AWS: Can't clone repo Codecommit, The requested URL returned error: 403

Question

I have two account AWS: DEV and PRD. I need to setup CodeCommit on PRD account. I test on DEV first. It worked well. Both DEV and PRD are setup CodeCommit on EU(Ireland) region. Then I clone all policy from DEV to PRD account.

When I tried to clone repo CodeCommit on PRD account, I have a problem like that: fatal: unable to access 'URL xxx': The requested URL returned error: 403 .

As I researched, I checked git and curl version. Git version is git version 2.14.4 , curl version is curl 7.53.1 (x86_64-redhat-linux-gnu) libcurl/7.53.1 NSS/3.28.4 zlib/1.2.8 libidn2/0.16 libpsl/0.6.2 (+libicu/50.1.2) libssh2/1.4.2 nghttp2/1.21.1 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz HTTP2 UnixSockets HTTPS-proxy PSL

Policy AWSCodeCommitPowerUser was attached for IAM user. Of course, I edited exactly repo as I want to user can access. IAM user also enabled HTTP credentials to access Repo CodeCommit .

I also tried to add credentials:

[credential] helper = !aws codecommit credential-helper $@ UseHttpPath = true

I don't know what am I miss ? On DEV account, I setup the same. It worked. Why did error appear on PRD account ? Could anyone explain for me ?

Thank you!

Update

I got that error cause by on PRD account, I've to enable MFA for IAM user. It was resolved! Thank all!

Answer 1

Had the exact same thing, just found the answer in their documentation:

"If you are using macOS, use HTTPS to connect to an AWS CodeCommit repository. After you connect to an AWS CodeCommit repository with HTTPS for the first time, subsequent access will fail after about fifteen minutes. The default Git version on macOS uses the Keychain Access utility to store credentials. For security measures, the password generated for access to your AWS CodeCommit repository is temporary, so the credentials stored in the keychain will stop working after about 15 minutes."

https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-https-unixes.html#setting-up-https-unixes-credential-helper