[SOLVED] CodeBuild policy error: "Not authorized to perform: ssm:GetParameters"

CodeBuild policy error: "Not authorized to perform: ssm:GetParameters"

I need to transfer a variables which I prescribed in my CodeBuild, but I get this error:

Phase context status code: Decrypted Variables
Error Message: AccessDeniedException:
User: arn:aws:sts::<acc_id>:assumed-role/codebuild-image_builder-service-role/AWSCodeBuild-c892c6f5-ffba-48ec-a53f-35ddca9818a5 is not authorized to perform: ssm:GetParameters on resource: arn:aws:ssm:eu-west-1:<acc_id>:parameter/eu-west-1 because no identity-based policy allows the ssm:GetParameters action

My buildspec.yml file:

phases:
  pre_build:
    commands:
      - echo Logging in to Amazon ECR...
      - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
  build:
    commands:
      - echo Build started on `date`
      - echo Building the Docker image...          
      - docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG .
      - docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME:$IMAGE_TAG      
  post_build:
    commands:
      - echo Build completed on `date`
      - echo Pushing the Docker image...
      - docker push $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME:$IMAGE_TAG

Solution

You can see in the logs

not authorized to perform: ssm:GetParameters on resource:

Check the service role of your Codebuild have the right/policy/permissions to access to parameter Store.

You can check this page https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html to add permisions