Aws-codebuild-docker-images: codebuild_build.sh -c doesn't seem to be passing AWS credentials in

[rascalking]

Hi, I've had good luck with local builds so far, but have run into an issue once I tried using a buildspec with a parameter-store variable in it.

Here's the ~/.aws contents, and the buildspec in question.

$ cat .aws/config
[default]
region = us-west-2
output = json
$ cat .aws/credentials
[default]
aws_access_key_id = <ACCESS_KEY_ID>
aws_secret_access_key = <SECRET_ACCESS_KEY>
$ cat buildspec-test.yml
---
version: 0.2

env:
  parameter-store:
    PIP_EXTRA_INDEX_URL: "/CodeBuild/pip-extra-index-url"

phases:
  install:
    commands:
      # for pyenchant
      - apt-get update
      - apt-get install -y libenchant-dev
  pre_build:
    commands:
      - pip install virtualenv
      - virtualenv venv
      - venv/bin/pip install -r webapp/requirements.txt -r webapp/test_requirements.txt
  build:
    commands:
      - echo Tests started on `date`
      - venv/bin/python -m unittest discover
  post_build:
    commands:
      - echo Tests completed on `date`
...

But if I run it, I get a MissingRegion error:

$ codebuild_build.sh -i aws/codebuild/python:2.7.12 -a $SCRATCH/test-artifacts -s $SCRATCH/build -b $SCRATCH/build/buildspec-test.yml -c
Build Command:

docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=aws/codebuild/python:2.7.12" -e "ARTIFACTS=/Users/bonnerd/tmp/test-artifacts" -e "SOURCE=/Users/bonnerd/tmp/build" -e "BUILDSPEC=/Users/bonnerd/tmp/build/buildspec-test.yml" -e "AWS_CONFIGURATION=/Users/bonnerd/.aws" amazon/aws-codebuild-local:latest

Retry 1/3 to get agent ID
Removing agentresources_build_1 ... done
Removing agentresources_agent_1 ... done
Removing network agentresources_default
Removing volume agentresources_user_volume
Removing volume agentresources_source_volume
Creating network "agentresources_default" with the default driver
Creating volume "agentresources_user_volume" with local driver
Creating volume "agentresources_source_volume" with local driver
Creating agentresources_agent_1 ...
Creating agentresources_agent_1 ... done
Creating agentresources_build_1 ...
Creating agentresources_build_1 ... done
Attaching to agentresources_agent_1, agentresources_build_1
agent_1  | [Container] 2018/10/02 19:15:25 Waiting for agent ping
agent_1  | [Container] 2018/10/02 19:15:26 Waiting for DOWNLOAD_SOURCE
agent_1  | [Container] 2018/10/02 19:15:27 Phase is DOWNLOAD_SOURCE
agent_1  | [Container] 2018/10/02 19:15:27 CODEBUILD_SRC_DIR=/codebuild/output/src640571178/src
agent_1  | [Container] 2018/10/02 19:15:27 YAML location is /codebuild/output/src640571178/src/buildspec-test.yml
agent_1  | [Container] 2018/10/02 19:15:27 Processing environment variables
agent_1  | [Container] 2018/10/02 19:15:27 Decrypting parameter store environment variables
agent_1  | [Container] 2018/10/02 19:15:27 Phase complete: DOWNLOAD_SOURCE Success: false
agent_1  | [Container] 2018/10/02 19:15:27 Phase context status code: Decrypted Variables Error Message: MissingRegion: could not find region configuration
agent_1  | [Container] 2018/10/02 19:15:27 Runtime error (*awserr.baseError: MissingRegion: could not find region configuration)
agentresources_build_1 exited with code 255

Which, fine, I can just set AWS_REGION and try again.

