The Misleading "User is not authorized to access connection" Error in AWS CodeBuild — and Why Your IAM Policy Looks Fine

AWS CodeBuild’s “User is not authorized to access connection” error usually points to the project service role, not the human caller.

The most common fix is granting the service role CodeConnections `GetConnectionToken` permission.

Another hidden cause is scoping CodeConnections list actions like `ListConnections` or `ListInstallationTargets` to a connection ARN instead of `*`.

Both permission mistakes can surface as the same misleading authorization failure, slowing down build setup and troubleshooting.