aws-codeartifact/README.yaml at main · cloudposse-terraform-components/aws-codeartifact · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: "aws-codeartifact"

# Canonical GitHub repo
github_repo: "cloudposse-terraform-components/aws-codeartifact"

# Short description of this project
description: |-
  This component is responsible for provisioning an AWS CodeArtifact domain, its repositories, cross-account read and
  publish access, and package groups with origin controls. It wraps the
  [`cloudposse/codeartifact/aws`](https://github.com/cloudposse/terraform-aws-codeartifact) module and its
  `package-groups` submodule.

  Repositories can connect to public registries (PyPI, npm, Maven Central and others) and list other repositories in the
  same domain as upstreams, so consumers point their package manager at a single repository and resolve both private and
  public packages through it.

  Access is granted by IAM principal ARN or by AWS Organization ID. The principals receive both the domain policy (to
  obtain an authorization token) and a permissions policy on every repository. Wire role ARNs from other components in
  the stack configuration with `!terraform.state`.

  Package groups protect first-party package names from dependency confusion: with publishing allowed and both upstream
  restrictions set to `BLOCK`, a matching package can only come from a direct publish into the domain, never from a
  public registry. Package groups are managed with the `hashicorp/awscc` provider, because the `hashicorp/aws` provider
  has no resource for them.

  ## Authentication

  This component ships the next-gen `providers.tf`: the `aws` and `awscc` providers set only `region`, and
  [Atmos Auth](https://atmos.tools/cli/configuration/auth) supplies the target account credentials before Terraform
  runs. There is no dependency on `account-map`. When `account_map.full_account_map` is populated, the account
  verification check fails the plan if the credentials belong to a different account than the stack's `tenant-stage`.

  On infrastructure that still uses `account-map` and team roles, vendor the
  `providers-account-map-bypass.depth-1.tf` mixin from
  [cloudposse-terraform-components/mixins](https://github.com/cloudposse-terraform-components/mixins) in place of
  `providers.tf`, and give the `awscc` provider in `provider-awscc.tf` the same `assume_role` as the `aws` provider.
  `awscc` takes `assume_role` as an attribute, not a block:

  ```hcl
  provider "awscc" {
    region = var.region

    assume_role = var.account_map_enabled && length(compact([module.iam_roles.terraform_role_arn])) > 0 ? {
      role_arn = module.iam_roles.terraform_role_arn
    } : null
  }
  ```

usage: |-
  **Stack Level**: Regional

  This component is normally applied once, in the account that holds build artifacts (typically `artifacts`, `auto` or
  `corp`), in the primary Region. The domain name is what every consumer types into its package manager configuration,
  so keep it short and never change it: replacing a domain deletes every package stored in it.

  ```yaml
  components:
    terraform:
      codeartifact:
        vars:
          enabled: true
          name: codeartifact
          domain_name: acme
          repositories:
            # Holds only the public connection. Nothing installs from it directly.
            pypi-store:
              description: "Cache of public PyPI"
              external_connection: "public:pypi"
            # First-party packages, with public PyPI resolved through pypi-store.
            python:
              description: "First-party Python packages"
              upstreams:
                - pypi-store
          repository_endpoint_formats:
            - pypi
          package_groups:
            # Packages named acme* can only be published here, never pulled from PyPI.
            first-party-python:
              pattern: "/pypi//acme~"
              publish:
                restriction_mode: ALLOW
              external_upstream:
                restriction_mode: BLOCK
              internal_upstream:
                restriction_mode: BLOCK
          # Role ARNs from other components, resolved by Atmos.
          principals_readonly_access:
            - !terraform.state iam-role/ci-build plat-dev-use1 arn
            - !terraform.state iam-role/ci-build plat-prod-use1 arn
          principals_publish_access:
            - !terraform.state iam-role/ci-publish core-auto-use1 arn
  ```

  Consumers in other accounts also need an identity policy allowing `codeartifact:GetAuthorizationToken`,
  `codeartifact:GetRepositoryEndpoint`, `codeartifact:ReadFromRepository` and `sts:GetServiceBearerToken`.

  A package group pattern is validated by the API at apply time, not at plan time. A prefix match ends in `~`
  (`/pypi//acme~`), and `*` only matches a whole segment (`/npm/@acme/*`).

tags:
  - terraform
  - terraform-modules
  - aws
  - components
  - terraform-components
  - root
  - geodesic
  - reference-implementation
  - reference-architecture

# Categories of this project
categories:
  - terraform-modules/root
  - terraform-components

# License of this project
license: "APACHE2"

# Badges to display
badges:
  - name: "Latest Release"
    image: "https://img.shields.io/github/release/cloudposse-terraform-components/aws-codeartifact.svg?style=for-the-badge"
    url: "https://github.com/cloudposse-terraform-components/aws-codeartifact/releases/latest"
  - name: "Slack Community"
    image: "https://slack.cloudposse.com/for-the-badge.svg"
    url: "https://slack.cloudposse.com"

references:
  - name: "AWS CodeArtifact"
    description: "CodeArtifact concepts: domains, repositories, upstream repositories and external connections"
    url: "https://docs.aws.amazon.com/codeartifact/latest/ug/welcome.html"
  - name: "Package groups and origin controls"
    description: "How package groups set origin controls for packages that match a pattern"
    url: "https://docs.aws.amazon.com/codeartifact/latest/ug/package-groups.html"
  - name: "cloudposse/terraform-aws-codeartifact"
    description: "The Terraform module this component wraps"
    url: "https://github.com/cloudposse/terraform-aws-codeartifact"
  - name: "Cloud Posse Documentation"
    description: "Complete documentation for the Cloud Posse solution"
    url: "https://docs.cloudposse.com"
  - name: "Reference Architectures"
    description: "Launch effortlessly with our turnkey reference architectures, built either by your team or ours."
    url: "https://cloudposse.com/"

related:
- name: "Cloud Posse Terraform Modules"
  description: Our collection of reusable Terraform modules used by our reference architectures.
  url: "https://docs.cloudposse.com/modules/"
- name: "Atmos"
  description: "Atmos is like docker-compose but for your infrastructure"
  url: "https://atmos.tools"

contributors: [] # If included generates contribs