title: AWS CloudFormation CodePipeline: Could not fetch the contents of the repository from GitHub
body: <p>I'm attempting to setup an AWS CloudFormation configuration using CodePipeline and GitHub.</p>
  
  <p>I've failed both at my own example project and the tutorial: <a href="https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-cloudformation-github.html" rel="noreferrer">Create a GitHub Pipeline with AWS CloudFormation</a>.</p>
  
  <p>All resources are created, but in CodePipeline I continuously get the following error during the initial "Source" stage.</p>
  
  <p><code>Could not fetch the contents of the repository from GitHub.</code></p>
  
  <p>See image below:</p>
  
  <p><a href="https://i.stack.imgur.com/coRBL.png" rel="noreferrer"><img src="https://i.stack.imgur.com/coRBL.png" alt="CodePipeline with Github failing with &quot;Could not fetch the contents of the repository from Github.&quot;"></a></p>
  
  <p>Note that this is not a permissions error. It's something else that does not exist on Google until now.</p>
  
  <p>GitHub can be configured to work if I stop using CloudFormation and create a CodePipeline through the console, but for my purposes, I need to use CloudFormation. Need to stick to a template.</p>
  
  <p>Here is the template from the CloudFormation template copied from the tutorial:</p>
  
  <pre><code>Parameters:
    BranchName:
      Description: GitHub branch name
      Type: String
      Default: master
    RepositoryName:
      Description: GitHub repository name
      Type: String
      Default: test
    GitHubOwner:
      Type: String
    GitHubSecret:
      Type: String
      NoEcho: true
    GitHubOAuthToken:
      Type: String
      NoEcho: true
    ApplicationName:
      Description: CodeDeploy application name
      Type: String
      Default: DemoApplication
    BetaFleet:
      Description: Fleet configured in CodeDeploy
      Type: String
      Default: DemoFleet
  Resources:
    CodePipelineArtifactStoreBucket:
      Type: "AWS::S3::Bucket"
    CodePipelineArtifactStoreBucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties:
        Bucket: !Ref CodePipelineArtifactStoreBucket
        PolicyDocument:
          Version: 2012-10-17
          Statement:
            - Sid: DenyUnEncryptedObjectUploads
              Effect: Deny
              Principal: "*"
              Action: "s3:PutObject"
              Resource: !Join
                - ""
                - - !GetAtt
                    - CodePipelineArtifactStoreBucket
                    - Arn
                  - /*
              Condition:
                StringNotEquals:
                  "s3:x-amz-server-side-encryption": "aws:kms"
            - Sid: DenyInsecureConnections
              Effect: Deny
              Principal: "*"
              Action: "s3:*"
              Resource: !Join
                - ""
                - - !GetAtt
                    - CodePipelineArtifactStoreBucket
                    - Arn
                  - /*
              Condition:
                Bool:
                  "aws:SecureTransport": false
    AppPipelineWebhook:
      Type: "AWS::CodePipeline::Webhook"
      Properties:
        Authentication: GITHUB_HMAC
        AuthenticationConfiguration:
          SecretToken: !Ref GitHubSecret
        Filters:
          - JsonPath: $.ref
            MatchEquals: "refs/heads/{Branch}"
        TargetPipeline: !Ref AppPipeline
        TargetAction: SourceAction
        Name: AppPipelineWebhook
        TargetPipelineVersion: !GetAtt
          - AppPipeline
          - Version
        RegisterWithThirdParty: true
    AppPipeline:
      Type: "AWS::CodePipeline::Pipeline"
      Properties:
        Name: github-events-pipeline
        RoleArn: !GetAtt
          - CodePipelineServiceRole
          - Arn
        Stages:
          - Name: Source
            Actions:
              - Name: SourceAction
                ActionTypeId:
                  Category: Source
                  Owner: ThirdParty
                  Version: 1
                  Provider: GitHub
                OutputArtifacts:
                  - Name: SourceOutput
                Configuration:
                  Owner: !Ref GitHubOwner
                  Repo: !Ref RepositoryName
                  Branch: !Ref BranchName
                  OAuthToken: !Ref GitHubOAuthToken
                  PollForSourceChanges: false
                RunOrder: 1
          - Name: Beta
            Actions:
              - Name: BetaAction
                InputArtifacts:
                  - Name: SourceOutput
                ActionTypeId:
                  Category: Deploy
                  Owner: AWS
                  Version: 1
                  Provider: CodeDeploy
                Configuration:
                  ApplicationName: !Ref ApplicationName
                  DeploymentGroupName: !Ref BetaFleet
                RunOrder: 1
        ArtifactStore:
          Type: S3
          Location: !Ref CodePipelineArtifactStoreBucket
    CodePipelineServiceRole:
      Type: "AWS::IAM::Role"
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - codepipeline.amazonaws.com
              Action: "sts:AssumeRole"
        Path: /
        Policies:
          - PolicyName: AWS-CodePipeline-Service-3
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - "codecommit:CancelUploadArchive"
                    - "codecommit:GetBranch"
                    - "codecommit:GetCommit"
                    - "codecommit:GetUploadArchiveStatus"
                    - "codecommit:UploadArchive"
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - "codedeploy:CreateDeployment"
                    - "codedeploy:GetApplicationRevision"
                    - "codedeploy:GetDeployment"
                    - "codedeploy:GetDeploymentConfig"
                    - "codedeploy:RegisterApplicationRevision"
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - "codebuild:BatchGetBuilds"
                    - "codebuild:StartBuild"
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - "devicefarm:ListProjects"
                    - "devicefarm:ListDevicePools"
                    - "devicefarm:GetRun"
                    - "devicefarm:GetUpload"
                    - "devicefarm:CreateUpload"
                    - "devicefarm:ScheduleRun"
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - "lambda:InvokeFunction"
                    - "lambda:ListFunctions"
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - "iam:PassRole"
                  Resource: "*"
                - Effect: Allow
                  Action:
                    - "elasticbeanstalk:*"
                    - "ec2:*"
                    - "elasticloadbalancing:*"
                    - "autoscaling:*"
                    - "cloudwatch:*"
                    - "s3:*"
                    - "sns:*"
                    - "cloudformation:*"
                    - "rds:*"
                    - "sqs:*"
                    - "ecs:*"
                  Resource: "*"
  </code></pre>
  
  <p>I've have taken the following steps:</p>
  
  <ul>
  <li>provided Github Organization, Repo &amp; Branch</li>
  <li>setup a personal access token on GitHub and supplied it to the template <code>GitHubOAuthToken</code> parameter with access to <code>repo:all</code> &amp; <code>admin:repo_hook</code></li>
  <li>setup a random string and provided it to the <code>GitHubSecret</code></li>
  <li>tried not including a <code>GitHubSecret</code> as in many other examples</li>
  <li>verified that AWS CodePipeline for my region is listed in Github Applications under "Authorized OAuth Applications"</li>
  </ul>
  
  <p>In attempts to start from a clear slate, I've also done the following:</p>
  
  <ul>
  <li>cleared all GitHub webhooks before starting <code>aws codepipeline list-webhooks</code> &amp; <code>aws codepipeline delete-webhook --name</code></li>
  <li>added a new personal access token</li>
  <li>tried multiple repos &amp; branches</li>
  </ul>
  
  <p>Any ideas how I can get GitHub to work with CloudFormation &amp; CodePipeline?</p>