[CodeBuild] CodePipeline + CodeBuild + SecretsManager/SSM seems to have permission issues

Trying to add SecretsManager secret (same applies for SSM Parameter Store) to CodeBuild runs into AccessDeniedException when trying to run the CodePipeline. Weird thing is that the env varible is correctly visible and set in Environment Variables in CodeBuild but still can’t be accessed by the CodeBuild project. I have also checked that the grantRead actually creates required policies to access the secret but alas, it still keeps complaining that the CodeBuild role can’t access it.

Reproduction Steps

Stack CodeBuild configuration:

const roleCodeBuildCdk = new Role(this, 'CodeBuildRole', {
  assumedBy: new ServicePrincipal('codebuild.amazonaws.com'),
});

const secretGithubAccessToken = new Secret(this, 'GithubAccessToken', {
  secretName: 'GithubAccessToken',
});
secretGithubAccessToken.grantRead(roleCodeBuildCdk);

const projectNpmCommand = new PipelineProject(this, 'CdkBuildStage', {
  buildSpec: RunNpmCommand,
  environment: {
    buildImage: LinuxBuildImage.STANDARD_2_0,
    computeType: ComputeType.SMALL,
    environmentVariables: {
      NODE_AUTH_TOKEN: {
        value: secretGithubAccessToken.secretValue,
        type: BuildEnvironmentVariableType.SECRETS_MANAGER,
      },
    },
  },
  role: roleCodeBuildCdk,
});

Error Log

[Container] 2020/06/26 12:24:35 Phase context status code: Secrets Manager Error Message: AccessDeniedException: User: arn:aws:sts::12...cd2 is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:eu-west-1:12...K11

Environment

• Framework Version: v1.45.0
• Language (Version): TypeScript v3.9.5

---

This is 🐛 Bug Report

[zgajo]

I had the same problem and solved it by adding a policy to CodeBuild

  const secret = new secretsmanager.Secret(scope, `Api ${branch} Secret`, {
    secretName: `secret-secrets`,
  });

const cdk_build = new codebuild.PipelineProject(scope, `Build Api Website ${branch}`, {
    buildSpec: codebuild.BuildSpec.fromSourceFilename('./buildspec.yml'),
    environment: {
      buildImage: codebuild.LinuxBuildImage.STANDARD_3_0,
      environmentVariables: {
        SECRET_MANAGER_ARN: { value: secret.secretArn },
      },
    },
  });

  // add policy to allow fetching from secrets manager
  cdk_build.addToRolePolicy(
    new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      actions: [
        'secretsmanager:GetRandomPassword',
        'secretsmanager:GetResourcePolicy',
        'secretsmanager:GetSecretValue',
        'secretsmanager:DescribeSecret',
        'secretsmanager:ListSecretVersionIds',
      ],
      resources: [secret.secretArn],
    })
  );

[jaredjj3]

I had the same problem and solved it by adding a policy to CodeBuild

  const secret = new secretsmanager.Secret(scope, `Api ${branch} Secret`, {
    secretName: `secret-secrets`,
  });

const cdk_build = new codebuild.PipelineProject(scope, `Build Api Website ${branch}`, {
    buildSpec: codebuild.BuildSpec.fromSourceFilename('./buildspec.yml'),
    environment: {
      buildImage: codebuild.LinuxBuildImage.STANDARD_3_0,
      environmentVariables: {
        SECRET_MANAGER_ARN: { value: secret.secretArn },
      },
    },
  });

  // add policy to allow fetching from secrets manager
  cdk_build.addToRolePolicy(
    new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      actions: [
        'secretsmanager:GetRandomPassword',
        'secretsmanager:GetResourcePolicy',
        'secretsmanager:GetSecretValue',
        'secretsmanager:DescribeSecret',
        'secretsmanager:ListSecretVersionIds',
      ],
      resources: [secret.secretArn],
    })
  );

This only works because SECRET_MANAGER_ARN is implicitly a PLAINTEXT variable, which is different from OP, which is explicitly a SECRETS_MANAGER variable.

For the value of a SECRETS_MANAGER variable, use the build-spec secrets manager pattern: https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec.env.secrets-manager