(aws-codebuild): Pipeline build fails when environment variable is from parameter store

[cvrajeesh]

Pipeline build fails when an environment variable is loaded from parameter store.

Reproduction Steps

new PipelineProject(this, "PackageBuild", {
      buildSpec: BuildSpec.fromObject({
        .....
        phases: {
          install: {
            commands: "yarn install",
          },
          build: {
            commands: ["yarn build"],
          },
          post_build: {
            commands: ["yarn test"],
          },
        },
        artifacts: {
        ......
        },
      }),
      environment: {
       .....
      },
      environmentVariables: {
        MY_ENV: {
          type: BuildEnvironmentVariableType.PARAMETER_STORE,
          value: "/prams/param1",
        },
      },
    });

What did you expect to happen?

Build to succeed

What actually happened?

Build failed and the log shows the following lines, nothing after that

[Container] 2020/11/29 10:14:46 YAML location is /codebuild/readonly/buildspec.yml
[Container] 2020/11/29 10:14:46 Processing environment variables
[Container] 2020/11/29 10:14:46 Decrypting parameter store environment variables

Environment

• CDK CLI Version : 1.75.0
• Framework Version:
• Node.js Version: 12.13.0
• OS : macOS
• Language (Version): TypeScript (4.0.3)

Other

It looks like generated CodePipeline role policy doesn't contain a policy for ssm:GetParameters

---

This is 🐛 Bug Report

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.