Granting EC2 Access to CodeArtifact for Python Packages

DOP-C02 By islever Editorial Last updated

Implement techniques for identity and access management at scale.

Short answer

D Create an instance profile containing an IAM role with CodeArtifact permissions, associate it with the EC2 instance, and use the aws codeartifact login CLI command.

Question

A company uses an AWS CodeArtifact repository to store Python packages that the company developed internally. A DevOps engineer needs to use AWS CodeDeploy to deploy an application to an Amazon EC2 instance. The application uses a Python package that is stored in the CodeArtifact repository. A BeforeInstall lifecycle event hook will install the package.
The DevOps engineer needs to grant the EC2 instance access to the CodeArtifact repository.
Which solution will meet this requirement?
  1. Create a service-linked role for CodeArtifact. Associate the role with the EC2 instance. Use the aws codeartifact get-authorization-token CLI command on the instance.
  2. Configure a resource-based policy for the CodeArtifact repository that allows the ReadFromRepository action for the EC2 instance principal.
  3. Configure ACLs on the CodeArtifact repository to allow the EC2 instance to access the Python package.
  4. Create an instance profile that contains an IAM role that has access to CodeArtifact. Associate the instance profile with the EC2 instance. Use the aws codeartifact login CLI command on the instance. Correct Answer

Key Takeaways

The exam tests knowledge of CodeArtifact's specific authentication model: it relies on IAM permissions attached to the executing principal (via Instance Profile) and the aws codeartifact login command, rather than resource-based policies or service-linked roles.

This question tests the correct method for an EC2 instance to authenticate with AWS CodeArtifact using IAM roles and the codeartifact login CLI. It establishes that resource-based policies are not supported for CodeArtifact repositories.

Common mistake: Candidates often select Option B, assuming CodeArtifact supports resource-based policies like S3 buckets. This is incorrect because CodeArtifact access is controlled entirely through IAM identity-based policies.

Expert Analysis

Why the Answer Is Correct

Option D is the only valid solution. To allow an EC2 instance to access CodeArtifact, you must attach an IAM role with appropriate permissions to the instance via an Instance Profile. The aws codeartifact login command then uses the temporary credentials from this role to configure the package manager (e.g., pip) with an authorization token. This is the standard, secure way to integrate CodeArtifact with compute services.

Why the Other Options Are Wrong

Option A is incorrect because CodeArtifact does not use a service-linked role for client access; it requires specific IAM permissions. Option B is incorrect because CodeArtifact repositories do not support resource-based policies; access is strictly identity-based. Option C is incorrect because CodeArtifact does not use ACLs in the traditional sense (like S3); it relies on IAM policies.

Community Comment Notes

Community consensus strongly favors Option D. Users like 'uncledana' and 'Srikantha' correctly identify that IAM roles and codeartifact login are required. User 'nickp84' explicitly notes that CodeArtifact does not support resource-based policies, debunking Option B. While some users initially considered resource policies, official documentation confirms they are not applicable here.

Official Reference

https://docs.aws.amazon.com/codeartifact/latest/ug/security-iam.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always verify if a service supports resource-based policies. For CodeArtifact, remember that access is managed via IAM identity-based policies attached to the user, role, or instance profile performing the action.

Frequently Asked Questions

Does CodeArtifact support resource-based policies?

No. CodeArtifact access is controlled entirely through IAM identity-based policies attached to users, roles, or instance profiles.

What is the purpose of aws codeartifact login?

It configures your package manager (like pip) to use temporary credentials from the instance's IAM role to authenticate with CodeArtifact.

More DOP-C02 FAQ →

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. uncledana 👍 4 Answered D
    D. Create an instance profile that contains an IAM role that has access to CodeArtifact. Associate the instance profile with the EC2 instance. Use the aws codeartifact login CLI command on the instance. Explanation: To allow the EC2 instance to access the CodeArtifact repository, the EC2 instance must have the necessary IAM permissions to interact with AWS CodeArtifact. Here’s why option D is the best solution:
  2. teo2157 👍 4 Answered D
    Vote for D based on https://docs.aws.amazon.com/codeartifact/latest/ug/security-iam.html
  3. tinyshare 👍 3 Answered B
    It is the resource allows who can use it, in this case, CodeArtifact. https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html
  4. GripZA 👍 1 Answered B
    just like other resource policies, CodeArtifact uses resource-based permissions to control access. Resource-based permissions let you specify who has access to a repository and what actions they can perform on it. By default, only the repository owner has access to a repository so implicit deny unless you apply a policy document that allows other IAM principals to access your repository. https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html
  5. Srikantha 👍 1 Answered D
    IAM role with CodeArtifact permissions: You need an IAM role attached to the EC2 instance (via instance profile) that grants permission to read from CodeArtifact. aws codeartifact login sets up your Python environment (e.g., pip) to authenticate to the CodeArtifact repository using temporary credentials tied to the instance’s IAM role. This is the recommended approach to grant secure and scalable access to CodeArtifact from EC2 instances.
Show 3 more comments
  1. nickp84 👍 1 Answered D
    B. Configure a resource-based policy for the CodeArtifact repository: Issue: CodeArtifact repositories do not support resource-based policies (unlike S3 buckets or SNS topics). Access to CodeArtifact is controlled entirely through IAM policies attached to roles or users, making this option invalid.
  2. danish1234 👍 1 Answered D
    A is wrong . Pushing an unsigned image to Amazon ECR and then invoking CodeBuild to retrieve the image again solely to sign it introduces unnecessary complexity and extra network/compute steps compared to signing it directly during the build phase.
  3. robotgeek 👍 1
    That is not saying that "specifically" you can not use IBPs, IBPs are prefered when you want to give individual access

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Optimizing Amazon Timestream Query Performance

S-grade

Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

S-grade

Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

S-grade

Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

S-grade

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide