Unable to clone AWS CodeCommit with IAM Role

Question

I have following settings with my ec2 instance, but no luck.

And there is a same issue on aws forum but no answer.

~/.gitconfig:

[credential]
        helper = !aws --region us-east-1 codecommit credential-helper $@
        UseHttpPath = true

IAM Role Policy for the EC2 Instance:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "codecommit:*"
      ],
      "Resource": "*"
    }
  ]
}

Then following code works:

echo -e "protocol=https\npath=/v1/repos/my-repo\nhost=git-codecommit.us-east-1.amazonaws.com" | aws --region us-east-1 codecommit credential-helper get

However, with git, it doesn't.

git clone https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo
Cloning into 'my-repo'...
fatal: unable to access 'https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo/': The requested URL returned error: 403

Any ideas?

UPDATE

After some investigation, I figure out that attached IAM Role doesn't work git operation, but IAM User worked fine.

| Type                               | list-repositories | credential-helper | git operation |
| IAM User with CodeCommitFullAccess | OK                | OK                | OK            |
| IAM Role with CodeCommitFullAccess | OK                | OK                | NG            |

Tries following command:

list-repositories

aws codecommit list-repositories
credential-helper

echo -e "protocol=http\npath=/v1/repos/my-repo\nhost=git-codecommit.us-east-1.amazonaws.com" | aws --region=us-east-1 codecommit credential-helper get
git operation

git clone --config credential.helper='!aws --region=us-east-1 codecommit credential-helper $@' --config credential.UseHttpPath=true https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo

my awscli version is following:

$ aws --version
aws-cli/1.10.44 Python/2.7.5 Linux/3.10.0-327.10.1.el7.x86_64 botocore/1.4.34

Update2

My git and curl version is as following:

$ git --version
git version 1.8.3.1
$ curl --version
curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.19.1 Basic ECC zlib/1.2.7 libidn/1.28 libssh2/1.4.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz

What OS are you using? – Wade Matveyenko Jul 06 '16 at 21:58 — Wade Matveyenko, Jul 06 '16 at 21:58
I'm using CentOS7. But I don't think that the matter. – cynipe Jul 07 '16 at 15:52 — cynipe, Jul 07 '16 at 15:52
What version of git and curl are you using? – Wade Matveyenko Jul 08 '16 at 16:48 — Wade Matveyenko, Jul 08 '16 at 16:48
@WadeMatveyenko Added in the very last of the post. – cynipe Jul 11 '16 at 06:29 — cynipe, Jul 11 '16 at 06:29

score 2 · Accepted Answer · answered Jul 14 '16 at 22:40

2

You need to be using at least curl 7.33 or later. From the CodeCommit documentation:

AWS CodeCommit requires curl 7.33 and later. However, there is a known issue with HTTPS 
and curl update 7.41.0.

answered Jul 14 '16 at 22:40

Wade Matveyenko

4,290
1
23
27

Thank you for pointing me that!! It's fix my problem. However, CentOS7 doesn't have the curl in official repo, so need to build or get the rpms. http://serverfault.com/a/738900/265703 this post may help. – cynipe Jul 15 '16 at 04:43
1

Thanks for saving an indefinite amount of time from my life; installing curl 7.56 from source helped – progfan Nov 28 '17 at 21:25

Unable to clone AWS CodeCommit with IAM Role

Update2

1 Answers1