title: Grant AWS CodeBuild access to AWS CodeArtifact
body: <p>I have to AWS accounts - A and B.</p>
  <p>Account A has a CodeArtifact repository set up. In account A I have created a role with TrustRelationship to account B. I have attached policies with <code>codeartifact:*</code> and <code>sts:GetServiceBearerToken</code> to this role's Permissions.</p>
  <p>Account B has a CodePipeline with Codebuild. Codebuild is using its own Build role. Within the buildspec of the source built in the Codebuild in account B, I am trying to:</p>
  <p><code>aws codeartifact login --tool npm --repository accountA-repository --domain accountA</code></p>
  <p>this of course won't work because:</p>
  <blockquote>
  <p>An error occurred (AccessDeniedException) when calling the
  GetAuthorizationToken operation: User:
  arn:aws:sts::xxx:assumed-role/accountB-CodeBuildServiceRol/AWSCodeBuild-xxx
  is not authorized to perform: codeartifact:GetAuthorizationToken on
  resource: arn:aws:codeartifact:us-x::domain/accountA</p>
  </blockquote>
  <p>I tried to assume in <code>buildspec.yaml</code> in the CodeBuild on account B but no luck there. Is there a way to assume role by Code Build role? Or is there a better way to give permission to CodeBuild? Tried searching but no luck finding this scenario. All samples seem to use the same account.</p>
  <p>How do you allow CodeBuild from account B to interact with CodeArtifact from account A?</p>