- Newest
- Most votes
- Most comments
To save or upload an artifact from a CodeBuild project running in us-east-1 to an S3 bucket in us-east-2, you need to make some adjustments to your CodeBuild project configuration and the way you interact with S3. Here's how you can accomplish this:
-
In your CodeBuild project configuration, under the "Artifacts" section, specify the S3 bucket in us-east-2 as the destination for your artifacts.
-
In your buildspec.yml file or in the build commands, when interacting with S3, explicitly specify the region for the S3 bucket. For example, if you're using the AWS CLI to sync files to S3, use the --region parameter:
aws s3 sync . s3://your-bucket-name --region us-east-2
-
Ensure that the IAM role associated with your CodeBuild project has the necessary permissions to access the S3 bucket in us-east-2. You may need to update the role's policies to include the specific ARN of the bucket in us-east-2.
-
If you're using AWS KMS for encryption, make sure the KMS key policy allows access from the CodeBuild role in us-east-1.
The error message you received suggests that the S3 client is defaulting to the region of the CodeBuild project (us-east-1) instead of the region of the S3 bucket (us-east-2). By explicitly specifying the region in your S3 commands, you should be able to resolve this issue.
Remember to test your configuration thoroughly to ensure that the cross-region artifact storage works as expected.
Sources
S3 AccessDenied on Cross account codebuild | AWS re:Post
Deploy code in multiple AWS Regions using AWS CodePipeline, AWS CodeCommit, and AWS CodeBuild - AWS Prescriptive Guidance
Relevant content
asked 7 years ago
asked 2 years ago
asked 4 years ago

This is what I did, and I believe this is why it is failing.
I am not using any CLI command to copy the files to an S3 bucket. I am relying on the "Artifacts" to upload the file.
The role has all the necessary policies.
I disabled the KMS encryption, but it is still failing.