feat: AWS CodeCommit support

[taraspos]

Summary

Add support of AWS CodeCommit with IAM role auth (fluxcd/pkg#1142).

As part of:

• Support AWS CodeCommit Access with IAM Role flux2#5866

[matheuscscp]

Thanks @taraspos!

Please test this PR e2e with a real AWS account and post here some evidence 🙏

[taraspos]

Testing steps

1. Created AWS EKS Pod Identity for namespace=flux-system and serviceaccount=source-controller and permissions:

   {
       "Statement": [
           {
               "Action": "codecommit:GitPull",
               "Effect": "Allow",
               "Resource": "arn:aws:codecommit:us-east-1:*:taras-test-123",
               "Sid": "CodeCommitPullAccess"
           }
       ],
       "Version": "2012-10-17"
   }

2. Updated source-controller pod to use image built from this PR and pick up pod identity settings (in us-west-2)

3. Created CodeCommit new repository taras-test-123 (in us-east-1)

4. Created new GitRepository object

   apiVersion: source.toolkit.fluxcd.io/v1
   kind: GitRepository
   metadata:
     name: taras-test-123
     namespace: flux-system
   spec:
     interval: 1m0s
     ref:
       branch: main
     timeout: 60s
     url: https://git-codecommit.us-east-1.amazonaws.com/v1/repos/taras-test-123
     provider: aws

5. Check repo object - success ✅

   ➜  k -n flux-system get gitrepositories.source.toolkit.fluxcd.io
   NAME             URL                                                                           AGE     READY   STATUS
   taras-test-123   https://git-codecommit.us-east-1.amazonaws.com/v1/repos/taras-test-123        82s     True    stored artifact for revision 'main@sha1:3e1f9032f6b6b9b77bf79d1bc5be93147d987873'
   

6. Check CloudTrail event - success ✅

   {
       "eventVersion": "1.11",
       "userIdentity": {
           "type": "AssumedRole",
           "principalId": "redacted",
           "arn": "redacted",
           "accountId": "123456789012",
           "accessKeyId": "redacted",
           "sessionContext": {
               "sessionIssuer": {
                   "type": "Role",
                   "principalId": "redacted",
                   "arn": "redacted",
                   "accountId": "123456789012",
                   "userName": "redacted"
               },
               "attributes": {
                   "creationDate": "2026-04-20T12:14:47Z",
                   "mfaAuthenticated": "false"
               }
           }
       },
       "eventTime": "2026-04-20T12:44:01Z",
       "eventSource": "codecommit.amazonaws.com",
       "eventName": "GitPull",
       "awsRegion": "us-east-1",
       "sourceIPAddress": "redacted",
       "userAgent": "go-git/5.x",
       "requestParameters": null,
       "responseElements": null,
       "additionalEventData": {
           "protocol": "HTTP",
           "dataTransferred": false,
           "repositoryName": "taras-test-123",
           "repositoryId": "redacted"
       },
       "requestID": "redacted",
       "eventID": "redacted",
       "readOnly": true,
       "resources": [
           {
               "accountId": "123456789012",
               "type": "AWS::CodeCommit::Repository",
               "ARN": "arn:aws:codecommit:us-east-1:123456789012:taras-test-123"
           }
       ],
       "eventType": "AwsApiCall",
       "managementEvent": true,
       "recipientAccountId": "123456789012",
       "eventCategory": "Management"
   }

[matheuscscp]

@taraspos Thanks for testing!

The CI is failing, pls take a look. One is failing due to code generation (you need to run make api-docs generate manifests), the other seems a genuine failure

[matheuscscp]

@taraspos Please update the docs to point to the integrations page.

We also need a PR here:

https://github.com/fluxcd/website/blob/main/content/en/flux/integrations/aws.md?plain=1

Will merge this one after we have the PR for website ready and also a similar PR for image-automation-controller

[taraspos]

Confirmed that object-level workload identity works via IRSA. Testing steps are the same as above (#2035 (comment)), with following differences:

1. Add --feature-gates=ObjectLevelWorkloadIdentity=true to source-controller args

2. Create IRSA-compatible IAM role

3. Create Service Account like:

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     annotations:
       eks.amazonaws.com/role-arn: arn:aws:iam::12456789012:role/fluxcd-test-workload-irsa
     name: aws-workload-identity-sa
     namespace: flux-system

4. Create GitRepository like:

   apiVersion: source.toolkit.fluxcd.io/v1
   kind: GitRepository
   metadata:
     name: taras-test-123-sa
     namespace: flux-system
   spec:
     interval: 1m0s
     ref:
       branch: main
     timeout: 60s
     url: https://git-codecommit.us-east-1.amazonaws.com/v1/repos/taras-test-123
     provider: aws
     serviceAccountName: aws-workload-identity-sa

5. Success ✅

[matheuscscp]

LGTM! 🚀