6

I have a 3 stage CodePipeline on AWS.

  1. Source: Checks out upon commit a specific branch of CodeCommit (success)

  2. Build: Runs some tests on a docker image via CodeBuild (success)

  3. Deploy: Performs a deployment on a deployment group (a.k.a. some specifically tagged EC2 instances) via CodeDeploy (failure).

Step 3 fails with

Unable to access the artifact with Amazon S3 object key 'someitem-/BuildArtif/5zyjxoZ' located in the Amazon S3 artifact bucket 'codepipeline-eu-west-1-somerandomnumber'. The provided role does not have sufficient permissions.

Which role is the later referring to?

The service role of CodePipeline or the service role of CodeDeploy?

I am almost certain I have attached the appropriate policies to both though ...

Here is a snippet of my CodePipeline service role

enter image description here

pkaramol
  • 16,451
  • 43
  • 149
  • 324
  • I'm guessing it's the CodeDeploy role, since it's the CodePipeline that put the artifact into the bucket (although it doesn't necessarily mean it can also get it back). – Milan Cermak Feb 07 '19 at 14:00
  • This is due to artifact not being created. Refer this answer(https://stackoverflow.com/a/60983084/4842112) and article - https://medium.com/@shanikae/insufficient-permissions-unable-to-access-the-artifact-with-amazon-s3-247f27e6cdc3 – Shanika Ediriweera Apr 02 '20 at 01:58

4 Answers4

2

try to give "CodeDeploy" policy with full access, it should work.

Dharmendra Singh Negi
  • 393
  • 1
  • 12
1

This could also be due to the actual BuildArtifact not existing. Check the specified path in your S3 bucket to see whether the object actually exists. CodePipeline just gives CodeDeploy a reference to an artifact it thinks has been built and uploaded, but it doesn't really know.

ramdesh
  • 650
  • 6
  • 22
1

This issue is not related to the Roles assigned to either Codepipeline or Codebuild. If you investigate you would find that in the S3 bucket 'codepipeline-eu-west-1-somerandomnumber', there is no folder "BuildArtif" and certainly no file - "5zyjxoZ".

The issue is that Codebuild is not sending any artifact to Codedeploy, change the 'Input artifacts' for Codebuild to the output of the Source stage of the Pipeline and the issue would be resolved.

AwsAnurag
  • 91
  • 7
0

The error message should be referring to the CodeDeploy role. The CodeDeploy action passes the S3 artifact by reference to CodeDeploy, so the CodeDeploy role needs to have read access to the CodePipeline artifact.

Aaron
  • 1,575
  • 10
  • 18