Secure Packages with AWS CodeArtifact

Set up a private Maven artifact repository with IAM-secured EC2 access.

Introduction

30 Second Summary

When you install packages for a coding project, your build tool reaches out to the public internet to download them. In a professional environment, this creates security risks and reliability concerns.

In this project, you will create a private package repository using AWS CodeArtifact, configure secure access with IAM, and connect your Java web app to fetch dependencies through your own controlled pipeline.

What You'll Build

A secure package management pipeline that routes your Java project's Maven dependencies through a private AWS CodeArtifact repository instead of directly from the public internet.

By the end of this project, you'll have:

  • A working CodeArtifact repository connected to Maven Central as an upstream source.
  • An IAM role attached to your EC2 instance granting secure, credential-free access to CodeArtifact.
  • A configured settings.xml file that tells Maven to authenticate and pull dependencies through your private repository.
  • Secret Mission: Publish your own custom package to your CodeArtifact repository.

Are there any prerequisites?

This project is Day 3 of a CI/CD pipeline series. You need an AWS account with an IAM Admin User, a running EC2 instance with Java 8 and Maven installed, VS Code with Remote-SSH, and a GitHub repository with your Java web app code.

If you have not completed the earlier projects in this series, go back and set up these resources first.

Before We Start

Before We Start...

Reconnect to Your EC2 Instance

Your EC2 instance has been stopped since your last project. Before you can set up a private package repository, you need to get back into your development environment.

In this step, you'll start the instance, reconnect through VS Code, and confirm your tools are ready to go.

In this step, get ready to:
  • Start your EC2 instance and reconnect via VS Code Remote-SSH.
  • Verify Java and Maven are still installed.
  • Confirm your project directory is intact.
Start your EC2 instance and reconnect via VS Code Remote-SSH

Your EC2 instance is currently stopped. Starting it gives you a fresh public address to connect to.

  • Sign in to the AWS Management Console as your IAM Admin User.
  • Navigate to the EC2 service using the search bar at the top.
  • Select Instances from the left menu.
  • Find and select your instance (nextwork-devops-yourname).
  • Click Instance state, then choose Start instance.
  • Wait for the Instance state column to show Running.
  • Once running, copy the new Public IPv4 DNS value from the instance details panel.

Why does the Public IPv4 DNS change?

Every time you stop and start an EC2 instance, AWS assigns it a new public IP address. This means the DNS address you used last time no longer works. You need to update your SSH configuration with the fresh address before reconnecting.

  • In VS Code, open the command palette by pressing Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows).
  • Type Remote-SSH: Open Configuration File and select it.
  • Choose the SSH config file (usually ~/.ssh/config).
  • Find the HostName line for your EC2 instance and replace the old value with the new Public IPv4 DNS you just copied.
  • Save the config file.
  • Open the command palette again (Cmd+Shift+P / Ctrl+Shift+P).
  • Type Remote-SSH: Connect to Host and select your EC2 instance.
  • VS Code opens a new window connected to your remote instance. Wait for the connection to finish establishing.

Connection timed out?

Double check that your instance state shows Running in the EC2 console. If you just started it, wait 30 seconds and try connecting again.

Also confirm you pasted the full Public IPv4 DNS (not the IP address) into the HostName field in your SSH config.

Help me troubleshoot my Remote-SSH connection to EC2. The connection is timing out after I started my instance and updated the HostName in my SSH config.

Verify Java and Maven are still installed

Your EC2 instance had Java and Maven installed from a previous project. Let's confirm they survived the stop/start cycle.

  • Open a terminal in VS Code by pressing Ctrl+` (backtick key, works on both macOS and Windows).
  • Confirm Maven is available by running:
mvn -v
  • You should see output including Apache Maven 3.5.2.
  • Confirm Java is available by running:
java -version
  • You should see output including openjdk version "1.8.
  • Navigate to your project directory by running:
cd ~/nextwork-web-project

What are these tools?

Maven is a build tool for Java projects. It handles compiling your code and downloading any libraries (dependencies) your project needs. Java 8 is the runtime that executes your compiled code.

Both were installed on your EC2 instance in a previous project. Stopping and starting the instance preserves everything installed on its disk.

Clone your repository if needed

Your project files should already be on the instance from a previous session. Let's verify they're there.

  • Check that your project files exist by running:
ls
  • You should see pom.xml, src/, and other project files in the output.

