apprunner.yaml 无法获取CODEARTIFACT_AUTH_TOKEN

Question

export CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token --domain ** --domain-owner *** --region us-west-2 --query authorizationToken --output text)
这段代码出了问题，通过排除法定位的，始终报错，但没具体原因，删除相关的可以执行到mvn clean package；怎么修改？

这是原配置文件apprunner.yaml
version: 1.0
runtime: corretto11
build:
  env:
    - name: AWS_DEFAULT_REGION
      value: us-west-2
    - name: MAVEN_OPTS
      value: "-Xmx1024m"
  commands:
    build:
      - echo "开始构建流程..."
      - |
        set -e
        # 1. 获取令牌并导出为环境变量
        export CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token --domain ** --domain-owner *** --region us-west-2 --query authorizationToken --output text)
        
        # 2. 动态创建 settings.xml (直接写入当前目录，方便 mvn -s 调用)
        cat > settings.xml <

codeartifact
              aws
              \${env.CODEARTIFACT_AUTH_TOKEN}

codeartifact

codeartifact
                  https://liu-344577520173.d.codeartifact.us-west-2.amazonaws.com/maven/maven-central-store/

codeartifact

EOF
      - echo "执行 Maven 打包..."
      # 3. 使用 -s 指定刚才创建的 settings.xml
      - mvn clean package -DskipTests -Pprod -s settings.xml
run:
  # 提示：请确保 target 目录下的 jar 包确实叫这个名字，没有版本号后缀
  command: java -Xms128m -Xmx512m -XX:MetaspaceSize=128m -XX:MaxMetaspaceSize=256m -jar target/shopping-crm-service.jar
  network:
    port: 8080
  env:
    - name: SPRING_PROFILES_ACTIVE
      value: prod

re:Post Agent · Answer

It appears you're having an issue with retrieving the CodeArtifact authorization token in your App Runner configuration. The problem is likely related to how the token is being fetched and stored in the environment variable.

Here are a few ways to fix this issue:

1. Use a simpler syntax for token retrieval:
```yaml
- export CODEARTIFACT_AUTH_TOKEN=`aws codeartifact get-authorization-token --domain ** --domain-owner *** --region us-west-2 --query authorizationToken --output text`
```

2. Break down the command into multiple steps:
```yaml
- TOKEN=$(aws codeartifact get-authorization-token --domain ** --domain-owner *** --region us-west-2 --query authorizationToken --output text)
- echo "Token retrieved successfully"
- export CODEARTIFACT_AUTH_TOKEN=$TOKEN
```

3. Make sure the AWS CLI has the necessary permissions to call the CodeArtifact service. App Runner might need specific IAM permissions to access CodeArtifact.

4. Verify that your domain and domain-owner values (currently masked as ** and ***) are correct.

5. Add error handling to see what's happening:
```yaml
- |
set -e
echo "Retrieving CodeArtifact token..."
TOKEN=$(aws codeartifact get-authorization-token --domain ** --domain-owner *** --region us-west-2 --query authorizationToken --output text || echo "TOKEN_ERROR")
if [ "$TOKEN" = "TOKEN_ERROR" ]; then
echo "Failed to retrieve token"
exit 1
fi
echo "Token retrieved successfully"
export CODEARTIFACT_AUTH_TOKEN=$TOKEN
```

Remember that CodeArtifact authorization tokens are valid for 12 hours by default, so if you're testing repeatedly, the token retrieval should still work even if you already have a valid token.

If you continue to have issues, you might want to consider using AWS Secrets Manager to store the token and retrieve it during the build process instead of generating it on the fly.  
**Sources**  
[Configure the Swift Package Manager with CodeArtifact - CodeArtifact](https://docs.aws.amazon.com/codeartifact/latest/ug/configure-swift.html)  
[CodeArtifact examples using AWS CLI - AWS SDK Code Examples](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_codeartifact_code_examples.html)  
[Configure and use RubyGems and Bundler with CodeArtifact - CodeArtifact](https://docs.aws.amazon.com/codeartifact/latest/ug/configure-use-rubygems-bundler.html)  
[AWS CodeArtifact authentication and tokens - CodeArtifact](https://docs.aws.amazon.com/codeartifact/latest/ug/tokens-authentication.html)

apprunner.yaml 无法获取CODEARTIFACT_AUTH_TOKEN

提示：请确保 target 目录下的 jar 包确实叫这个名字，没有版本号后缀

Add your answer

Relevant content