Fix CodePipeline Build Action Configuration

In this tutorial, you'll learn about Fix CodePipeline Build Action Configuration. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

When you misconfigure codepipeline build action in AWS, operations fail with access denied errors or unexpected behavior. This fix walks you through the correct configuration, common mistakes, and how to prevent them. Doda Browser's AWS config auditor catches these issues before deployment.

Wrong

An incorrect codepipeline build action setup that causes permission errors or unintended behavior:

{
  "Effect": "Deny",
  "Action": "*",
  "Resource": "*"
}

Running the operation produces an error:

An error occurred (AccessDenied) when calling the operation:
User: arn:aws:iam::123456789012:user/dev-user is not authorized to perform
the action because no identity-based policy allows it

This configuration blocks all actions instead of granting the required access. The restrictive policy prevents codepipeline from functioning correctly.

Right

The correct codepipeline build action configuration that grants the necessary permissions while following least-privilege principles:

{
  "Effect": "Allow",
  "Action": [
    "codepipeline:Describe*",
    "codepipeline:List*]
  ],
  "Resource": "*"
}

Now the operation succeeds:

{
  "status": "success",
  "message": "Operation completed successfully"
}

This configuration grants only the read permissions needed, keeping the principle of Least Privilege intact while allowing the required codepipeline operations.

Prevention

• Use AWS IAM Access Analyzer to generate least-privilege policies based on CloudTrail access history.
• Apply the principle of Least Privilege — grant only the specific actions and resources needed.
• Test policy changes in a staging environment before applying to production.
• Use policy conditions to scope permissions further, such as aws:SourceIp or aws:RequestedRegion.
• Enable AWS CloudTrail to audit all API calls and detect unintended access.
• Review IAM Access Advisor to identify unused permissions and reduce scope.
• Use managed policies as a starting point, then create custom policies for finer control.
• Implement permission boundaries for developer roles to prevent privilege escalation.
• Validate policies with the IAM policy simulator before deployment.
• Use DodaZIP's policy analyzer to scan for overly permissive statements and suggest tighter scopes.

DodaTech Tools

Doda Browser includes a built-in AWS config auditor that scans IAM policies, S3 bucket policies, and service control policies for common misconfigurations. It highlights statements that are too permissive and suggests least-principle alternatives. DodaZIP's policy optimizer can reduce policy size by merging redundant statements while maintaining the exact same permission boundary. Durga Antivirus Pro uses similar IAM hardening techniques across its multi-account infrastructure, leveraging permission boundaries and SCPs to enforce security baselines.

FAQ