Running cloudformation template fails when using custom Transform in CodeBuild - aws-cloudformation

Question

One of my build steps runs a cloudformation template which has a custom transform. The transform is available in us-east-1 which is the same region in which code build is running. This same cloudformation template works when I run it with my local cli. Could you provide how to get this transform working in the code build container.
My local cli is aws-cli/1.16.223 Python/3.6.0 Windows/10 botocore/1.12.213
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.6/dist-packages/awscli/clidriver.py", line 207, in main
return command_table[parsed_args.command](remaining, parsed_args)
File "/usr/local/lib/python3.6/dist-packages/awscli/clidriver.py", line 348, in __call__
return command_table[parsed_args.operation](remaining, parsed_globals)
File "/usr/local/lib/python3.6/dist-packages/awscli/customizations/commands.py", line 187, in __call__
return self._run_main(parsed_args, parsed_globals)
File "/usr/local/lib/python3.6/dist-packages/awscli/customizations/cloudformation/deploy.py", line 295, in _run_main
parsed_args.fail_on_empty_changeset)
File "/usr/local/lib/python3.6/dist-packages/awscli/customizations/cloudformation/deploy.py", line 310, in deploy
tags=tags
File "/usr/local/lib/python3.6/dist-packages/awscli/customizations/cloudformation/deployer.py", line 227, in create_and_wait_for_changeset
self.wait_for_changeset(result.changeset_id, stack_name)
File "/usr/local/lib/python3.6/dist-packages/awscli/customizations/cloudformation/deployer.py", line 178, in wait_for_changeset
.format(ex, status, reason))
RuntimeError: Failed to create the changeset: Waiter ChangeSetCreateComplete failed: Waiter encountered a terminal failure state Status: FAILED. Reason: Failed to execute transform REDACTED::ALKSify
2019-08-21 17:03:42,717 - MainThread - awscli.clidriver - DEBUG - Exiting with rc 255
Failed to create the changeset: Waiter ChangeSetCreateComplete failed: Waiter encountered a terminal failure state Status: FAILED. Reason: Failed to execute transform REDACTED::ALKSify

Answer 1

I just run into the same issue and could solve it as follows.
You need to add the 2 following permissions to the IAM Role of your CodeBuild project.
Allow "cloudformation:CreateChangeSet" on the macro resource itself !Sub ${AWS::AccountId}::ALKSify
Allow "lambda:InvokeFunction" on the lambda function that implements the macro.
So it would look like:
BuildProjectRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service: codebuild.amazonaws.com
Action:
- "sts:AssumeRole"
Policies:
- PolicyName: codebuild
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: lambda
Effect: Allow
Action:
- "lambda:InvokeFunction"
Resource:
- !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:<MACRO FUNCTION NAME>"
- Sid: macro
Effect: Allow
Action:
- "cloudformation:CreateChangeSet"
Resource:
- !Sub "${AWS::AccountId}::<MACRO NAME>"
.... <Other Permissions>
Cheers,
Stan