$ export AWS_REGION=us-west-2
$ codebuild_build.sh -i aws/codebuild/python:2.7.12 -a $SCRATCH/test-artifacts -s $SCRATCH/build -b $SCRATCH/build/buildspec-test.yml -c
Build Command:

docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=aws/codebuild/python:2.7.12" -e "ARTIFACTS=/Users/bonnerd/tmp/test-artifacts" -e "SOURCE=/Users/bonnerd/tmp/build" -e "BUILDSPEC=/Users/bonnerd/tmp/build/buildspec-test.yml" -e "AWS_CONFIGURATION=/Users/bonnerd/.aws" -e "AWS_REGION=us-west-2" amazon/aws-codebuild-local:latest

Retry 1/3 to get agent ID
Removing agentresources_build_1 ... done
Removing agentresources_agent_1 ... done
Removing network agentresources_default
Removing volume agentresources_user_volume
Removing volume agentresources_source_volume
Creating network "agentresources_default" with the default driver
Creating volume "agentresources_user_volume" with local driver
Creating volume "agentresources_source_volume" with local driver
Creating agentresources_agent_1 ...
Creating agentresources_agent_1 ... done
Creating agentresources_build_1 ...
Creating agentresources_build_1 ... done
Attaching to agentresources_agent_1, agentresources_build_1
agent_1  | [Container] 2018/10/02 19:19:36 Waiting for agent ping
agent_1  | [Container] 2018/10/02 19:19:37 Waiting for DOWNLOAD_SOURCE
agent_1  | [Container] 2018/10/02 19:19:37 Phase is DOWNLOAD_SOURCE
agent_1  | [Container] 2018/10/02 19:19:37 CODEBUILD_SRC_DIR=/codebuild/output/src774051140/src
agent_1  | [Container] 2018/10/02 19:19:37 YAML location is /codebuild/output/src774051140/src/buildspec-test.yml
agent_1  | [Container] 2018/10/02 19:19:37 Processing environment variables
agent_1  | [Container] 2018/10/02 19:19:37 Decrypting parameter store environment variables
agent_1  | [Container] 2018/10/02 19:21:38 Phase complete: DOWNLOAD_SOURCE Success: false
agent_1  | [Container] 2018/10/02 19:21:38 Phase context status code: Decrypted Variables Error Message: UnrecognizedClientException: The security token included in the request is invalid.
agent_1  |      status code: 400, request id: e518e705-1bb0-4d8c-8ed6-b84a355f9c06
agent_1  | [Container] 2018/10/02 19:21:38 Runtime error (*awserr.requestError: UnrecognizedClientException: The security token included in the request is invalid.
agent_1  |      status code: 400, request id: e518e705-1bb0-4d8c-8ed6-b84a355f9c06)
agentresources_build_1 exited with code 255
Aborting on container exit...

And even setting the AWS credentials as environment variables gets the same UnrecognizedClientException:

$ export AWS_ACCESS_KEY_ID=<ACCESS_KEY_ID>
$ export AWS_SECRET_ACCESS_KEY=<SECRET_ACCESS_KEY>
$ codebuild_build.sh -i aws/codebuild/python:2.7.12 -a $SCRATCH/test-artifacts -s $SCRATCH/build -b $SCRATCH/build/buildspec-test.yml -c
Build Command:

docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=aws/codebuild/python:2.7.12" -e "ARTIFACTS=/Users/bonnerd/tmp/test-artifacts" -e "SOURCE=/Users/bonnerd/tmp/build" -e "BUILDSPEC=/Users/bonnerd/tmp/build/buildspec-test.yml" -e "AWS_CONFIGURATION=/Users/bonnerd/.aws" -e "AWS_SECRET_ACCESS_KEY=********" -e "AWS_REGION=us-west-2" -e "AWS_ACCESS_KEY_ID=<ACCESS_KEY_ID>" amazon/aws-codebuild-local:latest

Retry 1/3 to get agent ID
Removing agentresources_build_1 ... done
Removing agentresources_agent_1 ... done
Removing network agentresources_default
Removing volume agentresources_user_volume
Removing volume agentresources_source_volume
Creating network "agentresources_default" with the default driver
Creating volume "agentresources_user_volume" with local driver
Creating volume "agentresources_source_volume" with local driver
Creating agentresources_agent_1 ...
Creating agentresources_agent_1 ... done
Creating agentresources_build_1 ...
Creating agentresources_build_1 ... done
Attaching to agentresources_agent_1, agentresources_build_1
agent_1  | [Container] 2018/10/02 19:10:54 Waiting for agent ping
agent_1  | [Container] 2018/10/02 19:10:55 Waiting for DOWNLOAD_SOURCE
agent_1  | [Container] 2018/10/02 19:10:56 Phase is DOWNLOAD_SOURCE
agent_1  | [Container] 2018/10/02 19:10:56 CODEBUILD_SRC_DIR=/codebuild/output/src440440671/src
agent_1  | [Container] 2018/10/02 19:10:56 YAML location is /codebuild/output/src440440671/src/buildspec-test.yml
agent_1  | [Container] 2018/10/02 19:10:56 Processing environment variables
agent_1  | [Container] 2018/10/02 19:10:56 Decrypting parameter store environment variables
agent_1  | [Container] 2018/10/02 19:12:57 Phase complete: DOWNLOAD_SOURCE Success: false
agent_1  | [Container] 2018/10/02 19:12:57 Phase context status code: Decrypted Variables Error Message: UnrecognizedClientException: The security token included in the request is invalid.
agent_1  |      status code: 400, request id: 7c662e77-76ce-4b24-a25f-1d2476c69a37
agent_1  | [Container] 2018/10/02 19:12:57 Runtime error (*awserr.requestError: UnrecognizedClientException: The security token included in the request is invalid.
agent_1  |      status code: 400, request id: 7c662e77-76ce-4b24-a25f-1d2476c69a37)
agentresources_build_1 exited with code 255
Aborting on container exit...

I think I've eliminated the possibility that the credentials being passed in don't have rights to get that parameter:

$ aws ssm get-parameter --name /CodeBuild/pip-extra-index-url --with-decryption
{
    "Parameter": {
        "Name": "/CodeBuild/pip-extra-index-url",
        "Type": "SecureString",
        "Value": "<SECRET_VALUE>",
        "Version": 1,
        "LastModifiedDate": 1538422813.086,
        "ARN": "arn:aws:ssm:us-west-2:115600984895:parameter/CodeBuild/pip-extra-index-url"
    }
}

Without any verbose mode, I don't see how I can troubleshoot this, short of building modified amazon/aws-codebuild-local and aws/codebuild/python containers. I've made sure I have the most recent version of both containers, and of codebuild_build.sh.

[josephvusich]

Hi @rascalking , thanks for bringing this to our attention.

[awszhen]

Hi @rascalking , this is resolved in the latest version of the local agent. SHA: 26a6aec5a710fa40eb3433a20b50a72bdbfa1801a34cc52fee8bdf913f779a0d

[rascalking]

Works great. Thanks!

[nickstares]

Hi, I am getting this exact issue running the latest local agent,
17230d017b97ea06054b93209230943add0c2bc3b888ab565dbbd9368f77bacc

codebuild-build -i custom/build -s ./public-ui -a ./public-ui/target -e .env -c -l amazon/aws-codebuild-local:latest
Build Command:

docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=custom/build" -e "ARTIFACTS=/Users/nick/custom/public-ui/target" -e "SOURCE=/Users/nick/custom/public-ui" -v "/Users/nick/custom:/LocalBuild/envFile/" -e "ENV_VAR_FILE=.env" -e "LOCAL_AGENT_IMAGE_NAME=amazon/aws-codebuild-local:latest" -e "AWS_CONFIGURATION=/Users/nick/.aws" -e "AWS_PROFILE=custom" -e "INITIATOR=nick" amazon/aws-codebuild-local:latest

