如何从CodeBuild中查看CodeCommit回购？

Question

我有一个附在CodeCommit Repo“ a”上的AWS编码器。作为构建过程的一部分，我想从repo“ a”中生成一些文物，并将其提交给CodeCommit Repo“ B”。我已经尝试包括

git clone https://git-codecommit.us-west-2.amazonaws.com/v1/repos/RepoB

在buildSpec中，但我在CodeBuild中遇到了此错误：

fatal: could not read Username for 'https://git-codecommit.us-west-2.amazonaws.com': No such device or address

[Container] 2022/04/27 22:26:42 Command did not exit successfully git clone https://git-codecommit.us-west-2.amazonaws.com/v1/repos/RepoB exit status 128

看来它没有凭据。我还尝试了在git命令中包括用户名和密码，例如git克隆https：//codepipelineuser-at-- ***：***@git-codecommit.us-west-west-west-2.amazonaws.com/ v1/repos/repob并收到此错误

[Container] 2022/04/27 21:33:45 Command did not exit successfully git clone git clone https://codepipelineuser-at-***:***@git-codecommit.us-west-2.amazonaws.com/v1/repos/RepoB exit status 129
[Container] 2022/04/27 21:33:45 Phase complete: POST_BUILD State: FAILED
[Container] 2022/04/27 21:33:45 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: git clone git clone https://codepipelineuser-at-123542344134:***@git-codecommit.us-west-2.amazonaws.com/v1/repos/AmplifySpec-Kotlin. Reason: exit status 129

：已将密码存储在参数存储中）。

如何指定CodeCommit Repo的凭据，以便在CodeBuild中查看它？

Answer 1

我能够通过两种方式连接到代码提交
在IAM用户上创建HTTP访问，然后使用您从访问的生成中获得的用户名/密码。

或者，您可以使用AccessKey+SecretAccesskey，但是，您需要在SecretAccesskey上使用签名V4它有点复杂

Answer 2

您可以为您的CodeBuild项目设置IAM服务角色，该项目允许您的代码从CODECOMMIT存储库中提取代码。
这个角色可能看起来像下面，

{
  "Type": "AWS::IAM::Role",
  "Description": "ServiceRole for CodeBuild",
  "Properties": {
  "AssumeRolePolicyDocument": {
    "Statement": [{
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {"Service": "codebuild.amazonaws.com"}
     }],
    "Version": "2012-10-17"
  },
  "Policies": [{
    "PolicyName": "CodeCommitAccess",
    "PolicyDocument": {
      "Statement": [{
        "Action": "codecommit:GitPull",
        "Effect": "Allow",
        "Resource": "arn:aws:codecommit:yourregion:yourccount:yourreponame"
      }],
      "Version": "2012-10-17"
    },
  }]
}

然后您需要安装Python，PIP，AWS CLI和GIT。
AWS Linux 2023的规格文件可能包括以下内容：

version: "0.2"
phases:
    install:
        commands:
            - dnf update -y
            - dnf install -y awscli-2 git python3-pip
            - pip install git-remote-codecommit
    pre_build:
        commands:
            - groupadd -g 1000 ec2-user
            - useradd -g ec2-user -u 1000 -m ec2-user
    build:
        run-as: ec2-user
        commands:
            - export HOME=/home/ec2-user
            - aws sts get-caller-identity || true
            - git config --global credential.helper '!aws codecommit credential-helper $@'
            - git config --global credential.UseHttpPath true
            - git clone codecommit::yourregion://yourreponame 

它的工作原理：git配置指令git clone以调用aws codecommit codecommit cordecommit cordecommit cordecommit conderenter-helper可与git-remote一起使用-codecommit，并提供访问您存储库的git。您不需要AWS CLI配置文件，您不需要IAM用户。一切都从imdsv2撤出