In order to keep your application(s) more secure, this plugin only uses temporary credentials via STS, scoped to each application. To set this up, do one of the following:
- Log into the AWS Management Console and navigate to the Identity and Access Management console.
- Click on Roles, then click Create New Role.
- In the "Select Role Type" screen, click "Role for Cross-Account Access" then select Allows IAM users from a 3rd party AWS account to access this account.
- The external ID for this Jenkins instance is listed below
- In the policy screen, select Next Step to skip this step (we'll attach a custom policy later).
- Give an appropriate name for this role (for example, "JenkinsCodeBuildProject").
- Click Create Role.
- Click on the newly-created role in the IAM dashboard. Under Permissions, click the Inline Policies,
bar and create a new policy under Custom Policy with the following body:
{"Statement": [{"Action": ["codebuild:*","iam:PassRole"],"Resource": "*","Effect": "Allow"},{"Action": ["logs:FilterLogEvents","logs:GetLogEvents"],"Resource": "*","Effect": "Allow"},{"Action": ["s3:CreateBucket","s3:GetObject","s3:List*","s3:PutObject","s3:GetBucket*"],"Resource": "*","Effect": "Allow"}],"Version": "2012-10-17"}
- Copy-paste the Role ARN into this field.