(codepipeline-actions): BitBucketSourceAction requires s3:PutObjectAcl permissions

Some time between aws-cdk 1.90.0 and 1.91.0, a bunch of s3:PutObject* permissions were changed to s3:PutObject, but that seems to have caused an issue with the codepipeline-actions.BitBucketSourceAction, leading to the error [GitHub] Upload to S3 failed with the following error: Access Denied in the Source action of a pipeline.

We’re using this with GitHub as advised in https://github.com/aws/aws-cdk/issues/10632.

Reproduction Steps

Create a CodePipeline with the BitBucketSourceAction and a codestar-connection to a GitHub repository.

What did you expect to happen?

The source action has the necessary permissions to write to the pipeline artifact bucket.

What actually happened?

The source action failed with the error [GitHub] Upload to S3 failed with the following error: Access Denied

Environment

• CDK CLI Version : 1.92.0
• Framework Version: 1.92.0
• Node.js Version: 14.11.0
• OS : Mac OS Catalina
• Language (Version): Python (3.8.5)

Other

We just need to add s3:PutObjectAcl as part of the default role that is generated for a BitBucketSourceAction.

---

This is 🐛 Bug Report

[panamclipper]

@skinny85 Sorry for the late response. That solution worked perfectly! Thank you!

[skinny85]

Yes @panamclipper, something like this:

sourceRole = new iam.Role(this, 'SourceRole', {
  assumedBy: new iam.AccountRootPrincipal(),
});

new codepipeline_actions.BitBucketSourceAction({
  // ...
  role: sourceRole,
});

// add the extra permissions
artifactBucket.grantPutObjectAcl(sourceRole);