I'm setting up a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild to deploy a Docker application running on an Elastic Beanstalk instance. The Docker credentials are stored in AWS Secrets Manager, and are initialized as environment variables within the AWS CodeBuild Resource. Despite having the necessary IAM policies in place, I'm encountering an AccessDeniedException when CodeBuild tries to access the secrets.
Permission inside CodeBuild IAM Role:
{
"Version": "2012-10-17",
"Statement": [
{ "Effect": "Allow",
"Action": [ "secretsmanager:GetSecretValue" ],
"Resource": [ "arn:aws:secretsmanager:region:userid:secret:secretname-??????”]
}
]
}
Resource Permission inside the specific secret in Secrets Manager:
{
"Version" : "2012-10-17",
"Statement" : [ {
"Effect" : "Allow",
"Principal" : {
"AWS" : "arn:aws:iam::userid:role/service-role/servicename”
},
"Action" : "secretsmanager:GetSecretValue",
"Resource" : "arn:aws:secretsmanager:region:userid:secret:secretname-??????”
} ]
}
I keep getting the same error which is:
Phase context status code: Secrets Manager Error Message: AccessDeniedException: User: arn:aws:sts::userid:assumed-role/servicerolename/AWSCodeBuild-codebuildid is not authorized to perform: secretsmanager:GetSecretValue on resource: id_value because no identity-based policy allows the secretsmanager:GetSecretValue action
Thanks!
I've already tried both attaching a costumer managed policy, and creating an inline costumer policy, and nothing worked.
I've also checked on AWS' Policy Simulator and got an "allowed" output when accessed my secret values from my IAM service role.
EDIT: I managed to solve the issue. Problem was initialization of unnecessary env vars inside CodeBuild, which caused an overwrite/collision while retrieving the secrets.
Thanks.