AWS CodeArtifact
AWS's managed artifact repository for software packages: domains and repositories, upstreams and external connections to public registries such as PyPI and npm, controlling ML dependencies, security, and cost.
3 min read · Last reviewed · MLA-C02
Sign in to bookmark tutorials and track what you have read.
On this page
Already know this topic?
Try the AWS CodeArtifact quiz: 5 questions on AWS CodeArtifact.
What it is
AWS CodeArtifact is a managed artifact repository for software packages. Teams publish their private packages to it and fetch open-source packages through it, using the tools they already use: pip and twine, npm and yarn, Maven and Gradle, and the NuGet CLI, among others. CodeArtifact can fetch packages on demand from public repositories such as PyPI, npmjs.com, and Maven Central and keep a copy, so builds keep working even if a public package changes or disappears.
Choose CodeArtifact when a question asks to control and share dependencies: approved, versioned Python packages for training and inference containers, private libraries shared between teams, or builds that must not reach the public internet directly (MLA-C02 tasks 3.2.3 and 4.3.1).
Concepts and features
- Domain: groups repositories for an organization, with one storage and one encryption key; packages are stored once even when several repositories use them.
- Repository: holds packages of any supported type; a package manager points at the repository endpoint.
- Upstream repositories: a repository can use another in the same domain as an upstream, so packages approved in a central repository are available to team repositories.
- External connection: links a repository to a public registry such as PyPI or npmjs; packages are fetched on first request and cached.
- Authentication: users and build jobs get a short-lived authorization token from their AWS credentials; packages can't be made public.
Security, resilience, performance, and cost
Security
IAM policies and repository and domain policies control who can read and publish; assets are encrypted with a KMS key chosen for the domain; tokens expire; builds in a VPC can reach CodeArtifact through VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry. Combined with Amazon Inspector scanning of container images and code reviews, a curated repository reduces supply-chain risk.
Resilience
Packages fetched from public registries are kept in your repository, so builds are repeatable even if the public version is removed.
Performance
Builds fetch dependencies from a nearby managed repository; cache packages in CodeBuild for faster builds.
Cost
You pay for storage, requests, and data transfer out; there are no servers to run.
Monitoring
CloudTrail records publishing and reads; EventBridge reports package version changes, which can start downstream builds.
Comparisons
| Need | Choose |
|---|---|
| Private and approved Python, npm, Maven, or NuGet packages | AWS CodeArtifact |
| Container images for training and inference | Amazon ECR |
| Source code | AWS CodeCommit, or a third-party provider through CodeConnections |
| Trained model artifacts and versions | SageMaker Model Registry and Amazon S3 |
Reverse mindmap: when the question points here
- Points to CodeArtifact
- Only approved PyPI packages in training builds leads to CodeArtifact with an external connection
- Share a private Python library across teams leads to Publish to a CodeArtifact repository
- Builds have no internet access leads to CodeArtifact through VPC endpoints
- Points elsewhere
- Store Docker images leads to Amazon ECR
- Register model versions leads to SageMaker Model Registry
Key takeaways
- CodeArtifact stores private packages and caches public ones from PyPI, npmjs, Maven Central, and others.
- Domains hold repositories; upstreams share approved packages; external connections fetch public packages on demand.
- Access uses IAM, repository policies, short-lived tokens, and KMS encryption.
- Use ECR for container images and the Model Registry for models.