[BUG] CodePipeline fails Build stage due to Permission Error

[youngjeong46]

Implementing a pipeline to deploy stack require permissions currently not provided. Once the pipeline starts, build fails on npx cdk synth and prints the following error message:

(node:167) UnhandledPromiseRejectionWarning: Error: AccessDeniedException: User: arn:aws:sts::181460066119:assumed-role/starter-pipeline-stack-sspeksworkshoppipelinePipel-1AU1L2JPX68KL/AWSCodeBuild-9fc2fe77-47e4-472d-a7a2-038153065704 is not authorized to perform: secretsmanager:GetSecretValue on resource: argo-admin-secret because no identity-based policy allows the secretsmanager:GetSecretValue action

Workaround is to manually add admin privileges to CodeBuild service role, but this should be automatically implemented as part of the framework.

[tsahiduek]

Hi,
Any progress with this? Although it's a one-time manual operation, it something that would be nice to automate/as-code.

Does the fix requires adding to this method, implementation of codeBuildDefaults as documented in https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines-readme.html#customizing-codebuild-projects?

[shapirov103]

Agree with the reasoning.
The codebuild defaults was not available at the time of writing. We can enable passing additional poliicies or a role for the codebuild part of the pipeline.
It will be added shortly, in the next minor elease 1.1.0 along with GitOps driven add-on configuration.

[tsahiduek]

Hi @shapirov103 ,
I was able to "narrow down" the policy needed here (see multi-env pattern doc
It works for me with the following

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "cloudformation:*"
            ],
            "Resource": "*"
        }
    ]
}

[shapirov103]

Verified (@tsahiduek), closing the issue. Happy to re-open if there is anything pending.