, I had to rebuild the pipeline so that the deploy job would check out the new revision with the yaml correction from github. Good grief.