> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Demo Storing Artifacts in CodeArtifact > Guide to creating and managing AWS CodeArtifact domains and repositories, configuring upstreams, cross-account encryption, and authenticating developer tools via the AWS CLI and console In this lesson we explore AWS CodeArtifact from the AWS Management Console and the AWS CLI. You’ll learn how to create, configure, and manage artifact repositories as part of SDLC automation. While many teams use Amazon S3 for artifact storage, CodeArtifact is purpose-built for package repositories and integrates with developer tools (npm, Maven, pip, NuGet, etc.). Key concepts * Domain: A top-level grouping for an organization (frequently one domain per company). Domains deduplicate package content across repositories within the domain so identical packages stored in multiple repositories are retained only once. * Repository: Lives inside a domain and supports one or more package formats. Repositories can be primary (the authoritative store) or configured with upstreams to pass-through and cache packages from public or other CodeArtifact repositories. ![Screenshot of the AWS CodeArtifact console showing the "devops-demo-domain" domain and a list of three repositories (maven-packages, npm-packages, pypi-packages). Domain management buttons (Delete domain, Apply domain policy, Create repository) and the Developer Tools navigation menu are visible.](https://mintcdn.com/kodekloud-c4ac6d9a/deef86LW8w1XLb8X/images/AWS-Certified-DevOps-Engineer-Professional/Domain-1-SDLC-Automation/Demo-Storing-Artifacts-in-CodeArtifact/aws-codeartifact-devops-demo-domain-repos.jpg?fit=max\&auto=format\&n=deef86LW8w1XLb8X\&q=85\&s=0743a0bbdf109c72754b1cae07c9d1d2) You can create multiple repositories beneath a domain and mix package formats as required. Domains also let you attach resource policies to grant cross-account access and control. Upstream repositories and package flow When you add upstream connections (public registries or other CodeArtifact repositories) the repository can fetch packages that aren’t present locally. CodeArtifact creates upstream store mappings to enable caching and pass-through automatically. ![Screenshot of the AWS CodeArtifact console showing package flow and repository creation details: two external connections (public:maven-central and public:maven-commonsware) mapped to upstream stores (maven-central-store, commonsware-store) that feed into a repository named maven2-repo. The lower pane shows repository settings and a highlighted "Create repository" button.](https://mintcdn.com/kodekloud-c4ac6d9a/deef86LW8w1XLb8X/images/AWS-Certified-DevOps-Engineer-Professional/Domain-1-SDLC-Automation/Demo-Storing-Artifacts-in-CodeArtifact/aws-codeartifact-package-flow-create-repo.jpg?fit=max\&auto=format\&n=deef86LW8w1XLb8X\&q=85\&s=5de3df0a1352bb1a88c932298dec2372) Once a repository is created you can view details such as the repository ARN, configured upstreams, tags, and connection instructions from the console. ![A screenshot of the AWS CodeArtifact console showing the "maven2-repo" repository details, including domain, repository ARN, and upstream repositories. The packages section is visible but shows "No packages to display."](https://mintcdn.com/kodekloud-c4ac6d9a/deef86LW8w1XLb8X/images/AWS-Certified-DevOps-Engineer-Professional/Domain-1-SDLC-Automation/Demo-Storing-Artifacts-in-CodeArtifact/aws-codeartifact-maven2-repo-no-packages.jpg?fit=max\&auto=format\&n=deef86LW8w1XLb8X\&q=85\&s=fb52128c6fd42446082fa58f984112f2) Repository and domain policies CodeArtifact uses standard IAM-style JSON resource policies for domain and repository permissions. Use these resource-based policies to grant cross-account or cross-principal access. A minimal policy skeleton: ```json theme={null} { "Version": "2012-10-17", "Statement": [] } ``` You can also create general-purpose repositories that store binary artifacts (installers, ML models, etc.) and do not have upstreams. ![A screenshot of the AWS Management Console showing the CodeArtifact "Create repository" page with form fields for repository name, description, and public upstream repositories. The page includes step navigation on the left and a prominent orange "Next" button at the bottom right.](https://mintcdn.com/kodekloud-c4ac6d9a/deef86LW8w1XLb8X/images/AWS-Certified-DevOps-Engineer-Professional/Domain-1-SDLC-Automation/Demo-Storing-Artifacts-in-CodeArtifact/aws-codeartifact-create-repo-form.jpg?fit=max\&auto=format\&n=deef86LW8w1XLb8X\&q=85\&s=7499107a0166326a7c0a679ea8e65e93) Cross-account access and encryption considerations * For cross-account access to CodeArtifact, you usually need a customer-managed KMS key (CMK) for repository/domain encryption. AWS-managed keys generally cannot be used for cross-account CodeArtifact access. * Example formats (for clarity only): * domain endpoint: `devops-demo-domain-598274344262.d.codeartifact.us-east-1.amazonaws.com` * KMS alias ARN: `arn:aws:kms:us-east-1:598274344262:alias/devops-020-220-codeartifact` When granting cross-account access, ensure the CMK key policy and the CodeArtifact domain/repository policies both allow the target account to access the encrypted artifacts. If the KMS policy blocks access, cross-account operations will fail even if the CodeArtifact policy appears correct. Example domain policy (allowing another account to list repositories, get domain permissions, get an auth token, and describe the domain): ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowCrossAccountAccess", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:root" }, "Action": [ "codeartifact:GetDomainPermissionsPolicy", "codeartifact:ListRepositoriesInDomain", "codeartifact:GetAuthorizationToken", "codeartifact:DescribeDomain" ], "Resource": "*" } ] } ``` CLI helpers and common authentication pitfalls AWS provides CLI commands that make it straightforward to authenticate developer tools (npm, pip, mvn, etc.) against a CodeArtifact repository. A frequent error is forgetting to specify the correct region or domain owner, which produces a “Domain not found” or ResourceNotFoundException. If you see "Domain not found," confirm your `--region` and `--domain-owner` values. The AWS CLI defaults to the configured region; if the domain exists in another region you must add `--region `. Example: npm login without region may fail ```bash theme={null} # Attempt without region (may produce "Domain not found") aws codeartifact login --tool npm --domain devops-demo-domain --domain-owner 598274344262 --repository npm-packages # Error: # An error occurred (ResourceNotFoundException) when calling the GetAuthorizationToken operation: Domain not found. Domain 'devops-demo-domain' owned by account '598274344262' does not exist. ``` Retry with the correct region: ```bash theme={null} aws codeartifact login --tool npm --domain devops-demo-domain --domain-owner 598274344262 --repository npm-packages --region us-east-1 # Example success output: # Successfully configured npm to use AWS CodeArtifact repository https://devops-demo-domain-598274344262.d.codeartifact.us-east-1.amazonaws.com/npm/npm-packages/ # Login expires in 12 hours. ``` After configuring npm, installing packages from CodeArtifact is the same as a public registry: ```bash theme={null} npm install lodash ``` Maven connection example The CodeArtifact console provides connection instructions for Maven, showing how to obtain an authorization token and configure the `settings.xml` with server credentials and repository URLs. Windows cmd example to set an environment variable with the token: ```bat theme={null} FOR /F "tokens=*" %g IN ('aws codeartifact get-authorization-token --domain devops-demo-domain --domain-owner 598274344262 --region us-east-1 --query authorizationToken --output text') do (SET CODEARTIFACT_AUTH_TOKEN=%g) ``` Add a `` entry in `settings.xml` that references the token: ```xml theme={null} devops-demo-domain-maven-packages aws ${env.CODEARTIFACT_AUTH_TOKEN} ``` Add a Maven profile to point to your CodeArtifact repository URL so Maven will resolve artifacts from that repository: ```xml theme={null} devops-demo-domain-maven-packages true devops-demo-domain-maven-packages https://devops-demo-domain-598274344262.d.codeartifact.us-east-1.amazonaws.com/maven/maven-packages/ ``` All of these connection snippets are available from the repository's "View connection instructions" link in the console. ![Screenshot of the AWS CodeArtifact console showing a "maven-packages" repository (connected to a public repository) with no packages listed. The left sidebar shows Developer Tools navigation (CodeCommit, CodeArtifact, CodeBuild, etc.) and a "View connection instructions" button is highlighted.](https://mintcdn.com/kodekloud-c4ac6d9a/deef86LW8w1XLb8X/images/AWS-Certified-DevOps-Engineer-Professional/Domain-1-SDLC-Automation/Demo-Storing-Artifacts-in-CodeArtifact/aws-codeartifact-maven-repo-view-instructions.jpg?fit=max\&auto=format\&n=deef86LW8w1XLb8X\&q=85\&s=254196822572148df0806ebe759541ba) Summary and best practices | Resource | Purpose | Best practice | | -: | - | - | | Domain | Organizes repositories and deduplicates packages across them | Use a single domain per organization where practical and attach domain policies for cross-account access | | Repository | Stores packages (primary or pass-through cache) | Use upstreams to cache public registries and reduce external dependency latency | | Upstream | Public registries or other CodeArtifact repos used for pass-through | Configure only the upstreams you need to minimize exposure and reduce cache size | Key takeaways * Domains contain repositories. Repositories can be primary (store your published packages) or pass-through (cache and proxy upstream public repositories). * Repositories act as caches to bring packages closer to your build and deployment environments, improving reliability and speed. * Use domain and repository resource policies to control access. For cross-account encryption scenarios, prefer a customer-managed KMS key (CMK) and ensure KMS key policies allow the target accounts access. * Use the AWS CLI helpers to configure developer tools; always verify `--region` and `--domain-owner` to avoid authentication errors. Further reading and references * AWS CodeArtifact documentation: [https://docs.aws.amazon.com/codeartifact/latest/ug/what-is-codeartifact.html](https://docs.aws.amazon.com/codeartifact/latest/ug/what-is-codeartifact.html) * Maven Central: [https://search.maven.org](https://search.maven.org) * CommonsWare: [https://commonsware.com](https://commonsware.com) This concludes the CodeArtifact lesson. For additional SDLC automation topics, review other lessons in the course. > **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/199ecdf9-a58f-4c2d-b9c9-eac36de111cd/lesson/2959a111-f65c-4ce4-b179-aff93b8cde6c)** > **[Practice Lab](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/199ecdf9-a58f-4c2d-b9c9-eac36de111cd/lesson/97c36b95-46d8-4d4b-b8e6-62cfb24b215f)** This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.