Access AWS CodeCommit without Git Credentials

Authenticate to AWS CodeCommit repositories using Vouch

Vouch authenticates to AWS CodeCommit using short-lived STS credentials – no SSH keys, no HTTPS Git credentials, and no IAM access keys to manage. Both HTTPS credential helper and native codecommit:// remote helper are supported.

Prerequisites

Before developers can configure the AWS CodeCommit integration:

• The AWS integration must be configured (OIDC provider and IAM role)
• The IAM role must have codecommit:GitPull and codecommit:GitPush permissions on the target repositories

Step 1 – Configure the Git credential helper

Run the setup command to install the Vouch credential helper for AWS CodeCommit:

vouch setup codecommit [--region <REGION>] [--profile <PROFILE>] [--configure]

This configures Git to use Vouch as the credential helper for AWS CodeCommit HTTPS URLs across all supported AWS partitions. It adds the following to your ~/.gitconfig:

[credential "https://git-codecommit.*.amazonaws.com"]
    helper = vouch
    useHttpPath = true

[credential "https://git-codecommit.*.amazonaws.com.cn"]
    helper = vouch
    useHttpPath = true

[credential "https://git-codecommit.*.amazonaws.eu"]
    helper = vouch
    useHttpPath = true

The setup also installs the native git-remote-codecommit helper as a symlink at ~/.local/bin/git-remote-codecommit, enabling codecommit:// URL support (see below).

Step 2 – Use Git normally

Not logged in yet? Run vouch login — one YubiKey tap starts an 8-hour session that every command below uses automatically.

With the credential helper configured and an active session, Git commands work without any extra flags or tokens:

# Clone an AWS CodeCommit repository
git clone https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo

# Pull latest changes
cd my-repo
git pull

# Push commits
git add .
git commit -m "Update feature"
git push

Vouch handles authentication transparently. You do not need to enter a username, password, or configure IAM HTTPS Git credentials.

Native codecommit:// remote helper

Vouch ships its own native git-remote-codecommit remote helper, which is installed automatically by vouch setup codecommit. This provides codecommit:// URL support without requiring any external dependencies – no Python or pip install needed.

The remote helper reads credentials directly from the AWS credential chain, bypassing Git’s credential helper system entirely. This avoids known conflicts with macOS Keychain and Git Credential Manager.

URL formats

Usage

# Clone using the default profile
git clone codecommit://my-repo

# Clone using a specific AWS profile
git clone codecommit://vouch@my-repo

# Clone from a specific region
git clone codecommit::us-west-2://vouch@my-repo

The profile name before @ must match your AWS profile (typically vouch). All subsequent Git operations (push, pull, fetch) work normally.

When to use codecommit:// URLs

Use codecommit:// URLs when:

• You have multiple credential helpers installed and experience conflicts (macOS Keychain, Git Credential Manager)
• You want to avoid HTTPS URL region-specific hostnames
• You need to work with multiple AWS profiles or regions across repositories

Cross-partition support

All AWS partitions – standard (aws), China (aws-cn), and European Sovereign Cloud (aws-eusc) – are configured automatically during setup, as the ~/.gitconfig entries in Step 1 show.

Troubleshooting

Authentication failed

fatal: Authentication failed for 'https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo'

• Verify you have an active Vouch session: vouch login.
• Confirm the credential helper is configured: git config --global credential.https://git-codecommit.*.amazonaws.com.helper should return vouch.
• Check that the Vouch agent is running: vouch status.

“Not authorized to perform codecommit:GitPull”

• Verify the IAM role you are assuming has the correct AWS CodeCommit permissions.
• Check that the IAM trust policy allows AssumeRoleWithWebIdentity from the Vouch OIDC provider.

Wrong region

• AWS CodeCommit repository URLs include the region (e.g., git-codecommit.us-east-1.amazonaws.com). Make sure you are using the correct region for your repository.
• Alternatively, use codecommit:// URLs with an explicit region: codecommit::us-east-1://vouch@my-repo.

Another credential helper is interfering

1. List all configured credential helpers:

   git config --show-origin --get-all credential.https://git-codecommit.*.amazonaws.com.helper
   

2. Remove or reorder conflicting entries so that vouch appears first.
3. Re-run vouch setup codecommit to ensure the configuration is correct.
4. Alternatively, switch to codecommit:// URLs which bypass Git’s credential helper system entirely.

How it works

1. Git requests credentials – Git calls the Vouch credential helper when it needs to authenticate to an AWS CodeCommit repository.
2. OIDC to STS – Vouch exchanges your active hardware-backed session for temporary AWS STS credentials via AssumeRoleWithWebIdentity.
3. SigV4 signing – Vouch uses the STS credentials to sign the Git HTTP request with AWS Signature Version 4, authenticating directly to AWS CodeCommit – bypassing the legacy HTTPS Git credential system, with no stored secrets on disk.
4. Git authenticates – The signed credentials are returned to Git and used for the current operation.

Authentication method comparison