从 CodePipeline 跨区域访问 CodeCommit 存储库

Question

我正在使用 CloudFormation 构建 CodePipeline。管道部署到 eu-west-1 区域，但它必须从位于 us-east-1 区域的 CodeCommit 存储库获取源代码。

管道定义如下所示：

CodePipeline:
  Type: AWS::CodePipeline::Pipeline
  Properties:
    Name: !Ref PipelineName
    RoleArn: !GetAtt CodePipelineServiceRole.Arn
    Stages:
      - Name: Source
        Actions:
          - Name: Source
            ActionTypeId:
              Category: Source
              Owner: AWS
              Provider: CodeCommit
              Version: 1
            OutputArtifacts:
              - Name: SourceCodeOutputArtifact
            Configuration:
              RepositoryName: !Ref MyRepository
              BranchName: !Ref DeploymentBranch
            RunOrder: 1
            Region: us-east-1

附加的角色和策略如下所示：

CodePipelineServiceRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: 2012-10-17
      Statement:
        - Effect: Allow
          Action:
            - sts:AssumeRole
          Principal:
            Service:
              - codepipeline.amazonaws.com

CodePipelineServicePolicy:
  Type: AWS::IAM::Policy
  Properties:
    PolicyName: CodePipelineServicePolicy
    Roles:
      - !Ref CodePipelineServiceRole
    PolicyDocument:
      Version: 2012-10-17
      Statement:
......
        - Effect: Allow
          Action:
            - codecommit:BatchGet*
            - codecommit:BatchDescribe*
            - codecommit:Get*
            - codecommit:Describe*
            - codecommit:List*
            - codecommit:GitPull
          Resource: !Sub "arn:aws:codecommit:us-east-1:${AWS::AccountId}:MyRepository*"

唉，代码管道仍然无法访问我在 us-east-1 中的存储库，或者它正在错误的区域中寻找它，结果我收到以下错误

The service role or action role doesn’t have the permissions required to access the AWS CodeCommit repository named MyRepository. Update the IAM role permissions, and then try again. Error: User: arn:aws:sts::111111111111:assumed-role/MyPipeline-CodePipelineServiceRole-N996SC3JYINW/1564844186052 is not authorized to perform: codecommit:GetBranch on resource: arn:aws:codecommit:eu-west-1:111111111111:MyRepository

任何帮助将不胜感激。

编辑： 我知道我可以将 repo 复制到另一个区域，但我想知道有没有办法在不将 repo 复制到另一个区域的情况下做我想做的事情？

Answer 1

您需要将 codecommit 复制到其他区域。您可以使用 CI 作业、ECS 或 Fargate 中的计划容器来完成。