从GitHub Actions访问AWS CodeArtifact仓库遇权限错误如何解决？

我在AWS CodeArtifact中配置了一个仓库，本地以管理员身份可以通过dotnet restore正常访问。现在尝试通过GitHub Actions实现部署，使用的工作流如下：

jobs:
  build-app:
    runs-on: ubuntu-latest
    steps:
    - name: 配置AWS CLI
      uses: aws-actions/configure-aws-credentials@v2
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: eu-west-2
    - name: 检出代码
      uses: actions/checkout@v3.5.0
    - name: 安装.NET Core环境
      uses: actions/setup-dotnet@v3.2.0
      with:
        dotnet-version: 6.0.x
    - name: 登录AWS CodeArtifact
      run: |
          aws codeartifact login --tool dotnet --repository ${{ secrets.AWS_CODEARTIFACT_REPOSITORY }} --domain ${{ secrets.AWS_CODEARTIFACT_DOMAIN }}

执行后出现以下错误：

An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::***:user/username is not authorized to perform: codeartifact:GetAuthorizationToken on resource: arn:aws:codeartifact:eu-west-2:***:domain/*** because no identity-based policy allows the codeartifact:GetAuthorizationToken action
Error: Process completed with exit code 254.

关键信息：CodeArtifact属于账户A，访问用户属于账户B。

当前IAM配置 #

账户B中的用户策略

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:GetServiceBearerToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "sts:AWSServiceName": "codeartifact.amazonaws.com"
                }
            }
        }
    ],
    "Version": "2012-10-17"
}

账户A中的CodeArtifact域策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::account-b-id:root"
            },
            "Action": "codeartifact:GetAuthorizationToken",
            "Resource": "arn:aws:codeartifact:eu-west-2:289579680938:domain/afterlife"
        }
    ]
}

账户A中的CodeArtifact仓库策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::account-b-id:root"
            },
            "Action": [
                "codeartifact:ReadFromRepository",
                "codeartifact:ListPackages",
                "codeartifact:ListPackageVersions",
                "codeartifact:ListPackageVersionDependencies",
                "codeartifact:ListPackageVersionAssets",
                "codeartifact:GetRepositoryEndpoint",
                "codeartifact:GetPackageVersionReadme",
                "codeartifact:GetAuthorizationToken",
                "codeartifact:DescribeRepository",
                "codeartifact:DescribePackageVersion"
            ],
            "Resource": "arn:aws:codeartifact:eu-west-2:289579680938:repository/afterlife/nuget-mirror"
        }
    ]
}

请问哪里配置出错了？

核心问题 #

错误提示明确指出：账户B的用户没有基于身份的策略允许codeartifact:GetAuthorizationToken操作。当前账户B的用户策略只授权了sts:GetServiceBearerToken，但缺少执行codeartifact:GetAuthorizationToken的权限——这是跨账户访问CodeArtifact时，用户身份必须具备的基础权限。

另外，虽然账户A的域策略和仓库策略已经允许账户B的根用户访问，但IAM权限检查是身份策略+资源策略的组合验证：身份策略先判断用户是否被允许执行该操作，再结合资源策略确认是否允许访问目标资源。两者缺一不可。

修复步骤 #

1. 更新账户B的用户IAM策略 #

给账户B的用户添加codeartifact:GetAuthorizationToken权限，修改后的策略如下：

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:GetServiceBearerToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "sts:AWSServiceName": "codeartifact.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "codeartifact:GetAuthorizationToken",
            "Resource": "arn:aws:codeartifact:eu-west-2:289579680938:domain/afterlife"
        }
    ],
    "Version": "2012-10-17"
}

• 这里指定具体的域资源ARN，比用*更安全，符合最小权限原则。

2. 可选优化：缩小资源策略的主体范围 #

当前域策略和仓库策略的Principal是账户B的根用户，这会允许账户B下所有IAM实体访问。如果只需要特定用户访问，可以把Principal改为该用户的ARN：

"Principal": {
    "AWS": "arn:aws:iam::account-b-id:user/username"
}

3. 验证修复 #

重新运行GitHub Actions工作流，确认aws codeartifact login命令能正常执行，之后的dotnet restore也可以访问CodeArtifact仓库。

内容的提问来源于stack exchange，提问作者baynezy