Project #3 Secure Packages with CodeArtifact

Project 3 of the 7 Day DevOps Challenge — Learn how to set up and use AWS CodeArtifact to manage and secure Java dependencies for your applications.

In this portion of the project series we will dive into Code Artifact, this service is typically used when you don't want to create things from scratch. Instead we will use pre-made “packages” that other developers have made and then customize to our liking. Code Artifact is also a artifact repository, so we can store ALL of our app packages in on place which is essential in our CICD pipeline.

• Prior to beginning today please complete day 1 and 2 and meet me back at this point!

CodeArtifact Setup

• We’ll create a CodeArtifact repository.
• We’re setting up your EC2 instance’s permissions to access the CodeArtifact repository.
• We’ll see the CodeArtifact repository store your web app’s packages!

Step #1 Set up AWS CodeArtifact Repository

We’ll use CodeArtifact to store and manage our project’s dependencies, ensuring secure and reliable access to Java packages.

This is important because CodeArtifact provides a centralized, secure, and scalable way to manage dependencies for our Java projects, improving build consistency and security.

• Head back to the AWS Management Console.
• Head to the CodeArtifact service.

• In the CodeArtifact console, in the left-hand menu, click on Repositories.
• Click the Create repository button to start creating a new repository.
• On the Create repository page, head to the Repository configuration section.
• In the Repository name field, enter devops-cicd.
• In the Repository description — optional field, enter:
  This repository stores packages related to a Java web app created as a part of CI/CD Pipeline series.
• Under Public upstream repositories — optional, select the checkbox next to maven-central-store.
• This will configure Maven Central as an upstream repository for your CodeArtifact repository.

*Upstream repositories are new to me! After some extra research they are essentially like a backup library that your PRIMARY library can access if it doesn't have what it needs. IE- missing packages or missing code, it will fill in the blank. In this case we are choosing Maven Central, it is the most popular public repository where developers share Java libraries.

• Click Next.
• You’re now ready to set up your CodeArtifact domain!
• Under Domain selection, choose This AWS account.
• Under Domain name, enter “devops”

• Click Next to proceed.
• Now we’re on the last page! Let’s Review and create.
• Review the details of your repository configuration, including the package flow at the top.

*This is a package flow diagram, it shows you exactly how the dependencies will travel to our applicatrion. When our project needs a dependenecy it will first look at our CodeArtifact repo, if the package is there, then we are good. If not, then CodeArtifact will reach out towards Maven central and fetch it. After packages are fetched, they also become cached in our repo, wheich then makes every build going forward faster than the un-fetched version.

• Select the Create repository button to create your CodeArtifact repository.
• You’ll be taken to the repository’s details page.
• You should see a success message at the top of the page, telling us that the CodeArtifact repository devops-cicd has been successfully created.

Step#2 Create a IAM policy for CodeArtifact Access

We must allow access for our EC2 instance to to work with CodeArtifact. Maven needs permission to store and retrieve packages from CodeArtifact, but our EC2 instance wont be able to do anything without the correct IAM permissions.

Get CodeArtifact connection instructions

• On your newly created repository’s page, click the View connection instructions button at the top right corner.
• In the Connection instructions page, we’re configuring how Maven will connect to your CodeArtifact repository.
• For Operating system, select Mac and Linux.
• For Package manager client, select mvn (Maven).

🚨 Double check that you’re using Mac and Linux as the operating system. Even if you’re doing this project on a Windows computer, Mac and Linux is the right choice — your EC2 instance is an Amazon Linux 2023 instance!

• Make sure that Configuration method is set to Pull from your repository.
• Nice! The menu will now show you the steps and commands needed to connect Maven to your CodeArtifact repository.

Export CodeArtifact authorization token

• In the Connection instructions dialog, find Step 3: Export a CodeArtifact authorization token….
• Copy the entire command in Step 3.

• Go back to your VS Code terminal, which is connected to your EC2 instance.
• Paste the copied command into the terminal and press Enter to run it.

• WELP… we got a error, but that's okay!

Create a new IAM policy

• In the AWS Management Console, head to the the IAM console.

In the IAM console, in the left-hand menu, click on Policies.

• Click the Create policy button to start creating a new IAM policy
• On the Create policy page, select the JSON tab.
• Replace the default content in the text editor with the following JSON policy document. Copy and paste the entire JSON code block:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:GetAuthorizationToken",
                "codeartifact:GetRepositoryEndpoint",
                "codeartifact:ReadFromRepository"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "sts:GetServiceBearerToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "sts:AWSServiceName": "codeartifact.amazonaws.com"
                }
            }
        }
    ]
}

• After pasting the JSON policy document, click the Next button at the bottom right.
• On the Review policy page, in the Policy name field, enter codeartifact-devops-consumer-policy.
• In the Description — optional field, add a description like:
  Provides permissions to read from CodeArtifact. Created as a part of devops CICD Pipeline series.

Review the Summary of your policy to ensure the permissions and details are correct.

• Click the Create policy button to create the IAM policy.
• After clicking Create policy, you should see a success message at the top of the IAM Policies page, telling us that the policy codeartifact-devops-consumer-policy has been successfully created.

WOOHOO now that we have created this policy, lets attach this policy to a IAM role and associate that role with our EC2 instance

Step #3 Attach IAM policy and verify CodeArtifact Connection

Create a new IAM role for EC2

• In the IAM console, in the left-hand menu, click on Roles.

• Click the Create role button to start creating a new IAM role.
• For Select entity type, choose AWS service.
• Under Choose a use case, select EC2 from the list of services.

• Click Next to proceed to the Add permissions step
• In the Add permissions step, in the Filter policies search box, type codeartifact-devops-consumer-policy.
• Select the checkbox next to the codeartifact-devops-consumer-policy that you created in the previous step.
• Click Next to head to the Name, review, and create step.

• In the Name, review, and create step:
• In the Role name field, enter EC2-instance-devops-cicd.
• In the Description — optional field, enter:
  Allows EC2 instances to access services related to the devops CI/CD pipeline series.

• After clicking Create role, you should see a success message at the top of the IAM Roles page, telling us that the IAM role EC2-instance-devops-cicd has been successfully created. Your new role will be listed in the roles table.
• Attach IAM role to EC2
• Now, we need to associate this IAM role with your EC2 instance.
• Head back to the EC2 console.

• Head to the Instances tab.

• Select your running EC2 instance (devops-yourname).
• Click on Actions in the menu bar, then select Security, and then Modify IAM role.

• In the Modify IAM role dialog box, select Refresh to load the IAM roles available for your EC2 instance.
• Under IAM role, select the IAM role you just created, EC2-instance-nextwork-cicd, from the dropdown menu.

Select Update IAM role to attach the role to your EC2 instance.

• After attaching the IAM role, you should see a green banner at the top of the EC2 Instances dashboard confirming that the IAM role was successfully modified for your instance.

Re-run export token command

Get Zachary Travis’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Now that your EC2 instance has the necessary IAM role attached, let’s re-run the command to export the CodeArtifact authorization token.

This time, your EC2 instance should be able to retrieve the token, since it has the necessary permissions from the IAM role.

• Head back to your VS Code terminal connected to your EC2 instance.
• Re-run the same export token command from Step 3.
• This command will retrieve a temporary authorization token for CodeArtifact and store it in an environment variable named CODEARTIFACT_AUTH_TOKEN.

Fantastic! You’ve successfully attached the IAM policy and role to your EC2 instance. Your instance now has the permissions to access your CodeArtifact repository securely. Let’s verify the connection in the next step.

Step#4 See packages in CodeArtifact

To begin this step we will verify connection to our CodeArtifact repo via our EC2 instance. After we will configure Maven to use CodeArtifact to try and compile our web app. All dependencies should now be able to download from CodeArtifact now!

