How do I configure a CodePipeline source stage with a cross-account CodeCommit repository?

7 minute read

I want to configure an AWS CodePipeline source stage with a cross-account AWS CodeCommit repository.

Resolution

Note: CodeCommit isn't available to new customers. Existing CodeCommit customers can continue to use the service. For more information, see How to migrate your AWS CodeCommit repository to another Git provider.

The following resolution uses Account A for the CodeCommit repository and Account B for CodePipeline.

Create a CodeCommit repository in Account A

To create a CodeCommit repository in Account A, see Create an AWS CodeCommit repository.

Configure a cross-account role in Account A

Complete the following steps:

Open the AWS Identity and Access Management (IAM) console in Account A.
In the navigation pane, choose Roles.
Choose Create a new role, and then complete the following steps:
Choose AWS account as the trusted entity type.
Choose Another AWS account, and then enter Account B's ID.
Enter the IAM role's name, for example cross-account-access-role.

Create an IAM role with the following trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::example-account-b:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {}
        }
    ]
}

Note: Replace example-account-b with the Account B ID.

Create an AWS KMS key to use with CodePipeline in Account B

Note: You must use the AWS Key Management Service (AWS KMS) customer managed key for cross-account deployments. If you don't configure the key, then CodePipeline encrypts the objects with the default encryption and the destination account role can't decrypt the objects.

Complete the following steps:

Open the AWS KMS console in Account B.
In the navigation pane, choose Customer managed keys, and then complete the following steps:
For Key type, choose Symmetric.
For Key usage, choose Encrypt and decrypt.
Expand Advanced options, and then complete the following steps:
For Key material origin, choose KMS.
For Alias, enter your key's alias, for example cmk-key.
For Key Administrator, select the IAM identity that you want to grant key admin access to.
In the Other AWS accounts section, choose Add another AWS account.
Enter Account A's ID.
Choose Finish.

Create a CodePipeline in Account B

Complete the following steps:

Open the CodePipeline console.
Choose Create pipeline, and then name the pipeline, for example account\_B\_pipeline.
Note: The Role name text box automatically populates with the AWSCodePipelineServiceRole-ap-southeast-2-account\_B\_pipeline service role name. You can also choose an existing service role that has access to the AWS KMS key.
Expand Advanced settings, and then complete the following steps:
For Artifact store, choose Default location. If needed, you can choose Custom location.
For Encryption Key, choose Customer Managed Key, and then choose cmk-key on the dropdown list.
For Source provider, choose CodeCommit.
For Repository name, enter the repository name, for example account-a-repository with the branch name as main.
On the Add build stage page, choose Skip build stage, and then choose Skip.
On the Add deploy stage page, for Deploy provider, choose a service.
Choose Next to create the pipeline.

Note: If you receive the following error message after you create the pipeline, then see the Update your pipeline to use the cross-account role section of this resolution.

Error message:

"The action failed because no AWS CodeCommit repository named account-a-repository was found. Make sure you are using the correct repository name, and then try again. Error: account-a-repository"

Update the AWS KMS usage policy in Account B

Complete the following steps:

Open the AWS KMS console in Account B.
In the Navigation pane, choose Customer managed keys.
In the table, select your key's alias, for example cmk-key.
In the Key users section, choose Add.
Enter the pipeline service role, for example AWSCodePipelineServiceRole-ap-southeast-2-account\_B\_pipeline.

Add the pipeline service role to AWS KMS key policy. The following is an example of the key policy:

{
    "Id": "key-consolepolicy-3",
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "Enable IAM User Permissions",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::example-account-b:root"
        },
        "Action": "kms:*",
        "Resource": "*"
    }, {
        "Sid": "Allow use of the key",
        "Effect": "Allow",
        "Principal": {
            "AWS": ["arn:aws:iam::example-account-b:role/example-service-role/AWSCodePipelineServiceRole-ap-southeast-2-account_B_pipeline", "arn:aws:iam::<Account_A>:root"]
        },
        "Action": ["kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey"],
        "Resource": "*"
    }, {
        "Sid": "Allow attachment of persistent resources",
        "Effect": "Allow",
        "Principal": {
            "AWS": ["arn:aws:iam::example-account-b>:role/example-service-role/AWSCodePipelineServiceRole-ap-southeast-2-Account_B_pipeline", "arn:aws:iam::example-account-a:root"]
        },
        "Action": ["kms:CreateGrant", "kms:ListGrants", "kms:RevokeGrant"],
        "Resource": "*",
        "Condition": {
            "Bool": {
                "kms:GrantIsForAWSResource": "true"
            }
        }
    }]
}

Set up the assume role policy in Account B

Complete the following steps:

Open the IAM console in Account B.
In the Navigation pane, choose Roles, and then select your pipeline role.

Add the following policy to the pipeline role that assumes Account A's role:

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": [
            "arn:aws:iam::example-account-a:example-pipeline-role/*"
        ]
    }
}

Note: Replace example-account-A with Account A and example-pipeline-role with the pipeline role.

Update the bucket policy for the CodePipeline artifact bucket in Account B

Complete the following steps:

Open the Amazon Simple Storage Service (Amazon S3) console in Account B.
In the Navigation pane, choose Buckets, and then select your pipeline bucket.
Choose Permissions, and then choose Bucket Policy.

