A Package Domain that Resists Dependency Confusion
A repository with a public external connection serves whatever the public registry holds for any name it does not. This puts the connection on its own repository, reached through an upstream, and emits the origin-control commands Terraform cannot apply.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-12 · how we verify
Use it from the registry
terraform · opentofumodule "codeartifact" {
source = "www.iac-bazaar.com/iac-bazaar/aws-codeartifact/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/aws-codeartifact?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Package Domain that Resists Dependency Confusion](https://www.iac-bazaar.com/catalog/aws-codeartifact?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "codeartifact" {
source = "www.iac-bazaar.com/iac-bazaar/aws-codeartifact/aws"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-codeartifact
A CodeArtifact domain, its repositories, and the upstream chain that decides
where a package actually comes from. Works with Terraform and OpenTofu
(>= 1.6), AWS provider >= 6.0, < 7.0.
An external connection is the dependency-confusion surface. A repository connected to public npm or PyPI serves whatever the public registry has for any name it does not already hold. So an internal package name that has never been published to that repository - a new module, a renamed one, a typo in a lockfile
- resolves to whoever registered that name publicly. The attack needs no access to anything of yours; it needs the name to be unclaimed.
So this module builds the shape that avoids it. Each external connection
gets its own repository. The repositories developers point at reach it
through an upstream, with your internal repository first in the chain. Nothing
changes for a developer, and a public package is now something that had to
travel through a repository you control. An upstream naming a repository this
module does not create is refused by a precondition - CodeArtifact accepts the
reference and then quietly resolves nothing through it.
What Terraform cannot do, and this module does not pretend to. Package
origin controls - the per-package setting that says "this name may never be
fetched from an upstream again" - have no Terraform resource. They are a CLI
call, and for an internal package name they are the control that closes this
properly. List your internal names in internal_package_names and the module
emits the exact commands as the package_origin_commands output. The upstream
chain narrows the surface; origin controls shut it.
The domain's KMS key is set at creation and cannot be changed. Assets are stored and deduplicated at the domain level, so that one key covers every repository in it - and moving to a customer-managed key later means a new domain and re-publishing everything.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-codebuild
privileged_mode hands the build the Docker socket, so anything it runs can read every environment variable and assume the service role. Off by default, and a PLAINTEXT variable whose name looks like a secret is refused.
aws-fis
FIS refuses a template with no stop condition, which reads like a guarantee - and source = 'none' is a legal stop condition meaning the experiment never halts by itself. Refused here, along with targets that grow at run time and an empty-target mode that reports success for having tested nothing.
aws-appconfig
AppConfig exists to deploy a configuration slowly and roll it back automatically, and both halves are opt-in - the predefined AllAtOnce strategy is 100% of the fleet with zero bake time. Gradual here, and a precondition refuses an environment with no alarms, where automatic rollback has nothing to fire on.
ansible-aws-cli-v2
The AWS CLI v2 from the upstream zip, verified with gpg against the AWS CLI Team key (pinned by fingerprint, in a GnuPG home of its own) before it is unpacked. EL 10 has no package; most installs run curl | unzip and never read the signature. Pinned version, tab completion, and a live test that runs an API call to 'Unable to locate credentials'. Original role, live-tested on Rocky Linux 10.
aws-mwaa
webserver_access_mode defaults to PUBLIC_ONLY, and the Airflow UI is not a dashboard: anyone who reaches it can trigger a DAG, which is arbitrary Python running as the execution role. PRIVATE_ONLY here, all five log streams on, and a precondition refuses an unpinned requirements.txt or plugins.zip - where bucket write access is otherwise the same permission as code execution.
aws-codedeploy
CodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure.