无法执行 AWS Pipeline 错误：“调用 PutObject 操作时发生错误 (AccessDenied)：拒绝访问”

Question

Have been trying to setup an AWS pipeline following the tutorial here: https://docs.aws.amazon.com/lambda/latest/dg/build-pipeline.html

But the pipeline continously fails with below error logs:

Here are some of the actions, I tried already:

1. Granted full access of S3 to "cfn-lambda-pipeline" role associated with Cloud Formation and Code Pipeline Service Role.

2. Allowed public ACL access to S3 bucket.

Below is my buildspec.yml

version: 0.2
phases:
  install:
    runtime-versions:
        nodejs: 12
  build:
    commands:
      - npm install
      - export BUCKET=xx-test
      - aws cloudformation package --template-file template.yaml --s3-bucket $BUCKET --output-template-file outputtemplate.yml
artifacts:
  type: zip
  files:
    - template.yml
    - outputtemplate.yml

Below is my template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  helloWorld
  DZ Bank API Gateway connectivity helloWorld
  
Globals:
  Function:
    Timeout: 3

Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./
      Handler: app.lambdaHandler
      Runtime: nodejs12.x
      Events:
        HelloWorld:
          Type: Api
          Properties:
            Path: /hello
            Method: get

Answer 1

The error is actually related to CodeBuild not CodePipeline. It seems like CodeBuild does not have valid permissions for its attached service role.

From the console you can find the attached service role by performing the following:

• Go to the CodeBuild console
• Click "Build Projects" from the menu on the left hand side
• Click the radio button next to build project you're using, then on the top menu click "Edit" and select then "Edit Source" option.
• At the bottom of the page will be a section titled "Service role permissions" with the Arn below it.

This IAM role will need to be granted the permissions it requires (in your case "s3:PutObject") if they are not already there.

AWS provides a full policy in the Create a CodeBuild service role documentation.

Answer 2

"cfn-lambda-pipeline" role associated with Cloud Formation and Code Pipeline Service Role.

The S3 permissions should be associated with CodeBuild (CB), because CB is going to run buildspec.yml . Thus CB needs to be able to access the S3.

According to the tutorial linked in the Update the build stage role section, the AmazonS3FullAccess should be added to codebuild-lamba-pipeline-build-service-role role, not to cfn-lambda-pipeline nor CodePipeline's role.