A Package Domain that Resists Dependency Confusion
A repository with a public external connection serves whatever the public registry holds for any name it does not. This puts the connection on its own repository, reached through an upstream, and emits the origin-control commands Terraform cannot apply.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-12 · how we verify
Use it from the registry
terraform · opentofumodule "codeartifact" {
source = "www.iac-bazaar.com/iac-bazaar/aws-codeartifact/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-codeartifact
A CodeArtifact domain, its repositories, and the upstream chain that decides
where a package actually comes from. Works with Terraform and OpenTofu
(>= 1.6), AWS provider >= 6.0, < 7.0.
An external connection is the dependency-confusion surface. A repository connected to public npm or PyPI serves whatever the public registry has for any name it does not already hold. So an internal package name that has never been published to that repository - a new module, a renamed one, a typo in a lockfile
- resolves to whoever registered that name publicly. The attack needs no access to anything of yours; it needs the name to be unclaimed.
So this module builds the shape that avoids it. Each external connection
gets its own repository. The repositories developers point at reach it
through an upstream, with your internal repository first in the chain. Nothing
changes for a developer, and a public package is now something that had to
travel through a repository you control. An upstream naming a repository this
module does not create is refused by a precondition - CodeArtifact accepts the
reference and then quietly resolves nothing through it.
What Terraform cannot do, and this module does not pretend to. Package
origin controls - the per-package setting that says "this name may never be
fetched from an upstream again" - have no Terraform resource. They are a CLI
call, and for an internal package name they are the control that closes this
properly. List your internal names in internal_package_names and the module
emits the exact commands as the package_origin_commands output. The upstream
chain narrows the surface; origin controls shut it.
The domain's KMS key is set at creation and cannot be changed. Assets are stored and deduplicated at the domain level, so that one key covers every repository in it - and moving to a customer-managed key later means a new domain and re-publishing everything.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-codebuild
privileged_mode hands the build the Docker socket, so anything it runs can read every environment variable and assume the service role. Off by default, and a PLAINTEXT variable whose name looks like a secret is refused.
aws-codedeploy
CodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure.
aws-codepipeline
AWS-native CI/CD: CodePipeline orchestrating a CodeBuild project, with an encrypted private artifact bucket and least-privilege roles. Sources from S3 (or GitHub).
aws-jenkins
Self-hosted Jenkins controller on a hardened EC2 instance - restricted security group, IMDSv2 enforced, SSM access, encrypted root volume, Jenkins auto-installed via user-data.