CDK AWS Pipeline ListBucket permissions error

[lehigh123]

I am defining a Code Pipeline via CDK following the docs here to deploy a lambda. The final stage deploys a lambda cloudformation stack however I get an S3 permissions error when the deploy stage runs.

The deploy stage is defined as:

        const pipeline = new Pipeline(this, 'PipelineStack', {
            pipelineName: 'LambdaDeploymentPipeline',
            pipelineType: PipelineType.V2
        });
        ...source and build stage run correctly 
        pipeline.addStage({
            stageName: 'Deploy',
            actions: [
                new CloudFormationCreateUpdateStackAction({
                    actionName: 'lambda-application-deployment',
                    stackName: props.lambdaApplicationStack.stackName,
                    templatePath: cdkBuildOutput.atPath('LambdaStack.template.yaml'),
                    adminPermissions: true,
                })
            ],
        })

the error is:

User: arn:aws:sts::975050149793:assumed-role/CodePipelineStack-PipelineStackDeploylambdaapplicat-gF0oLczc8T7Z/1726918379606 is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::codepipelinestack-pipelinestackartifactsbucket870a-z0ggjsmh1utz" because no session policy allows the s3:ListBucket action (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied;

however when I check the permissions policy for the created role arn:aws:sts::975050149793:assumed-role/CodePipelineStack-PipelineStackDeploylambdaapplicat-gF0oLczc8T7Z/1726918379606

in the IAM console I can see it has list bucket permissions on the given bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:Abort*",
                "s3:DeleteObject*",
                "s3:GetBucket*",
                "s3:GetObject*",
                "s3:List*",
                "s3:PutObject",
                "s3:PutObjectLegalHold",
                "s3:PutObjectRetention",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionTagging"
            ],
            "Resource": [
                "arn:aws:s3:::codepipelinestack-pipelinestackartifactsbucket870a-z0ggjsmh1utz",
                "arn:aws:s3:::codepipelinestack-pipelinestackartifactsbucket870a-z0ggjsmh1utz/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:GenerateDataKey*",
                "kms:ReEncrypt*"
            ],
            "Resource": "arn:aws:kms:us-east-1:975050149793:key/cc2ef46c-329f-4e44-b209-89c7cce97cf4",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchGetImage",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ],
            "Resource": "arn:aws:ecr:us-east-1:975050149793:repository/hello-world-ecr-repository-from-cdk",
            "Effect": "Allow"
        },
        {
            "Action": "ecr:GetAuthorizationToken",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "sts:AssumeRole",
            "Resource": [
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackBuildcdkcodesynthesi-CBELbize1taP",
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackBuildlambdadockerima-022VbTwX3Bwh",
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackDeploylambdaapplicat-gF0oLczc8T7Z",
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackSourceCDKGitHubSourc-YLxuCRQKhqOD",
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackSourceLambdaGitHubSo-aOOfOJyDHRhJ"
            ],
            "Effect": "Allow"
        }
    ]
}

what updates do I need to make to rectify this error?

[Asilomare]

Hey did you fix this?

[JustasStarred]

In my case, I contacted AWS support who pointed out that the bucket I was using for artifacts in the CodePipeline did not exist due to a typo. However here's other suggestions from them:

This error is usually experienced when the pipeline tries to retrieve an input artifact from the bucket, and does not find it.
The pipeline is unable to get the artifact to pass on to the CloudFormation action.
I noted that the build artifact path of the bucket is empty, and as such there are two possibilities. Either:

• The object has been deleted, leading to the pipeline not being able to retrieve the artifact.
  or
• The artifact has not been uploaded to the artifact store (the S3 bucket).