IAM role for AWS SAM Deplop inside codebuild

Question

Hi!

I'm trying to identify the permissions need for a role inside codebuild that execute sam build command.

I the tutorial
https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-serverlessrepo-auto-publish.html

It made the process on separate steps (sam package with codebuild, and generate de artifacts), but I prefer to use a simpler "sam deploy"

I have granted cloudformation full access as seen on

https://github.com/aws/aws-sam-cli/blob/develop/samcli/lib/pipeline/bootstrap/stage_resources.yaml#L104-L111

But still failing due lack of permissions on lambda and iam

There is any managed AWS policy that I can use to setup my IAM role? is very frustrating use trial and error.

Accepted Answer

Hello.

I don't think configuring an IAM role is necessary for "sam build".  
I think the IAM role is required for resource deployment using "sam deploy".  
https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/using-sam-cli-build.html

> But still failing due lack of permissions on lambda and iam  
> There is any managed AWS policy that I can use to setup my IAM role?

Deployment with SAM requires permission to execute CloudFormation and permission to create AWS resources listed in template.yml.  
So, I don't think there is an AWS managed policy that is just what You need.  
If you can accept a policy with a wide range of privileges, why not set PowerUserAccess and iam:PassRole,iam:CreatePolicy,iam:CreateRole,iam:PutRolePolicy,iam:UpdateRole?  
https://docs.aws.amazon.com/aws-managed-policy/latest/reference/PowerUserAccess.html  
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_iam-passrole-service.html  
https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagementiam.html

Alternatively, I think a countermeasure would be to steadily test permissions using a policy simulator or the like.  
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html

IAM role for AWS SAM Deplop inside codebuild

Relevant content