Docker容器中CodeArtifact认证的IAM权限问题排查

问题背景 #

我已搭建CodeArtifact托管私有NuGet包并镜像公共NuGet包，本地环境及GitHub Actions均可正常拉取以实现CI。现计划在Docker容器中构建应用进行集成测试时遇到权限问题，相关细节如下：

Dockerfile片段 #

FROM cakebuild/cake:sdk-6.0 AS build-env
ARG AWS_ACCESS_KEY_ID
ARG AWS_SECRET_ACCESS_KEY
ARG AWS_CODEARTIFACT_REPOSITORY
ARG AWS_CODEARTIFACT_DOMAIN
ARG AWS_CODEARTIFACT_ACCOUNT_NUMBER
ENV AWS_ACCESS_KEY_ID ${AWS_ACCESS_KEY_ID}
ENV AWS_SECRET_ACCESS_KEY ${AWS_SECRET_ACCESS_KEY}
ENV AWS_CODEARTIFACT_REPOSITORY ${AWS_CODEARTIFACT_REPOSITORY}
ENV AWS_CODEARTIFACT_DOMAIN ${AWS_CODEARTIFACT_DOMAIN}
ENV AWS_CODEARTIFACT_ACCOUNT_NUMBER ${AWS_CODEARTIFACT_ACCOUNT_NUMBER}
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    apt-get update && \
    apt-get install -y unzip && \
    unzip awscliv2.zip && \
    ./aws/install && \
    rm -rf awscliv2.zip aws

WORKDIR /source

# Copy csproj and restore as distinct layers
COPY ./src/Application/*.csproj ./Application/
COPY ./src/Infrastructure/*.csproj ./Infrastructure/
COPY ./src/ProfileAPI/*.csproj ./ProfileAPI/

RUN aws configure set default.region eu-west-2 && \
    aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID && \
    aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY && \
    aws configure set output json
RUN aws codeartifact login --tool dotnet --repository $AWS_CODEARTIFACT_REPOSITORY --domain $AWS_CODEARTIFACT_DOMAIN --domain-owner $AWS_CODEARTIFACT_ACCOUNT_NUMBER

构建命令 #

docker build -t profile-api --build-arg AWS_ACCESS_KEY_ID=xxxxxx --build-arg AWS_SECRET_ACCESS_KEY=xxxxx --build-arg AWS_CODEARTIFACT_REPOSITORY=xxxxx --build-arg AWS_CODEARTIFACT_DOMAIN=xxxx --build-arg AWS_CODEARTIFACT_ACCOUNT_NUMBER=xxxx .

错误信息 #

An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::xxxxxx:user/PackageRead is not authorized to perform: codeartifact:GetAuthorizationToken on resource: arn:aws:codeartifact:eu-west-2:xxxxx:domain/xxxxxbecause no resource-based policy allows the 
codeartifact:GetAuthorizationToken action

已配置的IAM策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "sts:GetServiceBearerToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "sts:AWSServiceName": "codeartifact.amazonaws.com"
                }
            }
        }
    ]
}

问题 #

请问我遗漏了什么配置？

解决方案 #

从错误提示来看，核心问题是CodeArtifact域缺少对应的资源策略，仅配置IAM用户策略不足以完成授权，需要同时配置资源侧的访问控制：

1. 添加CodeArtifact域资源策略
   给目标CodeArtifact域添加资源策略，明确允许该IAM用户执行codeartifact:GetAuthorizationToken操作。示例策略如下：

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::xxxxxx:user/PackageRead"
               },
               "Action": "codeartifact:GetAuthorizationToken",
               "Resource": "arn:aws:codeartifact:eu-west-2:xxxxx:domain/xxxxx"
           }
       ]
   }
   

   可以通过AWS CLI执行以下命令添加策略：

   aws codeartifact put-domain-permissions-policy --domain <你的域名称> --domain-owner <域所属账号ID> --policy-document file://domain-policy.json
   

2. 验证命令参数正确性

   • 确认--domain-owner参数是否匹配域所属的AWS账号ID，若用户与域在同一账号下可省略该参数；
   • 检查容器内AWS CLI版本，建议使用最新版本避免兼容性问题（你当前Dockerfile中安装的是最新版，但可通过aws --version验证）。

3. 排查凭证有效性
   若使用的是临时STS凭证，需确保凭证包含codeartifact:GetAuthorizationToken权限且有效期覆盖整个构建流程；若为IAM用户永久密钥，可跳过此步。

内容的提问来源于stack exchange，提问作者baynezy