How to clone a private git repo in aws lambda

user_13523860 0
Viewed 6021

I need to clone a private git repo within aws lambda (lambda runtime is python). After doing some research, I know that the I need to clone the repo in /tmp directory because it is the only accessible directory in lambda. In addition, I need to use a private key to ssh to github.

Basically, my code looks like:

import git # lambda-git
import os

private_key = """-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----
"""
with open("/tmp/id_rsa", "w") as id_rsa:
  id_rsa.write(private_key)
os.chmod("/tmp/id_rsa", 600)
os.environ["GIT_SSH_COMMAND"] = 'ssh -i /tmp/id_rsa -o StrictHostKeyChecking=no'
git.exec_command("clone", "git@domain:repo_name.git", "/tmp")

However, after uploading the zipped folder into lambda, I got the following error

Could not create directory \\'/home/sbx_user1051/.ssh\\'.
Failed to add the host to the list of known hosts (/home/sbx_user1051/.ssh/known_hosts).
Load key \"/tmp/id_rsa\": Permission denied
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

What am I missing? Or is it even possible to clone a private repo within aws lambda? Any help is appreciated.

PS. I know that I can use a git token and clone the repo over https. But I cannot modify the repo url and have to use git@domain:repo_name.git as it is.

aws-lambda github
2 Answers

I finally found the answer. Changing permission code from 600 to 0o600 solved this problem!

user_135238600

Thanks for posting your solution @coding-monkey

My problem was that I used os.system("export GIT_SSH_COMMAND... instead of os.environ["GIT_SSH_COMMAND"]

Just in case someone needs, here is my solution:

import os

def lambda_handler(event, context):
    os.system('rm -rf /tmp/*')
    os.system("""cat >/tmp/id_rsa <<EOL
-----BEGIN OPENSSH PRIVATE KEY-----
ATTENTION, DO NOT STORE PRIVATE KEYS IN CODE, THIS IS ONLY DEMONSTRATION
-----END OPENSSH PRIVATE KEY-----
EOL""")
    os.chmod('/tmp/id_rsa', 0o600)
    os.system('ssh-keyscan -t rsa github.com | tee /tmp/known_hosts | ssh-keygen -lf -')
    os.environ['GIT_SSH_COMMAND'] = 'ssh -o UserKnownHostsFile=/tmp/known_hosts -i /tmp/id_rsa'
    os.system('git clone git@github.com:<privaterepo>.git /tmp/aws2')
    return {"test": "123"}
user_70858170
Related