aws / aws/git-remote-codecommit

git-remote-codecommit incompatible with aws login command - returns 403 error

Open
#61 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
289
Forks
40
PR merge metrics
No merged PRs in 30d

Description

### Summary
`git-remote-codecommit` fails with 403 error when using credentials authenticated via the `aws login` command (introduced in AWS CLI v2.32.0). The tool cannot read the credentials stored by `aws login`, making it incompatible with this new authentication method.

### Environment
- **AWS CLI Version:** aws-cli/2.32.21 Python/3.13.11 Windows/11 exe/AMD64
- **git-remote-codecommit Version:** Version: 1.17
- **Python Version:** Python 3.12.2
- **Operating System:** Windows 11
- **Git Version:**

### Steps to Reproduce

1. Install AWS CLI v2.32.0 or later
2. Authenticate using the new `aws login` command:
```bash
aws login --profile login-profile
```
(Browser opens, authentication succeeds)

3. Configure git remote using codecommit protocol:
```bash
git remote add aws codecommit://login-profile@repo
```

4. Attempt to fetch from the repository:
```bash
git fetch aws
```

### Expected Behavior
The git fetch should succeed, using the credentials obtained via `aws login`.

### Actual Behavior
The fetch fails with a 403 Forbidden error:
```
fatal: unable to access 'codecommit://login-profile@repo/': The requested URL returned error: 403
```

### Root Cause Analysis
The `aws login` command (AWS CLI v2.32.0+) uses browser-based OAuth authentication and stores credentials in a different location/format than traditional AWS credentials. `git-remote-codecommit` attempts to read credentials from:
- `~/.aws/credentials`
- `~/.aws/config` (standard profiles)
- SSO session cache (when configured via `aws configure sso`)

However, `aws login` stores credentials in a format that `git-remote-codecommit` does not recognize or cannot access.

### Workarounds

**Option 1: Use IAM User Credentials**
```bash
aws configure --profile login-profile
# Enter access key ID and secret access key when prompted
```

**Option 2: Use AWS SSO (Identity Center)**
```bash
aws configure sso --profile login-profile
# Follow prompts to configure SSO
aws sso login --profile login-profile
```

Both workarounds store credentials in formats that `git-remote-codecommit` can read.

### Documentation References
- `aws login` documentation: https://docs.aws.amazon.com/signin/latest/userguide/command-line-sign-in.html
- `git-remote-codecommit` setup: https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-git-remote-codecommit.html

### Related Issues
- #36 - Issues with new AWS CLI v2.9.x config formats
- #6 - CLI v2 support request

### Proposed Solution
`git-remote-codecommit` should be updated to:
1. Detect and read credentials stored by `aws login`
2. Support the OAuth-based credential format
3. Or, at minimum, provide a clear error message directing users to use `aws configure` or `aws configure sso` instead

Alternatively, AWS documentation should explicitly state that `aws login` is not compatible with `git-remote-codecommit` and users should use alternative authentication methods.

### Impact
- **Severity:** Medium - Users can work around this with alternative auth methods
- **Frequency:** Likely to increase as `aws login` is promoted as the recommended authentication method
- **User Experience:** Confusing for new users who follow the latest AWS CLI authentication guidance

### Additional Context

I discovered this issue while trying to use the new `aws login` command as
documented in the official AWS CLI documentation. The documentation suggests
`aws login` as the recommended method for console credential users, but this
creates an incompatibility with git-remote-codecommit.

This is particularly confusing because:
1. AWS promotes `aws login` as the easiest way to get started
2. CodeCommit documentation recommends git-remote-codecommit for federated access
3. There's no warning that these two features are incompatible

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.