Removing agent-resources_build_1 ... done
Removing agent-resources_agent_1 ... done
Removing network agent-resources_default
Removing volume agent-resources_source_volume
Removing volume agent-resources_user_volume
Creating network "agent-resources_default" with the default driver
Creating volume "agent-resources_source_volume" with local driver
Creating volume "agent-resources_user_volume" with local driver
Creating agent-resources_agent_1 ... done
Creating agent-resources_build_1 ... done
Attaching to agent-resources_agent_1, agent-resources_build_1
agent_1  | [Container] 2019/01/16 17:06:11 Waiting for agent ping
agent_1  | [Container] 2019/01/16 17:06:12 Waiting for DOWNLOAD_SOURCE
agent_1  | [Container] 2019/01/16 17:06:22 Phase is DOWNLOAD_SOURCE
agent_1  | [Container] 2019/01/16 17:06:22 CODEBUILD_SRC_DIR=/codebuild/output/src057885015/src
agent_1  | [Container] 2019/01/16 17:06:22 YAML location is /codebuild/output/src057885015/src/buildspec.yml
agent_1  | [Container] 2019/01/16 17:06:22 Processing environment variables
agent_1  | [Container] 2019/01/16 17:06:22 Decrypting parameter store environment variables
agent_1  | [Container] 2019/01/16 17:06:23 Phase complete: DOWNLOAD_SOURCE Success: false
agent_1  | [Container] 2019/01/16 17:06:23 Phase context status code: Decrypted Variables Error Message: UnrecognizedClientException: The security token included in the request is invalid.
agent_1  |  status code: 400, request id: b855efa6-f3b5-42fc-b210-1afe79cc4301
agent_1  | [Container] 2019/01/16 17:06:23 Runtime error (*awserr.requestError: UnrecognizedClientException: The security token included in the request is invalid.
agent_1  |  status code: 400, request id: b855efa6-f3b5-42fc-b210-1afe79cc4301)
agent-resources_build_1 exited with code 255
Aborting on container exit...

If I remove my parameter-store reference then this issue does not occur.

[irishgordo]

@nickstares - seeing the same thing as well

[mikesigs]

Also seeing this.

[ryanpodonnell1]

still seeing this for the parameter store declaration in the buildspec.yml

agent_1  | [Container] 2020/05/26 18:11:33 Phase context status code: Decrypted Variables Error Message: MissingRegion: could not find region configuration
agent_1  | [Container] 2020/05/26 18:11:33 Runtime error (*clienterr.PhaseContextError: MissingRegion: could not find region configuration)
agent-resources_build_1 exited with code 11
Aborting on container exit...

./aws-codebuild-docker-images/local_builds/codebuild_build.sh -i <account>.dkr.ecr.us-east-1.amazonaws.com/ubuntu18_04_codebuild:latest -e environment.txt -a ./output -c -l amazon/aws-codebuild-local:latest

buildspec.yml

  parameter-store:
    TOKEN: /pipeline-params/<redacted>
    USER: /pipeline-params/<redacted>

env vars:

└─▪ env | grep AWS
AWS_SDK_LOAD_CONFIG=1
AWS_PROFILE=<profile>
AWS_DEFAULT_REGION=us-east-1

[josemgloc-n]

Same here

[awszhen]

@ryanpodonnell1 @josemgloc-n , I can not reproduce this issue on my end using latest local agent image.
You need to export AWS_REGION environment variable and env | grep AWS command should show AWS_REGION value.
Or you can set region in ~/.aws/config as https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html.

