Onboard AWS CodeCommit

Connect AWS CodeCommit repositories to Cortex Cloud and manage the integration.

Prerequisites

Before you begin, ensure the following:

• Cortex Cloud user permissions: View/Edit access for Data Sources and Integrations. The AppSec Admin and Instance Administrator roles include this access
• AWS user permissions: Permissions to deploy the CloudFormation stack and create these resources:

  • cloudformation:CreateStack to deploy the integration template
  • iam:CreateRole to create the service role used for scanning
  • sns:CreateTopic to create notification triggers. Create a topic in each required region when the account and stack use different regions

Deployment requirement

During deployment, acknowledge CAPABILITY_IAM in the AWS Console. This authorizes CloudFormation to create the required IAM resources.

Scanning and policy permissions

The CloudFormation template configures the service role permissions required to scan repositories and evaluate findings against policies. No manual permission configuration is required.

For the complete list, see IAM Service Role permissions.

Onboarding steps

Step 1: Generate the template

1. Navigate to Settings → Data Sources & Integrations → + Add New.
2. Search for AWS CodeCommit, hover over it, and select Add. Select Add Another Instance if an instance is already onboarded.
3. Download and save the CloudFormation template (YAML file). You can also copy its link for your administrator.

Step 2: Create the CloudFormation stack

1. Log in to the AWS Console. Search for CloudFormation, then select Create stack.
2. In Specify template, select Upload a template file → Choose file. Upload the downloaded CloudFormation template, then select Next.
3. Provide a stack name and proceed through the configuration options.
4. Review the stack configuration, acknowledge IAM resource creation, then select Submit.

Step 3: Select repositories

1. On Data Sources & Integrations, filter for AWS CodeCommit and select the AWS CodeCommit data source.
2. Locate and right-click your newly created connector.

   Tip: The instance ID matches the stack ID in AWS.
3. Under Selection Options, choose the repositories to connect:

   • Permit all existing repositories
   • Permit all existing and future repositories
   • Select Choose from repository list, then select repositories
4. Click Save.

Verify integration

Verify the integration in Cortex Cloud or AWS:

• Cortex Cloud: On Data Sources & Integrations, filter for AWS CodeCommit. Select the data source and confirm your connector status is Connected.
• AWS: Open CloudFormation → Stacks. Confirm the integration shows Create Complete.

Validate repository scan health and view results

After connection, Cortex Cloud triggers a repository security scan. Scanning supports Infrastructure as Code (IaC) analysis, Software Composition Analysis (SCA), and Secrets detection.

1. Navigate to Modules → Application Security → Periodic scans.
2. Filter by Provider → AWS CodeCommit.
3. Verify your repository scan health is Completed.
4. Select the repository.
5. Review the findings summary and issues generated by repository policies.
6. Open a dedicated issue table, such as Secrets, to investigate and remediate issues.

Troubleshooting

• CloudFormation stack creation fails

  Stack status shows CREATE_FAILED or ROLLBACK_COMPLETE.

  • Verify IAM permissions for stack creation.
  • Check for naming conflicts with existing stacks.
  • Review CloudFormation events for specific errors.
  • Ensure CAPABILITY_IAM is granted.
• Connection status shows WARNING or ERROR

  The instance status is not Connected.

  • Verify the CloudFormation stack is in CREATE_COMPLETE state.
  • Check the IAM role trust relationship.
  • Ensure the CodeCommit repository exists and is accessible.
  • Verify cross-account access permissions.
• No scan results

  The repository is connected but tables show no findings.

  • Check that the repository contains scannable files.
  • Verify the scan job completed successfully.
  • Review scanner logs for errors.
  • Ensure the repository is not empty.

Manage the integration

Instance-level actions

1. Navigate to Settings → Data Sources & Integrations and search for AWS Code Commit.
2. Select the matching result.
3. Locate your instance from the displayed list → right-click → select an option:

   • Edit instance: Opens the onboarding wizard, where you can change the instance configuration
   • Delete instance: Deletes the instance and previous scan data
   • Copy entire row: Copies all row values to the clipboard

Repository-level actions

Right-click a connected repository to Set Scanned Branches, run a manual scan through Scan Repository, modify the Scan Configuration, or Remove Repository entirely. You can toggle specific scanners and manage PR behavior in Scan Configuration.

1. Locate your instance. See Instance-level actionsabove.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository → select the required action >→Save.