3

I am trying to set up a Continuous Integration pipeline for my simple AWS lambda function. To confess, the is my very first time using AWS code pipeline. I am having trouble with setting up the pipeline. The deploy stage in the pipeline is failing.

I created a CodeBuild

enter image description here

Then I created an application in CodeDeploy

enter image description here

Then I created a CodePipeline choosing the source as GitHub. The selected a repository and branch from the GitHub. Then linked the pipeline with the CodeDeploy application and CodeBuild I previously created.

After I save the pipeline and when the pipeline is built, I am getting this error.

enter image description here

When I check the error details, it says this

Unable to access the artifact with Amazon S3 object key 'the-goodyard-pipelin/BuildArtif/G12YurC' located in the Amazon S3 artifact bucket 'codepipeline-us-east-1-820116794245'. The provided role does not have sufficient permissions.

Basically, that Bucket does not exist as well. Isn't the Bucket created automatically? What went wrong with my set up?

The Bucket exist as well. It is just throwing error.

In the bucket, I can see the zip file as well.

enter image description here

halfer
  • 19,824
  • 17
  • 99
  • 186
Wai Yan Hein
  • 13,651
  • 35
  • 180
  • 372
  • 1
    This is due to artifact not being created. Refer this answer (https://stackoverflow.com/a/60983084/4842112) and article - https://medium.com/@shanikae/insufficient-permissions-unable-to-access-the-artifact-with-amazon-s3-247f27e6cdc3 – Shanika Ediriweera Apr 02 '20 at 01:57

1 Answers1

2

Well, the error message looks self explanatory, the role you assigned to codebuild doesn't have enough access to go to s3. Go to codebuild -> Build projects - > Choose your project -> Click on tab 'Build Details'. You will see a 'Service Role' ARN, that if you click on it, it will send you to that IAM role (if you are not an admin for that account, you may not have enough permissions to see IAM, as it is a critical permission service, so check this with the admin.) Check the policies for that role, and check if the policies have the action: s3:GetObject on resource: your bucket. If it doesn't, then you need to add it. Use the visual editor, use S3 as service, add Get* as action, and your s3 bucket to it.

Simon Ernesto Cardenas Zarate
  • 2,636
  • 1
  • 28
  • 42
  • I think you're right about the service role missing permissions, although I think it might be the CodePipeline service role rather than the CodeBuild one. There's documentation on the default CodePipeline service role here https://docs.aws.amazon.com/codepipeline/latest/userguide/how-to-custom-role.html – TimB Nov 21 '18 at 20:16