Myujth

I'm attempting to use the aws cli tool in our CI pipeline to deploy a new version of the application to elastic beanstalk:

aws elasticbeanstalk create-application-version 
 --application-name "serradev dev" 
 --version-label $BUILDKITE_COMMIT 
 --source-bundle S3Bucket="$BUCKET_NAME",S3Key="$BUILDKITE_COMMIT.zip"

it is failing with the following error:

An error occurred (InvalidParameterCombination) when calling the CreateApplicationVersion operation: Unable to download from S3 location (Bucket: elastic-beanstalk-deploys Key: da25301fc88a5c2908282a891fb0f80278008a36.zip). Reason: Forbidden

If I replace the key with a non existent deployment I get a NotFound error instead.

I have configured the following policy on the bucket

 "Version": "2012-10-17",
 "Id": "Policy1541741695771",
 "Statement": [
 
 "Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4",
 "Effect": "Allow",
 "Principal": 
 "AWS": [
 "arn:aws:iam::185535608991:role/aws-elasticbeanstalk-service-role",
 "arn:aws:iam::185535608991:role/aws-elasticbeanstalk-ec2-role"
 ]
 ,
 "Action": [
 "s3:ListBucket",
 "s3:GetObject",
 "s3:PutObject",
 "s3:DeleteObject",
 "s3:PutObjectAcl",
 "s3:GetObjectAcl",
 "s3:GetBucketPolicy",
 "s3:Get*"
 ],
 "Resource": [
 "arn:aws:s3:::elastic-beanstalk-deploys",
 "arn:aws:s3:::elastic-beanstalk-deploys/*"
 ]
 
 ]

The file is copied to the bucket using the aws s3 cp command :

aws s3 cp --acl=public-read $RUN_ARTIFACT_PATH/app.zip s3://$BUCKET_NAME/$BUILDKITE_COMMIT.zip

Note the addition of the --acl=public-read switch.

I have even configured the bucket to have full public access and tested this by downloading the manifest file in an anonymous browser session. Despite all of these permissions being available, I continue to get a Forbidden error.

At this point, I'm out of ideas of what to try next.