aws-code-deploy on S3 bucket with encryption

Question

Dear Support,

I have created a pipeline to deploy on AWS, using aws-code-deploy pipe and everything is working fine until the S3 bucket encryption is disabled.

Using the pipe aws-s3-deploy and the extra args --see aws:kms It's working as well, but after that I'm not able to deploy using aws-code-deploy (deploy).

There is a way to use pipe aws-code-deploy (upload) to upload on S3 with encrypion  ?

Thanks in advance

Oleksandr Kyrdan · Answer

@Fulvio Nigrisoli

Your error relates to AWS resources setup. So, try to extend permissions.

Best regards,
Oleksandr Kyrdan

Fulvio Nigrisoli · Answer

Sure. Here with pipeline: image: atlassian/default-image:3 artifact: &artifact step: name: Create artifact script: - zip -r artifact/file.zip . -x "artifact/*" -x ".git/*" artifacts: - artifact/* upload: &upload step: name: Upload to S3 with CodeDeploy script: - source artifact/set_env.sh - pipe: atlassian/aws-code-deploy:1.5.0 variables: AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID} AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY} AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION} COMMAND: 'upload' APPLICATION_NAME: ${AWS_APPLICATION_NAME} DEPLOYMENT_GROUP: ${AWS_DEPLOYMENT_GROUP} WAIT: 'true' S3_BUCKET: ${AWS_S3_BUCKET} FOLDER: ${AWS_S3_BUCKET_FOLDER} ZIP_FILE: 'artifact/file.zip' #DEBUG: 'true' deploy: &deploy step: name: Deploy with CodeDeploy script: - source artifact/set_env.sh - pipe: atlassian/aws-code-deploy:1.5.0 variables: AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID} AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY} AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION} COMMAND: 'deploy' APPLICATION_NAME: ${AWS_APPLICATION_NAME} DEPLOYMENT_GROUP: ${AWS_DEPLOYMENT_GROUP} IGNORE_APPLICATION_STOP_FAILURES: 'true' FILE_EXISTS_BEHAVIOR: 'OVERWRITE' WAIT: 'true' S3_BUCKET: ${AWS_S3_BUCKET} FOLDER: ${AWS_S3_BUCKET_FOLDER} #DEBUG: 'true' pipelines: branches: stage: - step: name: Setting environment script: - mkdir artifact - echo "export AWS_DEPLOYMENT_GROUP=xxxx" > artifact/set_env.sh - echo "export AWS_APPLICATION_NAME=xxxx" >> artifact/set_env.sh - echo "export AWS_S3_BUCKET=xxxx" >> artifact/set_env.sh - echo "export AWS_S3_BUCKET_FOLDER=xxxx" >> artifact/set_env.sh - echo "export AWS_DEFAULT_REGION=xxxx" >> artifact/set_env.sh - echo "export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID_STAGE}" >> artifact/set_env.sh - echo "export AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY_STAGE}" >> artifact/set_env.sh artifacts: - artifact/set_env.sh - <<: *artifact - <<: *upload - <<: *deploy Here with log (encryption on S3 bucket enabled) Status: Downloaded newer image for bitbucketpipelines/aws-code-deploy:1.5.0 93 INFO: Using default authentication with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY 94 INFO: Executing the aws-ecr-push-image pipe... 95 INFO: Uploading artifact/file.zip to S3. 96 INFO: Found credentials in environment variables. 97 ✖ Failed to upload artifact/file.zip to S3 98 An error occurred (AccessDenied) when calling the PutObject operation: Access Denied the same script is working fine if I disdable the encryption on S3 bucket

Oleksandr Kyrdan · Answer

Hi @Fulvio Nigrisoli

Thanks for your question!

Please, provide us with more details about this case:

* bitbucket-pipelines.yml file
* logs output of the pipeline's build

Best regards,
Oleksandr Kyrdan