# What Controls Permissions of AWS test roles for Shippable builds?

**URL:** <https://forum.ansible.com/t/what-controls-permissions-of-aws-test-roles-for-shippable-builds/26420>\
**Category:** Ansible Developer\
**Tags:** aws\
**Created:** [January 5, 2018, 5:39am UTC](https://forum.ansible.com/t/what-controls-permissions-of-aws-test-roles-for-shippable-builds/26420 "2018-01-05T05:39:21Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ed\_C](https://avatars.discourse-cdn.com/v4/letter/e/c67d28/32.png) [@Ed\_C](https://forum.ansible.com/u/Ed_C)\
**Post date:** [January 5, 2018, 5:39am UTC](https://forum.ansible.com/t/what-controls-permissions-of-aws-test-roles-for-shippable-builds/26420/1 "2018-01-05T05:39:21Z")

</div>

Hi,

My PR previously had a passing build, but after a recent update it’s started failing with permission errors from the AWS APIs. I’d like to get this passing again but can’t work out what it is that controls the permissions granted to the AWS test roles used in the shippable builds.

Can someone point me in the right direction to get more permissions granted to the AWS test user / roles used in these builds?

Specifically, my PR is here: [https://github.com/ansible/ansible/pull/31140](https://github.com/ansible/ansible/pull/31140)

This adds a new module and the associated integration tests (which are now failing).

Someone else helpfully added a couple of elements I appear to have missed (though I’m not 100% clear on what these are used for)

1. moving the integration test to “Group 4”
2. Adding the required permissions to hacking/aws\_config/testing\_policies/compute-policy.json

The builds are now failing with the following error:

```auto
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the GetIdentityVerificationAttributes operation: User: arn:aws:sts::966509639900:assumed-role/ansible-core-ci-test-prod/prod=shippable=ansible=ansible=47642.56 is not authorized to perform: ses:GetIdentityVerificationAttributes

```

I’ve run the tests using my own AWS user with only the permissions from the compute-policy file above and they pass. So presumably that file doesn’t control the permissions granted the roles used by the build.

I’m assuming that previously my integration test was not actually running in the shippable build and the move to group 4 has enabled it, which is why I’m now getting failures.

Any help on how to update these permissions would be much appreciated.

Thanks  
Ed