AWS CodeArtifact
A fully managed private package registry for npm, PyPI, Maven, NuGet and more. Here's what CodeArtifact is good for, what it costs, how it connects to CodeBuild, Lambda, and EventBridge, and the mistakes Design Beaver catches as you draw.
What CodeArtifact is
CodeArtifact is a fully managed artifact repository — a private package registry for the language ecosystems your builds already use: npm, PyPI, Maven/Gradle, NuGet, Ruby gems, Swift, Cargo, and a generic format for arbitrary versioned files. You publish your own internal packages to it so teams share one governed source, and you pull third-party dependencies through it so builds don’t reach straight out to public registries. It’s close to ECR, but for language packages instead of container images.
Design Beaver models CodeArtifact as a regional, endpoint-accessed repository — its domain and its repositories, not a subnet-resident box — so it validates how you wire it to your builds and pipelines as you draw.
When to use CodeArtifact (and when not to)
Reach for CodeArtifact when you want to share internal libraries privately across teams without standing up and operating your own Artifactory, Nexus, or Verdaccio server. It’s the right tool when you want one governed place to proxy and cache public dependencies, so you can control and audit what enters your builds instead of every pipeline hitting npmjs or PyPI directly. If your builds run on AWS and you’d rather have IAM-scoped access to packages than manage a separate registry’s credentials, it fits — provided you’re on a supported format.
Don’t reach for it to store container images or OCI artifacts — that’s ECR, and CodeArtifact holds language packages, not images. Skip it when your format isn’t supported (Go modules and Helm charts aren’t CodeArtifact formats today), or when you just need a general-purpose object store for arbitrary files — that’s S3, and the generic format is for versioned package assets, not a bucket replacement. A solo developer with no sharing or governance need doesn’t need the repository yet.
Variants: a domain and its repositories
There’s really one service. The pieces you lay out in an architecture are the domain — the account and Region-level container that dedupes storage and holds the encryption key and authorization — and the repositories inside it that package managers actually point at.
| Option | What it is |
|---|---|
| Domaindefault | The top-level container that aggregates repositories. All package assets and metadata are stored at the domain level, so a given asset (e.g. a Maven JAR) is stored only once per domain no matter how many of its repositories contain it. The domain is also where the encryption key and the domain-wide policy live, and where you get the authorization token (codeartifact:GetAuthorizationToken is a domain-level permission). |
| Repository | A repository holds packages and is what package managers actually point at via its HTTPS endpoint. A repository can have upstream repositories (its endpoint transparently serves their package versions too) and an external connection to one public registry (npmjs.com, Maven Central, PyPI, NuGet Gallery, etc.), which CodeArtifact fetches from on demand and caches. |
CodeArtifact pricing in plain English
You pay for what you use across three metrics, with no upfront fees, and same-Region transfer to AWS services is free — which is the main lever you control.
No upfront fees or commitments — you pay only for what you use, across three metrics: storage (GB of artifacts stored per month, prorated by how long they're stored), the number of requests made against the service, and data transferred OUT of the AWS Region (to the internet or another Region). Data transfer to AWS services in the SAME Region is not charged. A monthly AWS Free Tier covers a baseline of storage and requests.
| Option | Representative rate |
|---|---|
| storage | ~$0.05 per GB-month of stored artifacts (verify on the live pricing page). |
| requests | ~$0.05 per 10,000 requests (verify on the live pricing page). |
Free tier
- Monthly free tier includes a baseline amount of storage and a baseline number of requests.
Keeping the bill down
- Keep builds and compute in the same Region as the domain — same-Region data transfer to AWS services is free, so cross-Region pulls are the avoidable charge
- Rely on the domain's per-domain deduplication (one domain, many repositories) instead of many domains, so a shared asset is stored once rather than duplicated
- Clean up package versions you no longer need rather than paying to store every historical build artifact indefinitely
us-east-1 (rates vary by region). Rates as of 2026-07. Verify at the official pricing page before using for real cost estimates — these figures are not kept in sync with AWS pricing changes and several are still to be confirmed.
How CodeArtifact connects to other services
The boxes-and-arrows picture hides the real work here: whether an edge is a runtime call or a build-time one, and whose IAM role carries the permission. Design Beaver models each connection, so it knows what CodeArtifact talks to and what that connection actually needs.
A CodeBuild project pulls its dependencies from a CodeArtifact repository during the build (configuring npm/pip/Maven/NuGet to use the repository endpoint), giving reproducible, governed dependency resolution instead of reaching straight out to public registries
A Lambda function's dependencies (npm modules, Python packages) are resolved from a CodeArtifact repository at build/package time and bundled into the function's deployment package or a Lambda layer — CodeArtifact governs which library versions end up inside the function
CodeArtifact emits an event to the default EventBridge event bus whenever a package version is created, modified, or deleted (detail-type 'CodeArtifact Package Version State Change') — e.g. publishing a new npm version, adding an asset to an existing Maven package, or copying a package version between repositories
What CodeArtifact can’t connect to
Some edges look reasonable on a canvas but don’t exist in AWS. Design Beaver flags them instead of letting you draw a diagram that can’t be built.
Route 53 is DNS; a CodeArtifact repository is not a DNS target you point a domain at. Package managers reach the repository over its AWS-managed HTTPS endpoint using a bearer authorization token, not a custom hostname you front with a Route 53 record — there is no architectural edge between them.
CloudFront is a CDN for cacheable HTTP content; a CodeArtifact repository is not a CloudFront origin. Package fetches use the package-manager protocol with a per-request bearer token against the repository endpoint (CodeArtifact already stores and caches assets at the domain level, including public packages pulled via an external connection), so it is not fronted by a CDN.
Anti-patterns Design Beaver catches
These are the CodeArtifact mistakes that pass a diagram review but break under load or over time — the ones the validation engine flags as you draw.
Baking a CodeArtifact authorization token into an image, environment, or long-lived agent and reusing it
Why it breaksThe token is valid for at most 12 hours; a cached or embedded token silently expires and every fetch/publish after that fails auth, often mid-pipeline
Do this insteadFetch a fresh token per build/run (`aws codeartifact login` or get-authorization-token in a pre_build step) rather than storing one
Pointing package managers straight at public registries in CI instead of proxying through a CodeArtifact repository with an external connection
Why it breaksBuilds become non-reproducible and exposed to public-registry outages, rate limits, and package deletions/typosquats, with no central control over what dependencies enter your builds
Do this insteadGive the repository an external connection to the public registry so CodeArtifact fetches and caches public packages on demand, and point all builds at the repository endpoint
Creating a separate domain per team or per repository 'to keep them isolated'
Why it breaksAssets are deduplicated and stored once per domain, and the domain is the unit of shared storage and cross-repository upstreaming — many domains lose that dedup/sharing and multiply the management surface for no benefit
Do this insteadUse one domain per organization (or per environment) and separate concerns with multiple repositories and upstream relationships inside it; reserve extra domains for genuinely separate trust/billing boundaries
Gotchas that bite in production
- Authorization tokens expire in at most 12 hours. That’s both the default and the maximum; you can shorten it to as little as 15 minutes. Bake a token into an image or a long-lived agent and it silently expires, then every fetch or publish after that fails auth — often mid-pipeline. Get a fresh token per build.
- Assets are stored once per domain, not per repository. Creating a domain per team “for isolation” loses that deduplication and the ability to upstream between repositories. Prefer one domain with many repositories; reserve extra domains for genuine trust or billing boundaries.
- External-connection caching is pull-through, on demand. The first time a build requests a public package it’s fetched from the upstream registry and cached — it isn’t pre-mirrored. That’s what protects you from later public-registry outages and deletions, but only for versions you’ve already pulled at least once.
- The IAM for a build lives on the build’s role, not on the repository. CodeArtifact is the resource; CodeBuild, or whoever runs the package manager, is the principal that needs the permissions. When pulls or publishes fail with an auth error, look at the build’s service role.
Further reading
Frequently asked questions
When should you use AWS CodeArtifact?
How much does AWS CodeArtifact cost?
How does CodeArtifact connect to CodeBuild?
Can CodeArtifact connect to CloudFront or Route 53?
Validate your CodeArtifact architecture as you draw
Design Beaver checks your AWS design in real time — missing queues, invalid connections, and security anti-patterns, caught before you ship. It’s live in beta, free, and runs in your browser with no account.
Open the app →Prefer email? Get new features in your inbox: