Check ID:
Provider: AWS
Service:
Severity: CRITICAL
Categories:
Resource type:
codeartifact_packages_external_public_publishing_disabledProvider: AWS
Service:
codeartifactSeverity: CRITICAL
Categories:
software-supply-chain, internet-exposedResource type:
OtherWhat this check verifies
AWS CodeArtifact packages with an internal or unknown origin are evaluated for their package origin controls. The check identifies packages where theupstream setting allows ingesting versions from external or upstream repositories.
Risk
Allowing upstream on internal packages enables dependency confusion: public repos can supply higher versions to builds, leading to malicious code execution and package tampering. This threatens integrity, exposes secrets and data (confidentiality), and may disrupt pipelines and services (availability).Recommendation
Enforce Package Origin Controls so internal packages useupstream=BLOCK and only trusted publish paths. Apply least privilege with package groups and private namespaces, pin versions, and prefer private endpoints. Add artifact signing and CI isolation, and monitor package events for unexpected source changes.
Remediation
- CLI
- Dashboard steps
References
- https://noise.getoto.net/2022/07/15/tighten-your-package-security-with-codeartifact-package-origin-control-toolkit/
- https://docs.aws.amazon.com/codeartifact/latest/ug/package-origin-controls.html
- https://newstar.cloud/blog/improve-the-security-of-your-software-supply-chain-with-amazon-codeartifact-package-group-configuration/
- https://zego.engineering/dependency-confusion-in-aws-codeartifact-86b9ff68963d
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = codeartifact_packages_external_public_publishing_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks