Question

A development team uses CodeBuild to build a Node.js application in CodePipeline. Builds frequently fail intermittently because the public npm registry is rate-limiting requests, and the security team has mandated that all third-party packages be scanned and approved before use. The team wants a managed solution that caches public packages, enforces a single source of truth for dependencies, and integrates with the existing CodeBuild jobs with minimal changes. Which approach best meets these requirements?

Accepted Answer

Create a CodeArtifact repository with an upstream connection to the public npm registry, configure CodeBuild to authenticate and pull dependencies from CodeArtifact, and use the repository as the single approved dependency source.

Answer

Store all approved npm packages as objects in an S3 bucket and modify the build spec to download the tarballs from S3 before running the build.

Answer

Configure CodeBuild local caching with the LOCAL_CUSTOM_CACHE mode so that node_modules is reused across every build, eliminating registry calls entirely.

Answer

Add retry logic with exponential backoff in the buildspec so that npm install re-attempts against the public registry until the rate limit clears.