In order to keep your application(s) more secure, this plugin only uses temporary credentials via STS, scoped to each application. To set this up:

  1. Log into the AWS Management Console, and navigate to the Identity and Access Management console.
  2. Click on Roles, then click Create New Role.
  3. Give an appropriate name for this role (for example, "JenkinsCodePipelineProject").
  4. In the "Select Role Type" screen, click "Role for Cross-Account Access" then select Allows IAM users from a 3rd party AWS account to access this account.
  5. The account and external IDs for this Jenkins project are listed below
  6. In the policy screen, select Custom Policy and copy-paste the following policy:
    • {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["codepipeline:PollForJobs", "codepipeline:AcknowledgeJob", "codepipeline:PutJobSuccessResult", "codepipeline:PutJobFailureResult", "codepipeline:GetJobDetails"], "Resource": "*"}]}
  7. Click Create Role, then copy-paste the Role ARN into the below field.
  8. Click the Test Connection button to ensure that the permissions are set up properly.