All Services

Developer Tools

AWS CodeArtifact

AWS CodeArtifact is a managed artifact repository for supported package formats, with domain-level storage, repository upstreams, public-registry connections, encryption, authorization tokens, and package-origin controls.

Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with AWS CodeArtifact.

Package governance, CI access, and pricing

AWS CodeArtifact Pricing & Package Repository Guide

Design CodeArtifact around package trust and promotion, not only storage. Repository upstreams, external connections, package groups, origin controls, and short-lived CI credentials determine which package versions can enter and leave the domain.

Official AWS sources reviewed 2026-08-07.

What is AWS CodeArtifact?

CodeArtifact is a managed package repository for supported Cargo, generic, Maven, npm, NuGet, PyPI, Ruby, and Swift packages. Domains provide a storage and policy boundary, while repositories define publishing, consumption, and upstream paths.

AWS CodeArtifact concepts

What drives AWS CodeArtifact pricing?

Estimate stored package assets, package-manager and API requests, and data transfer. Public upstream caching, CI frequency, retention, replication patterns, and large artifacts can change those dimensions.

Official AWS CodeArtifact pricing

How does CodeArtifact reduce dependency-substitution risk?

Use package and package-group origin controls to restrict direct publishing and ingestion from internal or public upstreams. Combine those controls with approved repository paths, namespace ownership, immutable versions, and least-privilege publishing roles.

CodeArtifact package origin controls

Related AWS services for this plan

  • AWS CodeBuild — Authenticate CodeBuild jobs with short-lived roles and retrieve only approved packages.
  • AWS CodePipeline — Use CodePipeline promotion stages to move tested package versions through controlled repositories.
  • AWS Identity and Access Management — Use IAM and resource policies to separate package producers, consumers, and administrators.
  • AWS Key Management Service — Use KMS key policies when the CodeArtifact domain requires customer-managed encryption control.

AWS CodeArtifact pricing and cost programs

Pricing model: Artifact storage and request usage

On-Demand
Available
Reserved Instances or reserved capacity
Not applicable
Savings Plans
Not applicable
Spot
Not applicable

Billing dimensions: Storage · Requests · Data transfer

Programs and modes: Package repositories · Upstream connections · Cross-account domains

Storage, request, and transfer allowances are maintained on the pricing page.

Free Tier: Available — verify current offers

Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.

Official AWS pricing

Official AWS sources reviewed 2026-07-21.

Why implement AWS CodeArtifact?

  • Replaces self-managed package repository servers for supported Cargo, generic, Maven, npm, NuGet, PyPI, Ruby, and Swift packages.
  • Caches approved public dependencies and shares stored assets across repositories in a domain, reducing external availability and consistency risk.
  • Provides IAM and resource-policy controls, KMS encryption, cross-account repositories, upstream graphs, metadata, and package-origin controls.

How to implement AWS CodeArtifact

  1. Prefer one production domain with repositories separated by lifecycle or trust, choose a customer-managed KMS key when required, and define owning accounts, namespaces, retention, and recovery procedures.
  2. Attach each public external connection to a controlled repository, expose it through upstream repositories, configure package groups and origin controls, and explicitly block unapproved direct publishing or upstream ingestion.
  3. Issue short-lived authorization tokens to least-privilege developer and CI roles, publish immutable versions, promote through trusted repositories, monitor CloudTrail and usage, and delete obsolete assets under a documented policy.

AWS CodeArtifact best practices

  • Use upstream repositories rather than giving every build direct public-registry access, constrain namespaces with package groups, and apply origin controls to prevent dependency-substitution attacks.
  • Never embed CodeArtifact tokens in source or images; obtain short-lived tokens at build time and remember that token duration can outlive an assumed role unless explicitly aligned.
  • Separate producer, consumer, and administrator permissions, protect the domain KMS key and policies, review older package origin settings, and validate restore or republish procedures.

AWS CodeArtifact use cases and server impact

  • Private application packages
  • Controlled caching of public dependencies
  • Cross-account package promotion for CI/CD

Replaces package-repository hosts, storage, replication, and much availability work, while dependency policy, version immutability, malware or license scanning, credentials, and retention remain customer responsibilities.

Official implementation resources

Commonly paired AWS services