✔️ I see pom.xml and src/

Your project directory is intact. You're all set to continue.

ⓧ I see "No such file or directory" or the files are missing

Your project files are not on this instance. Clone them from your GitHub repository.

  • Navigate back to the home directory by running:
cd ~
  • Clone your repository by running:
git clone [[YOUR_REPO_URL="https://github.com/your-username/nextwork-web-project.git"]]
  • Move into the project directory by running:
cd ~/nextwork-web-project
  • Verify the project structure by running:
ls
  • You should now see pom.xml, src/, and other project files.

Git clone failed?

Make sure you're using the correct repository URL from your GitHub account. You can find it by visiting your repository page on GitHub and clicking the green Code button.

Help me fix a git clone error on my EC2 instance. I'm trying to clone my nextwork-web-project repository.

Your development environment is back online and ready. Next up, you'll create your CodeArtifact repository to securely manage your project's dependencies.

Create a CodeArtifact Repository

Right now, your Java project downloads dependencies directly from the public internet every time you build it. This works for personal projects, but in a professional CI/CD pipeline, you need a private, controlled repository that caches packages securely.

AWS CodeArtifact is a managed artifact repository service that sits between your build tool and the public internet. In this step, you will create a CodeArtifact repository that connects to Maven Central as an upstream source, giving your project a secure and reliable way to fetch dependencies.

In this step, get ready to:
  • Create a CodeArtifact repository with Maven Central as an upstream source.
  • Configure a CodeArtifact domain to group your repositories.
  • Verify the repository is ready to serve packages.
Create the CodeArtifact repository via the AWS Console

CodeArtifact organizes packages inside repositories. You will create a repository that connects to Maven Central so your Java project can fetch dependencies through a secure, private channel.

  • In the AWS Management Console, type CodeArtifact in the search bar at the top and select CodeArtifact from the results.
  • Select Repositories from the left menu.
  • Click Create repository.
  • In the Repository name field, enter nextwork-devops-cicd.
  • In the Repository description field, enter: This repository stores packages related to a Java web app created as a part of NextWork's CI/CD Pipeline series.
  • Under Public upstream repositories, select the checkbox next to maven-central-store.
  • Click Next.

What is an upstream repository?

An upstream repository is a source your CodeArtifact repository pulls packages from when it does not already have them cached. By selecting maven-central-store, any Maven package your project requests will be fetched from Maven Central and then stored in your private repository.

Once a package is cached, future builds pull it directly from your CodeArtifact repository instead of reaching out to the public internet again.

Configure the domain

A CodeArtifact domain is a grouping mechanism that lets you manage multiple repositories under one namespace. Every repository must belong to a domain.

  • Under Domain selection, choose This AWS account.
  • In the Domain name field, enter nextwork.
  • Click Next.
Review and create
  • Verify the following details on the review page:
  • Review the package flow diagram. This shows how dependencies travel from Maven Central through your upstream repository and into your nextwork-devops-cicd repository.
  • Click Create repository.

You should see a success message confirming your repository has been created. The CodeArtifact console now displays your nextwork-devops-cicd repository page.

Why CodeArtifact instead of downloading directly from Maven Central?

CodeArtifact adds three benefits over pulling packages directly from Maven Central. First, it provides security by giving you a centralized, auditable place for all your dependencies. Second, it provides reliability because cached copies survive Maven Central outages.

Third, it provides control. Everyone on your team pulls the same versions from the same place, which prevents inconsistencies across builds.

Don't see CodeArtifact in search results?

Make sure you are signed in as your IAM Admin User, not the root account. CodeArtifact requires IAM permissions that may not be available on restricted accounts.

Also check that your region is set correctly in the top-right corner of the console. CodeArtifact is region-specific.

Help me find CodeArtifact in the AWS Console.

Your private repository is live and connected to Maven Central. Next up, you will configure IAM permissions so your EC2 instance can actually authenticate with CodeArtifact and pull packages through it.

Create an IAM Policy for CodeArtifact Access

Your CodeArtifact repository is live, but your EC2 instance has no idea it exists. Right now, if Maven tried to fetch packages through CodeArtifact, AWS would reject the request.

In this step, you will attempt to connect to CodeArtifact from your EC2 terminal, see it fail, and then fix the problem by creating an IAM policy that grants the exact permissions needed.

