Why Codepipeline Generated Role is Missing Granting Access Rights to Logs?

Question

I have created Codepipeline before without issues but since we migrated to AMZ Linux 2 latest ROR platform for Beanstalk we encountered errors and we were instructed by Support to edit the auto generated role to allow access to Logs. Why isn't Codepipeline correctly creating the right policy? Is this being fixed?

Currently we have to manually change the policy to enable log access when we create new pipelines.

Giovanni Lauria · Answer

Currently, AWS CodePipeline does not automatically create the correct IAM policy for log access when using the latest Amazon Linux 2 platform for Elastic Beanstalk. This requires manual intervention to update the policy and grant necessary permissions.

Continue to manually edit the auto-generated IAM role to include log access permissions. Add the following permissions:

```
{
  "Effect": "Allow",
  "Action": [
    "logs:CreateLogGroup",
    "logs:CreateLogStream",
    "logs:PutLogEvents",
    "logs:DescribeLogStreams"
  ],
  "Resource": "arn:aws:logs:*:*:*"
}
```
Stay updated with AWS release notes for any announcements regarding this issue.

Why Codepipeline Generated Role is Missing Granting Access Rights to Logs?

Add your answer

Relevant content