diff --git a/build/full/Dockerfile b/build/full/Dockerfile
index 98e5480bf..83073a1f8 100644
--- a/build/full/Dockerfile
+++ b/build/full/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.22-bookworm@sha256:6d71b7c3f884e7b9552bffa852d938315ecca843dcc75a86ee7000567da0923d AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.22-bookworm@sha256:f020456572fc292e9627b3fb435c6de5dfb8020fbcef1fd7b65dd092c0ac56bb AS builder
 WORKDIR /app
 
 ARG TARGETOS
diff --git a/build/minimal/Dockerfile b/build/minimal/Dockerfile
index 10b8c2d4d..6cd33bc6d 100644
--- a/build/minimal/Dockerfile
+++ b/build/minimal/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.22-bookworm@sha256:6d71b7c3f884e7b9552bffa852d938315ecca843dcc75a86ee7000567da0923d AS builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.22-bookworm@sha256:f020456572fc292e9627b3fb435c6de5dfb8020fbcef1fd7b65dd092c0ac56bb AS builder
 WORKDIR /app
 
 ARG TARGETOS
diff --git a/checks/aws_config.go b/checks/aws_config.go
index f3aed003c..f75359cdf 100644
--- a/checks/aws_config.go
+++ b/checks/aws_config.go
@@ -4,9 +4,7 @@ package checks
 
 import (
 	"github.com/aws/aws-sdk-go-v2/service/configservice"
-	awsUtil "github.com/flanksource/artifacts/clients/aws"
 	"github.com/flanksource/canary-checker/api/context"
-	"github.com/flanksource/canary-checker/api/external"
 	v1 "github.com/flanksource/canary-checker/api/v1"
 	"github.com/flanksource/canary-checker/pkg"
 	"github.com/flanksource/duty/connection"
@@ -30,8 +28,7 @@ func (c *AwsConfigChecker) Type() string {
 	return "awsconfig"
 }
 
-func (c *AwsConfigChecker) Check(ctx *context.Context, extConfig external.Check) pkg.Results {
-	check := extConfig.(v1.AwsConfigCheck)
+func (c *AwsConfigChecker) Check(ctx *context.Context, check v1.AwsConfigCheck) pkg.Results {
 	result := pkg.Success(check, ctx.Canary)
 	var results pkg.Results
 	results = append(results, result)
@@ -44,12 +41,17 @@ func (c *AwsConfigChecker) Check(ctx *context.Context, extConfig external.Check)
 		}
 	}
 
-	cfg, err := awsUtil.NewSession(ctx.Context, *check.AWSConnection)
+	cfg, err := check.AWSConnection.Client(ctx.Context)
 	if err != nil {
 		return results.ErrorMessage(err)
 	}
 
-	client := configservice.NewFromConfig(*cfg)
+	client := configservice.NewFromConfig(cfg, func(o *configservice.Options) {
+		if check.AWSConnection.Endpoint != "" {
+			o.BaseEndpoint = &check.AWSConnection.Endpoint
+		}
+	})
+
 	if check.AggregatorName != nil {
 		output, err := client.SelectAggregateResourceConfig(ctx, &configservice.SelectAggregateResourceConfigInput{
 			ConfigurationAggregatorName: check.AggregatorName,
diff --git a/checks/aws_config_rule.go b/checks/aws_config_rule.go
index ee6489f35..ba8ca71e3 100644
--- a/checks/aws_config_rule.go
+++ b/checks/aws_config_rule.go
@@ -8,7 +8,6 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/service/configservice"
 	"github.com/aws/aws-sdk-go-v2/service/configservice/types"
-	awsUtil "github.com/flanksource/artifacts/clients/aws"
 	"github.com/flanksource/canary-checker/api/context"
 	"github.com/flanksource/canary-checker/api/external"
 	v1 "github.com/flanksource/canary-checker/api/v1"
@@ -45,15 +44,16 @@ func (c *AwsConfigRuleChecker) Check(ctx *context.Context, extConfig external.Ch
 		return results.Failf("failed to populate aws connection: %v", err)
 	}
 
-	cfg, err := awsUtil.NewSession(ctx.Context, *check.AWSConnection)
+	cfg, err := check.AWSConnection.Client(ctx.Context)
 	if err != nil {
 		return results.Failf("failed to create a session: %v", err)
 	}
 
-	client := configservice.NewFromConfig(*cfg)
-	if err != nil {
-		return results.Failf("failed to describe compliance rules: %v", err)
-	}
+	client := configservice.NewFromConfig(cfg, func(o *configservice.Options) {
+		if check.AWSConnection.Endpoint != "" {
+			o.BaseEndpoint = &check.AWSConnection.Endpoint
+		}
+	})
 
 	var complianceTypes = []types.ComplianceType{}
 	for _, i := range check.ComplianceTypes {
diff --git a/checks/cloudwatch.go b/checks/cloudwatch.go
index e3c71d211..ab5131138 100644
--- a/checks/cloudwatch.go
+++ b/checks/cloudwatch.go
@@ -7,9 +7,7 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/service/cloudwatch"
 	"github.com/aws/aws-sdk-go-v2/service/cloudwatch/types"
-	awsUtil "github.com/flanksource/artifacts/clients/aws"
 	"github.com/flanksource/canary-checker/api/context"
-	"github.com/flanksource/canary-checker/api/external"
 	v1 "github.com/flanksource/canary-checker/api/v1"
 	"github.com/flanksource/canary-checker/pkg"
 )
@@ -32,8 +30,7 @@ func (c *CloudWatchChecker) Type() string {
 	return "cloudwatch"
 }
 
-func (c *CloudWatchChecker) Check(ctx *context.Context, extConfig external.Check) pkg.Results {
-	check := extConfig.(v1.CloudWatchCheck)
+func (c *CloudWatchChecker) Check(ctx *context.Context, check v1.CloudWatchCheck) pkg.Results {
 	result := pkg.Success(check, ctx.Canary)
 	var results pkg.Results
 	results = append(results, result)
@@ -42,11 +39,17 @@ func (c *CloudWatchChecker) Check(ctx *context.Context, extConfig external.Check
 		return results.Failf("failed to populate aws connection: %v", err)
 	}
 
-	cfg, err := awsUtil.NewSession(ctx.Context, check.AWSConnection)
+	cfg, err := check.AWSConnection.Client(ctx.Context)
 	if err != nil {
 		return results.ErrorMessage(err)
 	}
-	client := cloudwatch.NewFromConfig(*cfg)
+
+	client := cloudwatch.NewFromConfig(cfg, func(o *cloudwatch.Options) {
+		if check.AWSConnection.Endpoint != "" {
+			o.BaseEndpoint = &check.AWSConnection.Endpoint
+		}
+	})
+
 	maxRecords := int32(100)
 	alarms, err := client.DescribeAlarms(ctx, &cloudwatch.DescribeAlarmsInput{
 		AlarmNames:      check.CloudWatchFilter.Alarms,
diff --git a/checks/folder.go b/checks/folder.go
index e0e918c45..324c95e05 100644
--- a/checks/folder.go
+++ b/checks/folder.go
@@ -6,9 +6,10 @@ import (
 	"os"
 	"strings"
 
+	"github.com/flanksource/artifacts"
+	artifactFS "github.com/flanksource/artifacts/fs"
 	"github.com/prometheus/client_golang/prometheus"
 
-	"github.com/flanksource/artifacts"
 	"github.com/flanksource/canary-checker/api/context"
 	"github.com/flanksource/canary-checker/api/external"
 	v1 "github.com/flanksource/canary-checker/api/v1"
@@ -111,18 +112,18 @@ func checkLocalFolder(ctx *context.Context, check v1.FolderCheck) pkg.Results {
 	return results
 }
 
