ERROR: get public public hosted zone ID for domain <REDACTED>

[nandubatchu]

I am able to deploy the service using the Administrator user login, but the service deployment fails for other less privileged users, even from the copilot codebuild-codepipeline. What permission is to be provided to which role?

[Lou1415926]

@nandubatchu Apologies! I think this is likely a bug on our end - sorry for the trouble 😞 !

The result of the bug is that if there is an app-level domain, then the user / CodeBuild role now need to have the permission of route53:ListHostedZonesByName to run copilot [svc/env] deploy. This also affects the CodeBuild role. We are working on a fix - once the fix is released, you won't need that additional permission.

To help me verify that what you saw was indeed the bug, could you please run aws route53 list-hosted-zones-by-name --dns-name your-domain.com using the less-privileged user and see if it gives you any error?

For now, to unblock you, you can:

1. Add the permissions to the less privileged users for now.
2. Use yaml patch for your pipeline:

- op: add
  path: /Resources/BuildProjectRole/Properties/Policies/-
  value:
    PolicyName: temporary-remove-after-copilot-v1321
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
      - Effect: Allow
        Resource: '*'
        Action:
          - route53:ListHostedZonesByName

You can:

1. run copilot pipeline override --tool yamlpatch
2. use the ⬆️ snippet in the cfn.patches.yml file
3. run copilot pipeline deploy --diff to deploy the change after confirming the diff

Apologies again, for the trouble 🙇🏼

[sebastianovide]

hi @Lou1415926 , the workaround fixed the problem. Nevertheless, I see errors in the code pipeline. Not sure if related to the same ticket:

[iamhopaul123]

Hello @sebastianovide. Looks like your web service deployment to the dev env failed, and you can go to the CFN console (with the correct account/region for where you deployed the dev env) to check it out. However, it might be unrelated to this issue anymore.

[iamhopaul123]

Hello! The fix is now released in v1.32.1: https://github.com/aws/copilot-cli/releases/tag/v1.32.1

[sebastianovide]

hi @iamhopaul123 , I've upgraded it copilot to V1.32.1, upgraded the app (copilot app upgrade) , removed the workaround #5535 (comment) , deleted the pipeline, re created it again and deployed it again and I still get the error...

ideas ?

4123 | Successfully tagged 437493907358.dkr.ecr.eu-west-1.amazonaws.com/mobile/web:b577e39d-c1fa-48d3-8010-e56802cf8803-dev
4124 | 437493907358.dkr.ecr.eu-west-1.amazonaws.com/mobile/web:latest
4125 | 437493907358.dkr.ecr.eu-west-1.amazonaws.com/mobile/web:b577e39d-c1fa-48d3-8010-e56802cf8803-dev
4126 | ✘ generate workload web template against environment dev: get public public hosted zone ID for domain mobile.v1.xxxxxx.com
4127 | Cloudformation stack and config files were not generated. Please check build logs to see if there was a manifest validation error.
4128 |  
4129 | [Container] 2023/12/13 22:15:30.847362 Command did not exit successfully for env in $pl_envs; do
4130 | tag=$(echo ${CODEBUILD_BUILD_ID##*:}-$env \| sed 's/:/-/g' \| rev \| cut -c 1-128 \| rev)
4131 | for svc in $svcs; do
4132 | ./copilot-linux svc package -n $svc -e $env --output-dir './infrastructure' --tag $tag --upload-assets;
4133 | if [ $? -ne 0 ]; then
4134 | echo "Cloudformation stack and config files were not generated. Please check build logs to see if there was a manifest validation error." 1>&2;
4135 | exit 1;
4136 | fi
4137 | done;
4138 | for job in $jobs; do
4139 | ./copilot-linux job package -n $job -e $env --output-dir './infrastructure' --tag $tag --upload-assets;
4140 | if [ $? -ne 0 ]; then
4141 | echo "Cloudformation stack and config files were not generated. Please check build logs to see if there was a manifest validation error." 1>&2;
4142 | exit 1;
4143 | fi
4144 | done;
4145 | done;
4146 | exit status 1
4147 | [Container] 2023/12/13 22:15:30.859522 Phase complete: POST_BUILD State: FAILED
4148 | [Container] 2023/12/13 22:15:30.859537 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: for env in $pl_envs; do
4149 | tag=$(echo ${CODEBUILD_BUILD_ID##*:}-$env \| sed 's/:/-/g' \| rev \| cut -c 1-128 \| rev)
4150 | for svc in $svcs; do
4151 | ./copilot-linux svc package -n $svc -e $env --output-dir './infrastructure' --tag $tag --upload-assets;
4152 | if [ $? -ne 0 ]; then
4153 | echo "Cloudformation stack and config files were not generated. Please check build logs to see if there was a manifest validation error." 1>&2;
4154 | exit 1;
4155 | fi
4156 | done;
4157 | for job in $jobs; do

[iamhopaul123]

Hello @sebastianovide. Did you just upgrade your local CLI version or you upgraded the pipeline buildspec as well?

[sebastianovide]

ok... I've initiated a new pipeline and then I've copied the buildspec and I've seen the small diff... now it works... thanks (should the update be less manual ?)

[iamhopaul123]

You don't necessarily need to start a new pipeline. Instead, you can just update the version you'd like to use for the build stage at the buildspec.yaml file. For example:

version: 0.2
phases:
  install:
    commands:
      - echo "cd into $CODEBUILD_SRC_DIR"
      - cd $CODEBUILD_SRC_DIR
      # Download the copilot linux binary.
      - wget -q https://ecs-cli-v2-release.s3.amazonaws.com/copilot-linux-v1.32.1 -O copilot-linux
      - chmod +x ./copilot-linux

[nandubatchu]

Thanks @iamhopaul123

• I upgrade the copilot app to 1.32.1
• I upgraded the cli version used in the build pipeline (buildspec.yml) to 1.32.1
• Redeployed the pipeline

This fixed my issue! 👍