CodePipeine cannot fetch the source from CodeCommit

Question

I have this error when codepipline trying to fetch source from codecommit

The service role or action role doesn’t have the permissions required to access the AWS CodeCommit repository named defon-liff. Update the IAM role permissions, and then try again. Error: User: arn:aws:sts::665852216333:assumed-role/df-stag-code-adminPipelineRole8AA4BBC2-LGTJJRF5EP4E/1720168399052 is not authorized to perform: codecommit:GetBranch on resource: arn:aws:codecommit:ap-northeast-1:665852216828:defon-liff because no identity-based policy allows the codecommit:GetBranch action

I think this is because df-stag-code-adminPipelineRole8AA4BBC2-LGTJJRF5EP4E cannot access to the CodeCommit

So, I investigate into df-stag-code-adminPipelineRole8AA4BBC2-LGTJJRF5EP4E, this has the policy named adminPipelineRoleDefaultPolicyC79967BE

Then it has two assumed role.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*",
                "s3:DeleteObject*",
                "s3:PutObject",
                "s3:PutObjectLegalHold",
                "s3:PutObjectRetention",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionTagging",
                "s3:Abort*"
            ],
            "Resource": [
                "arn:aws:s3:::si2-s3d-91",
                "arn:aws:s3:::si2-s3d-91/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
            ],
            "Resource": "arn:aws:kms:ap-northeast-1:665852216333:key/bf3cf318-1376-44de-a014-18107XXXXXX",
            "Effect": "Allow"
        },
        {
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::665852216333:role/df-stag-code-adminPipelinedfstagadmionsourcedfstag-1OZJ7LB64WXO2",
            "Effect": "Allow"
        },
        {
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::665852216333:role/df-stag-code-adminPipelinedfstagadmionbuilddfstaga-8NGM8PIRUGQ3",
            "Effect": "Allow"
        }
    ]
}

So, I checked df-stag-code-adminPipelinedfstagadmionsourcedfstag-1OZJ7LB64WXO2

This has policy adminPipelinedfstagadmionsourcedfstagadminsourceCodePipelineActionRoleDefaultPolicy32499DC6

then,it has

  {
        "Action": [
            "codecommit:GetBranch",
            "codecommit:GetCommit",
            "codecommit:UploadArchive",
            "codecommit:GetUploadArchiveStatus",
            "codecommit:CancelUploadArchive"
        ],
        "Resource": "arn:aws:codecommit:ap-northeast-1:665852216333:defon-*",
        "Effect": "Allow"
    }

it looks like it has the access to the codecommit defon-*

However error still happens

How can I fix this?

and I wonder in error message df-stag-code-adminPipelineRole8AA4BBC2-LGTJJRF5EP4E/1720168399052

What the 1720168399052 is this relevant with the problem??

MisterSmith · Accepted Answer · 2024-07-05 11:21:55Z

0

Do what the error is telling you, add codecommit:GetBranch (and the other codecommit related permissions listed on adminPipelinedfstagadmionsourcedfstag most likely) to the role df-stag-code-adminPipelineRole....

Dont worry about 1720168399052 - thats related to assuming the role.

answered Jul 5, 2024 at 11:21

MisterSmith

3,7041 gold badge12 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

whitebear Over a year ago

Thank you for your comment, however I have codecommit:GetBranch in df-stag-code-adminPipelinedfstagadmionsourcedfstag-1OZJ7LB64WXO2 role and it is used as AssumeRole.

whitebear Over a year ago

And I guess there is something wrong with assuming process. Does df-stag-code-adminPipelineRole8AA4BBC2-LGTJJRF5EP4E assume df-stag-code-adminPipelinedfstagadmionsourcedfstag-1OZJ7LB64WXO2 correctly? or how can i make sure?

MisterSmith Over a year ago

@whitebear - yeah i can see the 2nd role has the perms, but the error mentions only the first role not the assumed role. The fact that a role can assume another role that has some permissions doesnt grant the originating role those permissions. Assuming roles is like logging out and logging back in as a different user with a different set of policies - the way i read the error it implies both polices will need some access to CodeCommit.

whitebear Over a year ago

Thank you very much I added the permission directly to the IAM role not using AssumeRole, then it works.

Collectives™ on Stack Overflow

CodePipeine cannot fetch the source from CodeCommit

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related