AWS CodeCommit
Connect AWS CodeCommit to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect AWS CodeCommit to collect version control evidence automatically.
| Category | Version Control |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In AWS CodeCommit:
- Sign in to the IAM console (https://console.aws.amazon.com/iam/) as an administrator.
- In the navigation pane, choose Policies, select the radio button next to AWSCodeCommitReadOnly, then choose Actions › Attach.
- Select the IAM user Safeguard will use and choose Attach policy.
- Sign in to the console as that IAM user. In the navigation bar on the upper right, choose your user name, then choose Security credentials.
- In the Access keys section, choose Create access key.
- On the Access key best practices & alternatives page, choose Other, then choose Next.
- (Optional) Set a description tag value, then choose Create access key.
- On the Retrieve access keys page, choose Show or Download .csv file to save the access key ID and secret access key, then choose Done.
AWS CodeCommit shows the secret only once, so copy it before you leave the page.
AWSCodeCommitReadOnly is the AWS managed policy for read-only access to CodeCommit. The Retrieve access keys page is the only chance to save the secret access key. A user can have at most two access keys. Where to find the Region was not covered by the fetched pages.
Source: docs.aws.amazon.com, docs.aws.amazon.com, docs.aws.amazon.com, checked 2026-10-07.
-
On Compliance › Connectors, open AWS CodeCommit, click Connect, choose API token and fill in:
Field What to enter AWS Access Key ID Required. Stored encrypted and never shown again. AWS Secret Access Key Required. Stored encrypted and never shown again. Region Optional. Session token (optional) Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read AWS CodeCommit and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.1, A1.2, A1.3, C1.1, CC2.3, CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC7.1, CC7.2, CC7.3, CC7.4, CC8.1 | 148 |
| ISO/IEC 27001 | Automated tests | A.5.12, A.5.16, A.5.17, A.5.18, A.5.24, A.5.25, A.8.2, A.8.3, A.8.5, A.8.6, A.8.8, A.8.9, A.8.11, A.8.12, A.8.13, A.8.14, A.8.15, A.8.16, A.8.20, A.8.24, A.8.32 | 148 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1) | 81 |
| PCI DSS | Automated tests | 1.3.1, 3.5.1, 3.7.4, 4.2.1, 6.3.1, 6.3.3, 6.4.2, 6.5.1, 7.2.1, 7.2.2, 8.2.6, 8.3.6, 8.4.1, 8.4.2, 8.6.3, 10.2.1, 10.3.2, 10.5.1, 11.3.1, 11.5.1, 11.5.2 | 81 |
| NIST CSF 2.0 | Automated tests | DE.AE-02, DE.CM-01, DE.CM-09, ID.AM-07, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-11, PR.IR-01, PR.IR-03, PR.PS-01, PR.PS-02, PR.PS-04, RS.CO-02, RS.MA-01 | 148 |
| CIS AWS Foundations Benchmark | Automated tests | 1.1, 1.2, 1.6, 1.7, 1.11, 1.13, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 2.1.1, 2.1.2, 2.1.3, 2.3.2, 2.4.1, 3.4, 3.8, 3.9, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.16, 5.1, 5.4, 5.6 | 41 |
For a CIS benchmark, the numbers are its recommendations.
These tests are switched on per workspace by the Safeguard team.
Amazon CloudWatch, Amazon S3, Amazon Web Services, AWS GovCloud, AWS Inspector, AWS Security Hub connect to the same provider as AWS CodeCommit, and these tests run for a connection made through any of them.
Related
- Version Control connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks