Mastering Artifact Repositories: AWS CodeArtifact, ECR, and S3

This guide covers the essential knowledge for creating and configuring artifact repositories in AWS, a core component of the SDLC Automation domain for the AWS Certified DevOps Engineer – Professional (DOP-C02) exam.

Learning Objectives

After studying this guide, you should be able to:

Design and configure Amazon ECR repositories for containerized applications.
Implement AWS CodeArtifact domains and repositories for language-specific dependencies.
Utilize Amazon S3 as a secure, versioned storage for raw build artifacts.
Apply least-privilege IAM policies to secure artifact access.
Automate artifact lifecycle management to optimize storage costs.

Key Terms & Glossary

Artifact: A file produced during the software development process (e.g., compiled binaries, JAR files, Docker images, or documentation).
Registry (ECR): A managed service that hosts one or more Docker repositories.
Domain (CodeArtifact): A higher-level container that groups repositories, allowing for shared assets and unified management.
Upstream Repository: A repository in CodeArtifact that provides packages to a downstream repository.
Lifecycle Policy: Rules that automate the cleanup of old or unused artifacts (e.g., deleting ECR images older than 30 days).

The "Big Idea"

In a DevOps pipeline, the Artifact Repository acts as the "Single Source of Truth" between the Build phase and the Deployment phase. Without a central, versioned, and secure repository, pipelines become brittle, environment consistency is lost, and the risk of deploying unvetted code increases. Effective artifact management ensures that what you test is exactly what you deploy.

Formula / Concept Box

Feature	ECR (Elastic Container Registry)	CodeArtifact	Amazon S3
Primary Use	Docker/OCI Images	npm, pip, maven, nuget	Static assets, .zip, .war
Access Tool	Docker CLI / Helm	Language CLIs (npm, pip)	AWS CLI / SDK / Console
Auth Method	`aws ecr get-login-password`	`aws codeartifact get-authorization-token`	IAM / Bucket Policies
Hierarchy	Registry > Repository > Image	Domain > Repository > Package	Bucket > Folder > Object

Hierarchical Outline

Amazon Elastic Container Registry (ECR)
- Private vs. Public: Private for internal apps; Public for global distribution.
- Image Scanning: Automated vulnerability detection on push.
- Replication: Cross-region and cross-account replication for DR/Latency.
AWS CodeArtifact
- Domains: Centralized management for multiple repositories.
- Upstream Sources: Integration with public registries (e.g., npmjs.com).
- Versioning: Semantic versioning support for internal libraries.
Amazon S3 for Artifacts
- Versioning: Essential for preventing accidental overwrites.
- Encryption: SSE-S3 or SSE-KMS for regulatory compliance.
- Integrations: Direct support from AWS CodeBuild and CodeDeploy.

Visual Anchors

Artifact Flow in CI/CD

Loading Diagram...

Figure 1 — Mermaid diagram

CodeArtifact Hierarchy

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Definition-Example Pairs

Immutable Artifacts: Once a version (e.g., v1.2.0) is published, it cannot be changed. If a fix is needed, v1.2.1 must be created.
- Example: Tagging an ECR image as production-stable and using "Tag Immutability" to prevent anyone from overwriting that specific tag.
Upstream Connection: Linking a private repository to a public one to cache dependencies.
- Example: A CodeArtifact repo points to npmjs.com. When a developer requests lodash, CodeArtifact downloads it once and stores it locally for future internal use.

Worked Examples

1. Authenticating and Pushing to ECR

To push an image to ECR, you must first authenticate the Docker client. This is a common exam scenario regarding CLI permissions.

bash

# 1. Retrieve the password and login
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin <ACCOUNT_ID>.dkr.ecr.us-east-1.amazonaws.com

# 2. Tag your local image
docker tag my-app:latest <ACCOUNT_ID>.dkr.ecr.us-east-1.amazonaws.com/my-app:v1

# 3. Push to the repository
docker push <ACCOUNT_ID>.dkr.ecr.us-east-1.amazonaws.com/my-app:v1

2. S3 Bucket Policy for CodeDeploy

When using S3 for artifacts, the service (like CodeDeploy) needs permission to read from the bucket.

json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": { "Service": "codedeploy.amazonaws.com" },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-artifact-bucket/*"
        }
    ]
}

Checkpoint Questions

What is the benefit of a CodeArtifact Domain over individual standalone repositories?
How do ECR Lifecycle Policies differ from S3 Lifecycle Policies?
Which AWS CLI command is used to fetch a temporary token for npm to talk to CodeArtifact?
Why should you enable Tag Immutability in an ECR repository?

Muddy Points & Cross-Refs

S3 vs. CodeArtifact: Use S3 for deployment bundles (zip/tar) used by CodeDeploy. Use CodeArtifact for library dependencies (npm/pip) used by developers and CodeBuild.
ECR Auth Timeout: Authorization tokens for ECR/CodeArtifact are valid for 12 hours. Pipelines running longer than this may fail if they don't re-authenticate.
Cross-Account Access: Remember that CodeArtifact requires permissions on both the Repository and the Domain to function across accounts.

Comparison Tables

Criterion	Amazon ECR	AWS CodeArtifact	Amazon S3
Searchability	By image tag/digest	By package name/version	By prefix/object key
Caching	Pull-through cache available	Built-in upstream caching	No native package caching
Scanning	Basic/Enhanced Scanning	N/A (Manual/Third-party)	Macie (Sensitive data)
Cost Model	Storage + Data Transfer	Storage + Requests	Storage + Requests