Sushil Verma

Sushil Verma

A DevOps Practitioner, and Blockchain visionary with 11+ years of Software Development experience as a DevOps Engineering, Cloud Platform Specialist, Tech Lead, Cloud SME, Software Engineer, and fixer of broken project modules.

AWS CodeCommit - Setup SSH Connection

Posted: | Last updated: | 5 minute read

SSH provides secure, key-based authentication to AWS CodeCommit repositories. Unlike HTTPS which requires entering credentials, SSH uses cryptographic keys—more secure and more convenient once configured.

This guide walks you through setting up SSH access to CodeCommit, from generating keys to troubleshooting connection issues.

Why Use SSH for CodeCommit?

No password prompts: Authentication happens automatically with your SSH key.

More secure: Private key never leaves your machine—no credentials stored in config files.

Better for automation: CI/CD pipelines and scripts work seamlessly without credential management.

Multiple identities: Use different SSH keys for different repositories or accounts.

Prerequisites

AWS IAM User: You need an IAM user (not root account).

IAM Permissions: Attach AWSCodeCommitPowerUser policy or similar.

Git installed: Verify with git --version.

SSH client: Pre-installed on Linux/macOS. Windows 10+ includes OpenSSH.

Step-by-Step SSH Setup

Step 1: Generate SSH Key Pair

On Linux/macOS/Windows:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Prompts:

  1. File location: Press Enter for default (~/.ssh/id_rsa)
  2. Passphrase: Optional—adds extra security but requires entering when using key

Output:

  • Private key: ~/.ssh/id_rsa (keep secret!)
  • Public key: ~/.ssh/id_rsa.pub (safe to share)

View public key:

cat ~/.ssh/id_rsa.pub

Starts with ssh-rsa AAAAB3Nza...

Step 2: Upload Public Key to AWS IAM

Via AWS Console:

  1. Sign in to AWS Console
  2. Navigate to IAM → Users
  3. Select your user
  4. Click Security credentials tab
  5. Scroll to SSH keys for AWS CodeCommit
  6. Click Upload SSH public key
  7. Paste contents of ~/.ssh/id_rsa.pub
  8. Click Upload SSH public key

Important: Copy the SSH Key ID shown—looks like APKAEIBAERJR2EXAMPLE.

Via AWS CLI:

aws iam upload-ssh-public-key \
  --user-name your-username \
  --ssh-public-key-body "$(cat ~/.ssh/id_rsa.pub)"

Save the SSH Key ID from the response.

Step 3: Configure SSH Config File

Create/edit SSH config:

nano ~/.ssh/config

Add CodeCommit configuration:

Host git-codecommit.*.amazonaws.com
  User APKAEIBAERJR2EXAMPLE
  IdentityFile ~/.ssh/id_rsa

Replace APKAEIBAERJR2EXAMPLE with your actual SSH Key ID from Step 2.

Set correct permissions (important!):

chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

Step 4: Test SSH Connection

ssh git-codecommit.us-east-1.amazonaws.com

Expected output:

You have successfully authenticated over SSH. You can use Git to interact with AWS CodeCommit.
Connection to git-codecommit.us-east-1.amazonaws.com closed by remote host.
Connection to git-codecommit.us-east-1.amazonaws.com closed.

If you see this, SSH is configured correctly!

Cloning Repository via SSH

Get SSH Clone URL

Via AWS Console:

  1. Open CodeCommit Console
  2. Select your repository
  3. Click Clone URL → Clone SSH
  4. URL format: ssh://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo

Clone Repository

git clone ssh://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo

Git uses your SSH key automatically—no password needed!

Working with Existing Repository

Change HTTPS to SSH

Check current remote:

git remote -v

If showing HTTPS URL, change to SSH:

git remote set-url origin ssh://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo

Verify:

git remote -v

Should show SSH URL.

Using Multiple SSH Keys

Scenario: Different Keys for Different Repositories

Generate second key:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/codecommit-work

Upload public key (~/.ssh/codecommit-work.pub) to IAM—get new SSH Key ID.

Update SSH config:

Host codecommit-personal
  HostName git-codecommit.us-east-1.amazonaws.com
  User APKAEIBAERJR2EXAMPLE
  IdentityFile ~/.ssh/id_rsa

Host codecommit-work
  HostName git-codecommit.us-east-1.amazonaws.com
  User APKBWORKKEY12EXAMPLE
  IdentityFile ~/.ssh/codecommit-work

Clone using alias:

git clone ssh://codecommit-personal/v1/repos/personal-repo
git clone ssh://codecommit-work/v1/repos/work-repo

SSH Key Security

Protect Private Keys

Never share your private key (id_rsa).

