Clone AWS CodeCommit git repository using GitPython with https credentials

Question

I'm looking everywhere since for the more accurate way to clone an AWS CodeCommit git repository through python using https protocol.

In fact for those who don't know aws suggest using the codecommit credential helper to generate user and password, like this :

git config --global credential.helper '!aws codecommit credential-helper $@'
git config --global credential.UseHttpPath true

So git will invoke the codecommit helper each time he needs credentials, without prompt.

Thus, I look at GitPython library code, but didn't find anywhere how to provide credentials to git.

In my case, I'm using AWS Lambda to write a python function which will clone my CodeCommit Git repository among other stuff.

I would like to avoid launching a container like codebuild for example in my lambda function to execute git commands, or launching a shell in subprocess

Can one here give me avise for a better approach of the problematic?

Answer 1

As per this question,

aws codecommit credential helper is only available to be used with the AWS CLI, and thus cannot be invoked in a lambda function through the API.

So what I do is to however generate fixed git HTTPS credentials for a given IAM user, and use that in my lambda function.

These credentials can be either stored encrypted on S3 and retrieved during the execution of the function, or in Lambda Environment Variables.

Answer 2

I was able to do with IAM Role and Lambda using Lambda Layer with the AWS CLI installed https://github.com/aws-samples/aws-lambda-layer-awscli

I have the full solution here with a SAM template https://github.com/msimpsonnz/gitbackup