CodePipeline is not authorized to perform AssumeRole on role arn:aws:iam::<>:role/CodePipeline-Cfn-Guard-Demo-Role

0

Hi guys can you help with the error at the topic? I followed this one tutorial to integrate cloud formation guard into CI/CD pipeline. I need to create a policy for codepipeline, the policy as below:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "codecommit:UploadArchive",
                "codecommit:CancelUploadArchive",
                "codecommit:GetCommit",
                "codecommit:GetUploadArchiveStatus",
                "codecommit:GetBranch",
                "codestar-connections:UseConnection",
                "codebuild:BatchGetBuilds",
                "codedeploy:CreateDeployment",
                "codedeploy:GetApplicationRevision",
                "codedeploy:RegisterApplicationRevision",
                "codedeploy:GetDeploymentConfig",
                "codedeploy:GetDeployment",
                "codebuild:StartBuild",
                "codedeploy:GetApplication",
                "s3:*",
                "cloudformation:*",
                "ec2:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEqualsIfExists": {
                    "iam:PassedToService": [
                        "cloudformation.amazonaws.com",
                        "ec2.amazonaws.com"
                    ]
                }
            }
        }
    ]
}

Name for this policy is CodePipeline-Cfn-Guard-Demo-Role Then i create a trust policy for the CodePipeline, the trust policy looks like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codepipeline.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Then i create the role called CodePipeline-Cfn-Guard-Demo-Role with this trust policy. Then i attached the created policy called CodePipeline-Cfn-Guard-Demo.

Then after i want to try to create the pipeline i got the following error CodePipeline is not authorized to perform AssumeRole on role arn:aws:iam::<>:role/CodePipeline-Cfn-Guard-Demo-Role

Can help me with this problem?

1 Risposta
1
Risposta accettata

Kindly check whether the role which was created for codepipeline is selected while creating the pipeline. The error refers to the role which was used is not authorized to perform Assumerole.

Further, check whether the cloudformation role which was created have the permission policy attached to it and select the cloudformation role in add deploy stage page.

[Enter image description here

I was able to successfully follow the blog and pipeline is completed successfully.

profile picture
con risposta 7 mesi fa
profile picture
ESPERTO
verificato un mese fa

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande