title: How to read SSM parameters when using AWS Codebuild?
body: <p>I'm currently successfully using codebuild for simple build tasks (in a non-vpc configuration).</p>
  
  <p>But now I'm trying to run a build task that reads an SSM parameter value, and it's failing because it can't load any credentials, the apparent cause being: </p>
  
  <pre><code>com.amazonaws.auth.InstanceProfileCredentialsProvider@5754b242: Unable to load credentials from service endpoint
  </code></pre>
  
  <p>The IAM service-role I've allocated to the codebuild project does have <code>ssm:GetParameters</code> permission for the parameter that I'm trying to read (and if that were the problem, I'd expect to see an <code>unauthorized</code> message, rather than <code>unable to load credentials</code>).</p>
  
  <p>I'm using the Java SDK to do the SSM GetParameter call, which I've confirmed does work for reading from SSM parameters when run from an EC2 instance, so I'm pretty sure the problem here is Codebuild.</p>
  
  <p>To further diagnose the issue, I tried adding a build command to do a <code>curl</code> against the AWS instance metadata address:</p>
  
  <pre><code>curl 169.254.169.254/latest/meta-data/iam/info
  </code></pre>
  
  <p>Instead of returning the instance metadata like it would from a normal EC2 environment, it just times out.  </p>
  
  <p>So it seems like the root of the problem is that the codebuild environment doesn't work with the AWS metdata lookup address, which causes the AWS provider chain to not be able to look up credentials.</p>
  
  <p>How can I read my SSM parameters from codebuild (without hardcoding or using environment variables for SDK credentials)?</p>