跨AWS账号CI/CD构建疑问：Account B如何访问Account A的CodeCommit

1. 给Account A的CodeCommit仓库配置跨账号资源策略 #

在Account A中，通过CloudFormation给目标CodeCommit仓库附加资源策略，明确允许Account B的流水线/CodeBuild执行角色访问仓库的核心权限（拉取代码、获取仓库信息等）。

CloudFormation片段示例：

Resources:
  AppCodeCommitRepo:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: my-backend-repo
      RepositoryPolicy:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              # 替换为Account B中CodePipeline/CodeBuild的执行角色ARN
              AWS: arn:aws:iam::[ACCOUNT_B_ID]:role/AccountB-CI-Execution-Role
            Action:
              - codecommit:GitPull
              - codecommit:GetRepository
              - codecommit:GetBranch
            Resource: !GetAtt AppCodeCommitRepo.Arn

2. 给Account B的CI执行角色添加访问权限 #

在Account B的CloudFormation模板中，给CodePipeline或CodeBuild的执行角色添加允许访问Account A CodeCommit仓库的权限，同时确保角色信任关系允许AWS CI服务扮演它。

IAM角色CloudFormation片段示例：

AccountBCodeBuildExecutionRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: CrossAccountCodeCommitAccess
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - codecommit:GitPull
                - codecommit:GetRepository
                - codecommit:GetBranch
              # 替换为Account A的CodeCommit仓库ARN
              Resource: arn:aws:codecommit:[REGION]:[ACCOUNT_A_ID]:my-backend-repo

3. 在Account B的流水线中配置跨账号CodeCommit源 #

直接在Account B的CodePipeline源阶段指定Account A的CodeCommit仓库信息，注意填写正确的仓库URL和ARN。

CodePipeline CloudFormation片段示例：

DevPipeline:
  Type: AWS::CodePipeline::Pipeline
  Properties:
    RoleArn: !GetAtt AccountBCodePipelineExecutionRole.Arn
    Stages:
      - Name: Source
        Actions:
          - Name: PullSourceFromAccountA
            ActionTypeId:
              Category: Source
              Owner: AWS
              Provider: CodeCommit
              Version: "1"
            Configuration:
              RepositoryName: my-backend-repo
              BranchName: develop
              # 替换为Account A的CodeCommit仓库HTTPS地址
              RepositoryUrl: https://git-codecommit.[REGION].amazonaws.com/v1/repos/my-backend-repo
            OutputArtifacts:
              - Name: SourceCodeArtifact
            RunOrder: 1

4. 关键验证步骤 #

• 部署Account A的CloudFormation栈，确保资源策略生效
• 部署Account B的CI栈后，手动触发流水线，检查源阶段是否成功拉取Account A的代码
• 如果使用VPC内的CodeBuild，需要配置CodeCommit的VPC端点，避免网络访问问题

这个方案完全满足你的需求：所有CI/CD资源都在Account B，删除栈或调整流水线时无需Account A介入，直接在开发账号内操作即可。

内容的提问来源于stack exchange，提问作者StrawHat