CodeBuild is not authorized to perform: sts:AssumeRole

Question

I am trying to switch from creating CodeBuild jobs manually to creating them using the CLI.   
However I am running into issues doing this.  
Command I am running:

```
aws codebuild create-project --name "PROJECTNAME" --region "us-east-1" --source type=GITHUB,location="GITHUBURL",gitCloneDepth=1 --artifacts type=NO_ARTIFACTS --environment type=LINUX_CONTAINER,image=aws/codebuild/docker:18.09.0,computeType=BUILD_GENERAL1_SMALL --service-role SERVICE_ROLE
```

For this the `SERVICE_ROLE` is a role that I am currently using in another CodeBuild job. But when I try to run it from the CLI I am getting:

```
An error occurred (InvalidInputException) when calling the CreateProject operation: CodeBuild is not authorized to perform: sts:AssumeRole on [ARNTO_SERVICE_ROLE]
```

I tried adding the permission for `sts:AssumeRole` to that service role, but that did not fix the issue.  
The CLI is using an admin role and should any rights necessary for it to be able to do this.

Answer

Hi,

I recently faced same issue and I was able to resolve it by doing the following :

1. Open the IAM console at https://console.aws.amazon.com/iam/ and select your IAM role. (e.g SERVICE_ROLE)
2. Click on the `Trusted Relationships` tab and verify that your IAM role has the correct trust policy for AWS CodeBuild. See example JSON below :

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "codebuild.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

```

For more information refer to this documentation: [Create a CodeBuild service role](https://docs.aws.amazon.com/codebuild/latest/userguide/setting-up.html#setting-up-service-role)

Answer

Hi jonwis, I am Yong from AWS CodeBuild team.  
  
Do you still see this error? My suggestion is to follow this troubleshooting guide. https://docs.aws.amazon.com/codebuild/latest/userguide/troubleshooting.html#troubleshooting-assume-role  
  
If you still see the same error, can you please run the command with debug logging turned on and private message me the entire response payload? I can then help troubleshoot on our side.

```
aws codebuild --debug create-project ...
```

CodeBuild is not authorized to perform: sts:AssumeRole

相關內容