[josemgloc-n]

My env:

$ head ~/.aws/config
[default]
output = json
region = us-east-1

My AWS config:

$ env | grep AWS
AWS_REGION=us-east-1

Log

$ ./codebuild_build.sh -i node:10.16.3 -a tmp -p test
Build Command:

docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=node:10.16.3" -e "ARTIFACTS=/Users/test/Code/test/tmp" -e "SOURCE=/Users/test/Code/test" -e "INITIATOR=test" amazon/aws-codebuild-local:latest

Removing agent-resources_build_1 ... done
Removing agent-resources_agent_1 ... done
Removing network agent-resources_default
Removing volume agent-resources_source_volume
Removing volume agent-resources_user_volume
Creating network "agent-resources_default" with the default driver
Creating volume "agent-resources_source_volume" with local driver
Creating volume "agent-resources_user_volume" with local driver
Creating agent-resources_agent_1 ... done
Creating agent-resources_build_1 ... done
Attaching to agent-resources_agent_1, agent-resources_build_1
agent_1  | [Container] 2020/06/20 07:50:15 Waiting for agent ping
agent_1  | [Container] 2020/06/20 07:50:17 Waiting for DOWNLOAD_SOURCE
agent_1  | [Container] 2020/06/20 07:50:21 Phase is DOWNLOAD_SOURCE
agent_1  | [Container] 2020/06/20 07:50:21 CODEBUILD_SRC_DIR=/codebuild/output/src909946817/src
agent_1  | [Container] 2020/06/20 07:50:21 YAML location is /codebuild/output/srcDownload/src/buildspec.yml
agent_1  | [Container] 2020/06/20 07:50:21 No commands found for phase name: install
agent_1  | [Container] 2020/06/20 07:50:21 Processing environment variables
agent_1  | [Container] 2020/06/20 07:50:21 Decrypting parameter store environment variables
agent_1  | [Container] 2020/06/20 07:50:21 Phase complete: DOWNLOAD_SOURCE State: FAILED
agent_1  | [Container] 2020/06/20 07:50:21 Phase context status code: Decrypted Variables Error Message: MissingRegion: could not find region configuration
agent_1  | [Container] 2020/06/20 07:50:21 Runtime error (*clienterr.PhaseContextError: MissingRegion: could not find region configuration)
agent-resources_build_1 exited with code 11
Aborting on container exit...

Thanks.

[awszhen]

@josemgloc-n , you need to use this command ./codebuild_build.sh -i node:10.16.3 -a tmp -c to pass AWS credentials to the local agent. And the -p option is used to switch your AWS credentials profile. Please refer to https://github.com/aws/aws-codebuild-docker-images/blob/master/local_builds/README.md.

[josemgloc-n]

Thanks @awszhen . Now the error is other
agent_1 | [Container] 2020/06/20 21:57:55 Decrypting parameter store environment variables agent_1 | [Container] 2020/06/20 21:57:56 Phase complete: DOWNLOAD_SOURCE State: FAILED agent_1 | [Container] 2020/06/20 21:57:56 Phase context status code: Decrypted Variables Error Message: UnrecognizedClientException: The security token included in the request is invalid. agent_1 | status code: 400, request id: 2fabd89e-4ab9-4e5a-9d43-3177a765436c agent_1 | [Container] 2020/06/20 21:57:56 Runtime error (*clienterr.PhaseContextError: UnrecognizedClientException: The security token included in the request is invalid. agent_1 | status code: 400, request id: 2fabd89e-4ab9-4e5a-9d43-3177a765436c) agent-resources_agent_1 exited with code 0 Aborting on container exit...

[awszhen]

@josemgloc-n , this error means that the AWS credentials you provided for the local agent is not correct. Please try to use one of the following methods:
(1) Export AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN and AWS_REGION in your local environment and then try to run the local agent again.
(2) Make sure your can actually use the credentials in ~/.aws to call GetParameters to retrieve your parameters value. And remove AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN and AWS_REGION from your local environment because AWS_* in the local environment will override the credentials specified in ~/.aws.

[josemgloc-n]

Hi @awszhen . Thanks for your support but I still get the same error.

