Question

所以，我对AWS很陌生，并且使用AWS CodeStar构建了一个简单的管道。来源 - ＆gt;申请 - ＆gt; Beta版。我正在尝试部署到测试版网站，我得到this failure。

我尝试按照http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html上的说明进行操作，但遇到了以下问题：步骤3说明“选择AWS服务角色类型，然后选择您希望承担此角色的服务。但这不是我所看到的。我没有看到选择CodePipeline的能力，我假设是需要访问Elastic Beanstalk的服务。

我以为我可能误解了他们正在谈论的服务并尝试了另一种方式，选择Elastic Beanstalk，但这也与说明不同。

我尝试过此页面：http://docs.aws.amazon.com/codepipeline/latest/userguide/how-to-custom-role.html#view-default-service-role-policy，但无法弄清楚他们是如何创建默认的AWS CodePipeline服务角色政策

***************更新********************

Here is a screenshot of the whole pipeline

这是AWSCodeStarServiceRole政策

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "ProjectEventRules",
        "Effect": "Allow",
        "Action": [
            "events:PutTargets",
            "events:RemoveTargets",
            "events:PutRule",
            "events:DeleteRule",
            "events:DescribeRule"
        ],
        "Resource": [
            "arn:aws:events:*:*:rule/awscodestar-*"
        ]
    },
    {
        "Sid": "ProjectStack",
        "Effect": "Allow",
        "Action": [
            "cloudformation:*Stack*",
            "cloudformation:CreateChangeSet",
            "cloudformation:ExecuteChangeSet",
            "cloudformation:DeleteChangeSet",
            "cloudformation:GetTemplate"
        ],
        "Resource": [
            "arn:aws:cloudformation:*:*:stack/awscodestar-*",
            "arn:aws:cloudformation:*:*:stack/awseb-*",
            "arn:aws:cloudformation:*:*:stack/aws-cloud9-*",
            "arn:aws:cloudformation:*:aws:transform/CodeStar*"
        ]
    },
    {
        "Sid": "ProjectStackTemplate",
        "Effect": "Allow",
        "Action": [
            "cloudformation:GetTemplateSummary",
            "cloudformation:DescribeChangeSet"
        ],
        "Resource": "*"
    },
    {
        "Sid": "ProjectQuickstarts",
        "Effect": "Allow",
        "Action": [
            "s3:GetObject"
        ],
        "Resource": [
            "arn:aws:s3:::awscodestar-*/*"
        ]
    },
    {
        "Sid": "ProjectS3Buckets",
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::aws-codestar-*",
            "arn:aws:s3:::aws-codestar-*/*",
            "arn:aws:s3:::elasticbeanstalk-*",
            "arn:aws:s3:::elasticbeanstalk-*/*"
        ]
    },
    {
        "Sid": "ProjectServices",
        "Effect": "Allow",
        "Action": [
            "codestar:*Project",
            "codestar:*Resource*",
            "codestar:List*",
            "codestar:Describe*",
            "codestar:Get*",
            "codestar:AssociateTeamMember",
            "codecommit:*",
            "codepipeline:*",
            "codedeploy:*",
            "codebuild:*",
            "ec2:RunInstances",
            "autoscaling:*",
            "cloudwatch:Put*",
            "ec2:*",
            "elasticbeanstalk:*",
            "elasticloadbalancing:*",
            "iam:ListRoles",
            "logs:*",
            "sns:*",
            "cloud9:CreateEnvironmentEC2",
            "cloud9:DeleteEnvironment",
            "cloud9:DescribeEnvironment*",
            "cloud9:ListEnvironments"
        ],
        "Resource": "*"
    },
    {
        "Sid": "ProjectWorkerRoles",
        "Effect": "Allow",
        "Action": [
            "iam:AttachRolePolicy",
            "iam:CreateRole",
            "iam:DeleteRole",
            "iam:DeleteRolePolicy",
            "iam:DetachRolePolicy",
            "iam:GetRole",
            "iam:PassRole",
            "iam:PutRolePolicy",
            "iam:SetDefaultPolicyVersion",
            "iam:CreatePolicy",
            "iam:DeletePolicy",
            "iam:AddRoleToInstanceProfile",
            "iam:CreateInstanceProfile",
            "iam:DeleteInstanceProfile",
            "iam:RemoveRoleFromInstanceProfile"
        ],
        "Resource": [
            "arn:aws:iam::*:role/CodeStarWorker*",
            "arn:aws:iam::*:policy/CodeStarWorker*",
            "arn:aws:iam::*:instance-profile/awscodestar-*"
        ]
    },
    {
        "Sid": "ProjectTeamMembers",
        "Effect": "Allow",
        "Action": [
            "iam:AttachUserPolicy",
            "iam:DetachUserPolicy"
        ],
        "Resource": "*",
        "Condition": {
            "ArnEquals": {
                "iam:PolicyArn": [
                    "arn:aws:iam::*:policy/CodeStar_*"
                ]
            }
        }
    },
    {
        "Sid": "ProjectRoles",
        "Effect": "Allow",
        "Action": [
            "iam:CreatePolicy",
            "iam:DeletePolicy",
            "iam:CreatePolicyVersion",
            "iam:DeletePolicyVersion",
            "iam:ListEntitiesForPolicy",
            "iam:ListPolicyVersions"
        ],
        "Resource": [
            "arn:aws:iam::*:policy/CodeStar_*"
        ]
    },
    {
        "Sid": "InspectServiceRole",
        "Effect": "Allow",
        "Action": [
            "iam:ListAttachedRolePolicies"
        ],
        "Resource": [
            "arn:aws:iam::*:role/aws-codestar-service-role",
            "arn:aws:iam::*:role/service-role/aws-codestar-service-role"
        ]
    },
    {
        "Sid": "IAMLinkRole",
        "Effect": "Allow",
        "Action": [
            "iam:CreateServiceLinkedRole"
        ],
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "iam:AWSServiceName": "cloud9.amazonaws.com"
            }
        }
    }
]

}

另外，我无法更新角色的权限，因为it says it is an Amazon created role and is read-only。

我猜这很简单，我很遗憾。我想念它！

提前致谢！

Answer 1

首次访问AWS CodeStar控制台时，系统会提示您创建服务角色。你应该选择是。这将创建一个名为“AWSCodeStarServiceRole”的角色。

此角色具有您需要的权限。

此链接将指导您设置AWS CodeStar：

Setting Up AWS CodeStar

Answer 2

尝试了很多方法来调整设置和权限。我尝试创建一个重复的管道，一切都在新管道上工作，但不是旧管道。

因此，为了解决这个问题，我删除了CodeStar中保存的管道并创建了一个相同的新管道。然后，我删除了CodeStar中的Continuous Deployment磁贴，然后添加了一个新的Continuous部署磁贴，选择了我创建的新管道。

这解决了问题，管道工作正常。

AWS部署失败且权限不足：提供的角色没有Elasticbeanstalk：UpdateEnvironment权限

2 个答案: