DOP-C02 Practice Question 42: CodeArtifact External Connection
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 5 · question 2 of 10
Builds run in private subnets and pull open-source npm packages from the public npm registry through a NAT gateway. Two problems have surfaced: a transient outage at the public registry failed every build for an hour, and after a supply-chain advisory the security team could not tell which external package versions the organization had consumed, nor stop builds from pulling a specific bad version. The company does not want to operate a package registry of its own.
What should the team implement?
Show answer and explanation
Answer:
An external connection makes CodeArtifact a managed pull-through registry: "when you request a package from the CodeArtifact repository that's not already present in the repository, the package can be fetched from the external connection." Once a package version has been fetched it is stored in the repository, so later builds are served from CodeArtifact rather than from the public registry, which is why a transient public-registry outage stops breaking builds. Because every external package the organization consumes lands in the repository, the security team gets the inventory it was missing and can remove or restrict a specific package version. AWS runs the registry, so nothing new is operated.
Option A is a build cache, not a registry. A cache miss (a new dependency, a new build image, a cache eviction) goes straight back to the public registry, and a cache gives no inventory of consumed packages and no way to block a version.
Option B misuses S3. A bucket is not an npm registry and does not speak the registry protocol for metadata and version resolution, and a nightly full mirror of a public registry is enormous and always stale.
Option C is exactly the self-managed registry the stem rules out. It also means owning the availability, storage, patching, and access control of that registry, the operational burden CodeArtifact exists to remove.
Reference: Connect a CodeArtifact repository to a public repository