Artifact repositories (CodeArtifact, ECR, S3): DOP-C02 study notes and practice questions
What to know about Artifact repositories (CodeArtifact, ECR, S3) for the DOP-C02 exam, from the SDLC Automation domain (22% of the exam guide), then 1 free question to test it. Part of the DOP-C02 study guide.
These questions ask where to keep packages, images and build outputs so teams can share them safely.
AWS CodeArtifact
Managed repositories for npm, PyPI, Maven, NuGet, Swift, Ruby, Cargo and generic packages.
Upstream repositories and external connections to public registries give teams internal and open-source packages from one endpoint, with caching.
Domains group repositories across accounts; repository and domain policies control access.
Auth with aws codeartifact login or a short-lived token.
Package origin controls stop dependency confusion by blocking public versions of internal package names.
Amazon ECR
Private registries with immutable tags (stop overwrites), lifecycle policies (expire old images), replication across Regions and accounts, and pull-through cache for public registries.
Basic or enhanced scanning (enhanced uses Amazon Inspector, continuously).
Repository policies grant cross-account pulls; images are encrypted with KMS.
Image signing with AWS Signer and Notation, verified at deploy time.
Amazon S3
General artifacts (zip bundles, templates) with versioning, encryption and lifecycle rules.
Bucket and KMS key policies for cross-account pipelines.
Practices
Build once, promote the same artifact (by digest or version) across environments.
Tag images with the commit ID, not just latest.
Keep artifacts immutable and traceable.
Common traps
Teams pulling directly from public registries with no control or cache.
Mutable latest tags in production.
Rebuilding for each environment, so prod runs untested bits.
Copying images between Regions with scripts when ECR replication does it.
Sharing packages by copying them into every account instead of granting access with repository or domain policies.
An insurance firm shares internal Python and JavaScript libraries across about 40 product teams. The libraries are built by CodeBuild, and they are copied by hand into a shared S3 bucket that developers pull from with ad-hoc scripts.
The packages must not be published to any public registry. Teams also install open-source dependencies from PyPI and npm, and the build roles should not hold long-lived package manager passwords.
The security team wants one place to see every package version and to control which teams can publish a given package.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Store the libraries in a private Amazon ECR repository as artifacts, and have each team pull them with a registry login token that is valid for the whole build.
BB. Run a self-managed Nexus repository on an Amazon EC2 instance in a private subnet, and point all Python and JavaScript clients at it with a shared password stored in the build environment.
CC. Create a CodeArtifact domain with a private repository for internal packages, connect it to public PyPI and npm repositories as upstreams, and have builds fetch short-lived IAM tokens.
DD. Publish the internal libraries to the public PyPI and npm registries as private packages, and restrict access with a password that all product teams share.
Show the answer and explanation
Answer: C
A. Wrong: Amazon ECR stores container images and other OCI artifacts, but it does not provide the PyPI and npm endpoints that pip and npm install from. Teams would still need a separate way to publish and install their packages.
B. Wrong: A self-managed server can host packages, but the company would patch and scale it and keep a shared password. That is more overhead than a managed service and conflicts with the credential rule.
C. Right: Correct. CodeArtifact is a managed package repository with upstream connections to public registries, so internal and open-source packages come from one endpoint. Repository policies control who can publish, and tokens come from IAM rather than stored passwords. Learn more: Working with upstream repositories in CodeArtifact (opens in a new tab)
D. Wrong: Public registries cannot keep packages private, and the requirement forbids publishing internal code to them. A shared password would also be hard to rotate without breaking every team at once.
Explanation
CodeArtifact provides managed package repositories that can use public registries as upstream sources, so teams get internal and open-source packages from one endpoint. Its repository policies control publishing, and authorization tokens come from IAM rather than stored passwords. Container registries, self-managed servers and public registries each miss at least one requirement.
Want more on Artifact repositories (CodeArtifact, ECR, S3)? The 5 full-length practice sets have 12 more Artifact repositories (CodeArtifact, ECR, S3) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Artifact repositories (CodeArtifact, ECR, S3)