CDK "Failed to publish asset" - Fix Asset Upload in CI

CDK packaged your assets but could not upload them to the bootstrap S3 bucket or ECR repo. The publish step failed on permissions, a missing bucket, or a transient upload error before the stack could deploy.

What this error means

cdk deploy reaches the asset-publishing phase and fails with Failed to publish asset. A permissions/missing-bucket cause fails identically each run; a network/throttling cause during the upload often succeeds on retry.

cdk output

Failed to publish asset 4f3c...:current_account-us-east-1
❌  MyStack failed: Error: Failed to publish one or more assets.
  AccessDenied: Access Denied (Service: S3, Status Code: 403)

Common causes

Publish role lacks bucket/ECR access

The deploy identity cannot write to the bootstrap asset bucket or push to the ECR repo - a missing s3:PutObject/ecr permission, or a bucket policy/KMS key that denies it.

Transient upload or throttling error

A reset connection, an S3/ECR throttle, or a flaky network during a large asset upload fails the publish for this run only and clears on retry.

How to fix it

Grant publish access, then re-deploy

Confirm the deploy role can assume the CDK file/image publishing roles created by bootstrap.
Ensure write access to the bootstrap S3 bucket and ECR repo (and decrypt on the bootstrap KMS key).
Re-run - if the failure was a transient upload error, the retry publishes cleanly.

Verify the bootstrap stack exists and is current

A missing or stale bootstrap means there is no bucket/repo to publish to. Re-bootstrap the account/region.

Terminal

cdk bootstrap aws://123456789012/us-east-1
cdk deploy MyStack --require-approval never

How to prevent it

Bootstrap the account/region so the asset bucket and ECR repo exist.
Grant the deploy identity the publish-role and KMS permissions CDK needs.
Retry the deploy on transient publish failures rather than treating them as fatal.