Skip to content
Private S3 Package Repo

Architecture

Overview

Section titled “Overview”

One account holds two private package buckets and one public UI bucket. Consumers never call S3 across Regions: each VPC uses a gateway VPC endpoint
S3 gateway VPC endpoint. Route-table target that keeps S3 traffic on the AWS network; no hourly charge for the gateway itself.
 and the local bucket hostname. Replication
Cross-Region Replication. S3 copies objects (and versions) from a primary bucket to a replica in another Region.
 copies the repos/ tree from Sydney to Auckland after you publish.

Indexes live next to the packages. After an rpm or deb lands under repos/*/Packages/ or repos/*/pool/, S3 emits to EventBridge, which invokes the rebuild Lambda (image from ECR). The rule matches package blobs only — not repodata/ or dists/ — so index writes do not re-trigger. demo.sh publish uploads samples and waits for that rebuild; it does not invoke Lambda directly. The Lambda runs createrepo_c
createrepo_c builds yum/dnf repodata (repomd.xml and friends) for an RPM tree so dnf can resolve packages. and apt-ftparchive, signs repo metadata with a lab GPG key from Secrets Manager, writes indexes under repos/, and updates catalog.json (and the public key) on the UI bucket.

Each consumer Region is a dedicated lab VPC: private subnet, S3 gateway VPCE, SSM interface VPCEs (no NAT), and two probes (AL2023 + Ubuntu).

Lab architecture: private S3 package repo Publish rpm/deb to a private S3 primary in Sydney. EventBridge invokes a rebuild Lambda (ECR image) that signs repo metadata with a GPG key from Secrets Manager, writes indexes and catalog.json, and publishes the public key. CRR copies repos/ to Auckland. Each Region has a lab VPC with S3 gateway and SSM interface endpoints for dual-OS probes. Syd pkgs → EventBridge/Lambda (+GPG) → Akl replica · regional S3 + SSM ap-southeast-2 (Sydney) ap-southeast-6 (Auckland) publish S3 pkgs primary rpm + deb + signed indexes Replication repos/ S3 pkgs replica same tree S3 gateway + SSM interfaces AL2023 + Ubuntu lab VPC · dnf / apt S3 gateway + SSM interfaces AL2023 + Ubuntu lab VPC · dnf / apt EventBridge Rebuild Lambda indexes + GPG sign Secrets Mgr lab GPG key ECR image Catalog UI public metadata + pubkey IAM: CRR · publisher · Lambda · Secrets · probe EC2 · CloudWatch via Lambda basic exec

Same tree, regional URL:

https://<primary>.s3.ap-southeast-2.amazonaws.com/repos/...
https://<replica>.s3.ap-southeast-6.amazonaws.com/repos/...

Typical layout:

repos/rpm/al2023/x86_64/Packages/…rpm
repos/rpm/al2023/x86_64/repodata/…
repos/deb/ubuntu/noble/pool/…deb
repos/deb/ubuntu/noble/dists/…

Who owns what

Section titled “Who owns what”
Piece Account Region
Primary pkgs bucket (+ EventBridge notifications) Shared ap-southeast-2
Replica pkgs bucket Shared ap-southeast-6
Catalog UI bucket (public website) Shared ap-southeast-2
Rebuild Lambda + ECR ps3p-rebuild Shared ap-southeast-2
EventBridge rule on Packages/*.rpm + pool/*.deb Put Shared ap-southeast-2
Secrets Manager lab GPG signing key Shared ap-southeast-2
IAM: CRR, publisher, Lambda execution Shared global
Lab VPC + S3 gateway + SSM interface VPCEs Same account each Region
IAM: probe EC2 role + instance profile Same account each Region
AL2023 + Ubuntu probes Same account each Region

Package-bucket policies deny GetObject unless aws:SourceVpce matches an allowlisted gateway. Admin, CRR, publisher, and rebuild Lambda principals get a bypass. The UI bucket stays public read for the static site only — it does not host packages.

SSM interface endpoints (ssm, ssmmessages, and ec2messages where the service exists) are how probes register for Run Command without a NAT gateway. Auckland may skip ec2messages when that service is unavailable.

Consumers install the lab public key from repos/gpg/lab-signing.asc on the local package bucket, then use repo_gpgcheck=1 (dnf) and signed-by= (apt). Package-level gpgcheck for the sample EPEL RPM stays off — that signature is upstream’s, not the lab key.

Out of scope

Section titled “Out of scope”
  • Full Pulp (or other long-lived repo servers)
  • Public package download from the catalog viewer
  • Hosting the viewer on the private package buckets
  • CodeBuild / schedule-first index rebuild
  • Package re-signing (metadata only)