CodeCommit is Back! Testing the Revived AWS CodeCommit with Kiro-CLI and Reconfirming the Convenience of IAM-Authenticated Git
This page has been translated by machine translation. View original
AWS CodeCommit, for which a halt to new customer onboarding was announced in July 2025, has had that policy reversed today, and its full continuation (return to GA) has been announced.
The return of CodeCommit as an option, with its strong affinity with AWS environments and secure management through IAM authentication, is good news for many developers.
To celebrate this return, this article uses "Kiro-CLI", AWS's AI agent tool, to verify how smoothly "credential-less Git operations via IAM authentication", one of CodeCommit's strengths, can be performed, based on actual behavior and logs from a real machine.
Test Environment and Prerequisites
The verification was performed in the following environment.
- OS: Amazon Linux 2023
- Tool: Kiro-CLI 1.20.1
- Target service: AWS CodeCommit
- Authentication method:
aws login(AWS CLI v2 standard browser authentication)
For building the test environment and installing Kiro-CLI, I followed the procedures in the article below.
1. Obtaining AWS Credentials (Browser Authentication)
First, I authenticated to AWS from within the Kiro-CLI interactive session.
The biggest advantage of using CodeCommit is that you can achieve simple operations using only the AWS CLI's temporary credentials (IAM role), without managing SSH keys or fixed Git passwords.
aws login
Here, I used the aws login command added in AWS CLI v2.32.0 to start a session securely.
Command executed
!aws login
Execution log
After browser authentication, the profile on the machine was updated.
Attempting to open your default browser.
If the browser does not open, open the following URL:
https://ap-northeast-1.signin.aws.amazon.com/v1/authorize?response_type=code&client_id=arn%3Aaws%3Asignin%3A%3A%3Adevtools%2Fsame-device... (省略) ...
Profile default is already configured to use session ...
Do you want to overwrite it ...? (y/n): y
Updated profile default to use arn:aws:sts::123456789012:assumed-role/cm-user/cm-user credentials.
I checked whether the AI agent correctly recognized the updated credentials.
Instruction prompt
Please check the current AWS account information.
Execution log
Running aws cli command (using tool: aws):
Service name: sts
Operation name: get-caller-identity
Parameters:
Region: us-east-1
{
"UserId": "AROAYQNJSKC6XXXXXXXXX:cm-user",
"Account": "123456789012",
"Arn": "arn:aws:sts::123456789012:assumed-role/cm-user/cm-user"
}
I confirmed that access was made with the intended IAM role.
2. Creating a CodeCommit Repository
I instructed it to create a private repository in the Tokyo region.
Instruction prompt
Please create a private CodeCommit repository named "sample-repo-demo" in the Tokyo region.
Execution log
The AI executed aws codecommit create-repository.
Running aws cli command (using tool: aws):
Service name: codecommit
Operation name: create-repository
Parameters:
- repositoryDescription: "Sample repository for demo"
- repositoryName: "sample-repo-demo"
Region: ap-northeast-1
# Result (excerpt)
# - RepositoryName: sample-repo-demo
# - RepositoryId: ff82b310-xxxx-xxxx-xxxx-91b36111cca0
# - CloneUrlHttp: https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/sample-repo-demo
I confirmed that the repository was created and an HTTPS clone URL was issued.
3. Secure Cloning with Credential Helper
This is where CodeCommit really shines.
I asked the AI to configure Git authentication using only AWS CLI features, without the hassle of creating and registering an SSH key pair.
Instruction prompt
Please configure the AWS CLI credential helper and then clone the repository from earlier.
Execution log
The AI executed the credential-helper configuration and the clone in succession.
# Credential Helper configuration (this is the key part)
git config --global credential.helper '!aws codecommit credential-helper $@' && git config --global credential.UseHttpPath true
# Run the clone
git clone https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/sample-repo-demo
# Output
Cloning into 'sample-repo-demo'...
warning: You appear to have cloned an empty repository.
By injecting !aws codecommit credential-helper into the Git configuration, transparent authentication using IAM permissions was achieved. No password or similar input was requested at all.
4. Creating a File and Initial Git Setup
As preparation for repository operations, I created a README and configured the committer information.
Instruction prompt
Please create an initial template README.md and configure the Git user information.
Execution log
# Create README.md (generated by the write tool)
Creating: /home/user/work/sample-repo-demo/README.md
# Git config settings
git config user.email "user@example.com" && git config user.name "cm-user"
5. Creating a Branch and Pushing
I created a development branch (dev) and pushed it to the remote.
Instruction prompt
Please commit the changes and push them to the remote as the dev branch.
Execution log
# Commit
[dev (root-commit) 61b9601] Add initial README.md
# Push
git push -u origin dev
# Result
To https://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/sample-repo-demo
* [new branch] dev -> dev
branch 'dev' set up to track 'origin/dev'.
Because IAM authentication works behind the scenes, the push completed as smoothly as with ordinary Git commands.
6. Creating a Pull Request (PR)
An interesting behavior of Kiro-CLI: when instructed to "create a PR from Dev to Main", I observed it autonomously creating the nonexistent main branch.
Instruction prompt
Please create a pull request to merge the dev branch into the main branch.
Execution log
The AI determined that "the main branch does not exist" and carried out the following steps.
- Create the
mainbranch locally and push it - Switch back to the
devbranch - Create the PR via the CodeCommit API
# 1. Prepare the main branch (autonomous complementary action by the AI)
git checkout -b main && git push -u origin main
# 2. Return to the working branch
git checkout dev
# 3. Create the PR (AWS CLI)
aws codecommit create-pull-request \
--targets repositoryName=sample-repo-demo,sourceReference=dev,destinationReference=main \
--title "Merge dev to main" \
--description "Initial README.md" \
--region ap-northeast-1
As a result, the following PR was created successfully.
- Pull Request ID: 1
- Status: OPEN
7. Merging the PR
Finally, I merged the created PR.
Instruction prompt
Please merge the pull request that was created.
Execution log
Running aws cli command (using tool: aws):
Service name: codecommit
Operation name: merge-pull-request-by-fast-forward
Parameters:
- pull-request-id: "1"
- repository-name: "sample-repo-demo"
Region: ap-northeast-1
From the log, I confirmed that pullRequestStatus: CLOSED was shown and the merge was complete.
Summary: Re-evaluating CodeCommit × IAM Authentication
Through this verification, I reaffirmed the convenience of the revived CodeCommit.
In particular, the following two points are major strengths unique to CodeCommit as an AWS-native service.
-
IAM authentication with no token or key management
As thegit config ... credential-helperleft in the log shows, there is no need to issue and manage SSH private keys or Personal Access Tokens for Git operations.
Because the temporary session information obtained this time viaaws login, through a browser properly protected by MFA, could be used as-is by the AI agent as well, the risk of credential leakage can be minimized. -
High affinity with AI agents
When operating from a tool like Kiro-CLI, repository operations (creation, PRs, merges) are immediately possible as long as an IAM role is assigned.
Including contextual completion such as "create the branch if it doesn't exist", this demonstrated that it is a powerful option for automating operations.
CodeCommit, with its strong affinity with AWS environments and secure management through IAM authentication. I'm glad that this service has returned as an option once again.
