In order to keep your application(s) more secure, this plugin only uses temporary credentials via STS, scoped to each application. To set this up:
- Log into the AWS Management Console, and navigate to the Identity and Access Management console.
- Click on Roles, then click Create New Role.
- Give an appropriate name for this role (for example, "JenkinsCodePipelineProject").
- In the "Select Role Type" screen, click "Role for Cross-Account Access" then select Allows IAM users from a 3rd party AWS account to access this account.
- The account and external IDs for this Jenkins project are listed below
- In the policy screen, select Custom Policy and copy-paste the following policy:
{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["codepipeline:PollForJobs",
"codepipeline:AcknowledgeJob", "codepipeline:PutJobSuccessResult", "codepipeline:PutJobFailureResult", "codepipeline:GetJobDetails"], "Resource": "*"}]}
- Click Create Role, then copy-paste the Role ARN into the below field.
- Click the Test Connection button to ensure that the permissions are set up properly.