Failed at DOWNLOAD_SOURCE phase during AWS CodeBuild - amazon-web-services

Question

I am attempting to create a CICD pipeline using AWS CodePipeline to deploy magento to an EC2 instance and terraform to provision the infrastructure on AWS. After running the script, it fails at DOWNLOAD_SOURCE phase during the build stage. After much enquiry I realised it has to do with VPC settings. In the AWS documentation it says to use private subnet ids and present the arn instead of the just the subnet id. I have done all that but it is still failing. What do I do?
Here is the codebuild code
resource "aws_codebuild_project" "o4bproject_codebuild" {
name = "${local.name}-codebuild-project"
description = "${local.name}_codebuild_project"
build_timeout = 60
queued_timeout = 480
depends_on = [aws_iam_role.o4bproject_codebuild]
service_role = aws_iam_role.o4bproject_codebuild.arn
> artifacts {
type = "CODEPIPELINE"
encryption_disabled = false
name = "${local.name}-codebuild-project"
override_artifact_name = false
packaging = "NONE"
}
> cache {
type = "S3"
location = aws_s3_bucket.o4bproject-codebuild.bucket
}
> environment {
compute_type = "BUILD_GENERAL1_SMALL"
image = "aws/codebuild/standard:5.0"
type = "LINUX_CONTAINER"
image_pull_credentials_type = "CODEBUILD"
> environment_variable {
name = "PARAMETERSTORE"
value = aws_ssm_parameter.env.name
type = "PARAMETER_STORE"
}
}
> logs_config {
cloudwatch_logs {
group_name = "log-group"
stream_name = "log-stream"
}
s3_logs {
status = "ENABLED"
location = "${aws_s3_bucket.o4bproject-codebuild.bucket}/build-log"
}
}
> source {
type = "CODEPIPELINE"
buildspec = file("${abspath(path.root)}/buildspec.yml")
location = REDACTED
git_clone_depth = 1
git_submodules_config {
fetch_submodules = true
}
}
source_version = "master"
> vpc_config {
vpc_id = aws_vpc.o4bproject.id
subnets = [
aws_subnet.o4bproject-private[0].id,
aws_subnet.o4bproject-private[1].id,
]
security_group_ids = [
aws_security_group.o4bproject_dev_ec2_private_sg.id,
]
}
tags = local.common_tags
}`
Here is the codebuild role and policy
resource "aws_iam_role" "o4bproject_codebuild" {
name = "${local.name}-codebuild-role"
description = "Allows CodeBuild to call AWS services on your behalf."
path = "/service-role/"
assume_role_policy = jsonencode(
{
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "codebuild.amazonaws.com"
}
Sid = ""
},
]
Version = "2012-10-17"
}
)
tags = local.common_tags
}
resource` "aws_iam_role_policy" "o4bproject_codebuild" {
role = aws_iam_role.o4bproject_codebuild.name
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCodebuildCreateLogs",
"Effect": "Allow",
"Resource": [
"${aws_cloudwatch_log_group.o4bproject-codebuild.name}:*"
],
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
},
{
"Sid": "AllowCodeBuildGitActions",
"Effect": "Allow",
"Action": [
"github:GitPull"
],
"Resource": "*"
},
{
"Sid": "AllowCodeBuildGitActions",
"Effect": "Allow",
"Action": [
"github:GitPush"
],
"Resource": "*",
"Condition": {
"StringEqualsIfExists": {
"codecommit:References": [
"refs/heads/build"
]
}
}
},
{
"Sid": "SNSTopicListAccess",
"Effect": "Allow",
"Action": [
"sns:ListTopics",
"sns:GetTopicAttributes"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface",
"ec2:DescribeDhcpOptions",
"ec2:DescribeNetworkInterfaces",
"ec2:DeleteNetworkInterface",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeVpcs"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterfacePermission"
],
"Resource": [
"arn:aws:ec2:${var.aws_region}:REDACTED:network-interface/*"
],
"Condition": {
"StringEquals": {
"ec2:Subnet": [
"${aws_subnet.o4bproject-private[0].arn}",
"${aws_subnet.o4bproject-private[1].arn}"
],
"ec2:AuthorizedService": "codebuild.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"${aws_s3_bucket.o4bproject-codebuild.arn}",
"${aws_s3_bucket.o4bproject-codebuild.arn}/*"
]
}
]
}
POLICY
}`
Here is my code for vpc-network
resource "aws_vpc" "o4bproject" {
cidr_block = var.vpc_cidr_block
instance_tenancy = "default"
enable_dns_support = true
enable_dns_hostnames = true
tags = {
Name = "${local.name}-vpc"
Environment = "dev"
}
}
> resource "aws_subnet" "o4bproject-private" {
count = var.item_count
vpc_id = aws_vpc.o4bproject.id
availability_zone = var.private_subnet_availability_zone[count.index]
cidr_block = var.private_subnet_cidr_block[count.index]
tags = {
Name = "${local.name}-private-subnet-${count.index}"
Environment = "dev"
}
}
> resource "aws_subnet" "o4bproject-public" {
count = var.item_count
vpc_id = aws_vpc.o4bproject.id
availability_zone = var.public_subnet_availability_zone[count.index]
cidr_block = var.public_subnet_cidr_block[count.index]
tags = {
Name = "${local.name}-public-subnet-${count.index}"
Environment = "dev"
}
}
> resource "aws_route_table" "public-route-table" {
vpc_id = aws_vpc.o4bproject.id
tags = {
Name = "${local.name}-public-route-table"
Environment = "dev"
}
}
> resource "aws_route_table" "private-route-table" {
vpc_id = aws_vpc.o4bproject.id
tags = {
Name = "${local.name}-private-route-table"
Environment = "dev"
}
}
> resource "aws_route_table_association" "public-route-association" {
count = var.item_count
route_table_id = aws_route_table.public-route-table.id
subnet_id = aws_subnet.o4bproject-public[count.index].id
}
> resource "aws_route_table_association" "private-route-association" {
count = var.item_count
route_table_id = aws_route_table.private-route-table.id
subnet_id = aws_subnet.o4bproject-private[count.index].id
}
> resource "aws_internet_gateway" "o4bproject-igw" {
vpc_id = aws_vpc.o4bproject.id
tags = {
Name = "${local.name}-igw"
Environment = "dev"
}
}
> resource "aws_route" "public-internet-gateway-route" {
route_table_id = aws_route_table.public-route-table.id
gateway_id = aws_internet_gateway.o4bproject-igw.id
destination_cidr_block = "0.0.0.0/0"
}
> resource "aws_eip" "o4bproject-eip-nat-gateway" {
vpc = true
count = var.item_count
associate_with_private_ip = REDACTED
depends_on = [aws_internet_gateway.o4bproject-igw]
tags = {
Name = "${local.name}-eip-${count.index}"
Environment = "dev"
}
}
> resource "aws_nat_gateway" "o4bproject-nat-gateway" {
allocation_id = aws_eip.o4bproject-eip-nat-gateway[count.index].id
count = var.item_count
subnet_id = aws_subnet.o4bproject-public[count.index].id
depends_on = [aws_eip.o4bproject-eip-nat-gateway]
tags = {
Name = "${local.name}-nat-gw-${count.index}"
Environment = "dev"
}
}