How I Wired GitLab to AWS CodePipeline Through CodeCommit (and the Pitfalls)

I worked on a project where GitLab was the team's primary code repository, but the client-side deployment pipeline ran on AWS, and we had to sync the code to CodeCommit before it could feed into CodePipeline. It took me most of a day to get the entire chain working end to end, and I hit a few pitfalls along the way. So I've written up the process here — next time this comes up, you can just follow the steps.

My Overall Approach

The full chain has seven steps: create an IAM user, attach a policy, generate HTTPS credentials, create a CodeCommit repository, configure the GitLab mirror, lock down protected branches, and verify. It looks like a lot, but there are really only two spots where people tend to get stuck — getting the IAM permission ARN right, and formatting the GitLab mirror URL correctly. I'll walk through them in order.

Step-by-Step Walkthrough

1. Create an IAM User

In the AWS IAM console, create a new user. The name can be anything, but I recommend including a purpose identifier, such as `gitlab-mirror-bot`, so it's immediately recognizable during audits.

2. Attach a Policy

Attach an inline policy that grants only the `codecommit:GitPull` and `codecommit:GitPush` actions. I hit a pitfall here once: I got the region and account ID wrong in the resource ARN, and GitLab kept throwing 403 errors. It took me nearly twenty minutes of troubleshooting before I realized the ARN was the problem. The ARN must contain the correct region and account information — don't be lazy and use a wildcard.

3. Generate HTTPS Git Credentials

Switch to the "Security Credentials" tab for that IAM user and generate the HTTPS Git credentials for AWS CodeCommit. AWS will give you a username and password pair, which you'll need when configuring the GitLab mirror.

4. Create a CodeCommit Repository

In the CodeCommit console, create a new repository to receive the mirror from GitLab. It's easier to keep the name aligned with the GitLab repository.

5. Configure the GitLab Mirror

Go to your GitLab project → Settings → Repository, and scroll down to the "Mirror repositories" section. The Git repository URL format is:

`https://git-codecommit..amazonaws.com/v1/repos/`

For the username, enter the dedicated HTTPS Git user ID generated in step 3, and for the password, enter the corresponding password.

6. Protect Branches

Check the "Mirror only protected branches" option. My take is that you shouldn't skip this step — mirroring is a one-way push, and once you sync experimental branches beyond main over, the CodeCommit repository will get messy and rollbacks will be a pain.

7. Verify

Click "Update now" to trigger a manual sync from GitLab. Then refresh the CodeCommit console — once you see the commits coming in, you're good.

Wrapping Up

Once it's running, my day-to-day maintenance cost is minimal — I just push to GitLab as usual, and CodeCommit follows automatically. If you need to hook up CodePipeline later, you can simply create a trigger from CodeCommit without having to mess with webhooks.

References

• Unifying the DevOps Process: The Key to Vendor Collaboration
• Building an AWS DevOps CodePipeline System: Creating an Efficient, Automated Deployment Pipeline