AWS Codepipeline with a Codecommit targetsource repository from another account

Question

Is it possible to create a codepipeline that has a target source of a CodeCommit Repository in another account?

Answer 1

I just had to do this, I'll explain the process.

Account C is the account with your CodeCommit repository. Account P is the account with your CodePipeline... pipelines.

In Account P:

1. Create an AWS KMS Encryption Key and add Account C with having access (guide here in pre-requisite step). You will also need to add the CodePipeline role, and if you have a CodeBuild and CodeDeploy step add those roles too.

2. In your CodePipeline artifacts S3 bucket you need to add Account C access. Go to the Bucket Policy and add:

{
    "Sid": "",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::ACCOUNTC_ID:root"
    },
    "Action": [
        "s3:Get*",
        "s3:Put*"
    ],
    "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
},
{
    "Sid": "",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::ACCOUNTC_ID:root"
    },
    "Action": "s3:ListBucket",
    "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME"
}

Change ACCOUNTC_ID to the account ID of Account C, and change YOUR_BUCKET_NAME to the CodePipeline artifact S3 bucket name.

3. Add a policy to your CodePipeline service role so you can get access to Account C and the CodeCommit repositories:

{
   "Version": "2012-10-17",
   "Statement": {
       "Effect": "Allow",
       "Action": "sts:AssumeRole",
       "Resource": [
           "arn:aws:iam::ACCOUNTC_ID:role/*"
       ]
   }
}

Again, change ACCOUNTC_ID to the account ID of Account C.

In Account C:

1. Create an IAM Policy that lets Account P to access the CodeCommit resources and also the KMS key so it can encrypt them with the same key as the rest of your CodePipeline:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject*",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "codecommit:ListBranches",
                "codecommit:ListRepositories"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR_BUCKET_NAME_IN_ACCOUNTP_FOR_CODE_PIPELINE/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey",
                "kms:GenerateDataKey*",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:Decrypt"
            ],
            "Resource": [
                "arn:aws:kms:YOUR_KMS_ARN"
            ]
        }
    ]
}

Replace bucket name and KMS ARN in the above policy. Save the policy as something like CrossAccountPipelinePolicy.

2. Create a role for cross account access and attach the above policy as well as the AWSCodeCommitFullAccess policy. Make sure to make the Trusted entity as the account ID of Account P.

In AWS CLI You can't do this bit in the console so you have to use the AWS CLI. This will be to get your CodePipeline in AccountP to assume the role in the Source step and dump it in the S3 bucket for all your next steps to use.

aws codepipeline get-pipeline --name NameOfPipeline > pipeline.json

Modify the pipeline json so it looks a bit like this and replace the bits that you need to:

"pipeline": {
        "name": "YOUR_PIPELINE_NAME",
        "roleArn": "arn:aws:iam::AccountP_ID:role/ROLE_NAME_FOR_CODE_PIPELINE",
        "artifactStore": {
            "type": "S3",
            "location": "YOUR_BUCKET_NAME",
            "encryptionKey": {
              "id": "arn:aws:kms:YOUR_KMS_KEY_ARN",
              "type": "KMS"
            }
        },
        "stages": [
            {
                "name": "Source",
                "actions": [
                    {
                        "name": "Source",
                        "actionTypeId": {
                            "category": "Source",
                            "owner": "AWS",
                            "provider": "CodeCommit",
                            "version": "1"
                        },
                        "runOrder": 1,
                        "roleArn": "arn:aws:iam::AccountC_ID:role/ROLE_NAME_WITH_CROSS_ACCOUNT_POLICY",
                        "configuration": {
                            "BranchName": "master",
                            "PollForSourceChanges": "false",
                            "RepositoryName": "YOURREPOSITORYNAME"
                        },
                        "outputArtifacts": [
                            {
                                "name": "MyApp"
                            }
                        ],
                        "inputArtifacts": []
                    }
                ]
            },

Update the pipeline with aws codepipeline update-pipeline --cli-input-json file://pipeline.json

Verify it works by running the pipeline.