CodeBuild CLIENT_ERROR: authorization failed for primary source and source version

TL;DR

Add it to the role's policy, then retry the pipeline. The role needs permission to use the CodePipeline source connection (the codestar-connections UseConnection action on the connection ARN).

Steps

1. This is an IAM problem on the CodeBuild service role, not your GitHub auth. The role needs permission to use the CodePipeline source connection (the codestar-connections UseConnection action on the connection ARN). Add it to the role's policy, then retry the pipeline. If it still fails, check that the connection itself is in Available state in the CodePipeline console; a pending or errored connection produces the same CLIENT_ERROR even with the right role policy.

When to use

You are seeing this: This is an IAM problem on the CodeBuild service role, not your GitHub auth. Use this skill when you run into "CodeBuild CLIENT_ERROR: authorization failed for primary source and source version".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #64300151 (accepted answer, 36 votes): a CodePipeline-triggered CodeBuild fails before any build runs with CLIENT_ERROR: authorization failed for primary source and source version, even though the GitHub account was authenticated. The accepted answer points to the CodePipeline troubleshooting docs: the CodeBuild service role is missing permission to use the pipeline's source connection.

Verified resolution: This is an IAM problem on the CodeBuild service role, not your GitHub auth. The role needs permission to use the CodePipeline source connection (the codestar-connections UseConnection action on the connection ARN). Add it to the role's policy, then retry the pipeline. If it still fails, check that the connection itself is in Available state in the CodePipeline console; a pending or errored connection produces the same CLIENT_ERROR even with the right role policy.

Source URL: https://stackoverflow.com/questions/64300151/aws-codebuild-failed-client-error-authorization-failed-for-primary-source-and-s