[CodeBuild] CodePipeline + CodeBuild + SecretsManager/SSM seems to have permission issues
See original GitHub issueTrying to add SecretsManager secret (same applies for SSM Parameter Store) to CodeBuild runs into AccessDeniedException when trying to run the CodePipeline. Weird thing is that the env varible is correctly visible and set in Environment Variables in CodeBuild but still can’t be accessed by the CodeBuild project. I have also checked that the grantRead actually creates required policies to access the secret but alas, it still keeps complaining that the CodeBuild role can’t access it.
Reproduction Steps
Stack CodeBuild configuration:
const roleCodeBuildCdk = new Role(this, 'CodeBuildRole', {
assumedBy: new ServicePrincipal('codebuild.amazonaws.com'),
});
const secretGithubAccessToken = new Secret(this, 'GithubAccessToken', {
secretName: 'GithubAccessToken',
});
secretGithubAccessToken.grantRead(roleCodeBuildCdk);
const projectNpmCommand = new PipelineProject(this, 'CdkBuildStage', {
buildSpec: RunNpmCommand,
environment: {
buildImage: LinuxBuildImage.STANDARD_2_0,
computeType: ComputeType.SMALL,
environmentVariables: {
NODE_AUTH_TOKEN: {
value: secretGithubAccessToken.secretValue,
type: BuildEnvironmentVariableType.SECRETS_MANAGER,
},
},
},
role: roleCodeBuildCdk,
});
Error Log
[Container] 2020/06/26 12:24:35 Phase context status code: Secrets Manager Error Message: AccessDeniedException: User: arn:aws:sts::12...cd2 is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:eu-west-1:12...K11
Environment
- Framework Version: v1.45.0
- Language (Version): TypeScript v3.9.5
This is 🐛 Bug Report
Issue Analytics
- State:
- Created 3 years ago
- Reactions:2
- Comments:6 (1 by maintainers)
I had the same problem and solved it by adding a policy to CodeBuild
This only works because
SECRET_MANAGER_ARN
is implicitly aPLAINTEXT
variable, which is different from OP, which is explicitly aSECRETS_MANAGER
variable.For the
value
of aSECRETS_MANAGER
variable, use the build-spec secrets manager pattern: https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec.env.secrets-manager