AWS CodeArtifact
A fully managed artifact management service providing package repositories for npm, Maven, PyPI, NuGet, and more
Overview
AWS CodeArtifact is a fully managed service that provides software package repositories. It supports major package managers including npm, Maven, PyPI, NuGet, Swift, and Cargo, enabling centralized management of both cached packages from public registries and private internal packages. With fine-grained access control through IAM policies, cross-account sharing, and package version immutability guarantees, it strengthens software supply chain security.
Domain and Repository Hierarchy Design
CodeArtifact's resource structure consists of two tiers: domains and repositories. A domain defines the boundary for package management across an organization, and repositories within the same domain automatically benefit from package deduplication, optimizing storage costs. Repositories are created per team, project, or environment, each with independent access policies. In practice, a common design separates repositories for shared internal libraries, product team-specific packages, and public package caching. Domain-level encryption supports AWS KMS customer-managed keys, ensuring all stored package assets are encrypted. Cross-account sharing is controlled through domain policies, allowing multiple accounts within an AWS Organization to access the same domain's repositories, maintaining package consistency across the organization.
Upstream Connections and Package Caching
CodeArtifact's upstream connections automatically cache packages from public registries such as npmjs.com, PyPI, Maven Central, and NuGet Gallery. When a developer requests a package, CodeArtifact first searches the local repository, then traverses upstream repositories in order, and finally fetches from the public registry and caches the result. Once cached, packages are retained locally, making your builds immune to public registry outages or network latency. This mechanism also serves as a defense against supply chain attacks. Package origin controls restrict automatic ingestion of new packages from public registries, preventing dependency confusion attacks. Even if a package with the same name as an internal package is published publicly, origin controls ensure the internal version takes precedence. Package version status management (Published, Unlisted, Archived, Disposed) lets you gradually restrict the use of deprecated versions. For a comprehensive look at supply chain security and artifact management, related books (Amazon) offer valuable insights.
Authentication Integration with CI/CD Pipelines
CodeArtifact authentication works by issuing temporary authorization tokens. The aws codeartifact get-authorization-token command generates a token valid for up to 12 hours, which is then configured as credentials for package managers like npm, pip, and Maven. For CodeBuild integration, the standard pattern is to grant the build project's IAM role access to CodeArtifact and retrieve the token in the pre_build phase of buildspec.yml. External CI services such as GitHub Actions and GitLab CI use OIDC federation to assume an IAM role and obtain tokens. For npm, you configure the registry URL and token in the .npmrc file; for pip, you specify the repository URL via the --index-url option. Separating publish and read permissions through IAM policies prevents unintended package publishing from CI pipelines. Restricting access to VPC endpoint-only through repository endpoint policies further secures the network path.