title: Upload to S3 failed with the following error: Access Denied - CodeStarConnections
body: <p>I am building a CI/CD pipeline using AWS Codepipeline, the repository source is on bitbucket and I used the AWS-Codestarconnections to create a connection between the bitbucket repository and the pipeline.</p>
  <p>The pipeline details are below:</p>
  <pre><code>{
      &quot;pipeline&quot;: {
          &quot;name&quot;: &quot;test_pipeline&quot;,
          &quot;roleArn&quot;: &quot;arn:aws:iam::&lt;AccountId&gt;:role/PipelineServiceRole&quot;,
          &quot;artifactStore&quot;: {
              &quot;type&quot;: &quot;S3&quot;,
              &quot;location&quot;: &quot;tadadadada-artifact&quot;
          },
          &quot;stages&quot;: [
              {
                  &quot;name&quot;: &quot;Source&quot;,
                  &quot;actions&quot;: [
                      {
                          &quot;name&quot;: &quot;Source&quot;,
                          &quot;actionTypeId&quot;: {
                              &quot;category&quot;: &quot;Source&quot;,
                              &quot;owner&quot;: &quot;AWS&quot;,
                              &quot;provider&quot;: &quot;CodeStarSourceConnection&quot;,
                              &quot;version&quot;: &quot;1&quot;
                          },
                          &quot;runOrder&quot;: 1,
                          &quot;configuration&quot;: {
                              &quot;BranchName&quot;: &quot;dev&quot;,
                              &quot;ConnectionArn&quot;: &quot;arn:aws:codestar-connections:us-east-2:&lt;AccountId&gt;:connection/4ca7b1cf-2917-4fda-b681-c5239944eb33&quot;,
                              &quot;FullRepositoryId&quot;: &quot;&lt;username&gt;/repository_name&quot;,
                              &quot;OutputArtifactFormat&quot;: &quot;CODE_ZIP&quot;
                          },
                          &quot;outputArtifacts&quot;: [
                              {
                                  &quot;name&quot;: &quot;SourceArtifact&quot;
                              }
                          ],
                          &quot;inputArtifacts&quot;: [],
                          &quot;region&quot;: &quot;us-east-2&quot;,
                          &quot;namespace&quot;: &quot;SourceVariables&quot;
                      }
                  ]
              },
              {
                  &quot;name&quot;: &quot;Build&quot;,
                  &quot;actions&quot;: [
                      {
                        ....
                      }
                  ]
              }
          ],
          &quot;version&quot;: 1
      },
      &quot;metadata&quot;: {
          &quot;pipelineArn&quot;: &quot;arn:aws:codepipeline:us-east-2:&lt;AccountId&gt;:test_pipeline&quot;,
          &quot;created&quot;: 1611669087.267,
          &quot;updated&quot;: 1611669087.267
      }
  }
  
  </code></pre>
  <p>The PipelineServiceRole + that policy attached to it are:</p>
  <p><strong>Service Role</strong></p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;codepipeline.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  </code></pre>
  <p><strong>Policy</strong></p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Sid&quot;: &quot;IamPassRolePolicy&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: [
            &quot;iam:PassRole&quot;
        ],
        &quot;Resource&quot;: &quot;*&quot;,
        &quot;Condition&quot;: {
          &quot;StringEqualsIfExists&quot;: {
            &quot;iam:PassedToService&quot;: [
              &quot;cloudformation.amazonaws.com&quot;,
              &quot;ec2.amazonaws.com&quot;,
              &quot;ecs-tasks.amazonaws.com&quot;
            ]
          }
        }
      },
      {
        &quot;Sid&quot;: &quot;CodeBuildPolicy&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: [
          &quot;codebuild:BatchGetBuilds&quot;,
          &quot;codebuild:StartBuild&quot;
        ],
        &quot;Resource&quot;: &quot;*&quot;
      },
      {
        &quot;Sid&quot;: &quot;S3AccessPolicy&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: [
          &quot;s3:GetObject&quot;,
          &quot;s3:PutObject&quot;,
          &quot;s3:GetObjectVersion&quot;,
          &quot;s3:GetBucketAcl&quot;,
          &quot;s3:GetBucketLocation&quot;
        ],
        &quot;Resource&quot;: &quot;*&quot;
      },
      {
        &quot;Sid&quot;: &quot;ECRAccessPolicy&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: [
          &quot;ecr:DescribeImages&quot;
        ],
        &quot;Resource&quot;: &quot;*&quot;
      },
      {
        &quot;Sid&quot;: &quot;CodeStarConnectionsAccessPolicy&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: [
          &quot;codestar-connections:UseConnection&quot;
        ],
        &quot;Resource&quot;: &quot;*&quot;
      }
    ]
  }
  
  </code></pre>
  <p>The source stage fails with an error :</p>
  <pre><code>[Bitbucket] Upload to S3 failed with the following error: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 085999D90C19E650; S3 Extended Request ID: gJ6l08+cX3U6i2Vj0+fW7PiqA/UzM6ZGCfyECmWb+Jit4Knu+gi/L4y3F24uqkFWUfGy9tZo0VE=; Proxy: null) (Service: null; Status Code: 0; Error Code: null; Request ID: null; S3 Extended Request ID: null; Proxy: null) (Service: null; Status Code: 0; Error Code: null; Request ID: null; S3 Extended Request ID: null; Proxy: null)
  </code></pre>
  <p>The error message lacks details, I am not sure which service is trying to access s3, shouldn't it be code-pipeline (which in this case has PutObject permission)?</p>