title: How to get S3 objects from a codebuild buildspec ? (AccessDenied)
body: <p>I have a CodePipeline Pipeline with a CodeBuild stage</p>
  <p>Here is my buildspec :</p>
  <pre><code>{
    &quot;version&quot;: &quot;0.2&quot;,
    &quot;phases&quot;: {
      &quot;build&quot;: {
        &quot;commands&quot;: [
          &quot;echo \&quot;Hello, CodeBuild!\&quot;&quot;,
          &quot;echo \&quot;ca marche\&quot; &gt; test.txt&quot;,
          &quot;mkdir site-content&quot;,
          &quot;aws s3 sync s3://my-super-bucket-name site-content&quot;,
          &quot;ls - al&quot;
        ]
      }
    },
    &quot;artifacts&quot;: {
      &quot;files&quot;: [
        &quot;test.txt&quot;
      ]
    }
  }
  </code></pre>
  <p>The build project Service Role is defined with a default cdk generated policy, plus this one :</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Action&quot;: &quot;s3:*&quot;,
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::my-super-bucket-name&quot;,
                  &quot;arn:aws:s3:::my-super-bucket-name/* &quot;
              ],
              &quot;Effect&quot;: &quot;Allow&quot;
          }
      ]
  }
  </code></pre>
  <p>And codebuild.amazonaws.com is a trusted entities for the Role</p>
  <p>On the bucket side, I have this bucket policy :</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Id&quot;: &quot;PolicyXXXXXXXXXXXXX&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;StmtYYYYYYYYYYYYY&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::12345678910:user/a-user-for-another-process&quot;
              },
              &quot;Action&quot;: &quot;s3:*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::my-super-bucket-name&quot;
          }
      ]
  }
  </code></pre>
  <p>But the build project fail with this :</p>
  <pre><code>[Container] 2021/02/03 09:57:43 Running command aws s3 sync s3://my-super-bucket-name site-content
  download failed: s3://my-super-bucket-name/test.txt to site-content/test.txt An error occurred (AccessDenied) when calling the GetObject operation: Access Denied
  Completed 4 Bytes/13.7 KiB (0 Bytes/s) with 4 file(s) remaining
  </code></pre>
  <p>Help !</p>
  <p>EDIT :
  I just add this statement to the bucket policy :</p>
  <pre><code>        {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::XXXXXXXXXXXXX:role/my-role&quot;
              },
              &quot;Action&quot;: &quot;s3:*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::my-super-bucket-name&quot;
          }
  </code></pre>
  <p>But I have the same error :(</p>
  <p>EDIT 2 :
  Silly me ! It was :</p>
  <pre><code>&quot;Resource&quot;: &quot;arn:aws:s3:::my-super-bucket-name*&quot;
  </code></pre>
  <p>Now it work !</p>