简体繁体 English

AWS：无法克隆回购代码提交，请求的URL返回错误：403

[英]AWS: Can't clone repo Codecommit, The requested URL returned error: 403

原文 2018-08-22 10:00:24 7 1 git/ amazon-web-services/ http-status-code-403/ aws-codecommit

I have two account AWS: DEV and PRD. 我有两个账户AWS：DEV和PRD。 I need to setup CodeCommit on PRD account. 我需要在PRD帐户上设置CodeCommit 。 I test on DEV first. 我先在DEV上测试。 It worked well. 运行良好。 Both DEV and PRD are setup CodeCommit on EU(Ireland) region. DEV和PRD都在EU（爱尔兰）区域上设置了CodeCommit。 Then I clone all policy from DEV to PRD account. 然后，我将所有策略从DEV克隆到PRD帐户。

When I tried to clone repo CodeCommit on PRD account, I have a problem like that: fatal: unable to access 'URL xxx': The requested URL returned error: 403 . 当我尝试在PRD帐户上克隆回购CodeCommit时，出现类似问题： fatal: unable to access 'URL xxx': The requested URL returned error: 403 。

As I researched, I checked git and curl version. 在研究时，我检查了git和curl版本。 Git version is git version 2.14.4 , curl version is curl 7.53.1 (x86_64-redhat-linux-gnu) libcurl/7.53.1 NSS/3.28.4 zlib/1.2.8 libidn2/0.16 libpsl/0.6.2 (+libicu/50.1.2) libssh2/1.4.2 nghttp2/1.21.1 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz HTTP2 UnixSockets HTTPS-proxy PSL Git版本是git version 2.14.4 ，curl版本是curl 7.53.1 (x86_64-redhat-linux-gnu) libcurl/7.53.1 NSS/3.28.4 zlib/1.2.8 libidn2/0.16 libpsl/0.6.2 (+libicu/50.1.2) libssh2/1.4.2 nghttp2/1.21.1 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz HTTP2 UnixSockets HTTPS-proxy PSL

Policy AWSCodeCommitPowerUser was attached for IAM user. 已为IAM用户附加策略AWSCodeCommitPowerUser 。 Of course, I edited exactly repo as I want to user can access. 当然，我完全按照用户希望的方式编辑了仓库。 IAM user also enabled HTTP credentials to access Repo CodeCommit . IAM用户还启用了HTTP凭据来访问Repo CodeCommit 。

I also tried to add credentials: 我还尝试添加凭据：

[credential] helper = !aws codecommit credential-helper $@ UseHttpPath = true

I don't know what am I miss ? 我不知道我想念什么？ On DEV account, I setup the same. 在DEV帐户上，我设置相同。 It worked. 有效。 Why did error appear on PRD account ? 为什么PRD帐户上出现错误？ Could anyone explain for me ? 谁能为我解释？

Thank you! 谢谢！

Update 更新

I got that error cause by on PRD account, I've to enable MFA for IAM user. 我在PRD帐户上收到该错误原因，我必须为IAM用户启用MFA。 It was resolved! 解决了！ Thank all! 谢谢大家！

1 个解决方案

Had the exact same thing, just found the answer in their documentation: 有完全相同的事情，只是在他们的文档中找到了答案：

"If you are using macOS, use HTTPS to connect to an AWS CodeCommit repository. After you connect to an AWS CodeCommit repository with HTTPS for the first time, subsequent access will fail after about fifteen minutes. The default Git version on macOS uses the Keychain Access utility to store credentials. For security measures, the password generated for access to your AWS CodeCommit repository is temporary, so the credentials stored in the keychain will stop working after about 15 minutes." “如果您使用的是macOS，请使用HTTPS连接到AWS CodeCommit存储库。第一次使用HTTPS连接到AWS CodeCommit存储库后，大约十五分钟后，后续访问将失败。macOS上的默认Git版本使用钥匙串。用于存储凭证的访问实用程序。为安全起见，用于访问您的AWS CodeCommit存储库的密码是临时的，因此存储在钥匙串中的凭证将在大约15分钟后停止工作。”

https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-https-unixes.html#setting-up-https-unixes-credential-helper https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-https-unixes.html#setting-up-https-unixes-credential-helper