1.2: Access Denied in phase DOWNLOAD_SOURCE

Hello again,

I’ve been using the CodeBuild Plugin for Jenkins in my organisation for quite some time and gave the latest version a try. Yet when I change the plugin in Jenkins from 1.1 (March 2017) to the latest commit e56fc3d591027c24b7edb05e1c4639bbf790d4c5 i recieve an error which did not occur before in the same jobs. I also tried the version from jenkins.io

The Jenkins job fails with:

[AWS CodeBuild Plugin] Uploading source to S3.

[AWS CodeBuild Plugin] Uploading code to S3 at location <snip>/source/source/. MD5 checksum is vwgkz<snip>Ug0ve8Q==

[AWS CodeBuild Plugin] Source upload finished.
[AWS CodeBuild Plugin] S3 object version id for uploaded source is TB<snip>dY7
[AWS CodeBuild Plugin] Starting build with project name <snip> and source version TB<snip>dY7

[AWS CodeBuild Plugin] Logs url: https://console.aws.amazon.com/cloudwatch/home?region=eu-west-1#logEvent:group=/aws/codebuild/<snip>;stream=2b3c0e7<snip>de793

[AWS CodeBuild Plugin] Build failed for build-npm and source version 
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
CodeBuildException
	at CodeBuildStep$CodeBuildExecution.run(CodeBuildStep.java:170)
	at CodeBuildStep$CodeBuildExecution.run(CodeBuildStep.java:136)
	at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)
	at hudson.security.ACL.impersonate(ACL.java:260)
	at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:748)
Finished: FAILURE

And CodeBuild fails with:

Access Denied in the phase DOWNLOAD_SOURCE

The Cloudwatch logfile is also empty.

Has something changed with the permissons in version 1.2? My permissions for version 1.1 were fine as all builds succeeded.

Thanks

[krm1]

Not sure what specific permission was missing, but this fixed it for me:

IAM CodeBuild user:

        {
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::mycodebuildbucket/source/*"
            ],
            "Action": [
                "*"
            ]
        }

[andrewrch]

I ran in to this problem some days ago.

The problem seemed to occur because my source zip was located in a subfolder within the bucket. I worked around this issue by changing my CodeBuild project to use a zip file in the top level of the bucket.