Restrict AWS CodeArtifact Access per Group/Domain in AWS SSO

To restrict AWS CodeArtifact access per SSO group, you'll need to replace the managed policy (AWSCodeArtifactReadOnlyAccess) with custom policies that specify access to specific domains.

Here's how to approach this:

1. Replace the managed policy with custom policies: Yes, you should create custom IAM policies that grant access only to specific domains/repositories. The managed policy grants access to all CodeArtifact resources, which doesn't meet your requirements for domain-specific access.

2. Best approach for SSO groups:

• Create a custom IAM policy for each domain access pattern you need
• For each policy, specify the exact domain ARNs in the Resource section
• Use actions like codeartifact:ReadFromRepository, codeartifact:Describe*, codeartifact:Get*, and codeartifact:List* for read-only access
• Ensure you include the sts:GetServiceBearerToken permission which is required for authentication
• Assign these custom policies to your SSO permission sets that are linked to your groups

3. For multi-domain groups: Yes, you can combine multiple domains in a single custom policy. For a group like test3-Cloud-Technology-developer that needs access to multiple domains, you can list all the domain ARNs in the Resource section of a single policy.

Example custom policy structure for test1-Cloud-Technology-developer:

{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"codeartifact:Describe*",
"codeartifact:Get*",
"codeartifact:List*",
"codeartifact:ReadFromRepository"
],
"Effect": "Allow",
"Resource": "arn:aws:codeartifact:region-ID:account-ID:domain/test1*"
},
{
"Effect": "Allow",
"Action": "sts:GetServiceBearerToken",
"Resource": "*",
"Condition": {
"StringEquals": {
"sts:AWSServiceName": "codeartifact.amazonaws.com"
}
}
}
]
}

For the test3 group that needs access to multiple domains, you can either list multiple resource ARNs or use a policy with multiple statements, each targeting a specific domain.

This approach follows the principle of least privilege by ensuring each group only has access to the domains they need.
Sources
Identity-based policy examples for AWS CodeArtifact - CodeArtifact
AWS CodeArtifact permissions reference - CodeArtifact