Using Amazon CodeCommit with interface VPC endpoints

If you use Amazon Virtual Private Cloud (Amazon VPC) to host your Amazon resources, you can establish a private connection between your VPC and CodeCommit. You can use this connection to enable CodeCommit to communicate with your resources on your VPC without going through the public internet.

Amazon VPC is an Amazon service that you can use to launch Amazon resources in a virtual network that you define. With a VPC, you have control over your network settings, such as the IP address range, subnets, route tables, and network gateways. With VPC endpoints, the routing between the VPC and Amazon services is handled by the Amazon network, and you can use IAM policies to control access to service resources.

To connect your VPC to CodeCommit, you define an interface VPC endpoint for CodeCommit. An interface endpoint is an elastic network interface with a private IP address that serves as an entry point for traffic destined to a supported Amazon service. The endpoint provides reliable, scalable connectivity to CodeCommit without requiring an internet gateway, network address translation (NAT) instance, or VPN connection. For more information, see What Is Amazon VPC in the Amazon VPC User Guide.

Interface VPC endpoints are powered by Amazon PrivateLink, an Amazon technology that enables private communication between Amazon services using an elastic network interface with private IP addresses. For more information, see Amazon PrivateLink.

The following steps are for users of Amazon VPC. For more information, see Getting Started in the Amazon VPC User Guide.

Availability

CodeCommit currently supports VPC endpoints in the following Amazon Web Services Regions:

Create VPC endpoints for CodeCommit

To start using CodeCommit with your VPC, create an interface VPC endpoint for CodeCommit. CodeCommit requires separate endpoints for Git operations and for CodeCommit API operations. Depending on your business needs, you might need to create more than one VPC endpoint. When you create a VPC endpoint for CodeCommit, choose Amazon Services, and in Service Name, choose from the following options:

Create a VPC endpoint policy for CodeCommit

You can create a policy for Amazon VPC endpoints for CodeCommit in which you can specify:

For example, a company might want to restrict access to repositories to the network address range for a VPC. You can view an example of this kind of policy here: Example 3: Allow a user connecting from a specified IP address range access to a repository . The company configured two Git VPC endpoints for the US East (Ohio) region: com.amazonaws.us-east-2.codecommit and com-amazonaws.us-east-2.git-codecommit-fips. They want to allow code pushes to a CodeCommit repository named MyDemoRepo only on the FIPS-compliant endpoint only. To enforce this, they would configure a policy similar to the following on the com.amazonaws.us-east-2.codecommit endpoint that specifically denies Git push actions:

{
    "Statement": [
        {
            "Action": "*",
            "Effect": "Allow",
            "Resource": "*",
            "Principal": "*"
        },
        {
            "Action": "codecommit:GitPush",
            "Effect": "Deny",
            "Resource": "arn:aws:codecommit:us-east-2:123456789012:MyDemoRepo",
            "Principal": "*"
        }
    ]
}

For more information, see Creating an Interface Endpoint in the Amazon VPC User Guide.