auth/aws: AWS CodeCommit IAM authentication by taraspos · Pull Request #1142 · fluxcd/pkg

taraspos · 2026-02-28T03:32:40Z

Summary

This PR implements IAM role based authentification for AWS CodeCommit Git HTTPS URLs

Support AWS CodeCommit Access with IAM Role source-controller#1978
CodeCommit specific request signing was implemented in v4/signer: add codecommit git signing options aws/smithy-go#628

Testing

Verified locally that generated username and password works AWS CodeCommit repositories.

Integration tests succeeding:

--- PASS: TestGitCloneUsingProvider (25.85s)
    --- PASS: TestGitCloneUsingProvider/controller-level_workload_identity (12.20s)
    --- PASS: TestGitCloneUsingProvider/object-level_workload_identity_(impersonation) (13.65s)
    --- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(direct_access) (0.00s)
    --- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(impersonation,_federation) (0.00s)
    --- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(direct_access,_federation) (0.00s)

matheuscscp · 2026-04-01T10:17:29Z

@taraspos CI is failing, can you pls take a look?

taraspos · 2026-04-01T10:49:48Z

Seems like setup-envtest released a new version that depends on Go 1.26.0

go: sigs.k8s.io/controller-runtime/tools/setup-envtest@latest: sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20260331165415-bce0ec74ad73 requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)

Not related to my change, but I can raise a PR with a fix. Let me do it in a separate branch.

matheuscscp · 2026-04-01T10:52:50Z

Seems like setup-envtest released a new version that depends on Go 1.26.0
go: sigs.k8s.io/controller-runtime/tools/setup-envtest@latest: sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20260331165415-bce0ec74ad73 requires go >= 1.26.0 (running go 1.25.8; GOTOOLCHAIN=local)
Not related to my change, but I can raise a PR with a fix. Let me do it in a separate branch.

We just merged #1158, pls rebase and let's see if this gets fixed 🙏

matheuscscp

Started the review, will continue tomorrow 👌

Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>

matheuscscp · 2026-04-13T13:08:49Z

Integration tests are running:

taraspos · 2026-04-13T13:10:43Z

I just found that I forgot to add "codecommit:ListTagsForResource" to the readme, so it might fail because of that 🤔 (unless GHA role have more permissions than the documented ones)

Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>

matheuscscp · 2026-04-13T13:38:57Z

I suppose the fix you just pushed should fix this?

https://github.com/fluxcd/pkg/actions/runs/24345069351/job/71083589019

taraspos · 2026-04-13T13:49:31Z

I suppose the fix you just pushed should fix this?

https://github.com/fluxcd/pkg/actions/runs/24345069351/job/71083589019

My fix just updates required permissions in the readme; however, I suspect that you might need to update the IAM role in the AWS account itself in some other way (manually, maybe? or some internal Terraform code).

pkg/.github/workflows/integration-aws.yaml

Lines 39 to 42 in 215ee0a

    
           with: 
        
             role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.OCI_E2E_AWS_ASSUME_ROLE_NAME }} 
        
             role-session-name: OCI_GH_Actions 
        
             aws-region: us-east-1

taraspos · 2026-04-13T13:56:33Z

I guess permissions need to be updated in the same way, as they were previously updated here:

Fix support for public.ecr.aws #938 (comment)

matheuscscp · 2026-04-13T14:20:57Z

I guess permissions need to be updated in the same way, as they were previously updated here:

Fix support for public.ecr.aws #938 (comment)

Cool, I added codecommit:ListTagsForResource to the role used in the GHA workflow and retriggered. Let's see

taraspos · 2026-04-13T14:22:35Z

I guess permissions need to be updated in the same way, as they were previously updated here:

Fix support for public.ecr.aws #938 (comment)

Cool, I added codecommit:ListTagsForResource to the role used in the GHA workflow and retriggered. Let's see

It's not only that one, all of these are needed for integration test to succeed:

                "codecommit:CreateRepository",
                "codecommit:DeleteRepository",
                "codecommit:GetRepository",
                "codecommit:GitPull",
                "codecommit:GitPush",
                "codecommit:ListTagsForResource",
                "codecommit:TagResource",
                "codecommit:UntagResource",

matheuscscp · 2026-04-13T14:48:42Z

I guess permissions need to be updated in the same way, as they were previously updated here:

Fix support for public.ecr.aws #938 (comment)

Cool, I added codecommit:ListTagsForResource to the role used in the GHA workflow and retriggered. Let's see

It's not only that one, all of these are needed for integration test to succeed:
                "codecommit:CreateRepository",
                "codecommit:DeleteRepository",
                "codecommit:GetRepository",
                "codecommit:GitPull",
                "codecommit:GitPush",
                "codecommit:ListTagsForResource",
                "codecommit:TagResource",
                "codecommit:UntagResource",

Cool, added all of these and retriggered 🤞

matheuscscp · 2026-04-13T15:21:55Z

The AWS and Azure tests passed! GCP is timing out, but I think it's a generalized issue, the test running from main is probably also going to timeout:

https://github.com/fluxcd/pkg/actions/runs/24342753764/job/71101490831

Might be some GCP issue.

matheuscscp

LGTM! 🚀

Thanks very much, @taraspos! Very nice contribution!

taraspos · 2026-04-13T15:30:50Z

Thanks! I will look into raising source-controller (and other) PR soon!

matheuscscp · 2026-04-13T15:32:20Z

Thanks! I will look into raising source-controller (and other PR) soon!

