Cross-account repository access: Actions for the repository user in AccountB

Install the Amazon CLI on the local computer. See instructions for your operating system in Installing the Amazon CLI.

Install Git on the local computer. To install Git, we recommend websites such as Git Downloads or Git for Windows.

From the terminal or command line, at the directory location where you want to clone the repository, run the git config --local user.name and git config --local user.email commands to set the user name and email for the commits you will make to the repository. For example:

git config --local user.name "Saanvi Sarkar"
git config --local user.email saanvi_sarkar@example.com

These commands return nothing, but the email and user name you specify is associated with the commits you make to the repository in AccountA.

Run the aws configure --profile command to configure a default profile to use when connecting to resources in AccountB. When prompted, provide the access key and secret key for your IAM user.

For example, run the following command to create a default Amazon CLI profile that you use to access Amazon resources in AccountB in US East (Ohio) (us-east-2):

aws configure

When prompted, provide the following information:

Amazon Access Key ID [None]: Your-IAM-User-Access-Key
Amazon Secret Access Key ID [None]: Your-IAM-User-Secret-Access-Key
Default region name ID [None]: us-east-2
Default output format [None]: json

Run the aws configure --profile command again to configure a named profile to use when connecting to the repository in AccountA. When prompted, provide the access key and secret key for your IAM user. For example, run the following command to create an Amazon CLI profile named MyCrossAccountAccessProfile that you use to access a repository in AccountA in US East (Ohio) (us-east-2):

aws configure --profile MyCrossAccountAccessProfile

When prompted, provide the following information:

Amazon Access Key ID [None]: Your-IAM-User-Access-Key
Amazon Secret Access Key ID [None]: Your-IAM-User-Secret-Access-Key
Default region name ID [None]: us-east-2
Default output format [None]: json

In a plain-text editor, open the config file, also known as the Amazon CLI configuration file. Depending on your operating system, this file might be located at ~/.aws/config on Linux, OS X, or Unix, or at drive:\Users\USERNAME\.aws\config on Windows.

In the file, find the entry that corresponds to the default profile you configured for access to repositories in AccountB. It should look similar to the following:

[default]
region = us-east-2
output = json

Add account to the profile configuration. Provide the Amazon account ID of AccountB. For example:

[default]
account = 888888888888
region = us-east-2
output = json

In the file, find the entry that corresponds to the MyCrossAccountAccessProfile profile you just created. It should look similar to the following:

[profile MyCrossAccountAccessProfile]
region = us-east-2
output = json

Add account, role_arn and source_profile to the profile configuration. Provide the Amazon Web Services account ID of AccountA, the ARN of the role in AccountA that you assume to access the repository in the other account, and the name of your default Amazon CLI profile in AccountB. For example:

[profile MyCrossAccountAccessProfile]
region = us-east-2
account = 111122223333
role_arn = arn:aws:iam::111122223333:role/MyCrossAccountRepositoryContributorRole
source_profile = default
output = json

Save your changes, and close the plain-text editor.

At the command line or terminal, in the directory where you want to clone the repository, run the git clone command with the HTTPS (GRC) clone URL. For example:

git clone codecommit://MyCrossAccountAccessProfile@MySharedDemoRepo

Unless you specify otherwise, the repository is cloned into a subdirectory with the same name as the repository.

Change directories to the cloned repository, and either add or make a change to a file. For example, you can add a file named NewFile.txt.

Add the file to the tracked changes for the local repo, commit the change, and push the file to the CodeCommit repository. For example:

git add NewFile.txt
git commit -m "Added a file to test cross-account access to this repository"
git push

For more information, see Getting started with Git and Amazon CodeCommit.

Sign in to the Amazon Web Services Management Console in AccountB (888888888888) as the IAM user who has been granted cross-account access to the repository in AccountA.

Choose your user name on the navigation bar, and in the drop-down list, choose Switch Role.

On the Switch Role page, do the following:

For more information, see Switching to a Role (Amazon Web Services Management Console).

Open the CodeCommit console at https://console.www.amazonaws.cn/codesuite/codecommit/home.

If the assumed role has permission to view the names of repositories in AccountA, you see a list of repositories and an error message that informs you that you do not have permissions to view their status. This is expected behavior. Choose the name of the shared repository from the list.

If the assumed role does not have permission to view the names of repositories in AccountA, you see an error message and a blank list with no repositories. Paste the URL link to the repository or modify the console link and change /list to the name of the shared repository (for example, /MySharedDemoRepo).

In Code, find the name of the file you added from your local computer. Choose it to browse the code in the file, and then browse the rest of the repository and start using its features.

For more information, see Getting started with Amazon CodeCommit.