CodeBuild: CDK produces incorrect IAM role and results in failed build

[thesurlydev]

Describe the bug
I successfully created a new CodeBuild project and the resulting default IAM role had two issues that resulted in failed builds (in the PROVISIONING step).

To Reproduce
Using the following CDK code to produce the CodeBuild project in question:

val codeBuildBootstrapProps = CodeBuildBootstrapProps(
        stackProps, "https://github.foo.com/me/bar",
        "$appName-build-bucket",
        ComputeType.Small,
        LinuxBuildImage.UBUNTU_18_04_STANDARD_1_0,
        vpc
    )

    CodeBuildBootstrap(app, "code-build-bootstrap", codeBuildBootstrapProps)


val projectName = this.node.getContext("app") as String

        val buildEnvironment = BuildEnvironment.builder()
            .withComputeType(props.computeType)
            .withBuildImage(props.buildImage)
            .withPrivileged(false) // true only if used to build Docker images
            .build()

        val gitHubEnterpriseSourceProps = GitHubEnterpriseSourceProps.builder()
            .withCloneDepth(1)
            .withHttpsCloneUrl(props.cloneUrl)
            .build()
        val gitHubEnterpriseSource = GitHubEnterpriseSource(gitHubEnterpriseSourceProps)

        val buildBucket = Bucket(
            this, "buildbucket", BucketProps.builder()
                .withBucketName(props.buildBucketName)
                .withRemovalPolicy(RemovalPolicy.Destroy)
                .build()
        )

        val s3BucketBuildArtifactsProps = S3BucketBuildArtifactsProps.builder()
            .withName("code-build-artifacts")
            .withIdentifier("BuildArtifact")
            .withBucket(buildBucket)
            .withPath("code-build-artifacts/${projectName}.jar")
            .withIncludeBuildId(true)
            .build()
        val s3BucketBuildArtifacts = S3BucketBuildArtifacts(s3BucketBuildArtifactsProps)


        val projectProps = ProjectProps.builder()
            .withEnvironment(buildEnvironment)
            .withProjectName(projectName)
            .withSource(gitHubEnterpriseSource)
            .withBuildSpec("buildspec.yml")
            .withVpc(props.vpc)
            .withArtifacts(NoBuildArtifacts())
            .withSecondaryArtifacts(
                listOf(
                    s3BucketBuildArtifacts
                )
            )
            .build()

        val project = Project(this, "code-build-project", projectProps)

The first issue is the ec2:DescribeSecurityGroups action was missing on the IAM policy.
I fixed this with the following code:

project.addToRolePolicy(
PolicyStatement(PolicyStatementEffect.Allow).addAllResources().addActions("ec2:DescribeSecurityGroups")
        )

The second issue was that the following snippet was generated:

{
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterfacePermission"
            ],
            "Resource": "arn:aws:ec2:us-east-1:123456789000:network-interface/*",
            "Condition": {
                "StringEquals": {
                    "ec2:Subnet": [
                        "arn:aws:ec2:us-east-1:123456789000:subnet/[[subnets]]"
                    ],
                    "ec2:AuthorizedService": "codebuild.amazonaws.com"
                }
            }
        }

I fixed by explicitly setting the subnets in the condition clause:

{
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterfacePermission"
            ],
            "Resource": "arn:aws:ec2:us-east-1:123456789000:network-interface/*",
            "Condition": {
                "StringEquals": {
                    "ec2:Subnet": [
                        "arn:aws:ec2:us-east-1:123456789000:subnet/subnet-0c3840...aab329b0",
                        "arn:aws:ec2:us-east-1:123456789000:subnet/subnet-02a111...27737a5f",
                        "arn:aws:ec2:us-east-1:123456789000:subnet/subnet-03957...a50cc5f73"
                    ],
                    "ec2:AuthorizedService": "codebuild.amazonaws.com"
                }
            }
        }

Expected behavior
The default IAM role produced by the CDK should be correct and allow successful build.

Version:

• Ubuntu 18.04
• Kotlin using Java CDK artifacts
• 0.31.0

[skinny85]

Thanks for reporting the issue @digitalsanctum . This was indeed a bug, fixed here: #2506 .

I'm resolving this one, feel free to re-open if you have any further questions.

[thesurlydev]

@skinny85 The fix you referred to looks like it fixes the subnet issue but not the IAM role policy issue?

[skinny85]

It fixes it was well. See here for the contents of the IAM Policy in an integ test we have.