In the text editor, update your policy to include the following policy statements:

{
    "Version": "2012-10-17",
    "Id": "example-policy-id",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": ["arn:aws:iam::example-account-a-id:root", "arn:aws:iam::example-account-b-id:root"]
            },
            "Action": [
                "s3:Get*",
                "s3:Put*"
            ],
            "Resource": "arn:aws:s3:::example-pipeline-bucket/*"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": ["arn:aws:iam::example-account-a-id:root", "arn:aws:iam::example-account-b-id:root"]
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::example-pipeline-bucket"
        }
    ]
}

Note: To correctly align with the JSON format, add a comma after the existing statements. Replace example-policy-id with your policy ID, example-account-a-id with your Account A's ID, example-account-b-id with your Account B's ID, and example-pipeline-bucket with the pipeline bucket name.

Create an inline IAM policy for Account A that grants permission to use the AWS KMS key for Account B

Complete the following steps:

Open the IAM console in Account A.
In the Navigation pane, choose Roles, and then select your cross-account-access-role.
Choose Create inline policy.

On the JSON tab, enter the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:GenerateDataKey*",
        "kms:Encrypt",
        "kms:ReEncrypt*",
        "kms:Decrypt"
      ],
      "Resource": [
        "arn:aws:kms:ap-southeast-2:example-account-b-id:key/example-key-id"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:Put*"
      ],
      "Resource": [
        "arn:aws:s3:::example-pipeline-artifact-bucket-arn/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::example-pipeline-artifact-bucket-arn"
      ]
    }
  ]
}

Note: Replace example-account-b-id with Account B's ID, example-key-id with the AWS KMS key ARN, and example-pipeline-artifact-bucket-arn with the pipeline artifact bucket ARN.

Choose Review policy, and then create the policy.

Update your pipeline to use the cross-account role

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Complete the following steps:

To retrieve the pipeline definition from a file that's named codepipeline.json, run the get-pipeline command:

aws codepipeline get-pipeline --name example-account-b-pipeline > codepipeline.json

Note: Replace example-account-b-pipeline with Account B's pipeline name.

Add the cross-account IAM role ARN to the Source stage of the codepipeline.json file:

{
  "name": "Source",
  "actions": [
    {
      "name": "Source",
      "actionTypeId": {
        "category": "Source",
        "owner": "AWS",
        "provider": "CodeCommit",
        "version": "1"
     },
      "runOrder": 1,
      "roleArn": "arn:aws:iam::example-account-a-id:role/example-cross-account-access-role",
      "configuration": {
        "BranchName": "main",
        "OutputArtifactFormat": "CODE_ZIP",
        "PollForSourceChanges": "false",
        "RepositoryName": "example-account-a-repository"
      },
      "outputArtifacts": [ 
        {
          "name": "SourceArtifact"
        }
      ],
      "inputArtifacts": [],
      "region": "example-region",
      "namespace": "SourceVariables"
    }
  ]
}

Note: Replace example-account-a-id with Account A's ID, example-cross-account-access-role with the cross-account role, example-account-a-repository with Account A's repository, and example-region with your AWS Region.

Remove the metadata section that's located at the end of the codepipeline.json file. Also, remove the comma that's located before the metadata section.
Example:

"metadata": {
    "pipelineArn": "arn:aws:codepipeline:ap-southeast-2:12345678912:Account_B_pipeline",
    "created": "2023-01-11T05:09:20.235000+00:00",
    "updated": "2023-01-11T17:34:37.294000+00:00"
}

To update the pipeline, run the update-pipeline command:

aws codepipeline update-pipeline --cli-input-json example-codepipeline.json

Note: Replace example-codepipeline.json with the pipeline JSON file.

Note: You can also use the preceding resolution to use CodeCommit or Amazon S3 from a different AWS account on other AWS services. To do this, integrate the AWS service in the pipeline stages with the source stage from a different account. For more information, see Create a pipeline in CodePipeline that uses resources from another AWS account.

Topics: Developer Tools
Tags: AWS CodePipeline AWS CodeCommit
Language: English

AWS OFFICIALUpdated 9 months ago

No comments

Relevant content

CodeCommit as a global service
rePost-User-2738569
asked 10 months ago
Is it possible to create a Codepipeline with source as CodeCommit in different region or different accounts?
Deepak Puri
asked 2 years ago
CloudFormation Nested Stack From Codecommit in a CodePipeline
Accepted Answer
Nafiu
asked 2 years ago
Cross-Account CodePipeline Role not Authorized to Access CodeCommit in Same-Region Separate Account
rePost-User-9949303
asked 2 years ago
CloudFormation Create Repository with Multiple Branches
Accepted Answer
Nafiu
asked 2 years ago
How do I deploy code from a CodeCommit repository to an Elastic Beanstalk environment?
AWS OFFICIALUpdated 8 months ago
How do I create an AWS CodeCommit repository that uses a specified default branch name using AWS CloudFormation?
AWS OFFICIALUpdated 4 years ago
How do I perform Git operations on an AWS CodeCommit repository with an instance role on Amazon EC2 instances for Windows?
AWS OFFICIALUpdated 2 years ago
How do I perform Git operations on an AWS CodeCommit repository with an instance role on Amazon EC2 instances for Amazon Linux 2?
AWS OFFICIALUpdated 2 years ago
A sample CloudFormation template with Lambda configured in the CodePipeline deploy stage
EXPERT
Riku_Kobayashi
published 2 months ago