-func genericFolderCheck(dirFS artifacts.Filesystem, path string, recursive bool, filter v1.FolderFilter) (FolderCheck, error) {
+func genericFolderCheck(dirFS artifactFS.Filesystem, path string, recursive bool, filter v1.FolderFilter) (FolderCheck, error) {
 	return _genericFolderCheck(true, dirFS, path, recursive, filter)
 }
 
 // genericFolderCheckWithoutPrecheck is used for those filesystems that do not support fetching the stat of a directory.
 // Eg: s3, gcs.
 // It will not pre check whether the given path is a directory.
-func genericFolderCheckWithoutPrecheck(dirFS artifacts.Filesystem, path string, recursive bool, filter v1.FolderFilter) (FolderCheck, error) {
+func genericFolderCheckWithoutPrecheck(dirFS artifactFS.Filesystem, path string, recursive bool, filter v1.FolderFilter) (FolderCheck, error) {
 	return _genericFolderCheck(false, dirFS, path, recursive, filter)
 }
 
-func _genericFolderCheck(supportsDirStat bool, dirFS artifacts.Filesystem, path string, recursive bool, filter v1.FolderFilter) (FolderCheck, error) {
+func _genericFolderCheck(supportsDirStat bool, dirFS artifactFS.Filesystem, path string, recursive bool, filter v1.FolderFilter) (FolderCheck, error) {
 	result := FolderCheck{}
 	_filter, err := filter.New()
 	if err != nil {
@@ -170,7 +171,7 @@ func _genericFolderCheck(supportsDirStat bool, dirFS artifacts.Filesystem, path
 
 // getFolderContents walks the folder and returns all files.
 // Also supports recursively fetching contents
-func getFolderContents(dirFs artifacts.Filesystem, path string, filter *v1.FolderFilterContext) ([]fs.FileInfo, error) {
+func getFolderContents(dirFs artifactFS.Filesystem, path string, filter *v1.FolderFilterContext) ([]fs.FileInfo, error) {
 	files, err := dirFs.ReadDir(path)
 	if err != nil {
 		return nil, err
diff --git a/checks/folder_s3.go b/checks/folder_s3.go
index 562103747..9cc540bc4 100644
--- a/checks/folder_s3.go
+++ b/checks/folder_s3.go
@@ -8,10 +8,10 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/flanksource/artifacts"
+	artifactFS "github.com/flanksource/artifacts/fs"
 	"github.com/flanksource/canary-checker/api/context"
 	v1 "github.com/flanksource/canary-checker/api/v1"
 	"github.com/flanksource/canary-checker/pkg"
-	"github.com/flanksource/duty/models"
 )
 
 type S3 struct {
@@ -31,26 +31,22 @@ func CheckS3Bucket(ctx *context.Context, check v1.FolderCheck) pkg.Results {
 	var bucket string
 	bucket, check.Path = parseS3Path(check.Path)
 
-	connection, err := ctx.HydrateConnectionByURL(check.AWSConnection.ConnectionName)
-	if err != nil {
-		return results.Failf("failed to populate AWS connection: %v", err)
-	} else if connection == nil {
-		connection = &models.Connection{Type: models.ConnectionTypeS3}
-		if check.S3Connection.Bucket == "" {
-			check.S3Connection.Bucket = bucket
-		}
-
-		connection, err = connection.Merge(ctx, check.S3Connection)
-		if err != nil {
-			return results.Failf("failed to populate AWS connection: %v", err)
-		}
+	if err := check.S3Connection.Populate(ctx); err != nil {
+		return results.ErrorMessage(err)
 	}
 
-	fs, err := artifacts.GetFSForConnection(ctx.Context, *connection)
+	conn := check.S3Connection.ToModel()
+	conn.SetProperty("bucket", bucket)
+
+	fs, err := artifacts.GetFSForConnection(ctx.Context, conn)
 	if err != nil {
 		return results.ErrorMessage(err)
 	}
 
+	if limitFS, ok := fs.(artifactFS.ListItemLimiter); ok {
+		limitFS.SetMaxListItems(ctx.Properties().Int("s3.list.max-objects", 50_000))
+	}
+
 	folders, err := genericFolderCheckWithoutPrecheck(fs, check.Path, check.Recursive, check.Filter)
 	if err != nil {
 		return results.ErrorMessage(err)
diff --git a/checks/folder_sftp.go b/checks/folder_sftp.go
index 71b82aadc..ffb8f05e7 100644
--- a/checks/folder_sftp.go
+++ b/checks/folder_sftp.go
@@ -1,11 +1,7 @@
 package checks
 
 import (
-	"fmt"
-
 	"github.com/flanksource/artifacts"
-	"github.com/flanksource/artifacts/clients/sftp"
-
 	"github.com/flanksource/canary-checker/api/context"
 	v1 "github.com/flanksource/canary-checker/api/v1"
 	"github.com/flanksource/canary-checker/pkg"
@@ -16,19 +12,16 @@ func CheckSFTP(ctx *context.Context, check v1.FolderCheck) pkg.Results {
 	var results pkg.Results
 	results = append(results, result)
 
-	err := check.SFTPConnection.HydrateConnection(ctx)
-	if err != nil {
+	if err := check.SFTPConnection.HydrateConnection(ctx); err != nil {
 		return results.Failf("failed to populate SFTP connection: %v", err)
 	}
 
-	client, err := sftp.SSHConnect(fmt.Sprintf("%s:%d", check.SFTPConnection.Host, check.SFTPConnection.GetPort()), check.SFTPConnection.GetUsername(), check.SFTPConnection.GetPassword())
+	fs, err := artifacts.GetFSForConnection(ctx.Context, check.SFTPConnection.ToModel())
 	if err != nil {
 		return results.ErrorMessage(err)
 	}
-	defer client.Close()
 
-	session := artifacts.Filesystem(client)
-	folders, err := genericFolderCheck(session, check.Path, check.Recursive, check.Filter)
+	folders, err := genericFolderCheck(fs, check.Path, check.Recursive, check.Filter)
 	if err != nil {
 		return results.ErrorMessage(err)
 	}
diff --git a/checks/folder_smb.go b/checks/folder_smb.go
index 7d43ae1f9..5941b3d50 100644
--- a/checks/folder_smb.go
+++ b/checks/folder_smb.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/flanksource/artifacts/clients/smb"
+	"github.com/flanksource/artifacts"
 	"github.com/flanksource/canary-checker/api/context"
 	v1 "github.com/flanksource/canary-checker/api/v1"
 	"github.com/flanksource/canary-checker/pkg"
@@ -15,26 +15,30 @@ func CheckSmb(ctx *context.Context, check v1.FolderCheck) pkg.Results {
 	var results pkg.Results
 	results = append(results, result)
 
-	var serverPath = strings.TrimPrefix(check.Path, "smb://")
-	server, sharename, path, err := extractServerDetails(serverPath)
+	serverPath := strings.TrimPrefix(check.Path, "smb://")
+	server, share, path, err := extractServerDetails(serverPath)
 	if err != nil {
 		return results.ErrorMessage(err)
 	}
 
-	err = check.SMBConnection.Populate(ctx)
-	if err != nil {
+	if err := check.SMBConnection.Populate(ctx); err != nil {
 		return results.Failf("failed to populate SMB connection: %v", err)
 	}
 
-	session, err := smb.SMBConnect(server, fmt.Sprintf("%d", check.SMBConnection.GetPort()), sharename, check.SMBConnection.Authentication)
+	if server != "" {
+		check.SMBConnection.Domain = server
+	}
+
+	if share != "" {
+		check.SMBConnection.Share = share
+	}
+
+	fs, err := artifacts.GetFSForConnection(ctx.Context, check.SMBConnection.ToModel())
 	if err != nil {
 		return results.ErrorMessage(err)
 	}
-	if session != nil {
-		defer session.Close()
-	}
 
