Gitlab Pipeline部署前端至S3失败：无法定位凭证

Hey there, let's troubleshoot that "Unable to locate credentials" error you're hitting with your GitLab Pipeline to S3 deployment. Even though you've set up the secret variables, there are a few common gotchas that might be causing this. Here's what to check:

AWS relies on case-sensitive environment variables, so make sure your Secret Variables are named exactly:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
  Typos like lowercase letters or missing underscores (e.g., aws_access_key_id) will break credential detection immediately. Also confirm your deployment script/command is referencing these exact variable names—some tools might use non-standard names like AWS_ACCESS_KEY instead of the official ones.

Add a quick debug step to your .gitlab-ci.yml to confirm the variables are being passed into the job:

deploy_to_s3:
  stage: deploy
  before_script:
    - echo "Access Key prefix: ${AWS_ACCESS_KEY_ID:0:4}" # Print first 4 chars to avoid exposure
    - echo "Secret Key prefix: ${AWS_SECRET_ACCESS_KEY:0:4}"
  script:
    # Your existing deployment commands here

If the output is empty:

• Check if your variable has the correct environment scope (set it to * for all environments if you're unsure).
• If deploying from a protected branch/tag, make sure the variable has "Protect variable" enabled in GitLab's Secret Variables settings.

If you're using the official AWS CLI, it automatically reads AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from the environment—but some third-party tools or custom scripts might require explicit parameter passing. For example, if using a deployment plugin, you might need to write:

s3-deploy dist/ --bucket <my-s3-bucket-name> --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY

Or if using the AWS CLI directly, you can explicitly set credentials first to avoid any ambiguity:

aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
aws configure set region us-east-1 # Replace with your bucket's region
aws s3 sync dist/ s3://<my-s3-bucket-name>/ --delete

If you enabled "Mask variable" for your credentials, confirm the values meet GitLab's masking requirements:

• Minimum 8 characters long
• Not composed solely of numbers (AWS keys are alphanumeric, so this shouldn't be an issue, but it's worth checking)
  Temporarily disable masking to test if the variable starts working—if it does, adjust the value (unlikely for AWS keys) or re-enable masking once confirmed.

Sometimes the issue isn't GitLab, but the credentials themselves. Test them locally to confirm they have access to your bucket:

export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
aws s3 ls s3://<my-s3-bucket-name>

If this fails, head to the AWS IAM console to:

• Confirm the credentials haven't expired
• Check that the IAM user attached to these keys has permissions like s3:PutObject, s3:DeleteObject, and s3:ListBucket for your target bucket

内容的提问来源于stack exchange，提问作者Katana24