如何使用Cloudformation将代码从aws s3存储桶安全地提取到Codecommit存储库？

Question

Within AWS, I am able to successfully pull code from an existing S3 bucket into a new repo within Codecommit upon stack creation of a pipeline in Cloudformation (using a YAML file).

This works perfectly, but I hope to make sure the S3 bucket itself is private and not public, and want some sort of auth system to ensure that for a user to properly pull code from my s3 bucket, they need to supply the correct auth into cloudformation for it to properly populate the Codecommit repo.

Which AWS service is best for me to do this? I was thinking of using an API gateway with Lambda authorizer, but I am interested in other AWS services that might make this easier.

Answer 1

Does AWS Roles suit your needs? You can attach a role to S3 which allows users to download code:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS: [
                    "arn:aws:iam::AWS-account-ID:user/user-name-1",
                    "arn:aws:iam::AWS-account-ID:user/user-name-2", 
                ]
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOUR_BUCKET/SOME/PATH"
        }
    ]
}

and/or if you don't have predefined users, you can allow Lambda to assume such role, as explained here , and return credentials via API gateway with Lambda authorizer.