Credentials and service permissions
Separate the caller's registry access from the credentials used by background services.
On this page
Service permissions#
| Service | Needs |
|---|---|
| Proxy without a worker | Queue send and queue attributes when mirroring. Advisory reads when configured. PyPI mirror-state reads and prefix listing. CodeArtifact repository descriptions for private topology checks. |
| Mirror worker | Queue receive, delete, visibility changes, and attributes. Mirror repository reads and publication. Advisory reads. PyPI state reads, prefix listing, and conditional writes. |
| Advisory publisher | Advisory object read/write and prefix-scoped listing. Access to OSV and EPSS feeds. |
| Cleanup service | Inventory and metadata reads for both maintained stores. Consent inspection. Deletion only on those targets. Advisory reads and private topology inspection. |
| Caller | Read permission on the private read repository. Publication permission on the first-party repository if they publish. |
CodeArtifact specifics#
Token minting requires codeartifact:GetAuthorizationToken on the domain and sts:GetServiceBearerToken with the CodeArtifact service condition.
Minting a token does not grant repository access. Scope repository reads and package writes separately.
The proxy and cleanup service inspect the private repository's upstream chain at startup. Grant codeartifact:DescribeRepository on every repository in that chain.
The cleanup full-walk cursor needs restricted tag-write permission. That permission must not allow the service to create or change its own consent marker.