1st OPTION
I use "Cross-Account Access" with Role in my .aws/credentials file

[test]
role_arn = arn:aws:iam::XXXXXXXXXXX:role/CrossAdminRoleName
source_profile = default

2nd OPTION

$ aws ssm get-parameter --name test --profile test
{
    "Parameter": {
        "Name": "account",
        "Type": "String",
        "Value": "test",
        "Version": 1,
        "LastModifiedDate": "2020-06-18T14:56:26.393000+02:00",
        "ARN": "arn:aws:ssm:us-east-1:XXXXXXXXXXX:parameter/account",
        "DataType": "text"
    }
}

$ ./codebuild_build.sh -i node:10.16.3 -a tmp -c -p test
Build Command:

docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=node:10.16.3" -e "ARTIFACTS=/Users/user/Code/github.n/trogen/tmp" -e "SOURCE=/Users/user/Code/github.n/trogen" -e "AWS_CONFIGURATION=/Users/user/.aws" -e "AWS_PROFILE=test" -e "INITIATOR=user" amazon/aws-codebuild-local:latest

Removing agent-resources_build_1 ... done
Removing agent-resources_agent_1 ... done
Removing network agent-resources_default
Removing volume agent-resources_source_volume
Removing volume agent-resources_user_volume
Creating network "agent-resources_default" with the default driver
Creating volume "agent-resources_source_volume" with local driver
Creating volume "agent-resources_user_volume" with local driver
Creating agent-resources_agent_1 ... done
Creating agent-resources_build_1 ... done
Attaching to agent-resources_agent_1, agent-resources_build_1
agent_1  | [Container] 2020/06/21 07:28:48 Waiting for agent ping
agent_1  | [Container] 2020/06/21 07:28:49 Waiting for DOWNLOAD_SOURCE
agent_1  | [Container] 2020/06/21 07:28:57 Phase is DOWNLOAD_SOURCE
agent_1  | [Container] 2020/06/21 07:28:57 CODEBUILD_SRC_DIR=/codebuild/output/src004997630/src
agent_1  | [Container] 2020/06/21 07:28:57 YAML location is /codebuild/output/srcDownload/src/buildspec.yml
agent_1  | [Container] 2020/06/21 07:28:57 No commands found for phase name: install
agent_1  | [Container] 2020/06/21 07:28:57 Processing environment variables
agent_1  | [Container] 2020/06/21 07:28:57 Decrypting parameter store environment variables
agent_1  | [Container] 2020/06/21 07:28:57 Phase complete: DOWNLOAD_SOURCE State: FAILED
agent_1  | [Container] 2020/06/21 07:28:57 Phase context status code: Decrypted Variables Error Message: UnrecognizedClientException: The security token included in the request is invalid.
agent_1  |  status code: 400, request id: 5b8cf321-4742-4a71-8542-a3f79c3bd30d
agent_1  | [Container] 2020/06/21 07:28:57 Runtime error (*clienterr.PhaseContextError: UnrecognizedClientException: The security token included in the request is invalid.
agent_1  |  status code: 400, request id: 5b8cf321-4742-4a71-8542-a3f79c3bd30d)
agent-resources_build_1 exited with code 11
Aborting on container exit...

$ env | grep AWS

$ head buildspec.yml
version: 0.2

env:
  parameter-store:
    ENVIRONMENT: test

phases:
  install:
    runtime-versions:
      nodejs: 10

[awszhen]

Hi @josemgloc-n , we do not support using AWS IAM Role in credentials file currently. Please specify aws_access_key_id and aws_secret_access_key in credentials file. Thanks!

Example credentials and config files:

~/.aws/credentials

[default]
aws_access_key_id=AKIAIOSFODNN7EXAMPLE
aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

~/.aws/config

[default]
region=us-west-2
output=json

[josemgloc-n]

I must wait until IAM role will be supported. Thank you @awszhen .

[dls314]

I must wait until IAM role will be supported. Thank you @awszhen .

