Configuring Code, Image, and Artifact Repositories

This guide covers the foundational components of Domain 1 (SDLC Automation) for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam. We will focus on how to centralize, secure, and automate the storage of code and build outputs.

Learning Objectives

By the end of this module, you should be able to:

• Differentiate between source code, artifact, and image repositories.
• Configure AWS CodeArtifact for polyglot package management.
• Manage container images using Amazon ECR and lifecycle policies.
• Secure repository access using IAM policies and resource-based permissions.
• Automate image creation with EC2 Image Builder.

Key Terms & Glossary

• Artifact: A deployable component (e.g., .jar, .zip, .war) produced by a build process.
• Upstream Connection: A link between a CodeArtifact repository and an external public repository (like npmjs.com).
• Immutable Infrastructure: A strategy where servers/containers are never modified after deployment; instead, new versions are built and replaced.
• Lifecycle Policy: Rules in ECR that automatically clean up old or untagged images to reduce costs.
• Golden Image: A pre-configured snapshot of a virtual machine or container used as a template for launching new instances.

The "Big Idea"

Configuration management is about consistency. In a DevOps environment, we treat our infrastructure and dependencies as code. By centralizing where these assets live (Repositories), we ensure that whether we are deploying 5 or 500 instances, they all receive the exact same version of the truth. This eliminates the "it works on my machine" problem and enables rapid disaster recovery via rollbacks.

Formula / Concept Box

Hierarchical Outline

1. Source Code Management
   • AWS CodeCommit: Managed Git service.
   • Triggers: Using EventBridge to start pipelines on push events.
2. Artifact Management (AWS CodeArtifact)
   • Domains: High-level containers for multiple repositories.
   • Repositories: Where the actual packages are stored.
   • Security: Use of aws codeartifact get-authorization-token for local CLI access.
3. Image Management
   • Amazon ECR: Hosting Docker images with cross-account support.
   • EC2 Image Builder: Automating the creation of AMIs (Amazon Machine Images).
4. Configuration Repositories
   • AppConfig: Managing application-level toggles and configurations.
   • Parameter Store / Secrets Manager: Storing sensitive build/deploy variables.

Visual Anchors

The Artifact Pipeline

IAM Repository Permission Flow

Definition-Example Pairs

• Upstream Source: A repository that provides packages to a downstream repository.
  • Example: A team creates a local CodeArtifact repo named internal-lib. They set npmjs.com as an upstream source so they can fetch both their private code and public npm packages from a single endpoint.
• Image Recipe: A document in EC2 Image Builder defining the base image and software components.
  • Example: A recipe that takes a base Amazon Linux 2 AMI, installs CloudWatch Agent, and applies STIG security hardening.
• Artifact Lifecycle: The managed stages of an artifact from creation to deletion.
  • Example: Configuring an ECR policy to expire any image tagged with dev-* after 14 days, while keeping prod-* images indefinitely.

Worked Examples

Example 1: Authenticating to CodeArtifact

To push a package to CodeArtifact, you must obtain a temporary token.

Step-by-Step:

1. Run the CLI command to get the token:
   bashCopy

   export CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token --domain my-domain --domain-owner <ACCOUNT_ID> --query authorizationToken --output text)
2. Configure your local tool (e.g., npm or pip) to use this token in the header.
3. Run the publish command (e.g., npm publish).

Example 2: ECR Lifecycle Policy (JSON)

This policy keeps only the last 10 images to prevent storage bloat.

Checkpoint Questions

1. Question: Which service should be used to manage internal Java (Maven) dependencies securely within an organization?
2. Question: How does EC2 Image Builder differ from using a simple Bash script to build AMIs?
3. Question: In ECR, if a repository policy allows access but the IAM user policy denies it, what is the final outcome?

▶Click to see answers

1. AWS CodeArtifact. It natively supports Maven and provides secure, centralized storage.
2. EC2 Image Builder provides a managed pipeline, including automated testing of the image and distribution across multiple AWS regions.
3. Access Denied. In AWS, an explicit Deny always overrides an Allow.

Muddy Points & Cross-Refs

• CodeArtifact vs. S3: While S3 can store .zip files, CodeArtifact is preferred for software development because it understands package versioning (e.g., 1.2.0 vs ^1.2.0) and can proxy public repos.
• ECR Repository Policy: Don't confuse this with an IAM policy. A repository policy is attached to the resource (the repo) and is crucial for cross-account access (e.g., Account A builds the image, Account B pulls it for deployment).

Comparison Tables

Deployment Strategies for Repositories