feat(codecommit): HTTPS GRC clone URL (#12312)

Add the `repositoryCloneUrlGrc` property to expose the HTTPS GRC clone
URL.

HTTPS (GRC) is the protocol to use with git-remote-codecommit (GRC).

It is the recommended method for supporting connections made with federated
access, identity providers, and temporary credentials.

See https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-git-remote-codecommit.html


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk/aws-codecommit/README.md

@@ -27,6 +27,9 @@ const repo = new codecommit.Repository(this, 'Repository' ,{
 });
 ```
 
+Use the `repositoryCloneUrlHttp`, `repositoryCloneUrlSsh` or `repositoryCloneUrlGrc`
+property to clone your repository.
+
 To add an Amazon SNS trigger to your repository:
 
 ```ts

packages/@aws-cdk/aws-codecommit/lib/repository.ts

@@ -1,7 +1,7 @@
 import * as events from '@aws-cdk/aws-events';
 import * as iam from '@aws-cdk/aws-iam';
 import { IResource, Lazy, Resource, Stack } from '@aws-cdk/core';
-import { IConstruct, Construct } from 'constructs';
+import { Construct } from 'constructs';
 import { CfnRepository } from './codecommit.generated';
 
 export interface IRepository extends IResource {
@@ -29,6 +29,18 @@ export interface IRepository extends IResource {
    */
   readonly repositoryCloneUrlSsh: string;
 
+  /**
+   * The HTTPS (GRC) clone URL
+   *
+   * HTTPS (GRC) is the protocol to use with git-remote-codecommit (GRC).
+   *
+   * It is the recommended method for supporting connections made with federated
+   * access, identity providers, and temporary credentials.
+   *
+   * @see https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-git-remote-codecommit.html
+   */
+  readonly repositoryCloneUrlGrc: string;
+
   /**
    * Defines a CloudWatch event rule which triggers for repository events. Use
    * `rule.addEventPattern(pattern)` to specify a filter.
@@ -135,6 +147,8 @@ abstract class RepositoryBase extends Resource implements IRepository {
   /** The SSH clone URL */
   public abstract readonly repositoryCloneUrlSsh: string;
 
+  public abstract readonly repositoryCloneUrlGrc: string;
+
   /**
    * Defines a CloudWatch event rule which triggers for repository events. Use
    * `rule.addEventPattern(pattern)` to specify a filter.
@@ -291,8 +305,9 @@ export class Repository extends RepositoryBase {
     class Import extends RepositoryBase {
       public readonly repositoryArn = repositoryArn;
       public readonly repositoryName = repositoryName;
-      public readonly repositoryCloneUrlHttp = Repository.makeCloneUrl(stack, repositoryName, 'https', region);
-      public readonly repositoryCloneUrlSsh = Repository.makeCloneUrl(stack, repositoryName, 'ssh', region);
+      public readonly repositoryCloneUrlHttp = makeCloneUrl(stack, repositoryName, 'https', region);
+      public readonly repositoryCloneUrlSsh = makeCloneUrl(stack, repositoryName, 'ssh', region);
+      public readonly repositoryCloneUrlGrc = makeCloneUrl(stack, repositoryName, 'grc', region);
     }
 
     return new Import(scope, id);
@@ -303,54 +318,44 @@ export class Repository extends RepositoryBase {
 
     class Import extends RepositoryBase {
       public repositoryName = repositoryName;
-      public repositoryArn = Repository.arnForLocalRepository(repositoryName, scope);
-      public readonly repositoryCloneUrlHttp = Repository.makeCloneUrl(stack, repositoryName, 'https');
-      public readonly repositoryCloneUrlSsh = Repository.makeCloneUrl(stack, repositoryName, 'ssh');
+      public repositoryArn = Stack.of(scope).formatArn({
+        service: 'codecommit',
+        resource: repositoryName,
+      });
+      public readonly repositoryCloneUrlHttp = makeCloneUrl(stack, repositoryName, 'https');
+      public readonly repositoryCloneUrlSsh = makeCloneUrl(stack, repositoryName, 'ssh');
+      public readonly repositoryCloneUrlGrc = makeCloneUrl(stack, repositoryName, 'grc');
     }
 
     return new Import(scope, id);
   }
 
-  private static makeCloneUrl(stack: Stack, repositoryName: string, protocol: 'https' | 'ssh', region?: string) {
-    return `${protocol}://git-codecommit.${region || stack.region}.${stack.urlSuffix}/v1/repos/${repositoryName}`;
-  }
-
-  private static arnForLocalRepository(repositoryName: string, scope: IConstruct): string {
-    return Stack.of(scope).formatArn({
-      service: 'codecommit',
-      resource: repositoryName,
-    });
-  }
-
   public readonly repositoryArn: string;
   public readonly repositoryName: string;
-  private readonly repository: CfnRepository;
+  public readonly repositoryCloneUrlHttp: string;
+  public readonly repositoryCloneUrlSsh: string;
+  public readonly repositoryCloneUrlGrc: string;
   private readonly triggers = new Array<CfnRepository.RepositoryTriggerProperty>();
 
   constructor(scope: Construct, id: string, props: RepositoryProps) {
     super(scope, id, {
       physicalName: props.repositoryName,
     });
 