Using IAM roles in our aws cli config is also essential, but I'm able to somewhat work around the support issue by assuming a role and exporting the AWS_* variables before running local build.

Still some problems that result in the OP's Runtime error (*awserr.baseError: MissingRegion: could not find region configuration) type error if I use certain CodeBuild features in the buildspec (notably, use of an .env.variables.parameter-store section.

If I elide that section and pass them through in an environment variables file, I can work with the assumed roll; however. This might work for you @josemgloc-n

[dls314]

When I remove .env.variables.parameter-store from my buildspec, I can build correctly, and the build is using the correct role. That build log looks like this for me

~$ (. /mnt/c/ws/bb/cloud/example-service-motd/scripts/aws-assume-role.sh --profile eng-tooling ; export AWS_DEFAULT_REGION=us-east-1 ; export AWS_REGION=us-east-1 ; /mnt/c/ws/gh/aws/aws-codebuild-docker-images/local_builds/codebuild_build.sh -i aws/codebuild/standard:4.0 -a /mnt/c/ws/bb/cloud/example-service-motd-artifacts -b /mnt/c/ws/bb/cloud/example-service-motd/build/buildspec.yml -c -m -d -e /mnt/c/ws/bb/cloud/example-service-motd/build/local.env -s /mnt/c/ws/bb/cloud/example-service-motd)
Build Command:

docker run -it -v /var/run/docker.sock:/var/run/docker.sock -e "IMAGE_NAME=aws/codebuild/standard:4.0" -e "ARTIFACTS=/mnt/c/ws/bb/cloud/example-service-motd-artifacts" -e "SOURCE=/mnt/c/ws/bb/cloud/example-service-motd" -e "BUILDSPEC=/mnt/c/ws/bb/cloud/example-service-motd/build/buildspec.yml" -v "/mnt/c/ws/bb/cloud/example-service-motd/build:/LocalBuild/envFile/" -e "ENV_VAR_FILE=local.env" -e "AWS_CONFIGURATION=/home/dave/.aws" -e "AWS_SECRET_ACCESS_KEY=********" -e "AWS_DEFAULT_REGION=us-east-1" -e "AWS_REGION=us-east-1" -e "AWS_SESSION_TOKEN=********" -e "AWS_ACCESS_KEY_ID=ASIAZXWCWRLSSVEKDS6Z" -e "MOUNT_SOURCE_DIRECTORY=TRUE" -e "DOCKER_PRIVILEGED_MODE=TRUE" -e "INITIATOR=dave" amazon/aws-codebuild-local:latest

