AccessDenied when starting build with overrides

Question

Our team of developers is using CodeBuild, but for whatever reason they can't issue a build with overrides. Whenever they do this they are getting AccessDenied. Do you know what could be wrong? Is there a way to see what exactly is being blocked from permissions view?
The following is the policy that is attached to the dev group.

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"logs:GetLogRecord",
"codebuild:ListReportGroups",
"logs:GetLogDelivery",
"logs:ListLogDeliveries",
"codebuild:ImportSourceCredentials",
"codebuild:ListReports",
"codebuild:ListProjects",
"logs:DescribeQueryDefinitions",
"logs:DescribeResourcePolicies",
"logs:DescribeDestinations",
"codebuild:ListConnectedOAuthAccounts",
"logs:DescribeQueries",
"codebuild:ListCuratedEnvironmentImages",
"logs:StopQuery",
"logs:TestMetricFilter",
"codebuild:ListSourceCredentials",
"codebuild:ListRepositories",
"codebuild:ListSharedProjects",
"logs:DescribeExportTasks",
"codebuild:ListBuildBatches",
"codebuild:ListSharedReportGroups",
"logs:GetQueryResults",
"codebuild:ListBuilds",
"codebuild:DeleteOAuthToken",
"codebuild:DeleteSourceCredentials",
"codebuild:PersistOAuthToken"
],
"Resource": ""
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"logs:ListTagsLogGroup",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:DescribeSubscriptionFilters",
"logs:StartQuery",
"logs:GetLogEvents",
"logs:DescribeMetricFilters",
"logs:FilterLogEvents",
"logs:GetLogGroupFields"
],
"Resource": [
"arn:aws:logs::<<accnt_number>>:log-group::log-stream:",
"arn:aws:logs:us-east-2:<<accnt_number>>:log-group:build-dev:"
]
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": "codebuild:",
"Resource": "arn:aws:codebuild:us-east-2:<<accnt_number>>:project/*"
}
]
}

AlbertK · Answer

Finally realized that "s3:ListAllMyBuckets" was missing (just having ListBucket is not sufficient/not needed).  
Still, question remains as to why does it need it, because not all builds require access to S3.  
Also, would be nice to tell what exactly is prohibiting instead of giving blank "AccessDenied" message which isn't very helpful in figuring out what exactly is being denied.  
  
Edited by: AlbertK on Nov 2, 2021 6:44 AM

AlbertK · Answer

Did a bit more research on this. It turns out CodeBuild needs s3 ListBuckets permission, and this permission needs to be across all of the resources - I was unable to figure out the IAM Resource argument to only allow specific bucket.  
  
Here is an excerpt from the logs that show the permission issue.  
...  
			"eventTime": "2021-11-01T12:49:21Z",  
			"eventSource": "s3.amazonaws.com",  
			"eventName": "ListBuckets",  
			"awsRegion": "us-east-2",  
			"sourceIPAddress": "x3x.x1x.x6x.x0",  
			"userAgent": "\[aws-internal/3 aws-sdk-java/1.12.76 Linux/5.4.141-78.230.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]",  
			"errorCode": "AccessDenied",  
			"errorMessage": "Access Denied",  
			"requestParameters": {  
				"Host": "s3.us-east-2.amazonaws.com"  
			},  
...  
  
What's interesting is that simply having the following permission doesn't help, it needs much wider permission.  
{  
            "Sid": "2",  
            "Effect": "Allow",  
            "Action": \[  
                "s3:ListBucket"  
            ],  
            "Resource": "*"  
}  
  
Does anybody know what is the reason behind having this permission in order to issue build with overrides and what is the narrowest possible permissions will suffice?  
  
Edited by: AlbertK on Nov 2, 2021 5:58 AM

AccessDenied when starting build with overrides

Add your answer

Relevant content