AWS CodeCommit

Connect AWS CodeCommit so agents can read repositories and pull requests, and so Review can comment on your pull requests

Connect AWS CodeCommit to let CloudThinker agents list and read your repositories, and to run Review (automated AI code review) on their pull requests. The connection signs in with an IAM role (recommended) or IAM user access keys, and covers one AWS Region.

Prerequisites

• An AWS account that holds the CodeCommit repositories you want to connect.
• Permission to create an IAM role or IAM user in that account, and to open AWS CloudShell. The AWSCloudShellFullAccess managed policy grants CloudShell access.
• The AWS Region where the repositories live, for example us-east-1.

A workspace holds one AWS CodeCommit connection, and that connection covers one Region. To reach repositories in a second Region, connect that Region from a separate workspace.

Setup

In the sidebar, click More → Workspace settings → Connections, stay on the Builtin Connections tab, and select AWS CodeCommit. Choose the AWS Region, then pick a tab.

IAM role (recommended)

1. Open AWS CloudShell

   On the IAM Role tab, open AWS CloudShell from the Open AWS CloudShell step. It runs in your browser, so there’s nothing to install.

2. Run the setup script

   In Run Setup Script, copy the script, paste it into CloudShell, and run it. It creates the role CloudThinkerCodeCommitAccessRole with a trust policy that includes your workspace’s External ID, then prints the role ARN. Required permissions shows both policies.

   If a role with that name already exists, the script keeps it, refreshes its trust policy with your External ID, and prints its ARN. It doesn’t change that role’s permissions, so check them against the policy below. The wizard also lists the same steps as manual commands.

3. Paste the Role ARN

   Paste the ARN into Role ARN and click Connect.

   Success state: the dialog shows Connected with the number of repositories CloudThinker can reach.

Access keys

1. Run the setup script

   On the Access Keys tab, open AWS CloudShell, copy the script from Run Setup Script, and run it. It creates the IAM user CloudThinkerCodeCommitUser, attaches the CodeCommit permissions, and prints an access key pair.

   AWS shows the secret access key only once. Copy it from the script output before you close CloudShell.

2. Paste the keys

   Paste the values into Access Key ID and Secret Access Key, then click Connect.

   Success state: the dialog shows Connected with the number of repositories CloudThinker can reach.

To rotate the key, create a new access key for CloudThinkerCodeCommitUser in IAM, enter the new pair in Review → Settings → Connection actions → Update token (or, before Review is set up, disconnect and connect again), then delete the old key. IAM allows two keys per user.

Send pull request events to Review

Review doesn’t start on new pull requests until AWS sends it events.

1. Run the webhook script

   In the Review setup wizard, copy the script from the Events step. It already holds your webhook URL and secret. Run it in AWS CloudShell in the account that owns the repositories.

   For each repository in the Region, it creates Amazon EventBridge rules named CloudThinker-CodeCommit-* for pull request, comment, and push events. It also creates an EventBridge connection, an API destination, and the IAM role CloudThinker-CodeCommit-EventBridgeInvokeRole that sends events to CloudThinker.

2. Mark it as configured

   When the script prints “Webhook setup complete”, click Mark as Configured in the wizard.

   Success state: a new pull request gets a CloudThinker progress comment. Re-run the script after you add repositories. See provider authentication for details.

Connection details

Field	Description	Example
AWS Region	Region that holds your repositories	us-east-1
Role ARN	IAM role CloudThinker assumes (IAM role method)	arn:aws:iam::<your-account-id>:role/CloudThinkerCodeCommitAccessRole
Access Key ID	Access key for the dedicated IAM user (access keys method)	<your-access-key-id>
Secret Access Key	Secret for that access key (access keys method)	<your-secret-access-key>

Required permissions

The setup script attaches one inline policy with these actions:

Purpose	Actions
Find repositories	ListRepositories, GetRepository
Read pull requests	ListPullRequests, GetPullRequest, GetDifferences, GetCommentsForPullRequest, GetCommentReactions
Read code	GetBlob, GetFile, GetFolder, GitPull
Write review comments	PostCommentForPullRequest, PostCommentReply, UpdateComment
Manage EventBridge rules	events:PutRule, events:PutTargets, events:DescribeRule, events:DeleteRule, events:RemoveTargets, events:ListTargetsByRule, only on arn:aws:events:*:*:rule/CloudThinker-CodeCommit-*

The CodeCommit actions apply to all repositories (Resource: "*"). The policy holds no iam:PassRole.

