AWS, Cloud Computing, DevOps

5 Mins Read

A Guide to Create Cross-Account AWS CodePipeline

Voiced by Amazon Polly


In today’s dynamic IT landscape, organizations must maintain secure and isolated AWS environments for distinct application stages, such as development and production. To overcome these challenges, this blog post explores the process of setting up a Cross-Account AWS CodePipeline that connects to an AWS CodeCommit Repository located in a different AWS account. The separation of environments is crucial for resource segregation and heightened security measures. We will explore the steps and best practices to establish this innovative solution and demonstrate how technology can bridge the gap between isolated AWS accounts, facilitating a controlled and secure workflow for AWS resources and applications.


In the domain of AWS infrastructure and application development, a fundamental requirement is the creation of distinct and dedicated environments, primarily centered around the development (dev) and production stages. Organizations often establish multiple AWS accounts to maintain the highest resource isolation and security standards, each designated for specific application phases. In this technical exploration, we’ll focus on two AWS accounts: one dedicated to development and the other to production.

The core technical challenge here revolves around establishing a CodePipeline – a crucial component of continuous integration and continuous deployment (CI/CD) – that seamlessly connects with an AWS CodeCommit Repository residing in a separate AWS account. This requirement arises from strictly segregating the development and production environments while ensuring a controlled and secure workflow exists for AWS resources and applications.

The AWS CodePipeline will be created in the dev account, while the AWS CodeCommit repository is in the production account.

Pioneers in Cloud Consulting & Migration Services

  • Reduced infrastructural costs
  • Accelerated application deployment
Get Started

Step-by-Step Guide

  1. First, we must create Customer-managed keys in an AWS KMS service in the dev account.Customer-managed keys are beneficial when we want to grant cross-account access, where we will be configuring the policy of a customer-managed key to allow access from another account.
  • Choose Customer managed keys in the AWS KMS console.
  • Click on Create key, choose Symmetric under key type, and Encrypt and Decrypt under key usage.
  • Choose key AWS KMS under key material origin and Single-Region under Regionality.
  • Then click on Next.


  • Enter an alias and description, and click on Next.


  • In Define Key Administrative Permissions, choose AWS IAM user or any other users/groups who want to act as administrator for the key, and choose Next.


  • In Define Key Usage Permissions, select the service role used for the Pipeline, build, and deploy.
  • Click on Add another AWS account, type the production account ID (account with a codecommit repository), and choose Next.


  1. Now, we need to create an Amazon S3 bucket and provide access to the production account (account that has a codecommit repository) access to it.
  • We need to Create an Amazon S3 bucket for Pipeline to store Artifacts.
  • Under permission, add the following Bucket policy in the Amazon S3 bucket.

3. Add the following policy to the AWS CodePipeline service role in the dev account (where codepipeline will be created) to access the production account and the AWS CodeCommit repositories.

  1. Now, we need to create a policy and role in the production account (where codecommit repository resides)
  • Go to the AWS IAM console, choose Policy, and click Create Policy.
  • Select JSON, add the following code, and replace the resources arn.
  • Enter a name and click on Create policy.
  1. We need to create an AWS IAM role for cross-account access
  • Choose Role in the AWS IAM console and click on the Create role
  • Under the selected Trusted entity type, choose AWS account.
  • Choose Another AWS account under an AWS account, enter the account ID of the dev account (codepipeline account), and click next.


  • Search for AWSCodeCommitFullAccess and add the above policy created in the above step.
  • Add the proper name to the role and click on Create a role.
  1. We can do the cross-account creation of the Pipeline in CLI
  • To create a pipeline, we need to write a JSON file

example: pipeline.json

  • Run the below command to create the pipeline
  • If the pipeline fails in the build stage:
  • Go to the AWS CodePipeline console and click on Edit
  • Click on Edit Stage


  • Again, Click on Edit


  • Under the project name, click on Create Project and create a new project.
  • After creation, change the BUILD_PROJECT_NAME in the .json file and run the command again for the pipeline to create.


By following these steps and best practices, we can efficiently set up a Cross-Account AWS CodePipeline, promoting a secure and well-organized workflow for AWS resources and applications. This approach ensures that the development and production environments remain isolated, contributing to a robust and controlled AWS architecture.

Drop a query if you have any questions regarding Cross-Account AWS CodePipeline and we will get back to you quickly.

Making IT Networks Enterprise-ready – Cloud Management Services

  • Accelerated cloud migration
  • End-to-end view of the cloud environment
Get Started

About CloudThat

CloudThat is an official AWS (Amazon Web Services) Advanced Consulting Partner and Training partner, AWS Migration Partner, AWS Data and Analytics Partner, AWS DevOps Competency Partner, Amazon QuickSight Service Delivery Partner, Amazon EKS Service Delivery Partner, and Microsoft Gold Partner, helping people develop knowledge of the cloud and help their businesses aim for higher goals using best-in-industry cloud computing practices and expertise. We are on a mission to build a robust cloud computing ecosystem by disseminating knowledge on technological intricacies within the cloud space. Our blogs, webinars, case studies, and white papers enable all the stakeholders in the cloud computing sphere.

To get started, go through our Consultancy page and Managed Services PackageCloudThat’s offerings.


1. What is the purpose of customer-managed keys in AWS KMS for Cross-Account access?

ANS: – Customer-managed keys in AWS Key Management Service (KMS) control access to encrypted resources across accounts. In the context of Cross-Account access, they play a vital role in securing data and ensuring that sensitive information remains protected even when accessed from different AWS accounts.

2. What are the key benefits of using AWS CodePipeline compared to other CI/CD tools?

ANS: – AWS CodePipeline offers several benefits, including its seamless integration with various AWS services, centralized management, scalability, and the ability to create custom pipelines. It also supports multi-account and cross-region deployments, making it a powerful choice for AWS-centric workflows.

WRITTEN BY Abhilasha D

Abhilasha D is a Research Associate-DevOps at CloudThat. She is focused on gaining knowledge of Cloud environment and DevOps tools. She has keen interest in learning and researching on emerging technologies.



    Click to Comment

Get The Most Out Of Us

Our support doesn't end here. We have monthly newsletters, study guides, practice questions, and more to assist you in upgrading your cloud career. Subscribe to get them all!