And image-automation-controller :) Everything SC does, IAC has to do as well

stefanprodan

LGTM

stefanprodan · 2026-04-13T15:34:06Z

@taraspos we'll let you know here when we'll release the packages, then you can do SC first.

matheuscscp · 2026-04-13T15:39:25Z

@taraspos auth/v0.41.0 is tagged 🚀

taraspos changed the title ~~codecommit: initial implementation of git provider~~ auth/aws: AWS CodeCommit IAM authentification Mar 5, 2026

taraspos marked this pull request as ready for review March 5, 2026 13:18

taraspos requested a review from a team as a code owner March 5, 2026 13:18

taraspos force-pushed the taras/aws-codecommit branch 4 times, most recently from ba8d4f8 to c69e541 Compare March 5, 2026 13:23

taraspos mentioned this pull request Mar 5, 2026

Support AWS CodeCommit Access with IAM Role fluxcd/source-controller#1978

Open

makkes changed the title ~~auth/aws: AWS CodeCommit IAM authentification~~ auth/aws: AWS CodeCommit IAM authentication Mar 5, 2026

matheuscscp reviewed Mar 5, 2026

View reviewed changes

Comment thread auth/go.mod Outdated

taraspos requested a review from matheuscscp March 5, 2026 13:48

taraspos force-pushed the taras/aws-codecommit branch 3 times, most recently from 304978e to 1043954 Compare March 31, 2026 19:39

taraspos commented Apr 1, 2026

View reviewed changes

Comment thread tests/integration/aws_test.go

This comment was marked as resolved.

Sign in to view

taraspos force-pushed the taras/aws-codecommit branch 2 times, most recently from 5ba3c17 to 328d851 Compare April 1, 2026 11:06

taraspos mentioned this pull request Apr 1, 2026

aws-auth-http: v1.1.3 release aws/smithy-go#644

Closed

matheuscscp reviewed Apr 9, 2026

View reviewed changes

Comment thread auth/aws/provider.go Outdated

taraspos added 3 commits April 13, 2026 12:56

auth/aws: AWS CodeCommit IAM authentication

48ab85b

Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>

Add integration tests

ae597e4

Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>

deps: aws-http-auth 1.1.3

0f15fd1

Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>

taraspos force-pushed the taras/aws-codecommit branch from b4f81fd to 94eb047 Compare April 13, 2026 12:42

taraspos requested review from matheuscscp and stefanprodan April 13, 2026 12:45

Extract aws region from the URL

9ee13fc

Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>

taraspos force-pushed the taras/aws-codecommit branch from 94eb047 to 9ee13fc Compare April 13, 2026 12:49

add missing codecommit:ListTagsForResource permission

8e83249

Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>

taraspos force-pushed the taras/aws-codecommit branch from 58a2a91 to 8e83249 Compare April 13, 2026 13:16

matheuscscp approved these changes Apr 13, 2026

View reviewed changes

stefanprodan added area/git Git and SSH related issues and pull requests area/security Security related issues and pull requests labels Apr 13, 2026

stefanprodan approved these changes Apr 13, 2026

View reviewed changes

stefanprodan merged commit 214331e into fluxcd:main Apr 13, 2026
16 checks passed

taraspos deleted the taras/aws-codecommit branch April 14, 2026 14:09

Conversation

taraspos commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

Uh oh!

Uh oh!

matheuscscp commented Apr 1, 2026

Uh oh!

taraspos commented Apr 1, 2026

Uh oh!

matheuscscp commented Apr 1, 2026

Uh oh!

This comment was marked as resolved.

matheuscscp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

matheuscscp commented Apr 13, 2026

Uh oh!

taraspos commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

matheuscscp commented Apr 13, 2026

Uh oh!

taraspos commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

taraspos commented Apr 13, 2026

Uh oh!

matheuscscp commented Apr 13, 2026

Uh oh!

taraspos commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

matheuscscp commented Apr 13, 2026

Uh oh!

matheuscscp commented Apr 13, 2026

Uh oh!

matheuscscp left a comment

Choose a reason for hiding this comment

Uh oh!

taraspos commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

matheuscscp commented Apr 13, 2026

Uh oh!

stefanprodan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

stefanprodan commented Apr 13, 2026

Uh oh!

matheuscscp commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

taraspos commented Feb 28, 2026 •

edited

Loading

taraspos commented Apr 13, 2026 •

edited

Loading

taraspos commented Apr 13, 2026 •

edited

Loading

taraspos commented Apr 13, 2026 •

edited

Loading

taraspos commented Apr 13, 2026 •

edited

Loading