Back to Checks
aws

Internal CodeArtifact package does not allow publishing versions already present in external public sources

codeartifact_packages_external_public_publishing_disabled
Service: codeartifactSeverity: critical
OfficialBuilt-inVerified
Categories:software-supply-chaininternet-exposed
Resource Type:Other

AWS CodeArtifact packages with an internal or unknown origin are evaluated for their package origin controls. The check identifies packages where the upstream setting allows ingesting versions from external or upstream repositories.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing upstream on internal packages enables dependency confusion: public repos can supply higher versions to builds, leading to malicious code execution and package tampering. This threatens integrity, exposes secrets and data (confidentiality), and may disrupt pipelines and services (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks codeartifact_packages_external_public_publishing_disabled

Recommendation

Enforce Package Origin Controls so internal packages use upstream=BLOCK and only trusted publish paths. Apply least privilege with package groups and private namespaces, pin versions, and prefer private endpoints. Add artifact signing and CI isolation, and monitor package events for unexpected source changes.

Remediation

CLI

aws codeartifact put-package-origin-configuration --domain <DOMAIN> --repository <REPOSITORY> --format <FORMAT> --package <PACKAGE_NAME> --restrictions publish=ALLOW,upstream=BLOCK

Other

1In the AWS Console, go to CodeArtifact > Repositories and select <REPOSITORY>
2In Packages, open the internal package <PACKAGE_NAME>
3Under Origin controls, choose Edit
4Set Upstream to Block (leave Publish as Allow if required)
5Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.codeartifact.codeartifact_client import (
    codeartifact_client,
)
from prowler.providers.aws.services.codeartifact.codeartifact_service import (
    OriginInformationValues,
    RestrictionValues,
)


class codeartifact_packages_external_public_publishing_disabled(Check):
    def execute(self):
        findings = []
        for repository in codeartifact_client.repositories.values():
            for package in repository.packages:
                report = Check_Report_AWS(metadata=self.metadata(), resource=repository)
                report.resource_id = f"{repository.domain_name}/{package.name}"
                report.resource_arn = f"{repository.arn}/{package.namespace + ':' if package.namespace else ''}{package.name}"

                if package.latest_version.origin.origin_type in (
                    OriginInformationValues.INTERNAL,
                    OriginInformationValues.UNKNOWN,
                ):
                    if (
                        package.origin_configuration.restrictions.upstream
                        == RestrictionValues.ALLOW
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"Internal package {package.name} is vulnerable to dependency confusion in repository {repository.domain_name}."
                    else:
                        report.status = "PASS"
                        report.status_extended = f"Internal package {package.name} is not vulnerable to dependency confusion in repository {repository.domain_name}."

                    findings.append(report)

        return findings

References