In the AWS console we still have steps left to complete in CodeArtifacts connection setting panel.

brief description on the remaining steps.

Step 4- (servers) : where your store your access details to the repositories you’re connecting with your web app project. In this example, you’ve added your authentication token to access your local CodeArtifact repository.

Step 5- (profiles): section is where you write a rulebook on when Maven should use which repository. Our profiles section is telling Maven to go to the nextwork-packages repository to find the tools / packages needed to build your Java web app.

Step 6- (mirrors): section sets up backup locations that Maven can check if it can’t find what it needs in the first local repository it goes to.

• We’ll use the code in each step in a minute, but we’ll have to set up a special file called settings.xml first.
• In VS Code, in your left hand file explorer, head to the root directory of your devops-web-project.
• Create a new file at the root of your devops-web-project directory.
• Name the new file settings.xml.

• Open the settings.xml file. If you created a new file, it will be empty.
• In your settings.xml file, add the <settings> root tag if it’s not already there:

<settings>
</settings>

• Go back to the CodeArtifact connection settings panel.
• From the Connection instructions dialog, copy the XML code snippet from Step 4: Add your server to the list of servers in your settings.xml.

• Paste the code in the settings.xml file, in between the <settings> tags.

• Let’s copy the XML code snippet from Step 5: Add a profile containing your repository to your settings.xml.
• Paste the code snippet you copied right underneath the <servers> tags. Make sure the <profiles> tags are also nested inside the <settings> tags.

• Finally, paste the XML code snippet from Step 6: (Optional) Set a mirror in your settings.xml… right underneath the <profiles> tags.

• Save the settings.xml file. (crtl+s)

Compile your project and verify the CodeArtifact integration

• In your VS Code terminal, run pwd to check that you’re in the root directory of your devops-web-project
• If you’re not at the root directory, run cd nextwork-web-project to get there!
• Next, we’ll compile your project.

*Compling is essentially translating your projects code into a language that computers can understand and run. This step is making sure everything is correctly setup and ready to turn into a working app.

• Run the Maven compile command, which uses the settings.xml file we just configured:

mvn -s settings.xml compile

*I broke it again….when adding this command the terminal would just error out. Stating that the path to the specified path does not exist. To fix this, you can “right click" on your settings.xml file and then COPY “the relative path” to the file! Then change the above command to mvn -s (relative path) compile. Run the command and hopefully it should process.

• As Maven compiles your project, observe the terminal output.

• You should see messages like Downloading from devops-cicd telling us that Maven is downloading dependencies from your CodeArtifact repository. This is a good sign that Maven is using CodeArtifact to manage dependencies!
• If the compilation is successful and dependencies are downloaded from CodeArtifact, you’ll see a BUILD SUCCESS message at the end of the Maven output.

• See it to believe it! Let’s head back to the CodeArtifact console in your browser.
• Close the connection instructions window.

• If you don’t see any packages in your repository listed yet, click the refresh button in the top right corner of the Packages pane.
• After refreshing, you should now see a list of Maven packages in your CodeArtifact repository.

• These are the dependencies that Maven downloaded from Maven Central via CodeArtifact when you compiled your project.

Congrats! This confirms that your CodeArtifact setup is working correctly and that Maven is using it to manage dependencies 💪

WOOHOO, we did it! A lot of amazing troubleshooting that I gained in this lesson! Some times things break, but we are architects and engineers, we will always find a way to fix them!

Summary:

This part of the project we setup CodeArtifact for a dependency management! We learned how to configure AWS CodeArtifact as a private Maven repo for managing dependencies. Played with IAM roles and polices to let our EC2 instance access CodeArtifact. Compiled everything, broke a couple things, fixed it all and then verified our web apps connection to Code Artifact and ensure that Maven can download dependencies from it!