An insurance firm shares internal Python and JavaScript libraries across about 40 product teams. The libraries are built by CodeBuild, and they are copied by hand into a shared S3 bucket that developers pull from with ad-hoc scripts.
The packages must not be published to any public registry. Teams also install open-source dependencies from PyPI and npm, and the build roles should not hold long-lived package manager passwords.
The security team wants one place to see every package version and to control which teams can publish a given package.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Store the libraries in a private Amazon ECR repository as artifacts, and have each team pull them with a registry login token that is valid for the whole build.
BB. Run a self-managed Nexus repository on an Amazon EC2 instance in a private subnet, and point all Python and JavaScript clients at it with a shared password stored in the build environment.
CC. Create a CodeArtifact domain with a private repository for internal packages, connect it to public PyPI and npm repositories as upstreams, and have builds fetch short-lived IAM tokens.
DD. Publish the internal libraries to the public PyPI and npm registries as private packages, and restrict access with a password that all product teams share.
Show the answer and explanation
Answer: C
A. Wrong: Amazon ECR stores container images and other OCI artifacts, but it does not provide the PyPI and npm endpoints that pip and npm install from. Teams would still need a separate way to publish and install their packages.
B. Wrong: A self-managed server can host packages, but the company would patch and scale it and keep a shared password. That is more overhead than a managed service and conflicts with the credential rule.
C. Right: Correct. CodeArtifact is a managed package repository with upstream connections to public registries, so internal and open-source packages come from one endpoint. Repository policies control who can publish, and tokens come from IAM rather than stored passwords. Learn more: Working with upstream repositories in CodeArtifact (opens in a new tab)
D. Wrong: Public registries cannot keep packages private, and the requirement forbids publishing internal code to them. A shared password would also be hard to rotate without breaking every team at once.
Explanation
CodeArtifact provides managed package repositories that can use public registries as upstream sources, so teams get internal and open-source packages from one endpoint. Its repository policies control publishing, and authorization tokens come from IAM rather than stored passwords. Container registries, self-managed servers and public registries each miss at least one requirement.
Want more on Artifact repositories (CodeArtifact, ECR, S3)? The 5 full-length practice sets have 12 more Artifact repositories (CodeArtifact, ECR, S3) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →