Search code examples
amazon-web-servicesamazon-s3aclaws-codebuild

CodeBuild upload build artifact to S3 with ACL


I have 2 AWS accounts. Lets say A and B.

Account A uses CodeBuild to build and upload artifacts to an S3 bucket owned by B. B account has set a ACL permission for the bucket in order to give Write permissions to A.

The artifact file is successfully uploaded to the S3 bucket. However, B account doesnt have any permission over the file, since the file is owned by A.

Account A can change the ownership by running

aws s3api put-object-acl --bucket bucket-name --key key-name --acl bucket-owner-full-control

But this has to be manually run after every build from A account. How can I grant permissions to account B through CodeBuild procedure? Or how can account B override this ownership permission error.

The CodeBuild starts automatically with web-hooks and my buildspec is this:

 version: 0.2
 env:
 phases:
  install:
    runtime-versions:
      java: openjdk8
    commands:
      - echo Entered the install phase...
  build:
    commands:
      - echo Entered the build phase...
  post_build:
    commands:
      - echo Entered the post_build phase...
artifacts:
  files:
    - 'myFile.txt'

Solution

  • I did it using aws cli commands from the build phase.

    version: 0.2
    phases:
      build:
        commands:
          - mvn install...
          - aws s3 cp my-file s3://bucketName --acl bucket-owner-full-control
    

    I am using the build phase, since post_build will be executed even if the build was not successful.

    edit: updated answer with a sample.