Artifacts, Images and Packages

What it is

An artifact is anything a pipeline produces or consumes: a zip bundle, a library package, a container image or a machine image. Managing artifacts means storing them safely, versioning them, controlling who can use them and removing old ones.

AWS offers a different store for each kind. Amazon Simple Storage Service (S3) holds bundles, AWS CodeArtifact holds software packages, Amazon Elastic Container Registry (ECR) holds container images, and EC2 Image Builder produces Amazon Machine Images (AMIs).

How it works

Bundles in S3

Pipeline and deployment bundles sit in S3. Turn on bucket versioning so a deployment can name an exact version, and use lifecycle rules to expire old objects. Encrypt with a customer managed KMS key when other accounts need access.

Packages in CodeArtifact

CodeArtifact is a managed package repository that works with common package managers such as npm, Maven, Gradle, pip, NuGet and others. A domain groups repositories and handles storage and encryption, and a repository holds the packages.

Package origin controls help prevent dependency confusion, where a public package with the same name as a private one is pulled by mistake. Build tools log in with a temporary authorization token.

aws codeartifact login --tool npm --domain my-domain --repository my-repo

Images in ECR

ECR stores container images in private or public repositories, with access controlled by IAM and repository policies.

aws ecr get-login-password --region us-east-1 | docker login --username AWS \
  --password-stdin 111122223333.dkr.ecr.us-east-1.amazonaws.com

Features worth knowing for the exam:

• Image scanning: basic scanning checks for known vulnerabilities, and enhanced scanning uses Amazon Inspector for continuous results.
• Tag immutability: blocks overwriting an existing tag, so v1.2.0 always means one image.
• Lifecycle policies: expire old or untagged images automatically.
• Replication: copies images to other Regions or accounts, which supports multi Region deployments and disaster recovery.
• Pull through cache: caches images from supported public registries inside your private registry.

A lifecycle policy that removes untagged images after 14 days looks like this.

{
  "rules": [{
    "rulePriority": 1,
    "description": "Expire untagged images after 14 days",
    "selection": {
      "tagStatus": "untagged",
      "countType": "sinceImagePushed",
      "countUnit": "days",
      "countNumber": 14
    },
    "action": {"type": "expire"}
  }]
}

Tag images with the commit ID or a build number as well as a human friendly tag. Deploying latest makes rollbacks and audits unreliable.

Machine images with EC2 Image Builder

EC2 Image Builder automates building, testing and distributing AMIs and container images. You define the parts and a schedule, and it runs the build in a temporary instance.

A golden AMI pipeline can start when a new parent image appears, build a patched AMI, and then trigger a CodePipeline or update a launch template. Publish the new AMI ID in Systems Manager Parameter Store, and let launch templates read the parameter, so instances pick up the new image without template edits.

Sharing and encryption

An encrypted AMI or snapshot can be shared with another account only if its KMS key is a customer managed key that the other account may use. Images encrypted with the AWS managed EBS key cannot be shared that way.