(pipelines): (ArtifactsBucketB94BC086 missing Allow Policy on cross-region deployments)

[nonken]

Describe the bug

1. I have a pipeline deployed into us-east-1
2. The pipelines deploys a stage into eu-west-2

When synthesize the pipeline cloudformation template, I am getting the following policy:

{
  "ServiceApiPipelineArtifactsBucketPolicyD1CACCB2": {
    "Type": "AWS::S3::BucketPolicy",
    "Properties": {
      "Bucket": {
        "Ref": "ServiceApiPipelineArtifactsBucketB94BC086"
      },
      "PolicyDocument": {
        "Statement": [
          {
            "Action": "s3:*",
            "Condition": {
              "Bool": {
                "aws:SecureTransport": "false"
              }
            },
            "Effect": "Deny",
            "Principal": {
              "AWS": "*"
            },
            "Resource": [
              {
                "Fn::GetAtt": [
                  "ServiceApiPipelineArtifactsBucketB94BC086",
                  "Arn"
                ]
              },
              {
                "Fn::Join": [
                  "",
                  [
                    {
                      "Fn::GetAtt": [
                        "ServiceApiPipelineArtifactsBucketB94BC086",
                        "Arn"
                      ]
                    },
                    "/*"
                  ]
                ]
              }
            ]
          }
        ],
        "Version": "2012-10-17"
      }
    }
  }

This policy only denies access and subsequently the prepare step fails with s S3 403 error.

Wen I add another stage, in the same region as the pipeline (us-east-1), then I get the correcy policy:

{
  "ServiceApiPipelineArtifactsBucketPolicyD1CACCB2": {
    "Type": "AWS::S3::BucketPolicy",
    "Properties": {
      "Bucket": {
        "Ref": "ServiceApiPipelineArtifactsBucketB94BC086"
      },
      "PolicyDocument": {
        "Statement": [
          {
            "Action": "s3:*",
            "Condition": {
              "Bool": {
                "aws:SecureTransport": "false"
              }
            },
            "Effect": "Deny",
            "Principal": {
              "AWS": "*"
            },
            "Resource": [
              {
                "Fn::GetAtt": [
                  "ServiceApiPipelineArtifactsBucketB94BC086",
                  "Arn"
                ]
              },
              {
                "Fn::Join": [
                  "",
                  [
                    {
                      "Fn::GetAtt": [
                        "ServiceApiPipelineArtifactsBucketB94BC086",
                        "Arn"
                      ]
                    },
                    "/*"
                  ]
                ]
              }
            ]
          },
          {
            "Action": [
              "s3:GetBucket*",
              "s3:GetObject*",
              "s3:List*"
            ],
            "Effect": "Allow",
            "Principal": {
              "AWS": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":iam::ACCOUNT_ID:role/cdk-hnb659fds-deploy-role-ACCOUNT_ID-us-east-1"
                  ]
                ]
              }
            },
            "Resource": [
              {
                "Fn::GetAtt": [
                  "ServiceApiPipelineArtifactsBucketB94BC086",
                  "Arn"
                ]
              },
              {
                "Fn::Join": [
                  "",
                  [
                    {
                      "Fn::GetAtt": [
                        "ServiceApiPipelineArtifactsBucketB94BC086",
                        "Arn"
                      ]
                    },
                    "/*"
                  ]
                ]
              }
            ]
          }
        ],
        "Version": "2012-10-17"
      }
    }
  }

Expected Behavior

I would expect the policy to allow accessing S3 also when just deploying into one other region.

Current Behavior

See above.

Reproduction Steps

See above.

Possible Solution

No response

Additional Information/Context

I tried this with the latest version of the CDK as well to no success.

CDK CLI Version

2.102.0

Framework Version

No response

Node.js Version

18.16

OS

OSX

Language

TypeScript

Language Version

No response

Other information

No response

[nonken]

It looks like I was running into https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.pipelines-readme.html#s3-error-access-denied. Closing

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.