Stopping agent-resources_build_1 ... done
Stopping agent-resources_agent_1 ... done
Removing agent-resources_build_1 ... done
Removing agent-resources_agent_1 ... done
Removing network agent-resources_default
Removing volume agent-resources_source_volume
Removing volume agent-resources_user_volume
Creating network "agent-resources_default" with the default driver
Creating volume "agent-resources_source_volume" with local driver
Creating volume "agent-resources_user_volume" with local driver
Creating agent-resources_agent_1 ... done
Creating agent-resources_build_1 ... done
Attaching to agent-resources_agent_1, agent-resources_build_1
agent_1  | [Container] 2020/06/25 21:50:11 Waiting for agent ping
agent_1  | [Container] 2020/06/25 21:50:13 Waiting for DOWNLOAD_SOURCE
agent_1  | [Container] 2020/06/25 21:50:13 Phase is DOWNLOAD_SOURCE
agent_1  | [Container] 2020/06/25 21:50:13 CODEBUILD_SRC_DIR=/codebuild/output/src059042329/src
agent_1  | [Container] 2020/06/25 21:50:13 YAML location is /codebuild/output/srcDownload/src/build/buildspec.yml
agent_1  | [Container] 2020/06/25 21:50:13 Processing environment variables
agent_1  | [Container] 2020/06/25 21:50:13 Running command echo "Installing Node.js version 10 ..."
agent_1  | Installing Node.js version 10 ...
agent_1  |
agent_1  | [Container] 2020/06/25 21:50:13 Running command n $NODE_10_VERSION
agent_1  |    installed : v10.21.0 (with npm 6.14.4)
agent_1  | 
agent_1  | [Container] 2020/06/25 21:50:14 Moving to directory /codebuild/output/src059042329/src
agent_1  | [Container] 2020/06/25 21:50:14 Registering with agent
agent_1  | [Container] 2020/06/25 21:50:14 Phases found in YAML: 4
agent_1  | [Container] 2020/06/25 21:50:14  INSTALL: 6 commands
agent_1  | [Container] 2020/06/25 21:50:14  PRE_BUILD: 6 commands
agent_1  | [Container] 2020/06/25 21:50:14  BUILD: 12 commands
agent_1  | [Container] 2020/06/25 21:50:14  POST_BUILD: 6 commands
agent_1  | [Container] 2020/06/25 21:50:14 Phase complete: DOWNLOAD_SOURCE State: SUCCEEDED
agent_1  | [Container] 2020/06/25 21:50:14 Phase context status code:  Message:
agent_1  | [Container] 2020/06/25 21:50:14 Entering phase INSTALL
agent_1  | [Container] 2020/06/25 21:50:14 Running command echo $(aws sts get-caller-identity)
agent_1  | { "UserId": "AROA*****************:codebuild-developer-session", "Account": "************", "Arn": "arn:aws:sts::************:assumed-role/codebuild-developer/codebuild-developer-ses

If I have .env.variables.parameter-store in my buildspec, I get the same error mentioned in the OP Runtime error (*awserr.baseError: MissingRegion: could not find region configuration)

The environment file that is passed in _also_ contains the region (and it shows in the output above from the environment)

[josemgloc-n]

If I elide that section and pass them through in an environment variables file, I can work with the assumed roll; however. This might work for you @josemgloc-n

Thanks @dls314 , but I need role and parameter-store config.

[rl-michaelbrandeis]

@awszhen I am also getting the same issue. It looks like amazon/aws-codebuild-local:latest is not properly assuming roles to look up ssm parameters.

If the buildspec has a parameter-store section and you use -c -p <profile> it generates "clienterr.PhaseContextError: MissingRegion" before starting codebuild.

If you remove the parameter-store section it will start codebuild, and the codebuild commands will run with the -p <profile> role and can look up the parameters.

The ~/.aws/config has profiles defined with iam roles like

[default]
region = us-east-1

[profile test]
role_arn = arn:aws:iam::*****:role/example
source_profile = default

The buildspec looks like

version: 0.2

env:
  # amazon/aws-codebuild-local:latest  FAILS TO START
  parameter-store:
    PARAMETER_NAME: TestParameter
  variables:
    VAR_NAME: example

phases:
  install:
    runtime-versions:
      python: 3.7
    commands:
      - env
      - aws sts get-caller-identity
  build:
    commands:
      # REMOVE PARAMETER STORE AND THIS WORKS FINE
      - aws ssm get-parameter --name TestParameter

Update: To the comment about using AWS_ACCESS_KEY_ID, etc, that doesn't work either. It could be due to aws-mfa, but passing in the identity results in the invalid client error. The point here is that the codebuild-local image is doing something unique that does not affect the aws cli, boto3, aws-sdk, aws-mfa, or any other tool. This appears to be directly related to codebuild-local not handling parameter-store credentials correctly.

[awszhen]

@josemgloc-n @dls314 @rl-michaelbrandeis this is resolved in the latest version of the local agent. SHA: 78f5c1a205604c39cd8c797fd8447f590428c0908ba1fbdbd3dcf8712af5e325. Please let us know if you still face the same issue.

[josemgloc-n]

Now its working :) . Thank you very much @awszhen .