Migrating CDK Pipelines from CodeCommit to GitHub

AWS closed CodeCommit to new customers on July 25, 2024, so the pipelines are moving to GitHub. Only the source action changes. You are not rebuilding the pipeline.

Pick the right credential

CodePipelineSource.gitHub() gives you a version 1 source action: a personal access token you store and rotate yourself, plus a separate webhook. The CDK docs call it “no longer the recommended method.”

Use CodePipelineSource.connection() instead. It runs on AWS CodeConnections, authenticates through an installed GitHub App, and leaves no long-lived token in your account.

Create the connection first, in the Developer Tools console under Settings > Connections, same region as the pipeline. That step is manual on purpose: a connection created from CDK or the CLI lands in PENDING until a human finishes the handshake.

Swap the source

import { CodePipeline, CodePipelineSource, ShellStep } from 'aws-cdk-lib/pipelines';
import { Repository } from 'aws-cdk-lib/aws-codecommit';

const codeCommitRepository = Repository.fromRepositoryName(this, 'my-codecommit-repo-id', 'my-codecommit-repo-name');

const pipeline = new CodePipeline(this, 'Pipeline', {
    pipelineName: 'my-pipeline',
    synth: new ShellStep('Synth', {
        // Replace CodeCommit source with GitHub
        input: CodePipelineSource.codeCommit(codeCommitRepository, 'main'),
        input: CodePipelineSource.connection('your-username/your-repo', 'main', {
            connectionArn: 'arn:aws:codeconnections:us-east-1:123456789012:connection/abcd1234-ab12-cd34-ef56-abcdef123456',
        }),
        commands: ['npm ci', 'npm run build', 'npx cdk synth']
    })
});

Connections created before July 2024 say codestar-connections in the ARN. Both forms still work, so paste whatever the console shows you.

Push the code to GitHub, deploy through CodeCommit one last time, then swap the remotes:

git push github --all && git push github --tags
git remote rename origin codecommit-backup
git remote rename github origin

That last run won’t finish, and that’s fine

CDK Pipelines sets restartExecutionOnUpdate: true. The moment SelfMutate rewrites the source action, CloudFormation kills the running execution, UpdatePipeline shows as cancelled, and a fresh run starts against GitHub.

So the connection has to be AVAILABLE before that deploy, not after. Otherwise the restart lands on a source it can’t read.

Nothing gets recreated. pipelineName is fixed, the logical id doesn’t change, and history plus every downstream stage survive.

Two things that bite later

A connection source hands CodeBuild a zip of the tree, with no history, tags, or symlinks. If your synth runs git describe, add codeBuildCloneOutput: true next to connectionArn.

AWS now expects codeconnections:UseConnection even on ARNs that still read codestar-connections, and older CDK versions only grant the legacy action. An access denied naming UseConnection means you patch the source action’s role, not the connection.

If your org refuses the GitHub App and you’re stuck on a token, know that gitHub() reads a Secrets Manager secret named exactly github-token, reads the whole string (store it as plaintext, not key/value), and needs repo plus admin:repo_hook.