Terraform可正常调用CircleCI API，为何Bash中Curl传参失败？

我可以通过Terraform成功调用CircleCI的API，但使用Bash脚本调用时却失败。

可正常运行的Terraform代码 #

curl -X POST https://circleci.com/api/v2/project/gh/some-organization/${var.repository_name}/envvar \
 -H 'Content-Type: application/json' \
 -H 'Circle-Token: ${data.aws_ssm_parameter.ct[0].value}' \
 -d '{"name":"AWS_ACCOUNT_ID_${upper(var.environment)}","value":"${data.aws_caller_identity.current.account_id}"}'

无法正常运行的Bash代码 #

#!/bin/bash
user=$1
repo=$2
lower_env=$3
env=$(echo "$lower_env" | tr '[:lower:]' '[:upper:]')
token="1234567890"

......
NEW_ACCESS_KEY_ID="$(aws iam list-access-keys --user-name $user | jq -r '.AccessKeyMetadata[].AccessKeyId')"
......

  curl -X POST https://circleci.com/api/v2/project/gh/some-organization/$repo/envvar \
      -H 'Content-Type: application/json' \
      -H 'Circle-Token:${token}' \
      -d '{"name":"AWS_ACCESS_KEY_ID_${env}","value":"'\''$NEW_ACCESS_KEY_ID'\''"}'

核心问题在于Curl命令中变量（如token）的传递，尝试过多种转义方式均无效，例如：

-H 'Content-Type: application/json' \
      -H 'Circle-Token: '\''$token'\'' \
      -d '{"name":"AWS_SECRET_ACCESS_KEY_${upper('\''$env'\'')}","value":"'\''$NEW_SECRET_ACCESS_KEY'\''"}'

曾将Curl命令打印出来，格式看起来是正确的：

curl -X POST https://circleci.com/api/v2/project/gh/some-ogranization/repo-from-token/envvar -H 'Circle-Token: 1234567890'

可行解决方案代码 #

curl -X POST "https://circleci.com/api/v2/project/gh/some-organization/$repo/envvar" \
      -H "Content-Type: application/json" \
      -H "Circle-Token: $token" \
      -d "{\"name\":\"AWS_ACCESS_KEY_ID_${env}\",\"value\":\"$NEW_ACCESS_KEY_ID\"}"

内容的提问来源于stack exchange，提问作者Oleksadr S