Permissions for publishing

aws codebuild batch-get-projects --region ap-south-1 --names shortlink-web-deploy \
  --query 'projects[0].serviceRole' --output text

The last part of the ARN is the role name, normally codebuild-shortlink-web-deploy-service-role.

Open IAMRolescodebuild-shortlink-web-deploy-service-rolePermissionsAdd permissionsCreate inline policyJSON. Name it shortlink-web-deploy-website-sync.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::<WEB_BUCKET>"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::<WEB_BUCKET>/*"
    }
  ]
}

Two statements are needed because ListBucket applies to the bucket ARN (…:bucket), while the object actions apply to the objects (…:bucket/*). aws s3 sync lists first to work out what changed, and --delete needs DeleteObject. Without the first statement you get a confusing AccessDenied on ListObjectsV2.

The role that the wizard created for this project normally includes read access to the codepipeline-<region>-… bucket. Verify:

aws iam list-attached-role-policies --role-name codebuild-shortlink-web-deploy-service-role --output table
aws iam list-role-policies --role-name codebuild-shortlink-web-deploy-service-role --output table

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:GetObjectVersion", "s3:GetBucketLocation"],
      "Resource": ["arn:aws:s3:::<ARTIFACT_BUCKET>", "arn:aws:s3:::<ARTIFACT_BUCKET>/*"]
    }
  ]
}

The wizard grants codebuild:StartBuild for the project you created in it. When you added the second project in the editor the console may not have extended the policy. If the pipeline role cannot start a project, the action fails in CodePipeline before any CodeBuild log exists, which is confusing. Adding this is harmless if it is already allowed.

Find the role: aws codepipeline get-pipeline --region ap-south-1 --name shortlink-web-prod --query pipeline.roleArn --output text. Then IAMRoles(that role)PermissionsAdd permissionsCreate inline policyJSON, name shortlink-web-start-builds:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["codebuild:StartBuild", "codebuild:BatchGetBuilds"],
      "Resource": [
        "arn:aws:codebuild:ap-south-1:<AWS_ACCOUNT_ID>:project/shortlink-web-build",
        "arn:aws:codebuild:ap-south-1:<AWS_ACCOUNT_ID>:project/shortlink-web-deploy"
      ]
    }
  ]
}