AWS CodeCommit
A fully-managed private Git host inside your AWS account, governed by IAM. Here's what CodeCommit is good for, what it costs, how it connects to the rest of your CI/CD toolchain, and the mistakes Design Beaver catches as you draw.
What CodeCommit is
CodeCommit hosts private Git repositories inside your AWS account. You use it with a normal Git client — clone, commit, push, pull over HTTPS or SSH — but there are no servers, storage volumes, or repository-level accounts to manage. Access is controlled entirely through IAM: a principal with the right CodeCommit permissions can use the repo, and one without them can’t. It’s built to sit at the source end of an AWS-native toolchain, feeding CodePipeline and CodeBuild and emitting repository events other services react to.
One thing to get straight first, because its status has flip-flopped: AWS de-emphasized CodeCommit for new customers in July 2024, then returned it to full general availability on 24 November 2025 — new sign-ups reopened and new accounts can create repositories again. It’s GA and being invested in, not deprecated.
Design Beaver models CodeCommit as an external, regional source-control node, so it validates its connections and the IAM each one needs as you draw.
When to use CodeCommit (and when not to)
Reach for CodeCommit when you want a private Git host that’s part of AWS and governed by IAM, with nothing to run or patch yourself. It’s the natural source provider for an AWS-native pipeline: keep the repo in the same account and Region as CodePipeline, CodeBuild, and the rest of the toolchain and there’s no third-party Git integration to wire up. It also fits when data-residency or compliance rules require the repository to stay in a specific Region, or when you need private, no-internet Git access from inside a VPC over an interface VPC endpoint.
Don’t reach for it when your team already lives in GitHub, GitLab, or Bitbucket and depends on that ecosystem — Actions, a marketplace, social coding, a large community. CodeCommit deliberately has none of that. It’s also the wrong choice when you want rich built-in issue tracking, wikis, or a GitHub-grade web PR experience, or when collaborators without AWS identities need to access the repo — every user is an IAM principal. And if you need large binary assets today, check the state of Git LFS support before you commit to it rather than assuming it’s there.
Variants: how you authenticate, not repository tiers
There are no repository “tiers” or size classes — a repo is a repo. The one real decision is how your Git client authenticates, and for federated or SSO organizations git-remote-codecommit is the path that avoids static secrets.
| Option | What it is |
|---|---|
| HTTPS with Git credentialsdefault | Generate a service-specific username/password (Git credentials) for an IAM user in the console, then clone/push over HTTPS. Simplest for individuals; works with any Git client and credential manager. Requires an IAM user (not a role), so less suited to federated-only orgs. |
| HTTPS with git-remote-codecommit (GRC) | A helper that lets Git authenticate using your normal AWS credentials/role (including short-lived, federated, or SSO credentials) instead of static Git credentials. Preferred when you use IAM roles or IAM Identity Center rather than IAM users. |
| SSH key pairs | Upload an SSH public key to an IAM user and connect over SSH. Familiar to teams that already manage SSH keys, but like the Git-credentials option it is tied to an IAM user rather than a role. |
CodeCommit pricing in plain English
Billing works in an unusual way — you pay per active user per month, not per repository. So the repository count is free to grow, and the number you actually watch is how many distinct AWS identities touch CodeCommit in a month.
Billed per active user per month, not per repository. An 'active user' is any unique AWS identity (IAM user/role, federated user, or root) that accesses CodeCommit in the month via Git, console, CLI, or SDK. Beyond the free tier it is $1 per active user per month, and each paid active user adds an allowance of 10 GB-month of storage and 2,000 Git requests. There is no charge for the number of repositories.
| Option | Representative rate |
|---|---|
| https-git-credentials | $1.00 per active user per month beyond the free tier (same price regardless of auth method). |
Free tier
- 5 active users per month, 50 GB of storage, and 10,000 Git requests per month — at no charge
- This CodeCommit free-tier allowance is available indefinitely to both new and existing customers and does not expire at the end of the standard 12-month AWS Free Tier
Keeping the bill down
- Because billing is per active user, consolidating occasional automation onto shared roles (rather than many rarely-used human identities) keeps the active-user count down
- Service roles for CodePipeline/CodeBuild that access repositories also count as active users — factor CI/CD identities into the estimate, not just developers
Global list price (uniform across CodeCommit Regions; verify on the pricing page). Rates as of 2026-07. Verify at aws.amazon.com/codecommit/pricing before using for real estimates — the per-active-user rate and free-tier allowances are not kept in sync here, and actual cost also depends on how many distinct identities touch CodeCommit each month.
How CodeCommit connects to other services
This is where the connection detail matters more than usual, because most CodeCommit edges aren’t “attach a role to CodeCommit” — the permission lives on the other side. Design Beaver models each edge and what it actually needs to be correct.
