13

I was able to pull and/or push updated from my AWS CodeCommit repository until I reinstalled aws-cli. I tried all the suggested solutions I could find but nothing seems to work.

I am working on Ubuntu 21.10 and installed:

$ aws --v
  aws-cli/1.19.1 Python/3.9.7 Linux/5.13.0-41-generic botocore/1.20.0

git version 2.32.0

The error I am getting is:

fatal: unable to access 'https://git-codecommit.eu-west-2.amazonaws.com/v1/repos/myrepo/': The requested URL returned error: 403

It used to ask me for my username and password, but after my experiments to solve the issue it stopped asking for my credentials completely. Either way I confirmed that I was using the correct credentials. Also, I do have the necessary permissions at AWS. I was successfully pulling and pushing updates until a few hours ago.

The aws credential helper is set as recommended by most solutions online. More specifically my .gitconfig file looks like this:

[user]
    name = My_name
    email = My_email
[credential]
    helper = !aws codecommit credential-helper $@
    UseHttpPath = true

Additionally, I set up correctly (with the correct region) the $ aws configure configuration.

Listing $ git config --list --show-origin I am getting:

file:/etc/gitconfig     user.email=My_email
file:/home/f_user/.gitconfig user.name=My_name
file:/home/f_user/.gitconfig user.email=My_email
file:/home/f_user/.gitconfig credential.helper=!aws codecommit credential-helper $@
file:/home/f_user/.gitconfig credential.usehttppath=true

Honestly I have no idea what else to try, any help would be appreciated!

EDIT: The way I resolved the issue is:

  • Uninstalled aws client from my system and re installed and configured it from scratch.
  • I cloned my IAM account and gave it Full AWSCodeCommit access.

I am not sure what was the part that solved it, probably the first step.

4
  • 1
    403 is "forbidden", i.e., you don't have permission. Check your permissions. Note that user.name and user.email are not credentials; the credentials you're passing to AWS are from the aws codecommit credential-helper. If you are on macOS, see docs.aws.amazon.com/codecommit/latest/userguide/… as well.
    – torek
    May 14, 2022 at 3:13
  • I did check the permissions and they are the same as they were when I was pushing my changes a few days ago. Also, about the credentials, I am aware that the name and email are not the credentials that I need in order to authenticate. It is the username and password, but the command even stopped prompting me to use my credentials at this point, that is why it is so confusing. May 15, 2022 at 16:29
  • 2
    Something has changed: either the credentials you're presenting to AWS, or the verification that AWS are doing, or both. Use the test that VonC showed to see what you're sending to AWS (and/or set GIT_TRACE, GIT_PACKET_TRACE, CURL tracing, etc; see this question).
    – torek
    May 15, 2022 at 23:55
  • I used the SSH endpoint instead of HTTPS. It is way simpler.
    – f01
    Oct 26, 2022 at 16:57

11 Answers 11

20

If you're using Mac go to keychain access, look up codecommit and delete the stored key.

2
14

Just delete credentials as below and next time pop-up window prompt for credentials Steps to delete your Credential Manager

Control Panel Select "Credential Manager" Under Generic Credential, delete the appropriate Git Credential.

2
  • After deleting it, creates it again on "credential Manager".
    – Guillermo
    Feb 17, 2023 at 14:39
  • 1
    Is there a way to fix the need to delete the saved credentials every time? I'm working on multiple codecommit repos and when swtiching from one to another I alwasy need to delete the saved credentials. May 22, 2023 at 14:04
5

If you are a mac user. just type code ~/.gitconfig and then paste the following if the credential section missing.

[credential]
    helper = !aws codecommit credential-helper $@
    UseHttpPath = true
2

Double-check your AWS managed policies for for CodeCommit.
If your IAM User has switched to ForceMultiFactorAuthentication as policy, you would need to use a token, not your password.

Locally, check what password is stored by your credential manager:

printf "protocol=https\nhost=git-codecommit.eu-west-2.amazonaws.com"|aws codecommit credential-helper get
2
  • I did check my AWS managed policies specifically and that is not the case. At this point the command doesn't even ask me for my credentials so I don't think it is permission related. May 18, 2022 at 9:24
  • 3
    for the stored password I don't really get any useful in return. printf "protocol=https\nhost=git-codecommit.eu-west-2.amazonaws.com"|aws codecommit credential-helper get --> 'path' May 18, 2022 at 9:26
2

The resolution for me was to reinstall git and deselect the git credential helper.

1

The way I resolved the issue after all is:

Uninstalled aws client from my system and re installed and configured it from scratch.
I cloned my IAM account and gave it Full AWSCodeCommit access.

I am not sure what was the part that solved it, probably the first step since after I reinstalled everything I was prompted again to use my credentials.

0
0

I was also facing a similar kind of issue,

fatal: unable to access 'https://git-codecommit.ap-south-1.amazonaws.com/v1/repos/sunday-demo/': 
The requested URL returned error: 403

Solution :

Issue the below two commands so it will promote credential windows.

git config --global credential.helper '!aws codecommit credential-helper $@'

git config --global credential.UseHttpPath true
0

Follow the steps under the section called "Git for macOS: I configured the credential helper successfully, but now I am denied access to my repository (403)" under the below documentation.

https://docs.aws.amazon.com/codecommit/latest/userguide/troubleshooting-ch.html

0

For windows, if the problem still exists "fatal: unable to access 'https://git-codecommit.us-east-1.amazonaws.com/v1/repos/RepositoryName': The requested URL returned error: 403" Try fixing your environment variables in windows. If the credentials are changed for clonning the repos, the environment is led with the old set of region and key values.

  1. Search for "edit system environment variables"
  2. Look for "Environment Variables"
  3. Set up the new accesskey, secert accesskey and default region.
  4. click "ok"
0

I have been struggling with this issue for months. Today I discovered it was my setup.

Which is:

Running a Development Container in VS Code, on a Windows machine, Docker with WSL integration. I followed all AWS codecommit setup commands and ofcourse these:

git config --global credential.helper '!aws codecommit credential-helper $@'
git config --global credential.UseHttpPath true

But a git clone of any repo still resulted in: The requested URL returned error: 403

If you work with VS Code Development Containers, there are two locations where some gitconfig is stored:

/etc/gitconfig
/home/node/.gitconfig

(setup is a nodejs dev-container ie. see last line)

If you run:

git config --list --show-origin

Take note of these lines:

file:/etc/gitconfig         credential.helper=credential.helper=!aws codecommit credential-helper $@
file:/home/node/.gitconfig  credential.helper=!aws codecommit credential-helper $@

In my case, the content after the = was different. The fix was to edit /etc/gitconfig manually and give the helper key the correct value.

0

You can just add the AWSCodeCommitPowerUser Permission Policy to your User and that worked for me.

1
  • 1
    Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Oct 12, 2023 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.