copilot env init gives "S3 error: Access Denied"

[MJohnson459]

Hi, I'm trying to deploy a second environment but I keep hitting this error. As far as I can tell, the user has the full S3 permissions and deploying the first environment seemed to work so I'm quite confused. Is there a specific bucket this is trying to access that might need permission changed? Is there anything I can do to get more debug information to go on?

➜ copilot env init -n prod
Credential source: [profile sim_admin]
Default environment configuration? Yes, use default.
✔ Manifest file for environment prod already exists at environments/prod/manifest.yml, skipping writing it.
- Update regional resources with stack set "sim-admin-infrastructure"  [succeeded]  [8.8s]
✔ Proposing infrastructure changes for the sim-admin-prod environment.
✘ check if changeset is empty: create change set copilot-14bb5420-4acb-4b94-9436-7dc0b2382f10 for stack sim-admin-prod: ValidationError: S3 error: Access Denied
For more information check http://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html
        status code: 400, request id: 5f6385a9-1505-45a6-8933-b4a3ee62da10: describe change set copilot-14bb5420-4acb-4b94-9436-7dc0b2382f10 for stack sim-admin-prod: ValidationError: Stack [sim-admin-prod] does not exist
        status code: 400, request id: 0024c42c-2cbf-414d-a6d6-4d3a49bd50f9

[Lou1415926]

hey @MJohnson459! Is the sim_admin profile a different AWS account than the profile used for the first environment? Or is it different from the profile that was used to run copilot app init?

[Lou1415926]

For context, when you run env init, there are two credentials involved - account A and region a, where your app-level resources live, also the credential that has been used to run copilot app init; account B and region b, the credential that sim_admin represents. Note that account A could be the same as account B, depending on how your profiles were set up.

env init will:
a) create a S3 bucket (among other resources) in account A region b, along with S3 bucket policy.
b) upload the environment stack template to the said bucket (in account A region b).
c) use the credential for account B region b to read the uploaded template, and deploy the template in account B region b.

In a), the S3 bucket policy is designed such that it delegates permissions to read the bucket to account B's root account. Account B's root then has the capability of decide what users/roles in account B can read the bucket. Most typically this works out-of-the-box, however a few things could go wrong:

1. Perhaps account B has a Deny statement on any cross-account bucket access for any role/user.
2. The IAM credential of sim_admin is governed by some Deny statement on s3 resources, or it does not have enough s3 permissions.
3. Other scenarios that I haven't thought of right now 😂

[MJohnson459]

Thanks, I'm looking into the permissions but I don't see anything unusual yet. I don't have any Deny statements on S3 resources and I only have one account (as far as I'm aware at least). Your explanation gives me something to go off at least. I'm going to test access to the bucket independently and see if that tells me anything.