AWS仅使用角色即可对CodeCommit存储库进行跨帐户访问（无静态凭证）

Question

I have a CodeCommit REPO1 in AWS account 1111. I need to clone REPO1 in EC2 instances that will be launched and terminate on a regular basis in AWS account 2222. The EC2's are launched to perform some batch jobs for a short period (minutes), then are terminated in automated manner.

Without generating static credentials, how can I use roles to launch EC2 instances in 2222, clone REPO1 from 1111. The process must be automated using bash/CLI.

I have been banging my head against my desk for a couple of days now to no avail.

Answer 1

You need to create a role (R1) in account 1111 that:

• Trusts account 2222 to assume it
• Has the necessary permissions to access the repository REPO1

Then you need to make sure that the instance role for your EC2 instance has AssumeRole permissions. This allows you to assume R1 from within your EC2 instance.

Now, within your EC2 instance in account 2222, you should set a profile that accesses REPO1 through the role. You can do so by adding something that looks similar to the following to your ~/.aws/config file:

[profile cross-account-role]
role_arn = arn:aws:iam::<1111>:role/<R1>
credential_source = Ec2InstanceMetadata
external_id = <ExternalId of R1>
output = json
region = <Region where REPO1 is>

You then want to confirm whether you've set your permissions correctly, you can do:

aws --profile cross-account-role get-repository --repository-name REPO1

Once this works, you want to configure the git client to use the credential-helper with the correct profile, in your ~/.gitconfig by running:

git config --global credential.helper '!aws codecommit --profile cross-account-role credential-helper $@'
git config --global credential.UseHttpPath true