Using AWS CodeArtifact for packages

[danielmklein]

Hi there! We have recently upgraded to Enterprise, but it's not clear how to set up access to CodeArtifact and ensure we keep the relevant token refreshed. Where are the docs etc on that?

[rubenfiszel]

Hi, there is a specific env variable EPHEMERAL_TOKEN_CMD which is meant to have the specific aws command to generate a short token for the code artifact (the aws cli need to be used with --output arg to output just the token), and then you need to set PIP_INDEX_URL='xxxEPHEMERAL_TOKEN' and EPHEMERAL_TOKEN will be replaced by the output of the command.

We're asking another customer how they are currently using it

See other answer for format of the commands

[rubenfiszel]

Here are the env variables

EPHEMERAL_TOKEN_CMD="aws codeartifact get-authorization-token --region <region> --domain <insert domain> --query authorizationToken --output text --duration-seconds 900"
PIP_INDEX_URL="https://aws:EPHEMERAL_TOKEN@<CODE ARTIFACT DOMAIN>/pypi/<LIB NAME>/simple"

It assumes the ec2 nodes have the proper roles to get the token

[danielmklein]

If we're running on ECS Fargate, would the ECS task role take precedence there as far as providing IAM permission to get the token?

[rubenfiszel]

yes, I would think so. The command is passed with all the env variables passed to windmill and fargate should pass enough env variable for aws cli to auth itself as the ECS task executor role.

[danielmklein]

Sweet -- we will give it a shot. Thanks a ton for the quick response, as always!

UPDATE: this works perfectly, assuming you have the relevant CodeArtifact permissions on the ECS task role!