S3 AccessDenied on Cross account codebuild

Question

I have a codebuild project in the account "A" in region "A"
I need to snyc files to another bucket in the account "B" on region "B"

The s3 bucket has "Block all public access" ON and the following policy

```json
{
    "Effect": "Allow",
     "Principal": {
                "AWS": "arn:aws:iam::[account A]:role/service-role/codebuild-service-role-foo-bar"
      },
    "Resource": [
        "arn:aws:s3:::mytestbucket",
        "arn:aws:s3:::mytestbucket/*"
    ],
    "Action": [
        "s3:*"
    ]
}
```
And the role codebuild-service-role-foo-bar has temporally admin rights permissions.

The line that fails is:
`aws s3 sync . s3://mytestbucket --region B --delete`
> fatal error: An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

What is the root cause? the codebuild role has admin rights, aws cli is not using that permissions? I have something wrong in the s3 principal policy? I something related with the region?

re:Post Agent · Answer

The root cause of your AccessDenied error is likely a combination of factors related to cross-account and cross-region access. Let's break down the issues:

1. Cross-account access: Your CodeBuild project is in Account A, but you're trying to access a bucket in Account B. The bucket policy you've shown only allows access from Account A, which is correct, but there might be additional steps needed.

2. Cross-region access: Your CodeBuild project is in Region A, but you're trying to access a bucket in Region B. This isn't directly causing the issue, but it's important to note.

3. Bucket policy: The policy you've shown is allowing access, but it might not be the complete policy. Make sure there are no conflicting statements in the full policy.

4. KMS encryption: If the bucket is using AWS KMS for encryption (SSE-KMS), you'll need to grant the CodeBuild role permissions to use the KMS key as well.

5. S3 Block Public Access: This setting is correct and shouldn't interfere with your cross-account access.

To resolve this issue:

1. Ensure the CodeBuild role in Account A has the necessary permissions to access the S3 bucket in Account B. This includes both S3 actions and KMS actions if KMS encryption is used.

2. In the bucket policy in Account B, make sure you're using the correct ARN for the CodeBuild role. Double-check that the account number and role name are correct.

3. If using KMS encryption, add a policy to the KMS key in Account B that allows the CodeBuild role from Account A to use the key.

4. Verify that there are no VPC endpoint policies or other network configurations that might be restricting access.

5. When using the AWS CLI in your CodeBuild project, ensure you're using the correct credentials. The error message suggests that the CLI might not be using the CodeBuild role's credentials.

By addressing these points, you should be able to resolve the AccessDenied error and successfully sync files across accounts and regions.  
**Sources**  
[Community | AWS Cross Account S3 Access Through Lambda Functions](https://community.aws/content/2cCcsg05ZX2PoMHwMcWhv2BMlPL/aws-cross-account-s3-access-through-lambda-functions)  
[Troubleshoot 403 Access Denied error in Amazon S3 | AWS re:Post](https://repost.aws/selections/KPnhw2bVV2RlOuBSPTYbGvOw/troubleshoot-403-access-denied-error-in-amazon-s3)  
[cross-account permissions for S3 bucket access | AWS re:Post](https://repost.aws/questions/QUh6gWyv80TwibHHgRKikg6g/cross-account-permissions-for-s3-bucket-access)

S3 AccessDenied on Cross account codebuild

Add your answer

Relevant content