Configuring Code, Image, and Artifact Repositories

This guide covers the foundational components of Domain 1 (SDLC Automation) for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam. We will focus on how to centralize, secure, and automate the storage of code and build outputs.

Learning Objectives

By the end of this module, you should be able to:

Differentiate between source code, artifact, and image repositories.
Configure AWS CodeArtifact for polyglot package management.
Manage container images using Amazon ECR and lifecycle policies.
Secure repository access using IAM policies and resource-based permissions.
Automate image creation with EC2 Image Builder.

Key Terms & Glossary

Artifact: A deployable component (e.g., .jar, .zip, .war) produced by a build process.
Upstream Connection: A link between a CodeArtifact repository and an external public repository (like npmjs.com).
Immutable Infrastructure: A strategy where servers/containers are never modified after deployment; instead, new versions are built and replaced.
Lifecycle Policy: Rules in ECR that automatically clean up old or untagged images to reduce costs.
Golden Image: A pre-configured snapshot of a virtual machine or container used as a template for launching new instances.

The "Big Idea"

Configuration management is about consistency. In a DevOps environment, we treat our infrastructure and dependencies as code. By centralizing where these assets live (Repositories), we ensure that whether we are deploying 5 or 500 instances, they all receive the exact same version of the truth. This eliminates the "it works on my machine" problem and enables rapid disaster recovery via rollbacks.

Formula / Concept Box

Feature	AWS CodeArtifact	Amazon ECR	Amazon S3
Primary Use	Software packages (npm, pip, maven)	Docker/OCI Container Images	Zipped code, static assets, generic files
Version Control	Native semantic versioning	Tag-based (e.g., `v1`, `latest`)	S3 Object Versioning
Access Control	IAM + Domain/Repo Policies	IAM + Repository Policies	IAM + Bucket Policies
Scaling	Fully Managed	Fully Managed	Virtually Infinite

Hierarchical Outline

Source Code Management
- AWS CodeCommit: Managed Git service.
- Triggers: Using EventBridge to start pipelines on push events.
Artifact Management (AWS CodeArtifact)
- Domains: High-level containers for multiple repositories.
- Repositories: Where the actual packages are stored.
- Security: Use of aws codeartifact get-authorization-token for local CLI access.
Image Management
- Amazon ECR: Hosting Docker images with cross-account support.
- EC2 Image Builder: Automating the creation of AMIs (Amazon Machine Images).
Configuration Repositories
- AppConfig: Managing application-level toggles and configurations.
- Parameter Store / Secrets Manager: Storing sensitive build/deploy variables.

Visual Anchors

The Artifact Pipeline

Loading Diagram...

Figure 1 — Mermaid diagram

IAM Repository Permission Flow

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Definition-Example Pairs

Upstream Source: A repository that provides packages to a downstream repository.
- Example: A team creates a local CodeArtifact repo named internal-lib. They set npmjs.com as an upstream source so they can fetch both their private code and public npm packages from a single endpoint.
Image Recipe: A document in EC2 Image Builder defining the base image and software components.
- Example: A recipe that takes a base Amazon Linux 2 AMI, installs CloudWatch Agent, and applies STIG security hardening.
Artifact Lifecycle: The managed stages of an artifact from creation to deletion.
- Example: Configuring an ECR policy to expire any image tagged with dev-* after 14 days, while keeping prod-* images indefinitely.

Worked Examples

Example 1: Authenticating to CodeArtifact

To push a package to CodeArtifact, you must obtain a temporary token.

Step-by-Step:

Run the CLI command to get the token:
bash
export CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token --domain my-domain --domain-owner <ACCOUNT_ID> --query authorizationToken --output text)
Configure your local tool (e.g., npm or pip) to use this token in the header.
Run the publish command (e.g., npm publish).

Example 2: ECR Lifecycle Policy (JSON)

This policy keeps only the last 10 images to prevent storage bloat.

json

{
    "rules": [
        {
            "rulePriority": 1,
            "description": "Keep last 10 images",
            "selection": {
                "tagStatus": "any",
                "countType": "imageCountMoreThan",
                "countNumber": 10
            },
            "action": {
                "type": "expire"
            }
        }
    ]
}

Checkpoint Questions

Question: Which service should be used to manage internal Java (Maven) dependencies securely within an organization?
Question: How does EC2 Image Builder differ from using a simple Bash script to build AMIs?
Question: In ECR, if a repository policy allows access but the IAM user policy denies it, what is the final outcome?

▶Click to see answers

AWS CodeArtifact. It natively supports Maven and provides secure, centralized storage.
EC2 Image Builder provides a managed pipeline, including automated testing of the image and distribution across multiple AWS regions.
Access Denied. In AWS, an explicit Deny always overrides an Allow.

Muddy Points & Cross-Refs

CodeArtifact vs. S3: While S3 can store .zip files, CodeArtifact is preferred for software development because it understands package versioning (e.g., 1.2.0 vs ^1.2.0) and can proxy public repos.
ECR Repository Policy: Don't confuse this with an IAM policy. A repository policy is attached to the resource (the repo) and is crucial for cross-account access (e.g., Account A builds the image, Account B pulls it for deployment).

Comparison Tables

Deployment Strategies for Repositories

Strategy	Best For	Repository Role
Mutable	Legacy apps, quick patches	Artifacts are pushed to existing servers.
Immutable	Modern, scalable apps	New Image is built in ECR/Image Builder and replaces the old one.
Blue/Green	Zero-downtime production	Two versions of the artifact/image exist simultaneously in different environments.