fix(codebuild): missing permissions for SecretsManager environment variables #12121
Conversation
…riables When creating a CodeBuild Project that uses environment variables from SecretsManager, the Project fails execution with: ``` AccessDeniedException: User: arn:aws:sts::828671620168:assumed-role/role is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-west-2:123456789012:secret:my-secret-GXyUCE ``` The solution is to automatically grant the Project's Role permissions to read all Secrets whose names were provided as environment variables.
|
|
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
The build of this PR is stuck and is blocking the mergify "queue" see https://github.com/aws/aws-cdk/pull/12123/checks?check_run_id=1588463268 |
|
Pushed a dummy commit to re-trigger the build since for some reason the CodeBuild job wasn't running causing mergify to be blocked |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
…riables (aws#12121) When creating a CodeBuild Project that uses environment variables from SecretsManager, the Project fails execution with: ``` AccessDeniedException: User: arn:aws:sts::828671620168:assumed-role/role is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-west-2:123456789012:secret:my-secret-GXyUCE ``` The solution is to automatically grant the Project's Role permissions to read all Secrets whose names were provided as environment variables. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
When creating a CodeBuild Project that uses environment variables from SecretsManager,
the Project fails execution with:
The solution is to automatically grant the Project's Role permissions to read all
Secrets whose names were provided as environment variables.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license