CodeCommit is the source stage of a CodePipeline pipeline — a push to the tracked branch starts the pipeline and hands the commit to the downstream build/deploy stages
A CodeBuild project uses the CodeCommit repository as its source, cloning the specified branch/commit into the build environment when a build runs
CodeCommit emits repository activity to EventBridge as 'CodeCommit Repository State Change' and 'CodeCommit Pull Request State Change' events (source 'aws.codecommit'), so you can route pushes, branch/tag changes, and PR activity to any EventBridge target
Fan repository activity out as notifications — either a CodeCommit repository trigger that publishes to an SNS topic on events like a push, or a Developer Tools notification rule that sends repository/PR events to an SNS topic
A CodeCommit repository trigger invokes a Lambda function on repository events (for example running a lint/policy check on every push, or custom notification logic)
Associating a CodeCommit repository with Amazon CodeGuru Reviewer had it automatically review pull requests and post recommendations on the changed Java or Python code
- Laptop
A developer's machine clones, pushes, and pulls the repository with a standard Git client over HTTPS or SSH — the everyday way people interact with CodeCommit
The thing to internalize: for the CI/CD edges, CodeCommit itself needs no execution role. CodePipeline and CodeBuild read the repo using their own service roles — you grant actions like codecommit:GitPull and codecommit:GetBranch on the pipeline or build side, not on CodeCommit. SNS and Lambda are reached through a resource policy on the target: the topic’s access policy, or the function’s invoke permission. And to react to pushes, prefer the repository’s EventBridge events (source: aws.codecommit) over the older repository triggers or pipeline polling — it fires immediately, and the CodePipeline console sets the rule up for you.
What CodeCommit can’t connect to
Some edges look reasonable on a canvas but don’t exist in AWS. Design Beaver flags them instead of letting you draw a diagram that can’t be built.
CodeCommit is fully managed and does not expose or sync to a customer S3 bucket — there is no 'CodeCommit stores its data in your S3' edge and no built-in repository-to-S3 mirror. If you want repository contents in S3, that is a job you build (for example a CodeBuild/Lambda step that reads the repo and writes an archive to S3), not a direct CodeCommit-to-S3 connection.
CodeCommit is a Git host, not a deployment service — it does not push, copy, or deploy code onto an EC2 instance. Getting source onto a server is done by pulling from the repository on the instance, or by a pipeline (CodePipeline + CodeDeploy/CodeBuild); there is no direct CodeCommit-to-EC2 deploy edge.
Anti-patterns Design Beaver catches
These are the CodeCommit mistakes that pass a diagram review but bite later — the ones the validation engine flags as you draw.
Wiring pipelines and automation to CodeCommit by polling the repository instead of using EventBridge events
Why it breaksPolling adds latency (changes are noticed on a schedule, not immediately) and does needless work; it is the legacy change-detection path CodePipeline kept only for backward compatibility
Do this insteadTrigger pipelines and automation from the repository's 'CodeCommit Repository State Change' EventBridge events, which fire immediately on a push — the CodePipeline console sets this up by default
Handing individual developers long-lived IAM users with static Git credentials for repository access
Why it breaksStatic credentials are long-lived secrets that get copied to laptops and rarely rotated; they also don't fit a federated/SSO identity model
Do this insteadUse git-remote-codecommit (GRC) so Git authenticates with short-lived AWS role/SSO credentials, and scope each identity's CodeCommit actions to least privilege
Treating CodeCommit as a durable backup or system of record with no copy anywhere else
Why it breaksIt is a single-Region managed repository; an accidental force-push or repository deletion has no external safety net if nothing mirrors it
Do this insteadKeep a mirror/backup (another Git remote, or scheduled bundles archived to S3) and protect key branches with approval rules, rather than relying on the single hosted copy
Gotchas that bite in production
- Billing is per active user, not per repo. Automation identities count too — the service roles CodePipeline and CodeBuild use to read a repo each show up as active users. A “small” setup can have more billable identities than you’d guess, so include CI/CD principals in your estimate, not just developers.
- CodeGuru Reviewer PR review is legacy-only now. CodeCommit used to integrate with Amazon CodeGuru Reviewer for automatic pull-request analysis on Java and Python. As of 7 November 2025 you can no longer create new CodeGuru Reviewer repository associations — existing ones keep working, but it isn’t an option for a new repo. Don’t design new architectures around it.
- Polling is the slow legacy path. If a pipeline seems to notice pushes on a delay, it’s probably polling the repository. Switch it to EventBridge-based change detection for immediate, cheaper triggering.
- It’s a single-Region hosted copy, not a backup. An accidental force-push or a deleted repository has no external safety net unless you mirror it — another Git remote, or scheduled bundles archived to S3 — and protect key branches with approval rules.
- Everything is IAM. There are no separate CodeCommit accounts and no anonymous access. Every collaborator and every piece of automation needs an IAM principal with the right CodeCommit actions.
- Private VPC access exists. In-VPC clients can reach CodeCommit over an interface VPC endpoint without traversing the public internet — useful for locked-down networks.
Further reading
Frequently asked questions
Is AWS CodeCommit deprecated?
When should you use AWS CodeCommit?
How much does AWS CodeCommit cost?
Can AWS CodeCommit trigger a CodePipeline?
Validate your CodeCommit architecture as you draw
Design Beaver checks your AWS design in real time — missing queues, invalid connections, and security anti-patterns, caught before you ship. It’s live in beta, free, and runs in your browser with no account.
Open the app →Prefer email? Get new features in your inbox: