Using Bitbucket CodeStar Connection cross account

0

Account A has CodeStar Connection (sort of Admin account)

Account B wants to create a CodePipeline using the CodeStar connection in account A.

What permissions or setup is needed to achieve this?

Using the connection ARN from account A in account B causes sourcing error in pipeline with message "The provided role does not have sufficient permissions".

Is there any restriction of the "region" of the connection ARN to be used?

Suman
已提问 2 年前1050 查看次数
1 回答
0

Note that CodeStar Connection does not officially support sharing across accounts. As a result, there is no direct way to have a CodeStar Connection (CSC) created in AccountA to trigger a CodePipeline in AccountB. CodeStar Connections will only trigger pipelines that are defined in the same account as the CodeStar Connection.

If you don't care about triggering the pipelines, then you can technically achieve this by:

  1. Creating the CodeStar Connection in AccountA
  2. Creating an IAM role in AccountA that has a trust policy allowing CodePipeline service in spoke accounts to assume it. Make sure that the permissions policy on this IAM role has codestar-connections:UseConnection for the CodeStar Connection created in Step 1.
  3. Use the IAM role from AccountA when defining the Source Action in the CodePipeline which resides in AccountB
AWS
已回答 2 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则

相关内容