A Guide to Create Cross-Account AWS CodePipeline

Overview

In today’s dynamic IT landscape, organizations must maintain secure and isolated AWS environments for distinct application stages, such as development and production. To overcome these challenges, this blog post explores the process of setting up a Cross-Account AWS CodePipeline that connects to an AWS CodeCommit Repository located in a different AWS account. The separation of environments is crucial for resource segregation and heightened security measures. We will explore the steps and best practices to establish this innovative solution and demonstrate how technology can bridge the gap between isolated AWS accounts, facilitating a controlled and secure workflow for AWS resources and applications.

Introduction

In the domain of AWS infrastructure and application development, a fundamental requirement is the creation of distinct and dedicated environments, primarily centered around the development (dev) and production stages. Organizations often establish multiple AWS accounts to maintain the highest resource isolation and security standards, each designated for specific application phases. In this technical exploration, we’ll focus on two AWS accounts: one dedicated to development and the other to production.

The AWS CodePipeline will be created in the dev account, while the AWS CodeCommit repository is in the production account.

Step-by-Step Guide

1. First, we must create Customer-managed keys in an AWS KMS service in the dev account.Customer-managed keys are beneficial when we want to grant cross-account access, where we will be configuring the policy of a customer-managed key to allow access from another account.

• Choose Customer managed keys in the AWS KMS console.
• Click on Create key, choose Symmetric under key type, and Encrypt and Decrypt under key usage.
• Choose key AWS KMS under key material origin and Single-Region under Regionality.
• Then click on Next.

• Enter an alias and description, and click on Next.

• In Define Key Administrative Permissions, choose AWS IAM user or any other users/groups who want to act as administrator for the key, and choose Next.

• In Define Key Usage Permissions, select the service role used for the Pipeline, build, and deploy.
• Click on Add another AWS account, type the production account ID (account with a codecommit repository), and choose Next.

2. Now, we need to create an Amazon S3 bucket and provide access to the production account (account that has a codecommit repository) access to it.

• We need to Create an Amazon S3 bucket for Pipeline to store Artifacts.
• Under permission, add the following Bucket policy in the Amazon S3 bucket.

3. Add the following policy to the AWS CodePipeline service role in the dev account (where codepipeline will be created) to access the production account and the AWS CodeCommit repositories.

4. Now, we need to create a policy and role in the production account (where codecommit repository resides)

• Go to the AWS IAM console, choose Policy, and click Create Policy.
• Select JSON, add the following code, and replace the resources arn.

• Enter a name and click on Create policy.

5. We need to create an AWS IAM role for cross-account access

• Choose Role in the AWS IAM console and click on the Create role
• Under the selected Trusted entity type, choose AWS account.
• Choose Another AWS account under an AWS account, enter the account ID of the dev account (codepipeline account), and click next.

• Search for AWSCodeCommitFullAccess and add the above policy created in the above step.
• Add the proper name to the role and click on Create a role.

6. We can do the cross-account creation of the Pipeline in CLI

• To create a pipeline, we need to write a JSON file

example: pipeline.json

• Run the below command to create the pipeline

• If the pipeline fails in the build stage:
• Go to the AWS CodePipeline console and click on Edit
• Click on Edit Stage

• Again, Click on Edit

• Under the project name, click on Create Project and create a new project.
• After creation, change the BUILD_PROJECT_NAME in the .json file and run the command again for the pipeline to create.

Conclusion

By following these steps and best practices, we can efficiently set up a Cross-Account AWS CodePipeline, promoting a secure and well-organized workflow for AWS resources and applications. This approach ensures that the development and production environments remain isolated, contributing to a robust and controlled AWS architecture.

Drop a query if you have any questions regarding Cross-Account AWS CodePipeline and we will get back to you quickly.

About CloudThat

CloudThat is an official AWS (Amazon Web Services) Advanced Consulting Partner and Training partner, AWS Migration Partner, AWS Data and Analytics Partner, AWS DevOps Competency Partner, Amazon QuickSight Service Delivery Partner, Amazon EKS Service Delivery Partner, and Microsoft Gold Partner, helping people develop knowledge of the cloud and help their businesses aim for higher goals using best-in-industry cloud computing practices and expertise. We are on a mission to build a robust cloud computing ecosystem by disseminating knowledge on technological intricacies within the cloud space. Our blogs, webinars, case studies, and white papers enable all the stakeholders in the cloud computing sphere.

To get started, go through our Consultancy page and Managed Services Package, CloudThat’s offerings.