AWS CodeCommit
AWS's managed private Git repositories: repositories, pull requests, triggers and events for pipelines, IAM access, encryption, and when to use a third-party Git provider through CodeConnections instead.
2 min read · Last reviewed · MLA-C02
Sign in to bookmark tutorials and track what you have read.
On this page
Already know this topic?
Try the AWS CodeCommit quiz: 5 questions on AWS CodeCommit.
What it is
AWS CodeCommit is a managed, secure source control service that hosts private Git repositories. It supports standard Git, so existing Git tools work, and it adds pull requests with reviews, notifications, and integration with IAM and other AWS services. There are no servers to manage, and repositories are encrypted at rest and in transit.
Choose CodeCommit when a question asks for private Git repositories hosted in AWS, with access controlled by IAM, as the source for a release pipeline (MLA-C02 task 3.3.2). If the code already lives on GitHub, GitLab, or Bitbucket, connect it with AWS CodeConnections instead of moving it.
Concepts and features
- Repositories of any size and file type, with branches, tags, and history; clone over HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry or SSH (Secure Shell)A protocol for secure remote logins and commands over an encrypted connection, usually on TCP port 22. Session Manager in AWS Systems Manager gives shell access to instances without opening that port.Glossary entry.
- Pull requests with comments and approval rules, such as requiring two approvers before merging to
main. - Triggers and events: notify SNS or invoke Lambda on pushes, and send repository events to EventBridge, which can start a CodePipeline pipeline.
- Access with IAM: grant users and roles access per repository and per action (for example, deny pushes to
main); use temporary credentials through the Git credential helper or federated access.
Security, resilience, performance, and cost
Security
IAM policies control access; data is encrypted at rest with KMS (an AWS managed key or a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry) and in transit; CloudTrail records API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls; approval rules enforce code review.
Resilience
CodeCommit stores repositories redundantly as a managed service. Git itself is distributed, so every clone holds the history.
Performance
Git works best for source code: version large, frequently changing files in Amazon S3 instead, and delete branches and tags you no longer need.
Cost
You pay per active user per month above the free allowance, with additional charges for storage and Git requests above the included amounts.
Monitoring
EventBridge events and SNS notifications report pushes, pull requests, and comments; CloudTrail logs access.
Comparisons
| Need | Choose |
|---|---|
| Private Git repositories in AWS, IAM access control | AWS CodeCommit |
| Code already on GitHub, GitLab, or Bitbucket, used by AWS pipelines | AWS CodeConnections |
| Version large data files or model artifacts | Amazon S3 with versioning, or the SageMaker Model Registry for models |
| Store and share software packages | AWS CodeArtifact |
Reverse mindmap: when the question points here
- Points to CodeCommit
- Private Git hosted in AWS, IAM permissions leads to CodeCommit
- Two approvals before merging to main leads to Pull request approval rules
- Start a pipeline on each push leads to EventBridge event to CodePipeline
- Points elsewhere
- Repositories stay on GitHub leads to CodeConnections
- Track versions of large datasets leads to S3 versioning
Key takeaways
- CodeCommit hosts private Git repositories with IAM access control and encryption.
- Pull request approval rules enforce review; EventBridge events start pipelines.
- Keep large data and model artifacts in S3 or the Model Registry, not in Git.
- For repositories on GitHub, GitLab, or Bitbucket, use CodeConnections.