The requested URL returned error: 403, AWS Server less: Amplify app to CodeCommit

If you are getting a 403 error, you could check the policy associated with the service role in IAM. You need to specify the CodeCommit repository within the policy that uses the service role you specified in Amplify.

Amplify App Detail

Service Role Policy

The amplify app is is missing permissions to your git repository. Make sure you connect your AWS Amplify app to your repository in AWS CodeCommit.

Here's an image excerpt:

Please check the auto generated policy "AWSAmplifyExecutionPolicy" created by AWSAmplify in IAM console. The autogenerated AWSAmplifyExecutionPolicy specifies permission to access your repository in CodeCommit. The Resource in the CodeCommit policy, should have the ARN of your repository.

You need to set service role for your app. If you don't have a service role for amplify backend deployment, you have to create one.

The Amplify Console requires permissions to deploy backend resources with your front end. You use a service role to accomplish this

The following would be helpful.

Adding a service role to the Amplify Console when you connect an app

1. create role for aws service. select use cases "Amplify" then "Backend Deployment"

2. go to amplify console. open app settings, general. Set this role for your app's service role

Add a inline policy to give access on Codecommit to clone the repository and check the build code for any further errors.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "codecommit:*",
            "Resource": "*"
        }
    ]
}

check your role policy json in that check whether this is policy having access of your repo arn

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Resource": [
            "arn:aws:logs:ap-south-1:<accountid>:log-group:/aws/amplify/xxxxxx",
            "arn:aws:logs:ap-south-1:<accountid>:log-group:/aws/amplify/xxxxxx:*"
        ],
        "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
        ]
    },
    {
        "Effect": "Allow",
        "Resource": [ // here is your repo arn is required if not not present add it
            "arn:aws:codecommit:ap-south-1:<accountid>:<repo_name>",
            "arn:aws:codecommit:ap-south-1:<accountid>:<repo_name>"
        ],
        "Action": [
            "codecommit:GitPull"
        ]
    }
]
}