Cannot teardown lambda@edge when using custom distribution about cloudfront-authorization-at-edge

[rpattcorner]

Truth in advertising ... I'm not an author of this stack, I'm a very minor contributor. But I use the stack in the way that you do, however without additional lambda@edges in my parent stack.

That said, my experience has been that you can fairly easily locate the ARNs of the lambdas created by the (cloudfront authorization at edge) nested stack in a couple of places:

1. In the lambda console or CLI itself. For example:
   

2. As entries in the cloudwatch event logs

In either case you can delete the remaining lambdas from cli (by ARN) or through the console. But ... as AWS points out, you can only delete them once all the references to them are gone.

Here my experience diverges from the documentation. The doc says basically you can delete the hanging lambdas once the last (in our case cloudfront) reference to them is gone, which would mean simply deleting the references in the cloudfront behaviours section. I've found that fails more often than succeeds. And it wouldn't help you anyway, since your self-created cloudfront died when you deleted the parent stack.

But ... once the references are gone, and they should be now that your parent stack and the cloudfront it created died, you can delete the lambdas once the unreferenced edge instances age out. I've found that takes 6-12 hours, depending on how many regions you deployed in.

So give it a try once you've slept on it. If that fails, or in the entirely possible event that I've completely misunderstood, you might want to contact AWS support and ask them to look at the edge lambdas that remain and tell you what artifacts are referencing them, so you can delete the blocking references.

But, as I think, the ARNs of the stale edge lambdas from the child stack should be available to you regardless.

[mneil]

I did consider that it might take some time. I'll try back again on Monday. For now I've redeployed the stacks which generates different lambda names and and able to use them. I already did create an AWS support ticket as well. Hopefully it clears itself up, as you say. Would still be good to make a note of it just in case. If not here, maybe in the AWS docs. I'll mention that to support :).

[ottokruse]

Closing for now as I do not believe there is an action for this repo