How to link CodeBuild with CodeCommit repo in different account? - amazon-web-services

Question

I'm trying to set up CodeBuild with a CodeCommit source that lives in another AWS account. I believe this can be done using AssumeRole but I've had no luck. Can anyone help provide an example of how to make CodeBuild assume a role specified in another account to access a CodeCommit repo?
Currently my CodeBuild role (in account 22222222) includes the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::11111111:role/Read-CodeCommit"
}
]
}
In account 11111111 I have the Read-CodeCommit role has the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"codecommit:*"
],
"Resource": "arn:aws:codecommit:us-west-2:11111111:dashboard"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "codecommit:ListRepositories",
"Resource": "*"
}
]
}
Read-CodeCommit has the following trust policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::22222222:root",
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole",
"Condition": {}
}
]
}
Edit:
Posting a solution I came up with for anyone who might face a similar issue.
The best I could manage was just to side-step the issue. Instead of setting up CodeCommit as a source, I'm using a custom ECR image which includes CodeCommit credentials. The buildspec then clones from the repo.
It's not as clean as I like but it gets the job done.