How to clone branch from specific AWS Code commit account

We had 4 individual AWS accounts for Dev,QA, UAT and Prod.

I need to clone a repository from AWS Prod account with branch name Production.

The problem is I am using the command

git clone https://git-codecommit.us-east-1.amazonaws.com/v1/repos/vanguard"

which is working fine, but I am not sure the cloned repository belongs to which AWS account since I am not providing any AWS account details while cloning the repository to my local.

The clone URL

https://git-codecommit.us-east-1.amazonaws.com/v1/repos/vanguard"

is same in all AWS accounts.

How to clone a repository from specific AWS Code commit account only?

Solution

You'd have to create an IAM role in that AWS account you want to clone the repository from. The IAM role will delegate access to that repository to IAM user/users in the AWS account.

Then, you would have to configure your AWS CLI to use AWS Security Token Service (STS) and assume the role when running commands.

Also, note that, each CodeCommit repository is associated with an AWS Region.

Here's more on assuming roles with AWS CLI.

EDIT:

Here's what's need to be done to enable Cross-Account Access to a repository in a different account:

Repository Account Actions:

Create a policy for access to the repository.
Attach this policy to a role in the same account, and allow users in the user account to assume this role.

User Account Actions:

Create an IAM user or IAM group. Use these to access the repository from the other account.
Assign a policy to the user or group that allows them to assume the role created in the repository account as part of the previous step.

Finally, assume the cross-account role before you attempt to clone or otherwise access the repository. Also, make the necessary changes to your credentials file ~/.aws/config

For example:

[profile MyCrossAccountProfile]
role_arn = arn:aws:iam::123456789012:role/MyCrossAccountProfile
source_profile = user1

Lastly, you need to modify the AWS CLI credential helper so that you use MyCrossAccountProfile

git config --global credential.helper `!aws codecommit credential-helper --profile MyCrossAccountProfile $@'