AWS CodeConnections
Connections that let AWS developer tools use third-party source code providers such as GitHub, GitLab, and Bitbucket: how connections work, using them in CodePipeline and CodeBuild, hosts for self-managed providers, and security.
2 min read · Last reviewed · MLA-C02
Sign in to bookmark tutorials and track what you have read.
On this page
Already know this topic?
Try the AWS CodeConnections quiz: 5 questions on AWS CodeConnections.
What it is
AWS CodeConnections lets AWS developer tools use code in third-party source providers such as GitHub, GitLab, and Bitbucket. A connection is an AWS resource, with its own ARN (Amazon Resource Name)The unique identifier of an AWS resource, in the form arn:partition:service:region:account-id:resource. IAM policies use ARNs to name the resources they allow or deny.Glossary entry, that authorizes AWS to access repositories in your provider account. Services such as AWS CodePipeline, AWS CodeBuild, and AWS CodeDeploy reference the connection instead of storing tokens or passwords. The service was previously called AWS CodeStar Connections; existing resources in the old namespace still work.
Choose CodeConnections when a question says the code is on GitHub, GitLab, or Bitbucket and a pipeline in AWS must start on changes and read the code, without copying the repository or managing secrets (MLA-C02 task 3.3.2).
Concepts and features
- Connection: created in the Developer Tools console, then completed by authorizing the AWS app in the provider (a "handshake"); it stays pending until that step is done.
- Host: represents a self-managed provider installation, such as GitHub Enterprise Server or GitLab self-managed, including one reachable only from your VPC.
- Use in pipelines: a CodePipeline source action uses the connection to detect pushes and pull requests (with filters on branches, tags, and paths) and to fetch the code; CodeBuild can use it to check out source.
- IaC (Infrastructure as code)Defining infrastructure, such as networks, servers, and permissions, in text files that are versioned and deployed automatically, instead of setting it up by hand. AWS CloudFormation and the AWS CDK are AWS tools for it.Glossary entry: reference the connection ARN in CloudFormation or CDK templates, so no secrets appear in templates.
Security, resilience, performance, and cost
Security
Access to use a connection is controlled by IAM (for example codeconnections:UseConnection), so only approved pipelines and projects can read the repositories; no personal access tokens are stored in AWS. Scope the provider-side app to only the repositories you need. CloudTrail records connection use.
Resilience
Connections are managed resources; if the provider authorization is revoked, the connection stops working, so monitor pipeline source failures.
Performance
Event-based triggers through the connection start pipelines as soon as a change is pushed, instead of polling.
Cost
There is no additional charge for connections; you pay for the services that use them.
Monitoring
Pipeline source action failures appear in CodePipeline and EventBridge; CloudTrail logs connection API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls.
Comparisons
| Need | Choose |
|---|---|
| Use GitHub, GitLab, or Bitbucket repositories in AWS pipelines | AWS CodeConnections |
| Host private Git repositories in AWS | AWS CodeCommit |
| Store packages and dependencies | AWS CodeArtifact |
Reverse mindmap: when the question points here
- Points to CodeConnections
- Pipeline must start on GitHub pushes leads to Connection in a CodePipeline source action
- GitHub Enterprise Server in a private network leads to Connection with a host
- No tokens in templates leads to Reference the connection ARN
- Points elsewhere
- Move repositories into AWS leads to CodeCommit
Key takeaways
- A connection authorizes AWS developer tools to use GitHub, GitLab, or Bitbucket repositories, with no stored secrets.
- Hosts support self-managed providers such as GitHub Enterprise Server and GitLab self-managed.
- CodePipeline source actions use connections to trigger on pushes and pull requests.
- Formerly AWS CodeStar Connections; no extra charge.