Correct permissions:

chmod 600 ~/.ssh/id_rsa

Use Passphrases

Add passphrase when generating keys:

ssh-keygen -t rsa -b 4096 -C "email@example.com"

Enter passphrase when prompted.

Use ssh-agent to avoid repeated prompts:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_rsa

Enter passphrase once—agent remembers for the session.

macOS keychain integration:

ssh-add --apple-use-keychain ~/.ssh/id_rsa

Update ~/.ssh/config:

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_rsa

Rotate Keys Regularly

Best practice: Rotate SSH keys every 90-180 days.

  1. Generate new key pair
  2. Upload new public key to IAM
  3. Update SSH config with new key
  4. Test connection
  5. Delete old key from IAM

Troubleshooting SSH Connection

Permission Denied (publickey)

Problem: SSH authentication fails.

Solutions:

Check SSH Key ID:

cat ~/.ssh/config

Verify User matches your IAM SSH Key ID.

List IAM SSH keys:

aws iam list-ssh-public-keys --user-name your-username

Ensure key is Active.

Test with verbose output:

ssh -v git-codecommit.us-east-1.amazonaws.com

Look for which key SSH is trying to use.

Specify key explicitly:

ssh -i ~/.ssh/id_rsa git-codecommit.us-east-1.amazonaws.com

Connection Timeout

Problem: SSH connection hangs or times out.

Solutions:

Check region: Ensure SSH URL matches your repository region (us-east-1, eu-west-1, etc.).

Corporate firewall: Port 22 might be blocked. Try HTTPS instead or contact IT.

AWS endpoint: Verify git-codecommit.REGION.amazonaws.com is accessible:

ping git-codecommit.us-east-1.amazonaws.com

Wrong SSH Key Used

Problem: Multiple SSH keys, wrong one being used.

Solution: Update ~/.ssh/config to specify exact key:

Host git-codecommit.*.amazonaws.com
  IdentityFile ~/.ssh/codecommit-specific-key
  IdentitiesOnly yes

IdentitiesOnly yes prevents SSH from trying other keys.

Could Not Resolve Hostname

Problem: DNS can’t resolve CodeCommit hostname.

Solution:

Check spelling: Ensure correct region in URL.

Test DNS:

nslookup git-codecommit.us-east-1.amazonaws.com

Use public DNS (8.8.8.8) if corporate DNS has issues.

SSH vs HTTPS Comparison

Feature SSH HTTPS
Initial setup More complex Simpler
Daily use Easier (no passwords) Requires credentials
Security More secure Secure
Automation Better Requires credential storage
Firewall Port 22 (often blocked) Port 443 (rarely blocked)
Multiple accounts Easier with config Harder

Recommendation: SSH for developer machines, HTTPS for CI/CD or restricted networks.

CI/CD with SSH Keys

GitHub Actions Example

Store private key as secret:

  1. Go to GitHub repository settings
  2. Secrets and variables → Actions
  3. New secret: CODECOMMIT_SSH_KEY
  4. Paste private key content

Workflow file:

name: Deploy

on: [push]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          echo "$" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan git-codecommit.us-east-1.amazonaws.com >> ~/.ssh/known_hosts
          
      - name: Clone CodeCommit repo
        run: |
          git clone ssh://git-codecommit.us-east-1.amazonaws.com/v1/repos/my-repo

Best Practices

Use Dedicated SSH Keys

Don’t reuse personal SSH keys for work repositories.

Create purpose-specific keys:

  • codecommit-personal
  • codecommit-work
  • codecommit-ci

Document Your Setup

Keep notes on which SSH Key ID corresponds to which key file.

Team documentation: Share setup instructions with team members.

Monitor SSH Key Usage

Regularly audit IAM SSH keys:

aws iam list-ssh-public-keys --user-name your-username

Delete unused keys:

aws iam delete-ssh-public-key \
  --user-name your-username \
  --ssh-public-key-id APKAEXAMPLEKEYID

Backup SSH Keys Securely

Store private keys in password manager or encrypted vault.

Don’t store in cloud sync folders (Dropbox, Google Drive) unencrypted!

Wrapping Up

SSH access to AWS CodeCommit provides secure, convenient authentication:

  1. Generate SSH key pair with ssh-keygen
  2. Upload public key to AWS IAM
  3. Configure SSH config with SSH Key ID
  4. Test connection with ssh git-codecommit.REGION.amazonaws.com
  5. Clone repositories using SSH URLs

Once configured, SSH authentication is seamless—no passwords, no tokens, just secure key-based access. Perfect for daily development work and automation pipelines!

You may also enjoy