Trust policy and inline policy JSON

The IAM role’s trust policy lets only CloudThinker’s AWS principal assume the role, and only with your workspace’s External ID. The wizard fills in both values.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "<cloudthinker-principal-arn>" },
      "Action": "sts:AssumeRole",
      "Condition": { "StringEquals": { "sts:ExternalId": "<your-external-id>" } }
    }
  ]
}

The inline policy, named CodeCommitReviewAccess on the role and CodeCommitReviewAccessKeyPolicy on the access key user:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CodeCommitReviewActions",
      "Effect": "Allow",
      "Action": [
        "codecommit:ListRepositories",
        "codecommit:GetRepository",
        "codecommit:ListPullRequests",
        "codecommit:GetPullRequest",
        "codecommit:GetDifferences",
        "codecommit:GetCommentsForPullRequest",
        "codecommit:GetCommentReactions",
        "codecommit:PostCommentForPullRequest",
        "codecommit:PostCommentReply",
        "codecommit:UpdateComment",
        "codecommit:GetBlob",
        "codecommit:GetFile",
        "codecommit:GetFolder",
        "codecommit:GitPull"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EventBridgeRulesForCloudThinker",
      "Effect": "Allow",
      "Action": [
        "events:PutRule",
        "events:PutTargets",
        "events:DescribeRule",
        "events:DeleteRule",
        "events:RemoveTargets",
        "events:ListTargetsByRule"
      ],
      "Resource": "arn:aws:events:*:*:rule/CloudThinker-CodeCommit-*"
    }
  ]
}

Keep the policy exactly as the script attaches it and add nothing broader. The IAM role method stores no long-lived key, so prefer it.

Agent capabilities

Reads run without asking. Posting a pull request comment is a write, so it needs Allow writes on — it starts on — and passes through your Rules and Approval mode first. To block CodeCommit writes outright, open AWS CodeCommit in More → Workspace settings → Connections and turn off the Allow writes switch on its detail panel.

Capability	What agents can do
Repositories	List repositories in the connection’s Region and clone one to read its code
Pull requests	Read a pull request’s changes and comments during a review
Review comments	Post review summaries, findings, and replies as pull request comments

On CodeCommit, you can mention @cloudthinker-ai with a question or help in a top-level pull request comment. Thread replies, review, and autofix aren’t supported. See mention commands.

Verify the connection

List the AWS CodeCommit repositories CloudThinker can reach

Expect the repository names in the connection’s Region. The count should match the one the dialog showed when you connected.

Example prompts

Clone the payments repository from AWS CodeCommit and summarize how it's structured
Which AWS CodeCommit pull requests did Review flag with high-severity findings this week?

Troubleshooting

Failed to connect to AWS CodeCommit. Please verify your credentials.

CloudThinker couldn’t use the credentials. Work through these:

Check	Fix
IAM role: the trust policy holds a different External ID	Re-run the setup script. It refreshes the trust policy.
Access keys: the pair is wrong or the user can’t list repositories	Paste the pair again, or re-run the script to attach the policy
AWS Region is invalid	Pick the Region that holds your repositories
The workspace already has an AWS CodeCommit connection	Use the existing connection, or remove it first

Failed to connect to AWS CodeCommit. Please try again.

An unexpected error stopped the check. Try again. If it repeats, contact support.

Connected, but no repositories found yet

The credentials work, but the chosen Region has no repositories the role or user can list. Confirm the AWS Region and that the permissions above are attached.

An expected repository is missing

It lives in another Region. A connection only sees the Region it was set up for.

Review doesn't start on new pull requests

AWS sends no pull request events until the webhook step is done. Run the webhook script from the wizard, then click Mark as Configured. See provider authentication.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• External ID: the role’s trust policy requires it, which stops another AWS account from tricking CloudThinker into using your role (the confused deputy problem). AWS doesn’t treat an External ID as a secret.
• Dedicated identity: use the role or user the script creates only for CloudThinker, so you can revoke it without touching anything else.

Related

Review setup

Turn on automated code review for your CodeCommit repositories.

Provider authentication

Auth methods and webhook steps for every Review provider.