Menu
AWS CodeCommit
User Guide (API Version 2015-04-13)

Logging AWS CodeCommit API Calls with AWS CloudTrail

AWS CodeCommit is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in AWS CodeCommit. CloudTrail captures all API calls for AWS CodeCommit as events, including calls from the AWS CodeCommit console, your Git client, and from code calls to the AWS CodeCommit APIs. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for AWS CodeCommit. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail, you can determine the request that was made to AWS CodeCommit, the IP address from which the request was made, who made the request, when it was made, and additional details.

To learn more about CloudTrail, see the AWS CloudTrail User Guide.

AWS CodeCommit Information in CloudTrail

CloudTrail is enabled on your AWS account when you create the account. When activity occurs in AWS CodeCommit, that activity is recorded in a CloudTrail event along with other AWS service events in Event history. You can view, search, and download recent events in your AWS account. For more information, see Viewing Events with CloudTrail Event History.

For an ongoing record of events in your AWS account, including events for AWS CodeCommit, create a trail. A trail enables CloudTrail to deliver log files to an Amazon S3 bucket. By default, when you create a trail in the console, the trail applies to all regions. The trail logs events from all regions in the AWS partition and delivers the log files to the Amazon S3 bucket that you specify. Additionally, you can configure other AWS services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see:

When CloudTrail logging is enabled in your AWS account, API calls made to AWS CodeCommit actions are tracked in CloudTrail log files, where they are written with other AWS service records. CloudTrail determines when to create and write to a new file based on a time period and file size.

All AWS CodeCommit actions are logged by CloudTrail, including some (such as GetObjectIdentifier) that are not currently documented in the AWS CodeCommit API Reference but are instead referenced as access permissions and documented in AWS CodeCommit Permissions Reference. For example, calls to the ListRepositories (in the AWS CLI, aws codecommit list-repositories), CreateRepository (aws codecommit create-repository) and PutRepositoryTriggers (aws codecommit put-repository-triggers) actions generate entries in the CloudTrail log files, as well as Git client calls to GitPull and GitPush. In addition, if you have an AWS CodeCommit repository configured as a source for a pipeline in AWS CodePipeline, you will see calls to AWS CodeCommit access permission actions such as UploadArchive from AWS CodePipeline. Since AWS CodeCommit uses AWS Key Management Service to encrypt and decrypt repositories, you will also see calls from AWS CodeCommit to Encrypt and Decrypt actions from AWS KMS in CloudTrail logs.

Every log entry contains information about who generated the request. The user identity information in the log entry helps you determine the following:

  • Whether the request was made with root or IAM user credentials

  • Whether the request was made with temporary security credentials for a role or federated user, or made by an assumed role

  • Whether the request was made by another AWS service

For more information, see the CloudTrail userIdentity Element.

You can store your log files in your Amazon S3 bucket for as long as you want, but you can also define Amazon S3 lifecycle rules to archive or delete log files automatically. By default, your log files are encrypted with Amazon S3 server-side encryption (SSE).

Understanding AWS CodeCommit Log File Entries

CloudTrail log files can contain one or more log entries. Each entry lists multiple JSON-formatted events. A log event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. Log entries are not an ordered stack trace of the public API calls, so they do not appear in any specific order.

Note

This example has been formatted for improved readability. In a CloudTrail log file, all entries and events are concatenated into a single line. In addition, this example has been limited to a single AWS CodeCommit entry. In a real CloudTrail log file, you will see entries and events from multiple AWS services.

Example: A log entry for listing AWS CodeCommit repositories

The following example shows a CloudTrail log entry that demonstrates the ListRepositories action.

Note

Although ListRepositories returns a list of repositories, non-mutable responses are not recorded in CloudTrail logs, so responseElements is shown as null in the log file.

{ "eventVersion":"1.05", "userIdentity": { "type":"IAMUser", "principalId":"AIDACKCEVSQ6C2EXAMPLE", "arn":"arn:aws:iam::444455556666:user/Mary_Major", "accountId":"444455556666", "accessKeyId":"AKIAIOSFODNN7EXAMPLE", "userName":"Mary_Major" }, "eventTime":"2016-12-14T17:57:36Z", "eventSource":"codecommit.amazonaws.com", "eventName":"ListRepositories", "awsRegion":"us-east-1", "sourceIPAddress":"203.0.113.12", "userAgent":"aws-cli/1.10.53 Python/2.7.9 Windows/8 botocore/1.4.43", "requestParameters":null, "responseElements":null, "requestID":"cb8c167e-EXAMPLE", "eventID":"e3c6f4ce-EXAMPLE", "readOnly":true, "eventType":"AwsApiCall", "apiVersion":"2015-04-13", "recipientAccountId":"444455556666" }

Example: A log entry for creating an AWS CodeCommit repository

The following example shows a CloudTrail log entry that demonstrates the CreateRepository action in the US East (Ohio) Region region.

{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "arn": "arn:aws:iam::444455556666:user/Mary_Major", "accountId": "444455556666", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName":"Mary_Major" }, "eventTime": "2016-12-14T18:19:15Z", "eventSource": "codecommit.amazonaws.com", "eventName": "CreateRepository", "awsRegion": "us-east-2", "sourceIPAddress": "203.0.113.12", "userAgent": "aws-cli/1.10.53 Python/2.7.9 Windows/8 botocore/1.4.43", "requestParameters": { "repositoryDescription": "Creating a demonstration repository.", "repositoryName": "MyDemoRepo" }, "responseElements": { "repositoryMetadata": { "arn": "arn:aws:codecommit:us-east-2:111122223333:MyDemoRepo", "creationDate": "Dec 14, 2016 6:19:14 PM", "repositoryId": "8afe792d-EXAMPLE", "cloneUrlSsh": "ssh://git-codecommit.us-east-2.amazonaws.com/v1/repos/MyDemoRepo", "repositoryName": "MyDemoRepo", "accountId": "111122223333", "cloneUrlHttp": "https://git-codecommit.us-east-2.amazonaws.com/v1/repos/MyDemoRepo", "repositoryDescription": "Creating a demonstration repository.", "lastModifiedDate": "Dec 14, 2016 6:19:14 PM" } }, "requestID": "d148de46-EXAMPLE", "eventID": "740f179d-EXAMPLE", "readOnly": false, "resources": [ { "ARN": "arn:aws:codecommit:us-east-2:111122223333:MyDemoRepo", "accountId": "111122223333", "type": "AWS::CodeCommit::Repository" } ], "eventType": "AwsApiCall", "apiVersion": "2015-04-13", "recipientAccountId": "111122223333" }

Examples: Log entries for Git pull calls to an AWS CodeCommit repository

The following example shows a CloudTrail log entry that demonstrates the GitPull action where the local repo is already up-to-date.

{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "arn": "arn:aws:iam::444455556666:user/Mary_Major", "accountId": "444455556666", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName":"Mary_Major" }, "eventTime": "2016-12-14T18:19:15Z", "eventSource": "codecommit.amazonaws.com", "eventName": "GitPull", "awsRegion": "us-east-2", "sourceIPAddress": "203.0.113.12", "userAgent": "git/2.11.0.windows.1", "requestParameters": null, "responseElements": null, "additionalEventData": { "protocol": "HTTP", "dataTransferred": false, "repositoryName": "MyDemoRepo", "repositoryId": "8afe792d-EXAMPLE", }, "requestID": "d148de46-EXAMPLE", "eventID": "740f179d-EXAMPLE", "readOnly": true, "resources": [ { "ARN": "arn:aws:codecommit:us-east-2:111122223333:MyDemoRepo", "accountId": "111122223333", "type": "AWS::CodeCommit::Repository" } ], "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }

The following example shows a CloudTrail log entry that demonstrates the GitPull action where the local repo is not up-to-date and so data is transferred from the AWS CodeCommit repository to the local repo.

{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "arn": "arn:aws:iam::444455556666:user/Mary_Major", "accountId": "444455556666", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName":"Mary_Major" }, "eventTime": "2016-12-14T18:19:15Z", "eventSource": "codecommit.amazonaws.com", "eventName": "GitPull", "awsRegion": "us-east-2", "sourceIPAddress": "203.0.113.12", "userAgent": "git/2.10.1", "requestParameters": null, "responseElements": null, "additionalEventData": { "protocol": "HTTP", "capabilities": [ "multi_ack_detailed", "side-band-64k", "thin-pack" ], "dataTransferred": true, "repositoryName": "MyDemoRepo", "repositoryId": "8afe792d-EXAMPLE", "shallow": false }, "requestID": "d148de46-EXAMPLE", "eventID": "740f179d-EXAMPLE", "readOnly": true, "resources": [ { "ARN": "arn:aws:codecommit:us-east-2:111122223333:MyDemoRepo", "accountId": "111122223333", "type": "AWS::CodeCommit::Repository" } ], "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }

Example: A log entry for a successful push to an AWS CodeCommit repository

The following example shows a CloudTrail log entry that demonstrates a successful GitPush action. The GitPush action appears twice in a log entry for a successful push.

{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "arn": "arn:aws:iam::444455556666:user/Mary_Major", "accountId": "444455556666", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName":"Mary_Major" }, "eventTime": "2016-12-14T18:19:15Z", "eventSource": "codecommit.amazonaws.com", "eventName": "GitPush", "awsRegion": "us-east-2", "sourceIPAddress": "203.0.113.12", "userAgent": "git/2.10.1", "requestParameters": null, "responseElements": null, "additionalEventData": { "protocol": "HTTP", "dataTransferred": false, "repositoryName": "MyDemoRepo", "repositoryId": "8afe792d-EXAMPLE", }, "requestID": "d148de46-EXAMPLE", "eventID": "740f179d-EXAMPLE", "readOnly": true, "resources": [ { "ARN": "arn:aws:codecommit:us-east-2:111122223333:MyDemoRepo", "accountId": "111122223333", "type": "AWS::CodeCommit::Repository" } ], "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }, { "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "arn": "arn:aws:iam::444455556666:user/Mary_Major", "accountId": "444455556666", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName":"Mary_Major" }, "eventTime": "2016-12-14T18:19:15Z", "eventSource": "codecommit.amazonaws.com", "eventName": "GitPush", "awsRegion": "us-east-2", "sourceIPAddress": "203.0.113.12", "userAgent": "git/2.10.1", "requestParameters": { "references": [ { "commit": "100644EXAMPLE", "ref": "refs/heads/master" } ] }, "responseElements": null, "additionalEventData": { "protocol": "HTTP", "capabilities": [ "report-status", "side-band-64k" ], "dataTransferred": true, "repositoryName": "MyDemoRepo", "repositoryId": "8afe792d-EXAMPLE", }, "requestID": "d148de46-EXAMPLE", "eventID": "740f179d-EXAMPLE", "readOnly": false, "resources": [ { "ARN": "arn:aws:codecommit:us-east-2:111122223333:MyDemoRepo", "accountId": "111122223333", "type": "AWS::CodeCommit::Repository" } ], "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }