Cross-account pipeline doesn't generate sufficient permissions to deploy lambda in another account

🐛 Bug Report

What is the problem?

When using cross-account CloudFormation actions within pipeline to deploy Lambda the stack execution fails with the following error:

Your access has been denied by S3, please make sure your request credentials have permission to GetObject for ARTIFACTS_BUCKET_PATH

Error Code: AccessDenied. S3 Error Message: Access Denied (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException;

This happening because account deployment role doesn’t have permissions to both artifacts bucket and KMS key used by the pipeline. CDK only generates permissions for pipeline action role.

Reproduction Steps

1. Create a pipeline that deploys lambda into another account
2. Set lambda source code being from pipeline artifacts bucket
3. Deploy generated supporting stack to lambda account
4. Deploy pipeline stack to pipeline account
5. Execute the pipeline

Result: Pipeline fails due to insufficient permissions to deploy lambda.

Environment

• CDK CLI Version: 1.4.0
• Module Version: 1.4.0
• OS: OSX Mojave
• Language: TypeScript

[skinny85]

Yes, that is a separate problem 😃. A workaround can be to set the Project key to be the same as the Pipeline’s Key:

new codebuild.PipelineProject(this, 'Project', {
  // ...
  encryptionKey: myPipeline.artifactBucket.encryptionKey,
});

That should make it work.

[skinny85]

Thanks @jpeddicord . The solution here is to add permissions to the deployment Role, not to disable encryption:

myPipeline.artifactBucket.grantRead(myCloudFormationAction.deploymentRole);

(this will include both the Bucket and the Key)

Thanks, Adam