> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CodeCommit

> Connect AWS CodeCommit so agents can read repositories and pull requests, and so Review can comment on your pull requests

Connect AWS CodeCommit to let CloudThinker agents list and read your repositories, and to run [Review](https://docs.cloudthinker.io/guide/code-review/setup.md) (automated AI code review) on their pull requests. The connection signs in with an **IAM role** (recommended) or **IAM user access keys**, and covers one AWS Region.

## Prerequisites

* An AWS account that holds the CodeCommit repositories you want to connect.
* Permission to create an IAM role or IAM user in that account, and to open [AWS CloudShell](https://docs.aws.amazon.com/cloudshell/latest/userguide/getting-started.html). The `AWSCloudShellFullAccess` managed policy grants CloudShell access.
* The AWS Region where the repositories live, for example `us-east-1`.

> [!NOTE]
>
> A workspace holds one AWS CodeCommit connection, and that connection covers one Region. To reach repositories in a second Region, connect that Region from a separate workspace.

## Setup

In the sidebar, click **More → Workspace settings → Connections**, stay on the **Builtin Connections** tab, and select **AWS CodeCommit**. Choose the **AWS Region**, then pick a tab.

> [tab] IAM role (recommended)
>
> **1. Open AWS CloudShell**
>
> On the **IAM Role** tab, open AWS CloudShell from the **Open AWS CloudShell** step. It runs in your browser, so there's nothing to install.
>
> **2. Run the setup script**
>
> In **Run Setup Script**, copy the script, paste it into CloudShell, and run it. It creates the role `CloudThinkerCodeCommitAccessRole` with a trust policy that includes your workspace's External ID, then prints the role ARN. [Required permissions](#required-permissions) shows both policies.
>
> If a role with that name already exists, the script keeps it, refreshes its trust policy with your External ID, and prints its ARN. It doesn't change that role's permissions, so check them against the policy below. The wizard also lists the same steps as manual commands.
>
> **3. Paste the Role ARN**
>
> Paste the ARN into **Role ARN** and click **Connect**.
>
> **Success state:** the dialog shows **Connected** with the number of repositories CloudThinker can reach.

> [tab] Access keys
>
> **1. Run the setup script**
>
> On the **Access Keys** tab, open AWS CloudShell, copy the script from **Run Setup Script**, and run it. It creates the IAM user `CloudThinkerCodeCommitUser`, attaches the CodeCommit permissions, and prints an access key pair.
>
> AWS shows the secret access key only once. Copy it from the script output before you close CloudShell.
>
> **2. Paste the keys**
>
> Paste the values into **Access Key ID** and **Secret Access Key**, then click **Connect**.
>
> **Success state:** the dialog shows **Connected** with the number of repositories CloudThinker can reach.
>
> To rotate the key, create a new access key for `CloudThinkerCodeCommitUser` in IAM, enter the new pair in **Review → Settings → Connection actions → Update token** (or, before Review is set up, disconnect and connect again), then delete the old key. IAM allows two keys per user.

### Send pull request events to Review

Review doesn't start on new pull requests until AWS sends it events.

**1. Run the webhook script**

In the Review setup wizard, copy the script from the **Events** step. It already holds your webhook URL and secret. Run it in AWS CloudShell in the account that owns the repositories.

For each repository in the Region, it creates Amazon EventBridge rules named `CloudThinker-CodeCommit-*` for pull request, comment, and push events. It also creates an EventBridge connection, an API destination, and the IAM role `CloudThinker-CodeCommit-EventBridgeInvokeRole` that sends events to CloudThinker.

**2. Mark it as configured**

When the script prints "Webhook setup complete", click **Mark as Configured** in the wizard.

**Success state:** a new pull request gets a CloudThinker progress comment. Re-run the script after you add repositories. See [provider authentication](https://docs.cloudthinker.io/guide/code-review/provider-auth.md#configure-webhooks) for details.

## Connection details

| Field | Description | Example |
| - | - | - |
| **AWS Region** | Region that holds your repositories | `us-east-1` |
| **Role ARN** | IAM role CloudThinker assumes (IAM role method) | `arn:aws:iam::<your-account-id>:role/CloudThinkerCodeCommitAccessRole` |
| **Access Key ID** | Access key for the dedicated IAM user (access keys method) | `<your-access-key-id>` |
| **Secret Access Key** | Secret for that access key (access keys method) | `<your-secret-access-key>` |

## Required permissions

The setup script attaches one inline policy with these actions:

| Purpose | Actions |
| - | - |
| Find repositories | `ListRepositories`, `GetRepository` |
| Read pull requests | `ListPullRequests`, `GetPullRequest`, `GetDifferences`, `GetCommentsForPullRequest`, `GetCommentReactions` |
| Read code | `GetBlob`, `GetFile`, `GetFolder`, `GitPull` |
| Write review comments | `PostCommentForPullRequest`, `PostCommentReply`, `UpdateComment` |
| Manage EventBridge rules | `events:PutRule`, `events:PutTargets`, `events:DescribeRule`, `events:DeleteRule`, `events:RemoveTargets`, `events:ListTargetsByRule`, only on `arn:aws:events:*:*:rule/CloudThinker-CodeCommit-*` |

The CodeCommit actions apply to all repositories (`Resource: "*"`). The policy holds no `iam:PassRole`.

> [accordion] Trust policy and inline policy JSON
>
> The IAM role's trust policy lets only CloudThinker's AWS principal assume the role, and only with your workspace's External ID. The wizard fills in both values.
>
> ```json theme={null}
> {
>   "Version": "2012-10-17",
>   "Statement": [
>     {
>       "Effect": "Allow",
>       "Principal": { "AWS": "<cloudthinker-principal-arn>" },
>       "Action": "sts:AssumeRole",
>       "Condition": { "StringEquals": { "sts:ExternalId": "<your-external-id>" } }
>     }
>   ]
> }
> ```
>
> The inline policy, named `CodeCommitReviewAccess` on the role and `CodeCommitReviewAccessKeyPolicy` on the access key user:
>
> ```json theme={null}
> {
>   "Version": "2012-10-17",
>   "Statement": [
>     {
>       "Sid": "CodeCommitReviewActions",
>       "Effect": "Allow",
>       "Action": [
>         "codecommit:ListRepositories",
>         "codecommit:GetRepository",
>         "codecommit:ListPullRequests",
>         "codecommit:GetPullRequest",
>         "codecommit:GetDifferences",
>         "codecommit:GetCommentsForPullRequest",
>         "codecommit:GetCommentReactions",
>         "codecommit:PostCommentForPullRequest",
>         "codecommit:PostCommentReply",
>         "codecommit:UpdateComment",
>         "codecommit:GetBlob",
>         "codecommit:GetFile",
>         "codecommit:GetFolder",
>         "codecommit:GitPull"
>       ],
>       "Resource": "*"
>     },
>     {
>       "Sid": "EventBridgeRulesForCloudThinker",
>       "Effect": "Allow",
>       "Action": [
>         "events:PutRule",
>         "events:PutTargets",
>         "events:DescribeRule",
>         "events:DeleteRule",
>         "events:RemoveTargets",
>         "events:ListTargetsByRule"
>       ],
>       "Resource": "arn:aws:events:*:*:rule/CloudThinker-CodeCommit-*"
>     }
>   ]
> }
> ```

> [!TIP]
>
> Keep the policy exactly as the script attaches it and add nothing broader. The IAM role method stores no long-lived key, so prefer it.

## Agent capabilities

Reads run without asking. Posting a pull request comment is a write, so it needs **Allow writes** on — it starts on — and passes through your Rules and Approval mode first. To block CodeCommit writes outright, open **AWS CodeCommit** in **More → Workspace settings → Connections** and turn off the **Allow writes** switch on its detail panel.

| Capability | What agents can do |
| - | - |
| **Repositories** | List repositories in the connection's Region and clone one to read its code |
| **Pull requests** | Read a pull request's changes and comments during a review |
| **Review comments** | Post review summaries, findings, and replies as pull request comments |

On CodeCommit, you can mention `@cloudthinker-ai` with a question or `help` in a top-level pull request comment. Thread replies, `review`, and `autofix` aren't supported. See [mention commands](https://docs.cloudthinker.io/guide/code-review/mention-commands.md).

### Verify the connection

```text theme={null}
List the AWS CodeCommit repositories CloudThinker can reach
```

Expect the repository names in the connection's Region. The count should match the one the dialog showed when you connected.

### Example prompts

```text theme={null}
Clone the payments repository from AWS CodeCommit and summarize how it's structured
Which AWS CodeCommit pull requests did Review flag with high-severity findings this week?
```

## Troubleshooting

> [accordion] Failed to connect to AWS CodeCommit. Please verify your credentials.
>
> CloudThinker couldn't use the credentials. Work through these:
>
> | Check | Fix |
> | - | - |
> | IAM role: the trust policy holds a different External ID | Re-run the setup script. It refreshes the trust policy. |
> | Access keys: the pair is wrong or the user can't list repositories | Paste the pair again, or re-run the script to attach the policy |
> | **AWS Region** is invalid | Pick the Region that holds your repositories |
> | The workspace already has an AWS CodeCommit connection | Use the existing connection, or remove it first |

> [accordion] Failed to connect to AWS CodeCommit. Please try again.
>
> An unexpected error stopped the check. Try again. If it repeats, contact support.

> [accordion] Connected, but no repositories found yet
>
> The credentials work, but the chosen Region has no repositories the role or user can list. Confirm the **AWS Region** and that the permissions above are attached.

> [accordion] An expected repository is missing
>
> It lives in another Region. A connection only sees the Region it was set up for.

> [accordion] Review doesn't start on new pull requests
>
> AWS sends no pull request events until the webhook step is done. Run the webhook script from the wizard, then click **Mark as Configured**. See [provider authentication](https://docs.cloudthinker.io/guide/code-review/provider-auth.md#configure-webhooks).

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **External ID**: the role's trust policy requires it, which stops another AWS account from tricking CloudThinker into using your role (the confused deputy problem). AWS doesn't treat an External ID as a secret.
- **Dedicated identity**: use the role or user the script creates only for CloudThinker, so you can revoke it without touching anything else.

## Related

> [card] [Review setup](https://docs.cloudthinker.io/guide/code-review/setup.md)
>
> Turn on automated code review for your CodeCommit repositories.

> [card] [Provider authentication](https://docs.cloudthinker.io/guide/code-review/provider-auth.md)
>
> Auth methods and webhook steps for every Review provider.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.