In this step, get ready to:
  • Attempt a CodeArtifact connection and observe the credentials error.
  • Create an IAM policy granting least-privilege read access to CodeArtifact.
Attempt the CodeArtifact connection and see the error

Before building a fix, you will trigger the problem so you understand exactly why IAM permissions matter here.

  • Switch to the AWS Management Console in your browser.
  • Navigate to CodeArtifact in the console (search for it in the top search bar).
  • Select Repositories from the left menu.
  • Click on your nextwork-devops-cicd repository.
  • Click View connection instructions.
  • For Operating system, select Mac and Linux.
  • For Package manager client, select mvn.
  • Ensure Configuration method is set to Pull from your repository.

Why select Mac and Linux?

Even if your local computer runs Windows, your EC2 instance runs Amazon Linux 2023. The connection instructions need to match the operating system of the machine that will run the commands.

  • In the connection instructions dialog, find Step 3 (Export a CodeArtifact authorization token).
  • Copy the export command shown there.
  • Switch to your VS Code terminal (connected to your EC2 instance).
  • Paste the command and press Enter.

You should see an error message containing Unable to locate credentials. This is expected.

Why did this fail?

The command tried to call the AWS CodeArtifact API to generate an authorization token. Your EC2 instance has no AWS credentials attached to it, so AWS rejected the request outright.

To fix this, you need to grant your EC2 instance permission to access CodeArtifact. In AWS, permissions are defined in IAM policies.

Seeing a different error?

If you see a different message (for example, a network timeout), make sure your EC2 instance is in the Running state and that your VS Code terminal is connected to the instance via Remote-SSH.

Help me debug a different error when running the CodeArtifact export token command.

Create the IAM policy

Now that you have seen the problem, you will create an IAM policy that grants only the permissions CodeArtifact needs. This follows the principle of least privilege.

  • Switch back to the AWS Management Console.
  • Navigate to IAM (search for it in the top search bar).
  • Select Policies from the left menu.
  • Click Create policy.
  • Select the JSON tab in the policy editor.
  • Delete any default content in the editor, then paste the following policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:GetAuthorizationToken",
                "codeartifact:GetRepositoryEndpoint",
                "codeartifact:ReadFromRepository"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "sts:GetServiceBearerToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "sts:AWSServiceName": "codeartifact.amazonaws.com"
                }
            }
        }
    ]
}

What does this policy do?

This policy has two permission statements:

  • The first statement allows three CodeArtifact actions: GetAuthorizationToken (request a temporary token), GetRepositoryEndpoint (look up the repository URL), and ReadFromRepository (download packages).
  • The second statement allows sts:GetServiceBearerToken, which is required for CodeArtifact token exchange. The condition restricts this action so it can only be used for the CodeArtifact service.

What is least privilege?

Least privilege means granting only the minimum permissions needed for a task. This policy allows reading from CodeArtifact but does not allow publishing, deleting, or managing repositories. If the credentials were ever compromised, the damage would be limited.

  • Click Next.
  • In the Policy name field, enter codeartifact-nextwork-consumer-policy.
  • In the Description field, enter: Provides permissions to read from CodeArtifact. Created as a part of NextWork CICD Pipeline series.
  • Click Create policy.

You should see a green success banner confirming the policy was created.

Policy creation failed?

Make sure your JSON is valid. Common issues include a missing comma between actions or an extra trailing comma after the last action in the array. Check that you replaced any default content before pasting.

Help me fix an error when creating my CodeArtifact IAM policy.

Your IAM policy is ready. Next up, you will create an IAM role that uses this policy and attach it to your EC2 instance so the credentials error goes away for good.

Create an IAM Role and Attach to EC2

In the previous step, you created an IAM policy that defines what actions are allowed on CodeArtifact. A policy on its own does not grant any permissions.

To deliver those permissions to your EC2 instance, you need an IAM role. A role is a container that holds policies and can be assumed by an AWS service. In this step, you will create a role, attach your policy to it, and assign the role to your EC2 instance so it can securely access CodeArtifact.

In this step, get ready to:
  • Create an IAM role for the EC2 service.
  • Attach your CodeArtifact policy to the role.
  • Assign the role to your EC2 instance and verify CodeArtifact access.
Create the IAM role

Your IAM policy defines what is allowed. Now you will create a role that acts as the bridge between that policy and your EC2 instance.

  • In the AWS Management Console, type IAM in the top search bar and select IAM.
  • Select Roles from the left menu.
  • Click Create role.
  • Under Trusted entity type, choose AWS service.
  • Under Use case, select EC2.
  • Click Next.
  • In the Filter policies search box, type codeartifact-nextwork-consumer-policy.
  • Select the checkbox next to codeartifact-nextwork-consumer-policy.
  • Click Next.
  • In the Role name field, enter EC2-instance-nextwork-cicd.
  • In the Description field, enter Allows EC2 instances to access services related to the NextWork CI/CD pipeline series.
  • Click Create role.

What is an IAM role?

An IAM policy defines permissions ("what actions are allowed"). An IAM role is a container that holds one or more policies and can be assumed by an AWS service like EC2.

When you attach a role to an EC2 instance, AWS automatically provides temporary credentials to the instance. Your applications can then access AWS services without storing any access keys on the machine.

Attach the IAM role to your EC2 instance

The role exists, but your EC2 instance does not know about it yet. You need to explicitly assign the role to the instance.

  • In the AWS Console, navigate to EC2 using the top search bar.
  • Select Instances from the left menu.
  • Select your running instance (nextwork-devops-yourname).
  • Click Actions in the top menu.
  • Select Security, then click Modify IAM role.
  • Click the refresh icon to load the available roles.
  • From the dropdown, select EC2-instance-nextwork-cicd.
  • Click Update IAM role.
  • Confirm you see a green success banner at the top of the page.

Why attach a role instead of using access keys?

IAM roles provide temporary credentials that rotate automatically. You never store long-term access keys on the instance, which eliminates the risk of leaked credentials.

This follows the AWS security best practice of granting permissions through roles rather than hard-coded keys.

Re-run the export token command

Now that your EC2 instance has the correct permissions, the authorization token command that failed earlier should succeed.

  • Switch back to your VS Code terminal (connected to your EC2 instance).
  • Return to the CodeArtifact connection instructions in your browser. You can reopen them by navigating to your repository page and clicking View connection instructions.
  • Copy the command from Step 3 of the connection instructions (the export authorization token command).
  • Paste and run it in your VS Code terminal.

This time, the command should complete silently with no error output. No output means the token was exported successfully.

Still seeing an error?

After attaching the role to your EC2 instance, AWS can take 2-3 minutes to propagate the new credentials. Wait a few minutes, then try the command again.

If the error persists after waiting, double-check that you selected EC2-instance-nextwork-cicd in the IAM role dropdown and that the green success banner appeared.

Help me troubleshoot why my EC2 instance still cannot get a CodeArtifact authorization token after attaching the IAM role.

Your EC2 instance now has secure, credential-free access to CodeArtifact. Next up, you will configure Maven to pull your project's dependencies through your new repository.

Configure Maven and Verify CodeArtifact

Your EC2 instance now has secure, credential-free access to CodeArtifact. The IAM role handles authentication behind the scenes, so you never need to hard-code secrets.

The final piece is telling Maven where to find packages. Right now, Maven still points at Maven Central directly. You will create a settings.xml file that redirects all dependency requests through your CodeArtifact repository.

In this step, get ready to:
  • Create a settings.xml file that configures Maven to authenticate with CodeArtifact.
  • Compile your Java web app and confirm dependencies download through CodeArtifact.
  • Verify cached packages appear in the CodeArtifact console.
Create the settings.xml file

Maven uses a settings.xml file to know which repository to pull packages from and how to authenticate. The CodeArtifact console generates the exact XML you need, pre-filled with your account details.

  • Switch back to your VS Code window (connected to your EC2 instance).
  • In the Explorer sidebar, right-click inside the nextwork-web-project folder and select New File.
  • Name the file settings.xml and press Enter.
  • Type the opening and closing settings tags into the file:
<settings>

</settings>

Now you will copy three XML sections from the CodeArtifact connection instructions into this file. Each section handles a different part of the Maven configuration.

  • Return to the AWS Management Console in your browser.
  • Navigate to the CodeArtifact console.
  • In the left navigation pane, click Repositories, then select nextwork-devops-cicd.
  • Click View connection instructions.
  • For Operating system, select Mac and Linux.
  • For Package manager client, select mvn.
  • Ensure Configuration method is set to Pull from your repository.

Why select Mac and Linux?

Even if your local computer runs Windows, your EC2 instance runs Amazon Linux. The connection instructions need to match the operating system where Maven runs.

  • In the connection instructions dialog, find Step 4 (the servers section). Copy the entire XML snippet shown there.
  • Switch back to VS Code and paste it between your <settings> and </settings> tags.
  • Return to the connection instructions dialog and find Step 5 (the profiles section). Copy the XML snippet.
  • In VS Code, paste it below the servers section (still inside the <settings> tags).
  • Return to the connection instructions dialog and find Step 6 (the mirrors section). Copy the XML snippet.
  • In VS Code, paste it below the profiles section.
  • Save settings.xml.

What do these three sections do?

The servers section tells Maven how to authenticate. It uses the CODEARTIFACT_AUTH_TOKEN environment variable you exported earlier as the password, with aws as the username.

The profiles section defines your CodeArtifact repository URL as a source for dependencies.

The mirrors section redirects all Maven dependency requests (including those that would normally go to Maven Central) through your CodeArtifact repository instead.

File looks messy after pasting?

The XML you paste from the console may not have perfect indentation. That is fine. Maven only cares about the tag structure, not whitespace. If you want to tidy it up, right-click in the file and select Format Document.

Make sure every opening tag has a matching closing tag, and that all three sections sit between <settings> and </settings>.

Help me fix my settings.xml structure.

✔️ Awesome, I've got everything!

Great. Double check you have saved settings.xml before moving on.

ⓧ I'd like to double check the full code

Your settings.xml should have this overall structure. The URLs will be specific to your AWS account and region.

<settings>
  <servers>
    <server>
      <id>nextwork-devops-cicd</id>
      <username>aws</username>
      <password>${env.CODEARTIFACT_AUTH_TOKEN}</password>
    </server>
  </servers>
  <profiles>
    <profile>
      <id>nextwork-devops-cicd</id>
      <activation>
        <activeByDefault>true</activeByDefault>
      </activation>
      <repositories>
        <repository>
          <id>nextwork-devops-cicd</id>
          <url>https://nextwork-your-account-id.d.codeartifact.your-region.amazonaws.com/maven/nextwork-devops-cicd/</url>
        </repository>
      </repositories>
    </profile>
  </profiles>
  <mirrors>
    <mirror>
      <id>nextwork-devops-cicd</id>
      <name>nextwork-devops-cicd</name>
      <url>https://nextwork-your-account-id.d.codeartifact.your-region.amazonaws.com/maven/nextwork-devops-cicd/</url>
      <mirrorOf>*</mirrorOf>
    </mirror>
  </mirrors>
</settings>

Why do the URLs look different from mine?

The URLs shown above use placeholder values (your-account-id and your-region). Your file will have your actual AWS account ID and region in those spots because you copied them directly from the CodeArtifact console.

Compile your project using CodeArtifact

With settings.xml in place, Maven knows to fetch packages through your CodeArtifact repository. Time to test it by compiling your Java web app.

  • In your VS Code terminal, confirm you are in the nextwork-web-project directory by running:
pwd

You should see /home/ec2-user/nextwork-web-project in the output.

  • Compile your project using your new settings file by running:
mvn -s settings.xml compile

What does this command do?

The -s settings.xml flag tells Maven to use your project-local settings file instead of the default global one at ~/.m2/settings.xml. This keeps your CodeArtifact configuration contained within the project.

The compile goal downloads all dependencies listed in pom.xml and compiles your Java source code.

Watch the terminal output. You should see lines containing Downloading from nextwork-devops-cicd as Maven pulls dependencies through your CodeArtifact repository.

  • Wait for the BUILD SUCCESS message to appear at the end of the output.

Seeing BUILD FAILURE or an authentication error?

If you see an authorization error, your CODEARTIFACT_AUTH_TOKEN may have expired. Tokens last 12 hours. Re-run the export token command from the CodeArtifact connection instructions (Step 3 in the dialog) and then retry the compile.

If you see a "Could not find artifact" error, double check that the <url> values in your settings.xml match the URLs shown in the connection instructions. A typo in the domain name, account ID, or region will cause this.

Help me debug my Maven compile failure.

Verify packages in CodeArtifact

The compile succeeded, which means Maven downloaded dependencies through your CodeArtifact repository. Those packages are now cached in CodeArtifact so future builds can grab them instantly without reaching out to Maven Central.

