Make AWS CodeBuild artifacts public

user_13426164 0
Viewed 249

I have an issue where every time I want to use AWS CodeDeploy, I have to go to S3 and manually make the revision file public since CodeBuild creates an artifact that isn't public.

Is there a way to make CodeBuild create a public artifact in S3? Or is there a way to deploy a non-public artifact using CodeDeploy?

I tried to run some aws s3api commands in post_build phase but they seemed to fail with exit code 255.

artifacts aws-code-deploy aws-codebuild amazon-s3
2 Answers

You need to update your bucket policy for S3 bucket.

{
    "Version": "2012-10-17",
    "Id": "Policy1sdhgshjg",
    "Statement": [
        {
            "Sid": "Stmt1asdasdadasd",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucket_name/*"
        }
    ]
}

enter image description here This will make all the objects in your bucket public.

For more info you can read the other examples for bucket policies.

Note: I assume you have block public access off in your bucket enter image description here

user_144013990

Each Code Deploy Application will have one more Deployment Group. Each Deployment Group can be assigned with as service IAM Role.

enter image description here

For this service role we can grant permission to read the S3 bucket so that we dont have to make the artifact every time it is built.

Sample read permission will look like this.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetObject*",
                "s3:GetBucket*"
            ],
            "Resource": [
                "arn:aws:s3:::woohoo-auto-code-deploy/prod-QC-darpan-be/BuildArtif/*",
                "arn:aws:s3:::woohoo-auto-code-deploy/prod-QC-darpan-ui/BuildArtif/*"
            ],
            "Effect": "Allow"
        }
    ]
}
user_3127810
Related