The codebuild project is missing a KMSKey parameter

[indravd]

Please add the following line to the code-pipeline.yaml file at the Codebuil project part:
EncryptionKey: !Ref CMKARN

If you do not specify this AWS Codebuild will use the default s3 encryption for the artifacts in the s3 bucket. This is causing issues in the next step when you deploy it via Cloudformation in a different account (this account cannot have access to the default s3 kms key).

[richardhboyd]

That appears to already be present.
https://github.com/awslabs/aws-refarch-cross-account-pipeline/blame/master/ToolsAcct/code-pipeline.yaml#L94