AWS codebuild fails cant download source when initiated from codepipeline

Question

I have a an AWS codebuild job that works fine when I initate manually as a root user.

I have a codepipe line that should initiate the build job when codecommit merges into master. It fires the job and the build start but it fails when trying to download source.

Ive attached full S3/codebuild/codecommit policies to the pipeline, but it still throws access denied.

Which permissions am I missing?

Answer 1

This generally happens when you have a CodeBuild project already and you integrate it to the CodePipeline project. The Codebuild now does not download the sources from CodeCommit/Github repo. Instead, it will try to dowload the source artifact created in the codepipeline bucket in S3. So, you will need to provide permissions to the CodeBuild role to access the codepipline bucket in S3.

You can do this by modifying Codebuild role's attached policy (or attaching a new policy) that gives access to the following operations

s3:ListObjects
s3:GetObject
s3:ListBucket

for your Codepipeline bucket and its objects

"arn:aws:s3:::codepipeline-bucket",
"arn:aws:s3:::codepipeline-bucket/*"

Or you can just choose to add all operations for this bucket and its object. You can release the changes and it would work. Lmk if it does not.