Using aws codeartifact with rolesanywhere

Question

Pulumi · Accepted Answer

To use AWS CodeArtifact with AWS IAM Roles Anywhere, you'll typically follow three steps:

1. **Set up AWS CodeArtifact**: Create a domain and a repository within that domain to store and manage your packages.
2. **Set up AWS IAM Roles Anywhere**: Configure Roles Anywhere to define trust anchors and profiles, enabling workloads outside of AWS to use IAM roles.
3. **Integrate with your application**: Modify your application's authentication process to retrieve AWS credentials via Roles Anywhere and use those credentials to authenticate to CodeArtifact.

Below is the Pulumi TypeScript program that sets up an AWS CodeArtifact domain and repository. For setting up IAM Roles Anywhere and integrating with your application, you'd need to take additional steps beyond Pulumi infrastructure as code, such as configuring on-premises resources or modifying your application code, which are not directly within the scope of Pulumi.

### Detailed Explanation:

- `aws.codeartifact.Domain`: This resource creates a domain in AWS CodeArtifact. A domain is a container for repositories. This is the first thing we create because a repository must belong to a domain.
- `aws.codeartifact.Repository`: Once we have a domain, we can create a repository. A repository is where the package versions are stored.

Let's start with the Pulumi TypeScript code:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as aws from '@pulumi/aws';

// Create a CodeArtifact domain.
const codeArtifactDomain = new aws.codeartifact.Domain("my-domain", {
    // Naming the domain "my-domain". This name must be unique in your AWS account.
    domain: "my-domain",
    // An optional description of the domain.
    description: "My CodeArtifact Domain",
});

// Create a CodeArtifact repository within the created domain.
const codeArtifactRepository = new aws.codeartifact.Repository("my-repository", {
    // Naming the repository "my-repository". This name must be unique within the domain.
    repository: "my-repository",
    // Linking the repository to the domain that we created above.
    domain: codeArtifactDomain.domain,
    description: "My CodeArtifact Repository", // Optional description of the repository.
});

export const codeArtifactDomainName = codeArtifactDomain.domain;
export const codeArtifactRepositoryName = codeArtifactRepository.repository;
```

The above program sets up the foundational AWS CodeArtifact infrastructure. Once Pulumi applies this program, you will have a CodeArtifact domain and repository, which can be found in the [AWS CodeArtifact console](https://console.aws.amazon.com/codesuite/codeartifact/home). The `export` commands at the bottom are used to output the domain and repository names after deployment finishes, which can be helpful for further automation tasks or for inspecting in the Pulumi CLI.

Regarding AWS IAM Roles Anywhere, Pulumi currently doesn't have direct support for it as it often involves working with certificates and on-premises systems to assert identity. You would usually configure it through the AWS Management Console or via AWS CLI.

Remember that roles must be assumed by something that already has credentials; for on-premises systems, the AWS IAM Roles Anywhere will provide a mechanism to use your own identities (from Active Directory, Certificate Authority, etc.) to assume roles.

For the next steps, you'd:

1. **Create Trust Anchors**: Set up trust anchors to represent your certificate authorities or AWS SSO identity stores.
2. **Create Trust Profiles**: Configure trust profiles to establish trust relationships between trust anchors and IAM roles.
3. **Integrate Roles Anywhere into Your Application**: Adapt your applications to retrieve credentials from Roles Anywhere and use them to access your CodeArtifact repository.

Once set up, your on-premises or non-AWS-hosted applications would retrieve AWS temporary credentials to authorize against CodeArtifact for actions like uploading or downloading packages.