  • Return to the CodeArtifact console in your browser.
  • Close the connection instructions dialog if it is still open.
  • On your nextwork-devops-cicd repository page, scroll down to the Packages section.
  • Click Refresh if no packages appear yet.

You should see Maven packages listed in the table. These are the dependencies that Maven fetched from Maven Central and cached in your CodeArtifact repository during the compile.

Why is caching packages useful?

Once a package is cached in CodeArtifact, every developer on your team (or every CI/CD build server) can pull it from your private repository instead of hitting the public internet. This is faster, more reliable, and gives you a single place to audit which package versions your projects depend on.

Don't see any packages?

There can be a short delay between when the compile finishes and when packages appear in the console. Wait 30 seconds and click Refresh again.

If you still see nothing, confirm your mvn -s settings.xml compile output showed Downloading from nextwork-devops-cicd (not Downloading from central). If it said central, your mirrors section may be missing or malformed.

Help me figure out why packages aren't showing in my CodeArtifact console.

Secret mission

Publish Your Own Package

You've set up CodeArtifact to pull dependencies from Maven Central. But what about publishing your own packages for your team to use? In this secret mission, you'll extend your setup to support package publishing and deploy your web app as a reusable Maven artifact.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. Your EC2 instance is free tier eligible (t2.micro), but charges apply if you exceed free tier limits. CodeArtifact incurs minimal storage costs for cached packages.

Cost warning

If your EC2 instance is running outside of free tier limits, you will be charged for compute time. Stop or terminate the instance when not in use to avoid unexpected charges.

Resources you used:

  • CodeArtifact repository (nextwork-devops-cicd) and domain (nextwork): minimal storage costs for cached packages.
  • IAM policy (codeartifact-nextwork-consumer-policy): no cost.
  • IAM role (EC2-instance-nextwork-cicd): no cost.
  • EC2 instance (nextwork-devops-yourname): free tier eligible, but charges apply if running beyond free tier limits.

Keep everything running

No action needed. Choose this if you plan to continue to Day 4 (CodeBuild) soon. Your EC2 instance, CodeArtifact repository, and IAM resources will be reused in the next project.

Pause - I'll come back to this later

Shut down running processes to free up compute costs while keeping your setup intact for later.

  • In the EC2 console, select your instance (nextwork-devops-yourname).
  • Click Instance state, then choose Stop instance.
  • Your CodeArtifact repository, IAM role, and IAM policy remain in place at no additional cost.
  • When you return, start the instance again and update the Public IPv4 DNS in your SSH config file before reconnecting.

Delete - I don't want to use this again

Remove all project resources completely. Follow these steps in order.

First, terminate your EC2 instance:

  • In the EC2 console, select your instance (nextwork-devops-yourname).
  • Click Instance state, then choose Terminate instance.
  • Confirm the termination when prompted.

Next, delete the CodeArtifact repository and domain:

  • Open the CodeArtifact console.
  • In the navigation pane, choose Repositories.
  • Select nextwork-devops-cicd, then click Delete and follow the confirmation steps.
  • Also delete the maven-central-store upstream repository if it was created in your account. Select it and click Delete.
  • In the navigation pane, choose Domains.
  • Select nextwork, then click Delete and follow the confirmation steps. You must delete all repositories in a domain before you can delete the domain itself.

Finally, delete the IAM role and policy:

  • Open the IAM console.
  • In the navigation pane, choose Roles.
  • Search for EC2-instance-nextwork-cicd, select the checkbox next to it, and click Delete.
  • Type the role name to confirm, then click Delete.
  • In the navigation pane, choose Policies.
  • Search for codeartifact-nextwork-consumer-policy, select it, choose Actions, then Delete.
  • Confirm the deletion when prompted.

That's a Wrap!

That's a Wrap!

Nice work! You just built a secure package management pipeline using AWS CodeArtifact, proving you can implement enterprise-grade dependency management as part of a CI/CD workflow.

You've learned how to:

  • Created an AWS CodeArtifact repository with Maven Central configured as an upstream source, giving your project a private cache for dependencies.
  • Built an IAM policy and IAM role following the principle of least privilege, enabling your EC2 instance to access CodeArtifact without hardcoded credentials.
  • Configured Maven via settings.xml to authenticate and pull dependencies through CodeArtifact, then verified cached packages in the console.
  • (Secret Mission) Published your own custom package to CodeArtifact using mvn deploy, experiencing the full package lifecycle from consumer to publisher.

Ready to quiz yourself?