-    this.repository = new CfnRepository(this, 'Resource', {
+    const repository = new CfnRepository(this, 'Resource', {
       repositoryName: props.repositoryName,
       repositoryDescription: props.description,
       triggers: Lazy.any({ produce: () => this.triggers }, { omitEmptyArray: true }),
     });
 
-    this.repositoryName = this.getResourceNameAttribute(this.repository.attrName);
-    this.repositoryArn = this.getResourceArnAttribute(this.repository.attrArn, {
+    this.repositoryName = this.getResourceNameAttribute(repository.attrName);
+    this.repositoryArn = this.getResourceArnAttribute(repository.attrArn, {
       service: 'codecommit',
       resource: this.physicalName,
     });
-  }
-
-  public get repositoryCloneUrlHttp() {
-    return this.repository.attrCloneUrlHttp;
-  }
-
-  public get repositoryCloneUrlSsh() {
-    return this.repository.attrCloneUrlSsh;
+    this.repositoryCloneUrlHttp = repository.attrCloneUrlHttp;
+    this.repositoryCloneUrlSsh = repository.attrCloneUrlSsh;
+    this.repositoryCloneUrlGrc = makeCloneUrl(Stack.of(this), this.repositoryName, 'grc');
   }
 
   /**
@@ -427,3 +432,16 @@ export enum RepositoryEventTrigger {
   CREATE_REF = 'createReference',
   DELETE_REF = 'deleteReference'
 }
+
+/**
+ * Returns the clone URL for a protocol
+ */
+function makeCloneUrl(stack: Stack, repositoryName: string, protocol: 'https' | 'ssh' | 'grc', region?: string) {
+  switch (protocol) {
+    case 'https':
+    case 'ssh':
+      return `${protocol}://git-codecommit.${region ?? stack.region}.${stack.urlSuffix}/v1/repos/${repositoryName}`;
+    case 'grc':
+      return `codecommit::${region ?? stack.region}://${repositoryName}`;
+  }
+}

packages/@aws-cdk/aws-codecommit/package.json

@@ -113,6 +113,7 @@
       "props-default-doc:@aws-cdk/aws-codecommit.RepositoryTriggerOptions.customData",
       "docs-public-apis:@aws-cdk/aws-codecommit.IRepository",
       "props-default-doc:@aws-cdk/aws-codecommit.RepositoryTriggerOptions.name",
+      "attribute-tag:@aws-cdk/aws-codecommit.Repository.repositoryCloneUrlGrc",
       "docs-public-apis:@aws-cdk/aws-codecommit.RepositoryEventTrigger.ALL",
       "docs-public-apis:@aws-cdk/aws-codecommit.RepositoryEventTrigger.UPDATE_REF",
       "docs-public-apis:@aws-cdk/aws-codecommit.RepositoryEventTrigger.CREATE_REF",

packages/@aws-cdk/aws-codecommit/test/test.codecommit.ts

@@ -102,6 +102,8 @@ export = {
         ],
       });
 
+      test.deepEqual(stack.resolve(repo.repositoryCloneUrlGrc), 'codecommit::us-west-2://my-repo');
+
       test.done();
     },
 
@@ -140,6 +142,17 @@ export = {
         ],
       });
 
+      test.deepEqual(stack.resolve(repo.repositoryCloneUrlGrc), {
+        'Fn::Join': [
+          '',
+          [
+            'codecommit::',
+            { Ref: 'AWS::Region' },
+            '://my-repo',
+          ],
+        ],
+      });
+
       test.done();
     },
 
@@ -187,5 +200,27 @@ export = {
 
       test.done();
     },
+
+    'HTTPS (GRC) clone URL'(test: Test) {
+      const stack = new Stack();
+
+      const repository = new Repository(stack, 'Repository', {
+        repositoryName: 'my-repo',
+      });
+
+      test.deepEqual(stack.resolve(repository.repositoryCloneUrlGrc), {
+        'Fn::Join': [
+          '',
+          [
+            'codecommit::',
+            { Ref: 'AWS::Region' },
+            '://',
+            { 'Fn::GetAtt': ['Repository22E53BBD', 'Name'] },
+          ],
+        ],
+      });
+
+      test.done();
+    },
   },
 };