4

I am using CodeBuild with

  • Image: aws/codebuild/nodejs:7.0.0
  • service role: code-buid-some-service-role

In my buildspec the following command runs

aws s3 sync ./webroot s3://s3-us-west-2.amazonaws.com/some-amazing-s3-bucket/test

This is the bucket policy:

{
    "Version": "2012-10-17",
    "Id": "Policy1502332584348",
    "Statement": [
        {
            "Sid": "Stmt1502332580996",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789:role/service-role/code-buid-some-service-role"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::some-amazing-s3-bucket/*",
                "arn:aws:s3:::some-amazing-s3-bucket"
            ]
        }
    ]
}

Code build is failing with this:

[Container] 2017/08/10 02:41:16 Running command aws s3 sync ./webroot s3://s3-us-west-2.amazonaws.com/some-amazing-s3-bucket/test
fatal error: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied

What am I missing? I have the bucket policy wide open while testing this and it's still failing.

4
  • I wonder if the role / user the service is running under needs a policy to give it permission. It shouldn't, but but maybe it's worth trying.
    – Tim
    Aug 10, 2017 at 3:18
  • @Tim which sort of policy?
    – Sean256
    Aug 10, 2017 at 3:28
  • 1
    Much like the one you already have, but attached to the role that runs whatever is doing that upload. Have a look at the policy I posted on this question, you'd just need the S3 parts - the second allow but grant s3:* like you did above.
    – Tim
    Aug 10, 2017 at 4:43
  • I would move away from a bucket policy and just add the permissions to the to IAM Role instead. I've not seen a role as the principal in a bucket policy. docs.aws.amazon.com/AmazonS3/latest/dev/…
    – strongjz
    Aug 11, 2017 at 12:43

2 Answers 2

7

Adding the following to the CodeBuild generated role worked for me:

{
    "Effect": "Allow",
    "Resource": [
        "arn:aws:s3:::mytestbucket",
        "arn:aws:s3:::mytestbucket/*"
    ],
    "Action": [
        "s3:PutObject",
        "s3:Get*",
        "s3:List*"
    ]
}
1

I had this same error and tried everything in this thread. I was trying to do

aws s3 sync ./build s3://s3-us-east-1.amazonaws.com/some-amazing-s3-bucket

from a Codebuild action, but the S3 response was always

fatal error: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied

even when I did it from the aws-cli on my laptop (with admin access keys).

It took me several hours to realize that the actual s3 url is supposed to be written like this:

s3://some-amazing-s3-bucket

instead of

s3://s3-us-east-1.amazonaws.com/some-amazing-s3-bucket

That being said, a policy like tedsmitt's has to be attached to the (in my case) codebuild role too.

Hope this helps someone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .