CodeBuild 无法在 Gradle 脚本中获取 AWS 凭证答案

【问题标题】：CodeBuild Unable to obtain AWS Credentials in Gradle ScriptCodeBuild 无法在 Gradle 脚本中获取 AWS 凭证
【发布时间】：2020-03-03 05:27:44
【问题描述】：

我正在尝试使用 maven-publish 插件将我的工件上传到 S3，但我的脚本无法获取 AWS 凭证。关注了这个问题：How to use the default AWS credentials chain for an S3 backed Maven repository in a Gradle build? 也尝试过 DefaultAWSCredentialsProviderChain 但都没有奏效。基本上无法在 codebuild 脚本中获取 aws 凭据。任何提示将不胜感激。

CodeBuild 日志：

02:40:37.373 [DEBUG] [com.amazonaws.services.s3.AmazonS3Client] Region for my-repo is us-east-1
02:40:37.373 [DEBUG] [com.amazonaws.auth.AWSCredentialsProviderChain] Unable to load credentials from EnvironmentVariableCredentialsProvider: Unable to load AWS credentials from environment variables (AWS_ACCESS_KEY_ID (or AWS_ACCESS_KEY) and AWS_SECRET_KEY (or AWS_SECRET_ACCESS_KEY))
02:40:37.373 [DEBUG] [com.amazonaws.auth.AWSCredentialsProviderChain] Unable to load credentials from SystemPropertiesCredentialsProvider: Unable to load AWS credentials from Java system properties (aws.accessKeyId and aws.secretKey)
02:40:37.373 [DEBUG] [com.amazonaws.auth.AWSCredentialsProviderChain] Unable to load credentials from com.amazonaws.auth.profile.ProfileCredentialsProvider@124705d: profile file cannot be null
02:40:39.376 [DEBUG] [com.amazonaws.auth.AWSCredentialsProviderChain] Unable to load credentials from com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper@74a7b8dc: Unable to load credentials from service endpoint
02:40:39.376 [DEBUG] [com.amazonaws.services.s3.S3CredentialsProviderChain] No credentials available; falling back to anonymous access
02:40:39.376 [DEBUG] [com.amazonaws.request] Sending Request: PUT https://my-repo.s3.amazonaws.com /releases/com/mycompany/common/0.0.1/common-0.0.1.pom Headers: (x-amz-acl: bucket-owner-full-control, User-Agent: aws-sdk-java/1.11.407 Linux/4.14.152-98.182.amzn1.x86_64 OpenJDK_64-Bit_Server_VM/11.0.3+7 java/11.0.3 groovy/2.5.4 kotlin/1.3.20, amz-sdk-invocation-id: 057fae4d-67c5-4256-5804-7b17a09bba76, Content-Length: 2967, Content-Type: application/octet-stream, ) 
02:40:39.376 [DEBUG] [com.amazonaws.auth.AWSCredentialsProviderChain] Unable to load credentials from EnvironmentVariableCredentialsProvider: Unable to load AWS credentials from environment variables (AWS_ACCESS_KEY_ID (or AWS_ACCESS_KEY) and AWS_SECRET_KEY (or AWS_SECRET_ACCESS_KEY))
02:40:39.376 [DEBUG] [com.amazonaws.auth.AWSCredentialsProviderChain] Unable to load credentials from SystemPropertiesCredentialsProvider: Unable to load AWS credentials from Java system properties (aws.accessKeyId and aws.secretKey)
02:40:39.376 [DEBUG] [com.amazonaws.auth.AWSCredentialsProviderChain] Unable to load credentials from com.amazonaws.auth.profile.ProfileCredentialsProvider@124705d: profile file cannot be null
02:40:41.378 [DEBUG] [com.amazonaws.auth.AWSCredentialsProviderChain] Unable to load credentials from com.amazonaws.auth.EC2ContainerCredentialsProviderWrapper@74a7b8dc: Unable to load credentials from service endpoint
02:40:41.378 [DEBUG] [com.amazonaws.services.s3.S3CredentialsProviderChain] No credentials available; falling back to anonymous access

build.gradle

import com.amazonaws.auth.*

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'com.amazonaws:aws-java-sdk:1.11.645'
        classpath 'com.amazonaws:aws-java-sdk-core:1.11.645'
        classpath 'com.amazonaws:aws-java-sdk-sts:1.11.645'
    }
}
plugins {
   ...
   id 'maven-publish'
}
publishing {
    publications {
        mavenJava(MavenPublication) {
            from components.java
        }
    }
    repositories {
        maven {
            url "s3://my-repo/releases"
            authentication {
                awsIm(AwsImAuthentication)
            }
        }
    }
}

【问题讨论】：

标签： amazon-web-services maven gradle amazon-s3

【解决方案1】：

搞定了。将上面的代码保持不变，并将我的 buildspec.yml 修改为：

      - export AWS_ACCESS_KEY_ID=$(echo $temp_role | jq .Credentials.AccessKeyId)
      - export AWS_SECRET_ACCESS_KEY=$(echo $temp_role | jq .Credentials.SecretAccessKey)
      - export AWS_SESSION_TOKEN=$(echo $temp_role | jq .Credentials.SessionToken)
      - docker run -i --rm -w /opt/gradle -v $PWD:/opt/gradle -v $HOME/.gradle:/root/.gradle gradle:5.4-jdk11 ./gradlew publish

更新：曾经工作过，现在不再工作。不知道这里发生了什么。仍在调查中。

【讨论】：