-	folders, err := genericFolderCheck(session, path, check.Recursive, check.Filter)
+	folders, err := genericFolderCheck(fs, path, check.Recursive, check.Filter)
 	if err != nil {
 		return results.ErrorMessage(err)
 	}
diff --git a/checks/s3.go b/checks/s3.go
index 66a94aa8c..42cbb93b3 100644
--- a/checks/s3.go
+++ b/checks/s3.go
@@ -4,21 +4,13 @@ package checks
 
 import (
 	"bytes"
-	"crypto/tls"
 	"io"
-	"net/http"
 	"strings"
 
 	"github.com/flanksource/canary-checker/api/context"
 	"github.com/flanksource/commons/utils"
-	"github.com/flanksource/duty/connection"
-	"github.com/henvic/httpretty"
 
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
-	"github.com/flanksource/canary-checker/api/external"
 	"github.com/prometheus/client_golang/prometheus"
 
 	v1 "github.com/flanksource/canary-checker/api/v1"
@@ -65,8 +57,7 @@ func (c *S3Checker) Type() string {
 	return "s3"
 }
 
-func (c *S3Checker) Check(ctx *context.Context, extConfig external.Check) pkg.Results {
-	check := extConfig.(v1.S3Check)
+func (c *S3Checker) Check(ctx *context.Context, check v1.S3Check) pkg.Results {
 	result := pkg.Success(check, ctx.Canary)
 	var results pkg.Results
 	results = append(results, result)
@@ -75,13 +66,17 @@ func (c *S3Checker) Check(ctx *context.Context, extConfig external.Check) pkg.Re
 		return results.Failf("failed to populate aws connection: %v", err)
 	}
 
-	cfg, err := GetAWSConfig(ctx, check.AWSConnection)
+	cfg, err := check.AWSConnection.Client(ctx.Context)
 	if err != nil {
-		return results.Failf("Failed to get AWS config: %v", err)
+		return results.Failf("Failed to get aws client: %v", err)
 	}
 
 	client := s3.NewFromConfig(cfg, func(o *s3.Options) {
 		o.UsePathStyle = check.S3Connection.UsePathStyle
+
+		if check.AWSConnection.Endpoint != "" {
+			o.BaseEndpoint = &check.AWSConnection.Endpoint
+		}
 	})
 
 	listTimer := NewTimer()
@@ -122,52 +117,3 @@ func (c *S3Checker) Check(ctx *context.Context, extConfig external.Check) pkg.Re
 
 	return results
 }
-
-// nolint:staticcheck
-// FIXME: deprecated global endpoint resolver
-func GetAWSConfig(ctx *context.Context, conn connection.AWSConnection) (cfg aws.Config, err error) {
-	var options []func(*config.LoadOptions) error
-
-	if conn.Region != "" {
-		options = append(options, config.WithRegion(conn.Region))
-	}
-
-	if conn.Endpoint != "" {
-		options = append(options, config.WithEndpointResolverWithOptions(aws.EndpointResolverWithOptionsFunc(
-			func(service, region string, options ...any) (aws.Endpoint, error) {
-				return aws.Endpoint{
-					URL: conn.Endpoint,
-				}, nil
-			},
-		)))
-	}
-
-	if !conn.AccessKey.IsEmpty() {
-		options = append(options, config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(conn.AccessKey.ValueStatic, conn.SecretKey.ValueStatic, "")))
-	}
-
-	if conn.SkipTLSVerify {
-		var tr http.RoundTripper
-		if ctx.IsTrace() {
-			httplogger := &httpretty.Logger{
-				Time:           true,
-				TLS:            false,
-				RequestHeader:  false,
-				RequestBody:    false,
-				ResponseHeader: true,
-				ResponseBody:   false,
-				Colors:         true,
-				Formatters:     []httpretty.Formatter{&httpretty.JSONFormatter{}},
-			}
-			tr = httplogger.RoundTripper(tr)
-		} else {
-			tr = &http.Transport{
-				TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-			}
-		}
-
-		options = append(options, config.WithHTTPClient(&http.Client{Transport: tr}))
-	}
-
-	return config.LoadDefaultConfig(ctx, options...)
-}
diff --git a/fixtures/datasources/s3_bucket_pass.yaml b/fixtures/datasources/s3_bucket_pass.yaml
index ae9f8fd46..669198d41 100644
--- a/fixtures/datasources/s3_bucket_pass.yaml
+++ b/fixtures/datasources/s3_bucket_pass.yaml
@@ -74,9 +74,8 @@ spec:
       minSize: 25b
     - name: recursive folders
       namespace: default
-      path: s3://recursive-test/developers
-      minCount: 3
-      recursive: true
+      path: s3://recursive-test/developers/**/*.txt
+      minCount: 4
       display:
         expr: results.?files.orValue([]).map(i, i.name).join(", ")
       awsConnection:
diff --git a/go.mod b/go.mod
index 4686a59c6..001711489 100644
--- a/go.mod
+++ b/go.mod
@@ -1,14 +1,13 @@
 module github.com/flanksource/canary-checker
 
