Blocking certain public packages with AWS CodeArtifact

user_8559706 0
Viewed 249

I'm hoping to create a private CodeArtifact PyPI repo with an upstream that connects to the public PyPI repo. The private repo will store packages with a certain prefix.

Examples:

  • foo.databases
  • foo.logging

I want to avoid pulling the packages above from the public PyPI repo if a version is requested from the private repo is not available. Any package request with a foo prefix should be blocked from the upstream repo.

Per the repository policy docs...

The codeartifact:ReadFromRepository action can only be used on a repository resource. You cannot put a package's Amazon Resource Name (ARN) as a resource with codeartifact:ReadFromRepository as the action to allow read access to a subset of packages in a repository. A given principal can either read all the packages in a repository or none of them.

...I get the impression that this is not possible. Is there any way to make this work? Artifactory uses an include / exclude pattern to solve this. I was hoping for something similar in CodeArtifact.

aws-codeartifact pypi amazon-web-services packaging
1 Answers

CodeArtifact does not support blocking packages from upstream based on package name prefix. But CodeArtifact now offers package origin controls that can be used to block individual packages from upstreams.

If you create a private CodeArtifact PyPI repo with an upstream that connects to the public PyPI repo and then publish versions of the packages foo.databases and foo.logging to your private repo, then those packages will be initialized in your private repo with settings to block versions of those package from upstream repositories, which will prevent pulling any versions of those packages from the public PyPI repo.

Since the feature doesn't work on prefixes, if you later request something like foo.networking, it won't be blocked from pulling from public PyPI unless you first published a version of foo.networking to your private repository or manually configured package origin control on package foo.networking to set Upstream: BLOCK.

user_14893050
Related