1

I have a central Tooling Account that contains the deployment pipeline and another account ("stage") where the application is deployed to. One of the steps in the pipeline is migrating the database with a lambda function in the staging account. The function is called but it runs into an error because it can't access the codepipeline and the stage in the pipeline runs into a timeout after ~20 minutes. The error message in the Pipeline suggests that the lambda function is not calling PutJobSuccessResult/ PutJobFailureResult or the function is not allowed to.

The function is calling these functions, but it seems like it has no access rights to the codepipeline in the tooling account.

These are the policies that are attached to the Lambda and Codepipeline:

Lambda:

...,{
        "Action": [
            "codepipeline:PutJobSuccessResult",
            "codepipeline:PutJobFailureResult"
        ],
        "Effect": "Allow",
        "Resource": [
          "*",
          "${var.pipelineArn}"
        ]
    },...

And Codepipeline:

..., {
  "Effect": "Allow",
  "Action": [
    "codepipeline:*",
    "iam:ListRoles",
    "cloudformation:Describe*",
    "cloudFormation:List*",
    "codecommit:List*",
    "codecommit:Get*",
    "codecommit:GitPull",
    "codecommit:UploadArchive",
    "codecommit:CancelUploadArchive",
    "codebuild:BatchGetBuilds",
    "codebuild:StartBuild",
    "cloudformation:CreateStack",
    "cloudformation:DeleteStack",
    "cloudformation:DescribeStacks",
    "cloudformation:UpdateStack",
    "cloudformation:CreateChangeSet",
    "cloudformation:DeleteChangeSet",
    "cloudformation:DescribeChangeSet",
    "cloudformation:ExecuteChangeSet",
    "cloudformation:SetStackPolicy",
    "cloudformation:ValidateTemplate",
    "iam:PassRole",
    "s3:ListAllMyBuckets",
    "s3:GetBucketLocation"
  ],
  "Resource": "*"
}, ...

Any ideas on what is missing? I assume that I need to add the Principle somewhere, but I don't know where...

  • What do you mean by "it can't access the codepipeline"? Would you mind sharing a few more details about your pipeline definition? Some stage is calling a lambda function in 'stage' account. What is it expected to access in 'pipeline' account? IMO, CodePipeline does not support resource-based policy you could define a principal within... – dsmsk80 Mar 26 at 13:22
  • Yeah, I had some discussion with someone from AWS and in the end, I had to assume a role inside the tooling account - where the pipeline was located - from tha lambda function. So I basically went [Tool] -> assume Role A -> [Staging] -> assume Role B -> [Tool]. Not the prettiest solution, but this works and it was rather easy to implement this in the lambda function. – SvenFinke Apr 2 at 14:08
1

You may need to assume a cross-account role in the Lambda to gain access to the Code Pipeline resources. That will essentially make the lambda look like it's running in the tooling account.

Check this out for some background info on how it works and how to set up the policies: Cross-account access

Then in your lambda you will have to call STS:AssumeRole to obtain the credentials from the other account. For example if you're using Python you can use boto3 sts.assume_role() call.

Hope that helps :)

0

Currently there is no way to grant ressource based access to the Codepipeline. In my case, I had to modify the lambda function inside the Staging Account. The function had to assume a role from the tooling account to have access to the codepipeline.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.