Unable to clone AWS CodeCommit with IAM Role
<p>I have following settings with my ec2 instance, but no luck.</p>

<p>And there is <a href="https://forums.aws.amazon.com/thread.jspa?threadID=198356" rel="nofollow">a same issue on aws forum</a> but no answer.</p>

<p>~/.gitconfig:</p>

<pre><code>[credential]
        helper = !aws --region us-east-1 codecommit credential-helper $@
        UseHttpPath = true
</code></pre>

<p>IAM Role Policy for the EC2 Instance:</p>

<pre><code>{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "codecommit:*"
      ],
      "Resource": "*"
    }
  ]
}
</code></pre>

<p>Then following code works:</p>

<pre><code>echo -e "protocol=https\npath=/v1/repos/my-repo\nhost=git-codecommit.us-east-1.amazonaws.com" | aws --region us-east-1 codecommit credential-helper get
</code></pre>

<p>However, with git, it doesn't.</p>

<pre><code>git clone https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo
Cloning into 'my-repo'...
fatal: unable to access 'https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo/': The requested URL returned error: 403
</code></pre>

<p>Any ideas?</p>

<p><strong>UPDATE</strong></p>

<p>After some investigation, I figure out that attached IAM Role doesn't work git operation, but IAM User worked fine.</p>

<pre><code>| Type                               | list-repositories | credential-helper | git operation |
| IAM User with CodeCommitFullAccess | OK                | OK                | OK            |
| IAM Role with CodeCommitFullAccess | OK                | OK                | NG            |
</code></pre>

<p>Tries following command:</p>

<ul>
<li><p>list-repositories</p>

<p><code>aws codecommit list-repositories</code></p></li>
<li><p>credential-helper</p>

<p><code>echo -e "protocol=http\npath=/v1/repos/my-repo\nhost=git-codecommit.us-east-1.amazonaws.com" | aws --region=us-east-1 codecommit credential-helper get</code></p></li>
<li><p>git operation</p>

<p><code>git clone --config credential.helper='!aws --region=us-east-1 codecommit credential-helper $@' --config credential.UseHttpPath=true https://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo</code></p></li>
</ul>

<p>my awscli version is following:</p>

<pre><code>$ aws --version
aws-cli/1.10.44 Python/2.7.5 Linux/3.10.0-327.10.1.el7.x86_64 botocore/1.4.34
</code></pre>

<h2>Update2</h2>

<p>My git and curl version is as following:</p>

<pre><code>$ git --version
git version 1.8.3.1
$ curl --version
curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.19.1 Basic ECC zlib/1.2.7 libidn/1.28 libssh2/1.4.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz
</code></pre>