AWS Codebuild fails while downloading source. Message: Access Denied

Question

I created a CodeBuild Project that uses a docker image for node8. The purpose of this CodeBuild project is to do unit testing. It takes an input artifact from CodeCommit. And in the buildspec.yml it runs a test command.

This is my (simple) buildspec file:

version: 0.2

phases:
  install:
    commands:
     - echo "install phase started"
     - npm install
     - echo "install phase ended"
  pre_build: 
    commands:
     - echo "pre_build aka test phase started"
     - echo "mocha unit test"
     - npm test
     - echo "mocha unit test ended"
  build:
    commands:
     - echo "build phase started"
     - echo "build complete"

The build is failing at the DOWNLOAD_SOURCE phase with the following:

PHASE - DOWNLOAD_SOURCE

Start time 2 minutes ago

End time 2 minutes ago

Message Access Denied

The only logs in the build logs are the following

[Container] 2018/01/12 11:30:22 Waiting for agent ping

[Container] 2018/01/12 11:30:22 Waiting for DOWNLOAD_SOURCE

Thanks in advance.

Screenshot of the CodeBuild policies.

Can you post the policy for the IAM role you're using for the CodeBuild project? — Clare Liguori
– Clare Liguori, Commented Jan 12, 2018 at 22:43
Are all of these policies attached to the role used in your CodeBuild project? "Access Denied" during Download Source makes me think the policy doesn't have a permission like codecommit:GitPull or s3:GetObject. — Clare Liguori
– Clare Liguori, Commented Jan 15, 2018 at 18:25

Mahattam · Accepted Answer · 2019-09-25 00:36:57Z

15

I found a fix. It was a problem with my permissions. I added this to make it work.

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Resource": [
            "arn:aws:logs:eu-west-1:723698621383:log-group:/aws/codebuild/project",
            "arn:aws:logs:eu-west-1:723698621383:log-group:/aws/codebuild/project:*"
        ],
        "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
        ]
    },
    {
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::codepipeline-eu-west-1-*"
        ],
        "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:GetObjectVersion"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "ssm:GetParameters"
        ],
        "Resource": "arn:aws:ssm:eu-west-1:723698621383:parameter/CodeBuild/*"
    }
  ]
}

edited Sep 25, 2019 at 0:36

Mahattam

5,8714 gold badges27 silver badges34 bronze badges

answered Jan 16, 2018 at 19:20

Qais Abou Jaoudé

6271 gold badge8 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

DarkTrick Over a year ago

Can you explain where you added it?

Kim T · Accepted Answer · 2020-06-11 01:50:56Z

7

I had the same error, a permissions issue accessing S3 bucket url. Originally I used an auto-generated codepipeline-us-west-2-* bucket name with the policy:

{
  "Effect": "Allow",
  "Resource": [
      "arn:aws:s3:::codepipeline-us-west-2-*"
  ],
  "Action": [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetBucketAcl",
      "s3:GetBucketLocation"
  ]
}

After changing to my own bucket name, the policy had to be updated to:

{
  "Effect": "Allow",
  "Resource": [
      "arn:aws:s3:::project-name-files/*"
  ],
  "Action": [
      "s3:PutObject",
      "s3:GetObject",
      "s3:GetObjectVersion",
      "s3:GetBucketAcl",
      "s3:GetBucketLocation"
  ]
}

edited Jun 11, 2020 at 1:50

answered Jun 11, 2020 at 1:40

Kim T

6,5982 gold badges63 silver badges85 bronze badges

1 Comment

Jeremiah Cooper Over a year ago

This was the fix for me! Thanks!

Sina · Accepted Answer · 2018-07-28 00:12:46Z

5

I had similar error and will post my fix in case it helps anyone else. I was using CodePipeline and had two separate builds happening. Build #1 would complete its build and the output artifact for that was to be the input artifact for Build #2. Build #2 was failing on the the DOWNLOAD_SOURCE phase with the following error:

AccessDenied: Access Denied status code: 403

The problem was that in my build spec for Build #1, I didn't have the artifacts defined. After calling out the artifact files/folders in Build #1, then Build #2 was able to download the source without issue.

answered Jul 28, 2018 at 0:12

Sina

3895 silver badges9 bronze badges

1 Comment

Gabriel Over a year ago

The same could be happening with one single build, if outputs and inputs are not correctly defined between steps (was my case)

aydow · Accepted Answer · 2020-10-14 05:07:42Z

I was experiencing the same symptoms but my issue was due to the default encryption on the S3 bucket as described in this post.

So everything in S3 is encrypted at rest. When you don't specify how you want to encrypt them, objects in S3 will be encrypted by the default KMS key. And other accounts won't be able to get access to objects in the bucket because they don't have that KMS key for decryption. So to get around this issue, you need to create your own KMS key and use it to encrypt (let the CodeBuild to use this KMS Key you have created in this case). Then allow roles in other accounts to use this key by configure AssumeRole permissions. From what I see, most S3 access denial happens at not being able to decrypt objects. And this is specified here Troubleshoot S3 403 Access Denied - encrypted objects will also cause 403 Access Denied.

In my case, the keys that were being used were mismatched which was causing the decryption failure.

Suresh · Accepted Answer · 2020-11-24 05:48:06Z

1

I faced the same issue.

My source was from an S3 folder. The fix involved putting a / at the end of the source path. It seems that without the / CodeBuild thinks it is a key.

Hope this helps someone save time.

edited Nov 24, 2020 at 5:48

answered Jul 19, 2020 at 6:31

Suresh

8559 silver badges18 bronze badges

2 Comments

JasonlPrice Over a year ago

Where was the / missing from?

Suresh Over a year ago

/ at the end of the source path. (Corrected)

d0wn · Accepted Answer · 2022-10-30 05:25:30Z

1

In my case I fixed the issue that way - when I was creating a build project configuration there is a step in which you have to provide Service role and Role name. There are two options for that step 1) create new one and 2) choose existing one. I created a new one. After that I faced the issue author described. After some research I added this policies to that role in IAM module and the issue went away.

AWSCodeDeployRoleForECS AWS managed Permissions policy
AWSCodeDeployRole   AWS managed Permissions policy
AWSCodeDeployRoleForCloudFormation  AWS managed Permissions policy
AWSCloudFormationFullAccess AWS managed Permissions policy
AWSCodeDeployRoleForLambda  AWS managed Permissions policy

answered Oct 30, 2022 at 5:25

d0wn

1714 bronze badges

Collectives™ on Stack Overflow

AWS Codebuild fails while downloading source. Message: Access Denied

6 Answers 6

1 Comment

1 Comment

1 Comment

Comments

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

1 Comment

1 Comment

1 Comment

Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related