AWS codebuild: Added Bitbucket OAuth authentication error troubleshooting
Summary
Added documentation for Bitbucket builds failing due to OAuth refresh token rotation requiring PutSecretValue permission
Security assessment
Addresses authentication failures caused by OAuth token rotation requiring updated Secrets Manager permissions to store new tokens securely
Evidence
+**Recommended solution:** Add the `secretsmanager:PutSecretValue` permission to your CodeBuild service role.
Diff
diff --git a/codebuild/latest/userguide/troubleshooting.md b/codebuild/latest/userguide/troubleshooting.md index e8edaa132..06e9d6194 100644 --- a//codebuild/latest/userguide/troubleshooting.md +++ b//codebuild/latest/userguide/troubleshooting.md @@ -7 +7 @@ -Apache Maven builds reference artifacts from the wrong repositoryBuild commands run as root by defaultBuilds might fail when file names have non-U.S. English charactersBuilds might fail when getting parameters from Amazon EC2 Parameter StoreCannot access branch filter in the CodeBuild consoleCannot view build success or failureBuild status not reported to source providerCannot find and select the base image of the Windows Server Core 2019 platformEarlier commands in buildspec files are not recognized by later commandsError: "Access denied" when attempting to download cacheError: "BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE" when using a custom build imageError: "Build container found dead before completing the build. build container died because it was out of memory, or the Docker image is not supported. ErrorCode: 500"Error: "Cannot connect to the Docker daemon" when running a buildError: "CodeBuild is not authorized to perform: sts:AssumeRole" when creating or updating a build projectError: "Error calling GetBucketAcl: Either the bucket owner has changed or the service role no longer has permission to called s3:GetBucketAcl"Error: "Failed to upload artifacts: Invalid arn" when running a buildError: "Git clone failed: Unable to access 'your-repository-URL': SSL certificate problem: Self signed certificate"Error: "The bucket you are attempting to access must be addressed using the specified endpoint" when running a buildError: "This build image requires selecting at least one runtime version."Error: "QUEUED: INSUFFICIENT_SUBNET" when a build in a build queue failsError: "Unable to download cache: RequestError: Send request failed caused by: x509: Failed to load system roots and no roots provided"Error: "Unable to download certificate from S3. AccessDenied"Error: "Unable to locate credentials"RequestError timeout error when running CodeBuild in a proxy serverThe bourne shell (sh) must exist in build imagesWarning: "Skipping install of runtimes. runtime version selection is not supported by this build image" when running a buildError: "Unable to verify JobWorker identity"Build failed to startAccessing GitHub metadata in locally cached buildsAccessDenied: The bucket owner for the report group does not match the owner of the S3 bucket...Error: "Your credentials lack one or more required privilege scopes" when creating a CodeBuild project with CodeConnectionsError: "Sorry, no terminal at all requested - can't get input" when building with the Ubuntu install command +Apache Maven builds reference artifacts from the wrong repositoryBuild commands run as root by defaultBuilds might fail when file names have non-U.S. English charactersBuilds might fail when getting parameters from Amazon EC2 Parameter StoreCannot access branch filter in the CodeBuild consoleCannot view build success or failureBuild status not reported to source providerCannot find and select the base image of the Windows Server Core 2019 platformEarlier commands in buildspec files are not recognized by later commandsError: "Access denied" when attempting to download cacheError: "BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE" when using a custom build imageError: "Build container found dead before completing the build. build container died because it was out of memory, or the Docker image is not supported. ErrorCode: 500"Error: "Cannot connect to the Docker daemon" when running a buildError: "CodeBuild is not authorized to perform: sts:AssumeRole" when creating or updating a build projectError: "Error calling GetBucketAcl: Either the bucket owner has changed or the service role no longer has permission to called s3:GetBucketAcl"Error: "Failed to upload artifacts: Invalid arn" when running a buildError: "Git clone failed: Unable to access 'your-repository-URL': SSL certificate problem: Self signed certificate"Error: "The bucket you are attempting to access must be addressed using the specified endpoint" when running a buildError: "This build image requires selecting at least one runtime version."Error: "QUEUED: INSUFFICIENT_SUBNET" when a build in a build queue failsError: "Unable to download cache: RequestError: Send request failed caused by: x509: Failed to load system roots and no roots provided"Error: "Unable to download certificate from S3. AccessDenied"Error: "Unable to locate credentials"RequestError timeout error when running CodeBuild in a proxy serverThe bourne shell (sh) must exist in build imagesWarning: "Skipping install of runtimes. runtime version selection is not supported by this build image" when running a buildError: "Unable to verify JobWorker identity"Build failed to startAccessing GitHub metadata in locally cached buildsAccessDenied: The bucket owner for the report group does not match the owner of the S3 bucket...Error: "Your credentials lack one or more required privilege scopes" when creating a CodeBuild project with CodeConnectionsError: "Sorry, no terminal at all requested - can't get input" when building with the Ubuntu install commandBitbucket builds fail with authentication errors after using Secrets Manager OAuth @@ -78,0 +79,2 @@ Use the information in this topic to help you identify, diagnose, and address is + * Bitbucket builds fail with authentication errors after using Secrets Manager OAuth + @@ -736,0 +739,8 @@ For more information, see [Specify runtime versions in the buildspec file](./bui +## Bitbucket builds fail with authentication errors after using Secrets Manager OAuth + +**Issue:** Builds using Bitbucket as a source provider fail with a source credential error. The Bitbucket connection was configured using OAuth with AWS Secrets Manager as the storage service. + +**Possible cause:** Atlassian enforces single-use rotating refresh tokens for Bitbucket OAuth. Each time you use a refresh token, Bitbucket invalidates it and returns a new one. For more information, see [Bitbucket OAuth single-use refresh tokens (CHANGE-3052)](https://developer.atlassian.com/cloud/bitbucket/changelog/#CHANGE-3052) on the Atlassian developer website. + +**Recommended solution:** Add the `secretsmanager:PutSecretValue` permission to your CodeBuild service role. For more information about the required IAM permission, see [Required action for Secrets Manager-stored credentials](./connections-bitbucket-app.html#connections-bitbucket-oauth-sm-action). +