amazon-web-services - 上传到 S3 失败，出现以下错误 : Access Denied - CodeStarConnections

Question

我正在使用 AWS Codepipeline 构建 CI/CD 管道，存储库源位于 bitbucket 上，我使用 AWS-Codestarconnections 在 bitbucket 存储库和管道之间创建连接。
管道详细信息如下:

{
    "pipeline": {
        "name": "test_pipeline",
        "roleArn": "arn:aws:iam::<AccountId>:role/PipelineServiceRole",
        "artifactStore": {
            "type": "S3",
            "location": "tadadadada-artifact"
        },
        "stages": [
            {
                "name": "Source",
                "actions": [
                    {
                        "name": "Source",
                        "actionTypeId": {
                            "category": "Source",
                            "owner": "AWS",
                            "provider": "CodeStarSourceConnection",
                            "version": "1"
                        },
                        "runOrder": 1,
                        "configuration": {
                            "BranchName": "dev",
                            "ConnectionArn": "arn:aws:codestar-connections:us-east-2:<AccountId>:connection/4ca7b1cf-2917-4fda-b681-c5239944eb33",
                            "FullRepositoryId": "<username>/repository_name",
                            "OutputArtifactFormat": "CODE_ZIP"
                        },
                        "outputArtifacts": [
                            {
                                "name": "SourceArtifact"
                            }
                        ],
                        "inputArtifacts": [],
                        "region": "us-east-2",
                        "namespace": "SourceVariables"
                    }
                ]
            },
            {
                "name": "Build",
                "actions": [
                    {
                      ....
                    }
                ]
            }
        ],
        "version": 1
    },
    "metadata": {
        "pipelineArn": "arn:aws:codepipeline:us-east-2:<AccountId>:test_pipeline",
        "created": 1611669087.267,
        "updated": 1611669087.267
    }
}

PipelineServiceRole + 附加到它的策略是:
服务角色

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codepipeline.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

政策

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IamPassRolePolicy",
      "Effect": "Allow",
      "Action": [
          "iam:PassRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEqualsIfExists": {
          "iam:PassedToService": [
            "cloudformation.amazonaws.com",
            "ec2.amazonaws.com",
            "ecs-tasks.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "CodeBuildPolicy",
      "Effect": "Allow",
      "Action": [
        "codebuild:BatchGetBuilds",
        "codebuild:StartBuild"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3AccessPolicy",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:GetObjectVersion",
        "s3:GetBucketAcl",
        "s3:GetBucketLocation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ECRAccessPolicy",
      "Effect": "Allow",
      "Action": [
        "ecr:DescribeImages"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CodeStarConnectionsAccessPolicy",
      "Effect": "Allow",
      "Action": [
        "codestar-connections:UseConnection"
      ],
      "Resource": "*"
    }
  ]
}

源阶段失败并出现错误:

[Bitbucket] Upload to S3 failed with the following error: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 085999D90C19E650; S3 Extended Request ID: gJ6l08+cX3U6i2Vj0+fW7PiqA/UzM6ZGCfyECmWb+Jit4Knu+gi/L4y3F24uqkFWUfGy9tZo0VE=; Proxy: null) (Service: null; Status Code: 0; Error Code: null; Request ID: null; S3 Extended Request ID: null; Proxy: null) (Service: null; Status Code: 0; Error Code: null; Request ID: null; S3 Extended Request ID: null; Proxy: null)

错误消息缺少详细信息，我不确定哪个服务正在尝试访问 s3，不应该是代码管道(在这种情况下具有 PutObject 权限)吗？

Answer 1

通过从 "OutputArtifactFormat": "CODE_ZIP" 更改 OutputArtifactFormat 来解决此问题至 "OutputArtifactFormat": "CODEBUILD_CLONE_REF" .
CODEBUILD_CLONE_REF - 从控制台描述是一个完整的克隆，在这种情况下
AWS CodePipeline 传递有关存储库的元数据，允许后续操作执行完整的 git 克隆。仅支持 AWS CodeBuild 操作。
“CODE_ZIP”选项不包含有关存储库的 git 元数据