Docker容器构建时从AWS CodeArtifact拉取Maven Jar报401错误求助

我正在构建用于编译和运行测试的Docker镜像，依赖AWS CodeArtifact提供的Jar包，但拉取依赖时一直返回401未授权错误。本地通过环境变量传入AWS_ACCESS_KEY_ID和AWS_SECRET_ACCESS_KEY可以正常拉取，但在Docker镜像中完成AWS CLI安装配置后，Maven拉取操作还是失败。

Dockerfile内容 #

FROM --platform=linux/amd64 amazoncorretto:21.0.2

ARG MAVEN_VERSION=3.9.6

# 定义工作目录常量
ARG USER_HOME_DIR="/root"

ARG AWS_CLI_LINK=https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip

ARG AWS_ACCESS_KEY_ID
ARG AWS_SECRET_ACCESS_KEY
ARG CODEARTIFACT_AUTH_TOKEN

RUN echo $AWS_ACCESS_KEY_ID
RUN echo $AWS_SECRET_ACCESS_KEY
RUN echo $CODEARTIFACT_AUTH_TOKEN
#RUN mkdir -p .m2
#COPY settings-amazon-lawyrup.xml .m2/settings.xml


RUN mkdir -p /usr/share/aws
RUN echo "Downloading aws cli"
RUN curl -fsSL -o /tmp/awscli-exe-linux-x86_64.zip ${AWS_CLI_LINK}
RUN unzip /tmp/awscli-exe-linux-x86_64.zip -d /usr/share/aws
RUN /usr/share/aws/aws/install
RUN aws --version
RUN aws configure set aws_access_key_id $$AWS_ACCESS_KEY
RUN aws configure set aws_secret_access_key $$AWS_SECRET_KEY

# Maven下载与安装
RUN mkdir -p /usr/share/maven /usr/share/maven/ref
RUN echo "Downloading maven"
RUN curl -fsSL -o /tmp/apache-maven.tar.gz ${BASE_URL}/apache-maven-${MAVEN_VERSION}-bin.tar.gz
RUN echo "Checking download hash"
RUN echo "${MAVAN_SUM}  /tmp/apache-maven.tar.gz" | sha512sum -c -

RUN echo "Unziping maven"
RUN tar -xzf /tmp/apache-maven.tar.gz -C /usr/share/maven --strip-components=1

RUN echo "Cleaning and setting links"
RUN rm -f /tmp/apache-maven.tar.gz
RUN ln -s /usr/share/maven/bin/mvn /usr/bin/mvn

# 定义Maven所需环境变量
ENV MAVEN_HOME /usr/share/maven
ENV MAVEN_CONFIG "$USER_HOME_DIR/.m2"

# 缓存Maven依赖
COPY pom.xml ./pom.xml
RUN mvn -f pom.xml -B dependency:resolve-plugins dependency:resolve

错误信息 #

artifacts could not be resolved:
com.lawyrup:immutabletypes:pom:0.1.0.3 (absent): Could not transfer
artifact com.lawyrup:immutabletypes:pom:0.1.0.3 from/to
lawyrup-lawyrup
(https://lawyrup-437075886573.d.codeartifact.ap-southeast-2.amazonaws.com/maven/lawyrup/): status code: 401, reason phrase: Unauthorized (401) -> [Help 1]

排查与修复要点 #

• AWS CLI配置变量名错误：Dockerfile中aws configure set使用了$$AWS_ACCESS_KEY和$$AWS_SECRET_KEY，但传入的ARG是AWS_ACCESS_KEY_ID和AWS_SECRET_ACCESS_KEY，变量名完全不匹配。同时$$是shell转义写法，在Docker RUN指令中直接用$引用ARG即可，修正后：

  RUN aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
  RUN aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
  

• 缺少AWS区域配置：CodeArtifact是区域化服务，必须配置对应区域才能正常访问，添加区域配置：

  RUN aws configure set region ap-southeast-2
  

• Maven未配置CodeArtifact认证规则：当前Dockerfile注释掉了settings.xml的复制，Maven不知道如何用AWS凭证获取CodeArtifact授权。要么取消注释复制settings.xml（确保文件中配置了CodeArtifact仓库的认证方式），要么在pom.xml中配置仓库认证，或者使用Maven的AWS CodeArtifact扩展插件。

• ARG变量作用域限制：ARG变量仅在定义后的RUN指令中有效，若后续Maven步骤需要依赖这些凭证，建议转为ENV变量：

  ENV AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
  ENV AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY
  

• 未生成CodeArtifact临时授权令牌：Maven访问CodeArtifact需要临时授权令牌，可在拉取依赖前执行生成命令：

  RUN aws codeartifact get-authorization-token --domain lawyrup --domain-owner 437075886573 --region ap-southeast-2 --query authorizationToken --output text > /tmp/codeartifact.token
  

  之后在Maven命令中通过参数传入令牌，或者在settings.xml中引用该令牌文件。

• Dockerfile缺失关键变量：BASE_URL和MAVAN_SUM两个ARG未定义，会导致Maven下载失败，补充定义：

  ARG BASE_URL=https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries
  ARG MAVEN_SUM=替换为对应Maven版本的sha512哈希值
  

内容的提问来源于stack exchange，提问作者Damien Cooke