Bitbucket Pipe Authentication Failed - Missing Cloud Credentials
A pipe that talks to a cloud provider was rejected at authentication - the credential variables it needs are unset, wrong, or lack permission for the action it performs.
What this error means
A deploy/upload pipe fails with an access-denied or unauthorized error from the cloud provider, not a missing-variable error from the pipe itself. The credentials are present but invalid or under-scoped.
An error occurred (AccessDenied) when calling the PutObject
operation: Access Denied
✖ Deployment failed (pipe: atlassian/aws-s3-deploy:x.y.z)Common causes
Credentials missing or wrong
The pipe’s cloud credential variables (keys, or an OIDC role) are unset, point at the wrong account, or were rotated without updating the secured variables.
Credential lacks permission for the action
The credential authenticates but the IAM/role policy does not allow the specific operation (write to the bucket, deploy to the service), so the cloud returns access denied.
How to fix it
Provide valid credentials as secured variables
Set the pipe’s required cloud credentials as secured variables, or use OIDC for keyless auth.
- step:
oidc: true
script:
- pipe: atlassian/aws-s3-deploy:1.1.0
variables:
AWS_OIDC_ROLE_ARN: $AWS_ROLE_ARN
S3_BUCKET: 'my-bucket'
LOCAL_PATH: 'dist'Grant the action permission
- Confirm the credential/role policy allows the exact operation the pipe performs.
- Check the credential targets the intended account and region.
- Rotate and update the secured variable if the credential was revoked.
How to prevent it
- Store pipe credentials as secured variables; never inline them.
- Scope the credential/role to exactly the deploy action needed.
- Prefer OIDC role assumption to avoid stored cloud keys.