Gitlab CI/CD部署至AWS S3：dev分支上传失败求助

一、当前配置的核心错误 #

• 环境变量引用语法错误：在deploy_dev和deploy步骤中，设置AWS密钥时，AWS_SECRET_ACCESS_KEY_DEV和AWS_SECRET_ACCESS_KEY没有加$符号，导致awscli读取的是字符串字面量而非环境变量值：

  # 错误写法
  aws configure set aws_secret_access_key AWS_SECRET_ACCESS_KEY_DEV
  # 正确写法
  aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY_DEV
  

  这直接导致deploy_dev步骤使用无效密钥，触发InvalidAccessKeyId错误。而main分支看似正常，是因为awscli会自动读取默认环境变量AWS_ACCESS_KEY_ID和AWS_SECRET_ACCESS_KEY，即使aws configure设置错误，依然能通过环境变量获取正确值。

• 可能的S3 URL格式问题：如果AWS_S3_URL_DEV变量格式不符合要求（比如不是s3://bucket-name格式，或者变量为空），会触发s3 sync的参数错误，即第二种Invalid argument type错误。

二、修复后的完整CI配置 #

variables:
  # 全局变量，对应main分支
  AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
  AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
  AWS_S3_URL: $AWS_S3_URL
  # Dev分支变量
  AWS_ACCESS_KEY_ID_DEV: $AWS_ACCESS_KEY_ID_DEV
  AWS_SECRET_ACCESS_KEY_DEV: $AWS_SECRET_ACCESS_KEY_DEV
  AWS_S3_URL_DEV: $AWS_S3_URL_DEV

stages:
  - build
  - deploy

build:
  image: node:16.13.0-alpine3.11
  stage: build
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "development"'
  before_script:
    - yarn install --frozen-lockfile
  script:
    - yarn run build
    - yarn run generate
    - echo Build successful!
    - ls
  artifacts:
    paths:
      - dist/

# 复用deploy逻辑，通过分支判断切换变量
deploy:
  image: python:latest
  stage: deploy
  dependencies:
    - build
  rules:
    - if: '$CI_COMMIT_BRANCH == "main"'
      variables:
        DEPLOY_AWS_KEY: $AWS_ACCESS_KEY_ID
        DEPLOY_AWS_SECRET: $AWS_SECRET_ACCESS_KEY
        DEPLOY_S3_URL: $AWS_S3_URL
    - if: '$CI_COMMIT_BRANCH == "development"'
      variables:
        DEPLOY_AWS_KEY: $AWS_ACCESS_KEY_ID_DEV
        DEPLOY_AWS_SECRET: $AWS_SECRET_ACCESS_KEY_DEV
        DEPLOY_S3_URL: $AWS_S3_URL_DEV
  script:
    - pip3 install awscli
    - aws configure set aws_access_key_id $DEPLOY_AWS_KEY
    - aws configure set aws_secret_access_key $DEPLOY_AWS_SECRET
    - aws s3 sync ./dist $DEPLOY_S3_URL --delete #--acl public-read

三、更简便的多分支部署方案 #

1. 用GitLab CI规则+变量覆盖：如上面的配置，通过rules中的variables字段，根据分支自动切换对应的AWS密钥和S3地址，避免重复编写deploy步骤。
2. 使用AWS环境变量直接读取：awscli默认会读取AWS_ACCESS_KEY_ID、AWS_SECRET_ACCESS_KEY等环境变量，无需手动aws configure，可以简化脚本：

   # 去掉aws configure步骤，直接依赖环境变量
   script:
     - pip3 install awscli
     - aws s3 sync ./dist $DEPLOY_S3_URL --delete
   

   此时只需在rules中设置对应的环境变量即可：

   rules:
     - if: '$CI_COMMIT_BRANCH == "main"'
     - if: '$CI_COMMIT_BRANCH == "development"'
       variables:
         AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID_DEV
         AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY_DEV
         AWS_S3_URL: $AWS_S3_URL_DEV
   

3. 使用GitLab CI模板：如果有更多分支需要部署，可以将deploy逻辑抽成模板，通过extends关键字复用：

   .deploy_template:
     image: python:latest
     stage: deploy
     dependencies:
       - build
     script:
       - pip3 install awscli
       - aws s3 sync ./dist $AWS_S3_URL --delete
   
   deploy_main:
     extends: .deploy_template
     rules:
       - if: '$CI_COMMIT_BRANCH == "main"'
   
   deploy_dev:
     extends: .deploy_template
     rules:
       - if: '$CI_COMMIT_BRANCH == "development"'
     variables:
       AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID_DEV
       AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY_DEV
       AWS_S3_URL: $AWS_S3_URL_DEV
   

总结 #

这不是BUG，是配置中的环境变量引用语法错误导致的，同时需确保S3 URL格式正确。通过复用CI配置逻辑，可以大幅简化多分支部署的维护成本。

内容的提问来源于stack exchange，提问作者GTDiablo