How do I resolve authentication errors during CodeBuild with GitHub Actions integration?

Short description

You must include the CodeBuild project name to invoke jobs with the correct project settings. The following errors occur when you don't have authentication and your CodeBuild project fails at the Download_Source phase:

"CLIENT_ERROR: authentication required for primary source"

"CLIENT_ERROR: authorization failed for primary source and source version:"

To resolve these errors, identify the authentication method used, and then configure the required settings and permissions.

Resolution

To determine which method you use to connect CodeBuild to GitHub, complete the following steps:

1. Open the CodeBuild console.
2. In the navigation pane, expand Build, and then choose Build projects.
3. Select your build project, and then choose Edit.
4. In the Source section, review the Credential message to identify the authentication method used.

For personal access tokens

To verify that your personal access token exists and is valid, take the following actions:

• Check your GitHub Developer settings. For more information, see Managing your personal access tokens on the GitHub Docs website.
• Make sure that you correctly configured your personal access token with the access token prerequisites.
• If your personal access tokens are expired, then regenerate the authentication tokens and update the tokens in AWS Secrets Manager.

For Secrets Manager secret

To verify that your Secrets Manager secret exists and isn't expired, take the following actions:

• If you're connected through a Secrets Manager secret, then check that the secret exists and the value is up to date.
• Confirm that your CodeBuild project service role has the secretsmanager:GetSecretValue to fetch the secrets.

To check if you have the secretsmanager:GetSecretValue permissions, obtain the CodeBuild project's service role. Complete the following steps:

1. Open the CodeBuild console.
2. Select the project, and then choose the Project details tab.
3. In the Environment configuration, choose the Service role setting.
4. Select the service role.
5. Confirm that the role has the following permissions:

   "Action": [
     "secretsmanager:GetSecretValue"
   ],
   "Resource": [
      "arn:aws:secretsmanager:region:account-id:secret:secretName"
               ]

   Note: Replace region with your AWS Region, account-ID with your AWS account ID, and secretName with your secret name.

For OAuth applications

Your OAuth token is tied to the GitHub user. If the GitHub user is removed from the organization, then the token is no longer valid. To review your authorized OAuth applications, confirm that the Applications list on GitHub includes the AWS CodeBuild (region) application that aws-codesuite owns.

For CodeConnections

To verify that CodeConnections exist and are valid, take the following actions:

• Confirm that you installed the AWS Connector for GitHub application. For more information, see Navigating to the GitHub App you want to review or modify on the GitHub Docs website.
• Confirm that the CodeBuild service role has the correct AWS Identity and Access Management (IAM) role permissions.

Related information

GitHub OAuth app

GitHub and GitHub Enterprise Server access in CodeBuild

Change build project settings in AWS CodeBuild