# How I Wired GitLab to AWS CodePipeline Through CodeCommit (and the Pitfalls)

- Published: 2024-01-30 · Category: DevOps

I worked on a project where GitLab was the team's primary code repository, but the client-side deployment pipeline ran on AWS, and we had to sync the code to CodeCommit before it could feed into CodePipeline. It took me most of a day to get the entire chain working end to end, and I hit a few pitfalls along the way. So I've written up the process here — next time this comes up, you can just follow the steps.

## My Overall Approach

The full chain has seven steps: create an IAM user, attach a policy, generate HTTPS credentials, create a CodeCommit repository, configure the GitLab mirror, lock down protected branches, and verify. It looks like a lot, but there are really only two spots where people tend to get stuck — getting the IAM permission ARN right, and formatting the GitLab mirror URL correctly. I'll walk through them in order.

## Step-by-Step Walkthrough

### 1. Create an IAM User

In the AWS IAM console, create a new user. The name can be anything, but I recommend including a purpose identifier, such as `gitlab-mirror-bot`, so it's immediately recognizable during audits.

### 2. Attach a Policy

Attach an inline policy that grants only the `codecommit:GitPull` and `codecommit:GitPush` actions. I hit a pitfall here once: I got the region and account ID wrong in the resource ARN, and GitLab kept throwing 403 errors. It took me nearly twenty minutes of troubleshooting before I realized the ARN was the problem. The ARN must contain the correct region and account information — don't be lazy and use a wildcard.

### 3. Generate HTTPS Git Credentials

Switch to the "Security Credentials" tab for that IAM user and generate the HTTPS Git credentials for AWS CodeCommit. AWS will give you a username and password pair, which you'll need when configuring the GitLab mirror.

### 4. Create a CodeCommit Repository

In the CodeCommit console, create a new repository to receive the mirror from GitLab. It's easier to keep the name aligned with the GitLab repository.

### 5. Configure the GitLab Mirror

Go to your GitLab project → Settings → Repository, and scroll down to the "Mirror repositories" section. The Git repository URL format is:

`https://git-codecommit..amazonaws.com/v1/repos/`

For the username, enter the dedicated HTTPS Git user ID generated in step 3, and for the password, enter the corresponding password.

### 6. Protect Branches

Check the "Mirror only protected branches" option. My take is that you shouldn't skip this step — mirroring is a one-way push, and once you sync experimental branches beyond main over, the CodeCommit repository will get messy and rollbacks will be a pain.

### 7. Verify

Click "Update now" to trigger a manual sync from GitLab. Then refresh the CodeCommit console — once you see the commits coming in, you're good.

## Wrapping Up

Once it's running, my day-to-day maintenance cost is minimal — I just push to GitLab as usual, and CodeCommit follows automatically. If you need to hook up CodePipeline later, you can simply create a trigger from CodeCommit without having to mess with webhooks.

## References

- Unifying the DevOps Process: The Key to Vendor Collaboration
- Building an AWS DevOps CodePipeline System: Creating an Efficient, Automated Deployment Pipeline