Bernie Lenz
Bernie Lenz

Reputation: 2146

aws-maven s3 wagon running in codebuild is not using service role for s3 access

I have the following aws codebuild project setup:

pom.xml:

    <build>
        <extensions>
            <extension> <!-- provides s3 wagon, unfortunately the wagon doesn't work with roles but needs AWS_ACCESS_KEY & AWS_SECRET_ACCESS_KEY set -->
                <groupId>org.springframework.build</groupId>
                <artifactId>aws-maven</artifactId>
                <version>5.0.0.RELEASE</version>
            </extension>
        </extensions>
    </build>

    <repositories>
        <repository>
            <id>aws-release</id>
            <name>AWS S3 Release Repository
        </name>
        <url>s3://somebucket/release</url>
        <releases>
            <enabled>true</enabled>
        </releases>
        <snapshots>
            <enabled>false</enabled>
        </snapshots>
    </repository>
<repositories>

buildspec.yml:

version: 0.2
phases:
  install:
    commands:
      - echo Install started on `date`
    runtime-versions:
      java: corretto17
  pre_build:
    commands:
      - echo Starting pre_build
      - mvn -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec -e

My codebuild service role has AmazonS3FullAccess attached to it.

Without specifying AWS_ACCESS_KEY and AWS_SECRET_ACCESS_KEY as environment variables in code build I am getting below error:

[ERROR] Failed to execute goal on project my-app: Could not resolve dependencies for project com.my.path:my-app:jar:0.0.1-SNAPSHOT: Failed to collect dependencies at com.my-utils:my-utils:jar:2.1.0: Failed to read artifact descriptor for com.my-utils:my-utils:jar:2.1.0: The following artifacts could not be resolved: com.my-utils:my-utils:2.1.0 (absent): Could not transfer artifact com.my-utils:my-utils:pom:2.1.0 from/to aws-release (s3://somebucket/release): Unable to load AWS credentials from any provider in the chain -> [Help 1]

Is there a way to use the aws-maven s3 wagon in codebuild by using iam roles rather than providing credentials defined in AWS_ACCESS_KEY & AWS_SECRET_ACCESS_KEY?

AWS_ACCESS_KEY & AWS_SECRET_ACCESS_KEY can be compromised so easily and using roles is such a better concept...

Upvotes: 0

Views: 90

Answers (0)

Related Questions