Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS CodeArtifact: A fully managed software artifact repository service

aws.amazon.com

Post reply on HN
Print view View original

51–60 of 92 posts

Re: AWS CodeArtifact: A fully managed software artifact repository service

#51

Post by camhart »

ec109685 wrote: post #48
greyskull wrote: post #46

Earlier quoted context omitted.

I think CodeArtifact loses value when you aren't using a package manager; the benefit is an api-compatible service with various controls and audits built on top. Out of curiosity, what would you want from this service for the "plain binary" use-case when S3 already exists?

It’s nice having the metadata around the push available versus raw blobs to s3.

S3 supports metadata (see https://docs.aws.amazon.com/AmazonS3/latest/user-guide/add-o...).

Perhaps I don't understand what you're saying fully though--as I don't fully understand your comment.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#53

Post by thayne »

sudhirj wrote: post #43
thayne wrote: post #39

Earlier quoted context omitted.

> Developers frequently store this stuff in plain text in their home directory or as environment variables If you care about the security of these artifacts, why is their home directory (or their full disk) not encrypted? If they have access to the repository, they probably have artifacts downloaded on their laptops, so if the laptop is compromised, the artifacts are compromised anyway. Edit: Not saying temporary cre…

The problem isn't encryption, let's assume everyone has full disk encryption turned on, so someone who steals your laptop can't access your data. The problem is that your home directory is accessible to a ton of apps on your computer, and you have no idea what each of them is doing with that access. You also have no idea if any of them can be / are being exploited. The most recent case being Zoom – if that server the…

In that case, the rogue app would have access to your temporary credentials anyway...

Re: AWS CodeArtifact: A fully managed software artifact repository service

#54

Post by pskinner »

greyskull wrote: post #46
pskinner wrote: post #44

Is it just me or is this missing plain artifacts - those that are not packaged for a specific tool? I'm thinking of plain binaries and resources required for things like db build tools and automated testing tools - just files really. How do I publish a tarball up to this, for example? Also the lack of nuget is a major issue.

I think CodeArtifact loses value when you aren't using a package manager; the benefit is an api-compatible service with various controls and audits built on top. Out of curiosity, what would you want from this service for the "plain binary" use-case when S3 already exists?

I think mainly the ease of having security dealt with around who can access etc really. Ofc you can just upload files and serve them over http, but I'd like something that's as easy to setup and use as nexus for these files - and something that forces a structure for how they are organised. Stops arguments and people doing whatever they want.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#55

Post by baq »

dahfizz wrote: post #11
dmlittle wrote: post #6

Earlier quoted context omitted.

The benefit is being able to keep your existing maven/npm/pip workflows as well as use the same workflow for both internal and public dependencies.

I still don't see what's different. I can configure pip to look at my git server, so that all I have to do is `pip install my_thing` and it will automatically download all public and private deps. I don't know what you mean by "workflow" in this context but this is just about as simple as can be.

Looks like you’re assuming you have some kind of access to any part of the internet you please. I envy you because most tools just work in this case.

Not so on enterprise networks.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#56

Post by nickjj »

blaisio wrote: post #23
antoncohen wrote: post #12

The login credentials expire after 12 hours (or less)[1], just like with their Docker registry (ECR). That makes it pretty annoying to use, especially on developer laptops. GCP has a similar offering[2]. And GitHub[3]. [1] https://docs.aws.amazon.com/codeartifact/latest/ug/python-co... [2] https://cloud.google.com/artifact-registry [3] https://github.com/features/packages

I could not disagree more re. the expiring credentials. It is a bad practice to have credentials that never expire, especially on developer laptops, especially credentials of this nature. Developers frequently store this stuff in plain text in their home directory or as environment variables. That's a huge security risk! This service manages the process of generating and expiring credentials automatically, which is a…

> I could not disagree more re. the expiring credentials. It is a bad practice to have credentials that never expire, especially on developer laptops, especially credentials of this nature.

For the specific use case of the developer box and the Docker registry, resetting the credentials every 12 hours doesn't offer any more security than not on its own.

The reason for that is after you try to login to ECR after the expired time, the way you authenticate again is to run a specific aws CLI command to generate a docker login command. After you run that, you're authenticated for 12 hours.

If your box were compromised, all the attacker would have to do is run that aws command and now they are authenticated.

Also, due to how the aws CLI works, you end up storing your aws credentials in plain text in ~/.aws/credentials and they are not re-rolled unless the developer requests to do so. Ultimately they are the real means for Docker registry access.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#57

Post by StreamBright »

WatchDog wrote: post #3

This has been a fairly obvious service that has been missing for a while, nice to see them provide a solution. Most dependency management tools have some kind of hacky support for using S3 directly. Full fledged artifact management tools like Artifactory and Nexus support S3 backed storage. Interesting to see that the pricing is approximately double that of S3, for what I imagine is not much more than a thin layer on…

We have used S3 successfully several times. You can create a Maven repository, use it as RPM repo and many other use cases to host artifacts. I am not sure what functionality is missing that cannot be implemented on the top of S3 and requires CodeArtifact.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#58

Post by StreamBright »

pskinner wrote: post #54
greyskull wrote: post #46

Earlier quoted context omitted.

I think CodeArtifact loses value when you aren't using a package manager; the benefit is an api-compatible service with various controls and audits built on top. Out of curiosity, what would you want from this service for the "plain binary" use-case when S3 already exists?

I think mainly the ease of having security dealt with around who can access etc really. Ofc you can just upload files and serve them over http, but I'd like something that's as easy to setup and use as nexus for these files - and something that forces a structure for how they are organised. Stops arguments and people doing whatever they want.

>> I think mainly the ease of having security dealt with around who can access etc really. Ofc you can just upload files and serve them over http,

This is where S3 really shines. You can give developers access through group membership while servers using instance profiles. We have implemented a fine grained access control for the S3 repos that works really well. Of course you access the content via HTTPS.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#59

Post by StreamBright »

ec109685 wrote: post #48
greyskull wrote: post #46

Earlier quoted context omitted.

I think CodeArtifact loses value when you aren't using a package manager; the benefit is an api-compatible service with various controls and audits built on top. Out of curiosity, what would you want from this service for the "plain binary" use-case when S3 already exists?

It’s nice having the metadata around the push available versus raw blobs to s3.

You mean like Object Metadata for S3?

https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMetadat...

Post reply on HN