[CodeBuild] Build fails after introducing environmentVariables with type BuildEnvironmentVariableType.PARAMETER_STORE

[markusl]

After introducing the environment variable to the CDK Pipeline, the pipeline seems to fail in the 'Build' phase:

[Container] 2020/08/26 12:43:34 Phase context status code: Decrypted Variables Error Message: AccessDeniedException: User: arn:aws:sts::yyy:assumed-role/xxx-7BL0BNH108AP/AWSCodeBuild-05e07ae5-3da4-48a9-a206-5b44d40f4004 is not authorized to perform: ssm:GetParameters on resource: arn:aws:ssm:eu-central-1:yyy:parameter/VARIABLE_NAME

Reproduction Steps

    const pipeline = new pipelines.CdkPipeline(this, id, {
      cloudAssemblyArtifact,

      sourceAction: new codepipeline_actions.CodeCommitSourceAction({
        actionName: 'Source',
        repository,
        branch: 'master',
        output: sourceArtifact,
      }),

      synthAction: pipelines.SimpleSynthAction.standardNpmSynth({
      // The build will fail with missing permission after introducing 'environmentVariables'
        environmentVariables: {
          VARIABLE_NAME: {
            type: codebuild.BuildEnvironmentVariableType.PARAMETER_STORE,
            value: 'VARIABLE_NAME'
          }
        },
        sourceArtifact,
        cloudAssemblyArtifact,
        buildCommand: 'npm run build && npm run test'
      }),
    });

What did you expect to happen?

The relevant IAM configuration should be created automatically.

Environment

• CLI Version : 1.60.0 (build 8e3f53a)
• Framework Version: 1.60.0
• Node.js Version: v14.8.0
• OS : macOS
• Language (Version): 4.0.2

---

This is 🐛 Bug Report

[rix0rrr]

This needs to be implemented in CodeBuild

[skinny85]

Hey @markusl ,

this was recently fixed in CodeBuild: #11770 .

Can you try updating, and see if the problem persists?

Thanks,
Adam

[markusl]

@skinny85 Is this already released? I think I did not see this yet in the CHANGELOG. Will check this out if it's included in a release.

Thanks,
Markus

[markusl]

It seems not to work yet possibly due to this 3c5c2f4#diff-a8640958f8311388cd004191bfc1b0939145226e363e90ad1a0c45bc6aa30953R826

[skinny85]

Oh, that's a great catch @markusl !

Any chance of a quick PR fixing that? Should be a simple fix 🙂. https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.