CodeCommit

CodeCommit stores your Git repositories in AWS-managed infrastructure with high availability across multiple Availability Zones. You interact with it using standard Git commands - the only difference from GitHub or Bitbucket is authentication.

Two authentication methods are supported:

# Clone using GRC (works with assumed roles and SSO)
git clone codecommit::ap-south-1://my-repo

# Clone using HTTPS credentials
git clone https://git-codecommit.ap-south-1.amazonaws.com/v1/repos/my-repo

# Clone using SSH
git clone ssh://git-codecommit.ap-south-1.amazonaws.com/v1/repos/my-repo

CodeCommit has no concept of repository-level users or teams - all access is controlled through IAM. This is a fundamental difference from GitHub and requires understanding IAM policy conditions.

To restrict push to a specific branch (e.g., protect main), use a Deny policy with a condition:

{
  "Effect": "Deny",
  "Action": [
    "codecommit:GitPush",
    "codecommit:DeleteBranch",
    "codecommit:PutFile",
    "codecommit:MergeBranchesByFastForward"
  ],
  "Resource": "arn:aws:codecommit:us-east-1:123456789:my-repo",
  "Condition": {
    "StringEqualsIfExists": {
      "codecommit:References": ["refs/heads/main"]
    },
    "Null": {
      "codecommit:References": "false"
    }
  }
}

CodeCommit supports three event-driven mechanisms that are often confused in interviews:

Approval rule templates let you enforce pull request review requirements across multiple repositories. You can require N approvals and restrict who counts as an approver using IAM ARN patterns.

CodeCommit is often compared to GitHub and GitLab. For pure AWS workloads, the key consideration is how well each integrates with CodePipeline, CodeBuild, and IAM.

An "active user" is any unique AWS identity that makes at least one Git request or API call in a calendar month. Service roles used by CodePipeline or CodeBuild count as active users.