Receive "Not authorized to perform DescribeSecurityGroups" when creating new Project in AWS CodeBuild

Question

I am trying to create a new project in AWS CodeBuild. Every time I attempt to I receive the following error:

Not authorized to perform DescribeSecurityGroups

Any help would be greatly appreciated.

Answer 1

I had this same issue when using cloudformation. The issue was the IAM role was being created before CodeBuild started creation, but the Policy attached the IAM role was being created after CodeBuild was created.

The remedy for this was to add a DependsOn to CodeBuild saying it needs the Policy to be created first.

Ex:

CodeBuildIamRole: 
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'CodeBuildAutomatedTestingRole'
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
      Path: /
  CodeBuildIamPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: !Sub 'CodeBuildServiceRolePolicy-${AWS::StackName}'
      PolicyDocument:
        Statement:
          - Action:
              - 's3:PutObject'
              - 's3:GetObject'
              - 's3:GetObjectVersion'
              - 's3:ListBucket'
            Effect: Allow
            Resource: '*'
          - Action:
              - 'logs:CreateLogGroup'
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
              - 'ec2:CreateNetworkInterface'
              - 'ec2:DescribeDhcpOptions'
              - 'ec2:DescribeNetworkInterfaces'
              - 'ec2:DeleteNetworkInterface'
              - 'ec2:DescribeSubnets'
              - 'ec2:DescribeSecurityGroups'
              - 'ec2:DescribeVpcs'
              - 'ec2:CreateNetworkInterfacePermission'
              - 'ecr:*'
              - ...
            Effect: Allow
            Resource:
              - '*'
      Roles:
        - !Ref CodeBuildIamRole
CodeBuild:
    DependsOn:
      - CodeBuildIamPolicy
    Type: "AWS::CodeBuild::Project"
    Properties:
      ...

Hopefully this is helpful