Deployment variable is not reflecting in pipelines
Asked by Jaisa Ram:

I am using bitbucket pipeline to deploy using S3 deploy and for invalidation of by using **aws-cloudfront-invalidate**.

I have declared some variables at repository level and some at deployment environment level.

Here:

DISTRIBUTION_ID is a part deployment variable and during the run pipeline it is throwing error (DISTRIBUTION_ID can be a null) while invalidation pipe.

When I move DISTRIBUTION_ID to repository level variable, it is working.

I am using latest version of both pipes.


Answers:
author: Halyna Berezovska
body: [@Jaisa Ram](/t5/user/viewprofilepage/user-id/4113937) can you provide the code of your pipeline? To use deployment variables you need to put the keyword to pipeline, sth like as

name: Deploy

deployment: production

BUT be aware that deployment variables overwrites repository ones.

For more details see docs:

<https://support.atlassian.com/bitbucket-cloud/docs/variables-and-secrets/>

Regards, Galyna

comments: author: Jaisa Ram
body: Thanks [@Halyna Berezovska](/t5/user/viewprofilepage/user-id/3865505) , it works after updating deployment keyword


author: Jaisa Ram
body: related to <https://jira.atlassian.com/browse/BCLOUD-18261>


author: Fernando Silva Maransatto
body: Hi, [@Halyna Berezovska](/t5/user/viewprofilepage/user-id/3865505)   
I'm using the same deployment variables that I'm using with the previous pipe (aws-s3-deploy) but It shows me the following errors:  

`? Validation errors:`  
`AWS_ACCESS_KEY_ID:``- null value not allowed`  
`AWS_SECRET_ACCESS_KEY:``- null value not allowed`  
`DISTRIBUTION_ID:``- null value not allowed`  

I had the same problem and I tried to fixed it using by moving all the variables to the repository settings.  

Shouldn't **aws-cloudfront-invalidate** accept the deployment variables such as **was-s3-deploy** does?  

The issue now is that it shows me the following error:  

`ERROR: Error creating a cloudfront invalidation`  

`? Failed to create a cloudfront invalidation: An error occurred (AccessDenied) when calling the CreateInvalidation operation: User: arn:aws:iam::<iam>:user/Bitbucket is not authorized to perform: cloudfront:CreateInvalidation on resource: arn:aws:cloudfront::<iam>:distribution/<distribution_id>`  


author: Halyna Berezovska
body: [@Jaisa Ram](/t5/user/viewprofilepage/user-id/4113937) regarding the last question, why if failed - the user you use in s3 and cloudfront, do not have permissions to execute Cloudfront actions. To fix this, you have to change policy (any permissions attached, inline policy etc.) attached to this user or create another user specific for cloudfront.

Could you also tell more details about using Cloudfront as second pipe with default variables feature without passing aws keys as variables (I susoect you're using this)? We need to understand the root cause why it is not working for you.

Also feel free to use our new [Bitbucket pipelines oidc feature](https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/) , where you can authenticate without using any aws keys. Example of how to use it can be found [here](https://bitbucket.org/atlassian/aws-cloudfront-invalidate/src/master/README.md) in the first Advanced example .

Regards, Galyna


Tags: bitbucket-pipelines

aws

cloud