IAM blocks access to AWS CodeCommit repo

Question

I set up SSH access to CodeCommit and tested the connection:

You have successfully authenticated over SSH. You can use Git to interact with AWS CodeCommit. Interactive shells are not supported.Connection to git-codecommit.us-east-1.amazonaws.com closed by remote host.

When I attempt to clone or push, I see this error:

Access denied: User: arn:aws:iam::##########:user/[email protected] is not authorized to perform: codecommit:GitPull on resource: arn:aws:codecommit:us-east-1:##########:my-repo

Even after adding a policy to my user to access all operations on this repo, I cannot clone or push.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codecommit:*"
            ],
            "Resource": [
                "arn:aws:codecommit:us-east-1:##########:my-repo"
            ]
        }
    ]
}

What gives? Is anyone else having trouble with this?

Answer 1

In my case I had a policy that attempted to require MFA login for most things other than setting up MFA in AWS. I ended up adding codecommit as an exemption to the MFA required policy so I didn't have to do anything extra in our developer's environments to handle MFA login for git access to codecommit.

Answer 2

A few things could cause this:

1. If there are any group permissions denying access to CodeCommit

2. If you are using multi factor authentication, that will not work with SSH (http://docs.aws.amazon.com/codecommit/latest/userguide/temporary-access.html)

3. An IAM policy denying access to KMS

If you post this on the AWS forums, we can use your account ID to help you troubleshoot your issue.