-go 1.22.3
+go 1.22.5
+
+toolchain go1.23.0
 
 require (
 	cloud.google.com/go/storage v1.38.0
 	github.com/allegro/bigcache v1.2.1
 	github.com/asecurityteam/rolling v2.0.4+incompatible
-	github.com/aws/aws-sdk-go-v2 v1.30.4
-	github.com/aws/aws-sdk-go-v2/config v1.27.29
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.29
 	github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.32.2
 	github.com/aws/aws-sdk-go-v2/service/configservice v1.44.0
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.48.0
@@ -17,7 +16,7 @@ require (
 	github.com/eko/gocache/lib/v4 v4.1.6
 	github.com/eko/gocache/store/bigcache/v4 v4.2.1
 	github.com/elastic/go-elasticsearch/v8 v8.13.1
-	github.com/flanksource/artifacts v1.0.7
+	github.com/flanksource/artifacts v1.0.14
 	github.com/flanksource/commons v1.29.1
 	github.com/flanksource/duty v1.0.611
 	github.com/flanksource/gomplate/v3 v3.24.24
@@ -32,7 +31,6 @@ require (
 	github.com/gobwas/glob v0.2.3
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-getter v1.7.5
-	github.com/henvic/httpretty v0.1.3
 	github.com/jackc/pgx/v5 v5.6.0
 	github.com/joshdk/go-junit v1.0.0
 	github.com/jszwec/csvutil v1.9.0
@@ -103,8 +101,11 @@ require (
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go v1.50.8 // indirect
+	github.com/aws/aws-sdk-go v1.55.1 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.30.4 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.29 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.29 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.12 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.16 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.16 // indirect
@@ -121,6 +122,7 @@ require (
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
+	github.com/bmatcuk/doublestar/v4 v4.6.1 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -191,6 +193,7 @@ require (
 	github.com/hashicorp/go-safetemp v1.0.0 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/hcl/v2 v2.21.0 // indirect
+	github.com/henvic/httpretty v0.1.3 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/hirochachacha/go-smb2 v1.1.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
@@ -329,7 +332,10 @@ require (
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 )
 
-// replace github.com/flanksource/duty => /Users/moshe/go/src/github.com/flanksource/duty
+// replace github.com/flanksource/duty => ../duty
+
+// replace github.com/flanksource/artifacts => ../artifacts
 
