AWS CLIを使用せずにCodeCommitへSSHユーザーで接続する

2023/11/04

AWS CLIやアクセスキーID、シークレットアクセスキーなどを開発環境にセットアップせずに、CodeCommitへ接続したいケースでSSHユーザーとしての接続手順を確認しました。

環境

EC2 Amazon Linux 2023からAWS CLIをアンインストール
IAMユーザーにはAWS管理ポリシーAWSCodeCommitPowerUserをアタッチ

Gitのインストール

$ sudo yum -y install git

1 2	$ sudo yum -y install git

パブリックキーとプライベートキーの作成

$ ssh-keygen

1 2	$ ssh-keygen

Generating public/private rsa key pair.
Enter file in which to save the key (/home/ssm-user/.ssh/id_rsa):
Created directory '/home/ssm-user/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/ssm-user/.ssh/id_rsa
Your public key has been saved in /home/ssm-user/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:AqcCpaY9jmKSkpEyhuAabOuuaaYJyNou+Q6KuVHy53I ssm-user@ip-172-31-7-236.ap-northeast-1.compute.internal
The key's randomart image is:
+---[RSA 3072]----+
|  .              |
| o               |
|+.  . .          |
|B+   +           |
|X== . . S        |
|B%.o   .         |
|&amp;=o .            |
|&amp;X.oE            |
|^O=o.            |
+----[SHA256]-----+

Generating public/private rsa key pair.

Enter file in which to save the key (/home/ssm-user/.ssh/id_rsa):

Created directory '/home/ssm-user/.ssh'.

Enter passphrase (empty for no passphrase):

Enter same passphrase again:

Your identification has been saved in /home/ssm-user/.ssh/id_rsa

Your public key has been saved in /home/ssm-user/.ssh/id_rsa.pub

The key fingerprint is:

SHA256:AqcCpaY9jmKSkpEyhuAabOuuaaYJyNou+Q6KuVHy53I ssm-user@ip-172-31-7-236.ap-northeast-1.compute.internal

The key's randomart image is:

+---[RSA 3072]----+

| . |

| o |

|+. . . |

|B+ + |

|X== . . S |

|B%.o . |

|&=o . |

|&X.oE |

|^O=o. |

+----[SHA256]-----+

/home/ssm-user/.ssh/id_rsa
/home/ssm-user/.ssh/id_rsa.pub

の2つが作成されました。
検証につきパスフレーズはなしで作成しました。

パブリックキーをIAMユーザーに設定

$ cat /home/ssm-user/.ssh/id_rsa.pub

1 2	$ cat /home/ssm-user/.ssh/id_rsa.pub

パブリックキーを出力してコピーしました。

IAMユーザーのセキュリティ認証情報タブのAWS CodeCommitのSSH公開キーにパブリックキーをアップロードします。

パブリックキー出力結果をコピーして貼り付けました。

設定ファイルの作成

$ vim ~/.ssh/config

1 2	$ vim ~/.ssh/config

.sshディレクトリにconfigファイルを作成します。

公開キーに生成された公開キーIDをconfigファイルに設定します。

Host git-codecommit.*.amazonaws.com
  User APKARFDUEEVTO2DQEKVU
  IdentityFile ~/.ssh/id_rsa

Host git-codecommit.*.amazonaws.com

User APKARFDUEEVTO2DQEKVU

IdentityFile ~/.ssh/id_rsa

configファイルを保存しました。

$ chmod 600 ~/.ssh/config

1 2	$ chmod 600 ~/.ssh/config

パーミッションを変更しました。

$ ssh git-codecommit.ap-northeast-1.amazonaws.com

1 2	$ ssh git-codecommit.ap-northeast-1.amazonaws.com

テストしました。
東京リージョンにテストしてみました。

The authenticity of host 'git-codecommit.ap-northeast-1.amazonaws.com (54.240.225.207)' can't be established.
RSA key fingerprint is SHA256:Xk/WeYD/K/bnBybzhiuu4dWpBJtXPf7E30jHU7se4Ow.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'git-codecommit.ap-northeast-1.amazonaws.com' (RSA) to the list of known hosts.
You have successfully authenticated over SSH. You can use Git to interact with AWS CodeCommit. Interactive shells are not supported.Connection to git-codecommit.ap-northeast-1.amazonaws.com closed by remote host.
Connection to git-codecommit.ap-northeast-1.amazonaws.com closed.

The authenticity of host 'git-codecommit.ap-northeast-1.amazonaws.com (54.240.225.207)' can't be established.

RSA key fingerprint is SHA256:Xk/WeYD/K/bnBybzhiuu4dWpBJtXPf7E30jHU7se4Ow.

This key is not known by any other names

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added 'git-codecommit.ap-northeast-1.amazonaws.com' (RSA) to the list of known hosts.

You have successfully authenticated over SSH. You can use Git to interact with AWS CodeCommit. Interactive shells are not supported.Connection to git-codecommit.ap-northeast-1.amazonaws.com closed by remote host.

Connection to git-codecommit.ap-northeast-1.amazonaws.com closed.

初回接続なのでfingerprintの確認があったので、yesを入力して、successfullyで成功を確認しました。

既存リポジトリをクローンしてみる

$ git clone ssh://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/2048

1 2	$ git clone ssh://git-codecommit.ap-northeast-1.amazonaws.com/v1/repos/2048

既存のリポジトリをクローンしてみました。

Cloning into '2048'...
remote: Counting objects: 772, done.
Receiving objects: 100% (772/772), 454.57 KiB | 8.74 MiB/s, done.
Resolving deltas: 100% (429/429), done.