Unable to execute AWS Pipeline Error: "An error occurred (AccessDenied) when calling the PutObject operation: Access Denied"

Question

Have been trying to setup an AWS pipeline following the tutorial here: https://docs.aws.amazon.com/lambda/latest/dg/build-pipeline.html

But the pipeline continously fails with below error logs:

Here are some of the actions, I tried already:

1. Granted full access of S3 to "cfn-lambda-pipeline" role associated with Cloud Formation and Code Pipeline Service Role.

2. Allowed public ACL access to S3 bucket.

Below is my buildspec.yml

version: 0.2
phases:
  install:
    runtime-versions:
        nodejs: 12
  build:
    commands:
      - npm install
      - export BUCKET=xx-test
      - aws cloudformation package --template-file template.yaml --s3-bucket $BUCKET --output-template-file outputtemplate.yml
artifacts:
  type: zip
  files:
    - template.yml
    - outputtemplate.yml

Below is my template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  helloWorld
  DZ Bank API Gateway connectivity helloWorld
  
Globals:
  Function:
    Timeout: 3

Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./
      Handler: app.lambdaHandler
      Runtime: nodejs12.x
      Events:
        HelloWorld:
          Type: Api
          Properties:
            Path: /hello
            Method: get

Answer 1

The error is actually related to CodeBuild not CodePipeline. It seems like CodeBuild does not have valid permissions for its attached service role.

From the console you can find the attached service role by performing the following:

• Go to the CodeBuild console
• Click "Build Projects" from the menu on the left hand side
• Click the radio button next to build project you're using, then on the top menu click "Edit" and select then "Edit Source" option.
• At the bottom of the page will be a section titled "Service role permissions" with the Arn below it.

This IAM role will need to be granted the permissions it requires (in your case "s3:PutObject") if they are not already there.

AWS provides a full policy in the Create a CodeBuild service role documentation.