 // replace github.com/flanksource/gomplate/v3 => ../gomplate
+
 // replace github.com/flanksource/commons => /Users/moshe/go/src/github.com/flanksource/commons
diff --git a/go.sum b/go.sum
index cbb1481d4..34407d3c9 100644
--- a/go.sum
+++ b/go.sum
@@ -692,8 +692,8 @@ github.com/asecurityteam/rolling v2.0.4+incompatible h1:WOSeokINZT0IDzYGc5BVcjLl
 github.com/asecurityteam/rolling v2.0.4+incompatible/go.mod h1:2D4ba5ZfYCWrIMleUgTvc8pmLExEuvu3PDwl+vnG58Q=
 github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go v1.44.263/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
-github.com/aws/aws-sdk-go v1.50.8 h1:gY0WoOW+/Wz6XmYSgDH9ge3wnAevYDSQWPxxJvqAkP4=
-github.com/aws/aws-sdk-go v1.50.8/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
+github.com/aws/aws-sdk-go v1.55.1 h1:ZTNPmbRMxaK5RlTJrBullX9r/rF1MPf3yAJOLlwDiT8=
+github.com/aws/aws-sdk-go v1.55.1/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v1.18.0/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
 github.com/aws/aws-sdk-go-v2 v1.30.4 h1:frhcagrVNrzmT95RJImMHgabt99vkXGslubDaDagTk8=
 github.com/aws/aws-sdk-go-v2 v1.30.4/go.mod h1:CT+ZPWXbYrci8chcARI3OmI/qgd+f6WtuLOoaIA8PR0=
@@ -708,6 +708,8 @@ github.com/aws/aws-sdk-go-v2/credentials v1.17.29/go.mod h1:BPJ/yXV92ZVq6G8uYvbU
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3/go.mod h1:4Q0UFP0YJf0NrsEuEYHpM9fTSEVnD16Z3uyEF7J9JGM=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.12 h1:yjwoSyDZF8Jth+mUk5lSPJCkMC0lMy6FaCD51jm6ayE=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.12/go.mod h1:fuR57fAgMk7ot3WcNQfb6rSEn+SUffl7ri+aa8uKysI=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.7 h1:FnLf60PtjXp8ZOzQfhJVsqF0OtYKQZWQfqOLshh8YXg=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.7/go.mod h1:tDVvl8hyU6E9B8TrnNrZQEVkQlB8hjJwcgpPhgtlnNg=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33/go.mod h1:7i0PF1ME/2eUPFcjkVIwq+DOygHEoK92t5cDqNgYbIw=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.16 h1:TNyt/+X43KJ9IJJMjKfa3bNTiZbUP7DeCxfbTROESwY=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.16/go.mod h1:2DwJF39FlNAUiX5pAc0UNeiz16lK2t7IaFcm0LFHEgc=
@@ -755,6 +757,8 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
+github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwNy7PA4I=
+github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
@@ -855,8 +859,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fergusstrange/embedded-postgres v1.25.0 h1:sa+k2Ycrtz40eCRPOzI7Ry7TtkWXXJ+YRsxpKMDhxK0=
 github.com/fergusstrange/embedded-postgres v1.25.0/go.mod h1:t/MLs0h9ukYM6FSt99R7InCHs1nW0ordoVCcnzmpTYw=
-github.com/flanksource/artifacts v1.0.7 h1:tLbY4+7l2H06Td3zSgGSwJy9Vfhto+M7L80cm0aqyyc=
-github.com/flanksource/artifacts v1.0.7/go.mod h1:pzO1hirM9RMrkJMsLbZbZyN6elsCwz8SNOk3z+mpv34=
+github.com/flanksource/artifacts v1.0.14 h1:Vv70bccsae0MwGaf/uSPp34J5V1/PyKfct9z5JYCTJU=
+github.com/flanksource/artifacts v1.0.14/go.mod h1:qHVCnQu5k50aWNJ5UhpcAKEl7pAzqUrFFKGSm147G70=
 github.com/flanksource/commons v1.29.1 h1:82vkqo0JFFcOwRXkXrKtMPfUlywOb3YQ+mPSSW9gkpo=
 github.com/flanksource/commons v1.29.1/go.mod h1:Kcw3+JI04cVw2zYlv/XTMM1dkNkAwqLYqTxVb19Y/JA=
 github.com/flanksource/duty v1.0.611 h1:3QXR7gJsbSMP8c4U00e5Ubf/yD0yVQLLf24AzFZxJxQ=