Get authorization CodeArtifact token from Bitbucket Pipelines run

Question

I'm using Bitbucket as a source control service and I'm interested to start using its pipelines capability to build and deploy my app. I'm using AWS CodeArtifact to host my Java artifacts.

The thing I'm struggle with is how to authenticate AWS CodeArtifact from the Bitbucket pipelines.

How to run

aws sso login --profile XXXX
export CODEARTIFACT_AUTH_TOKEN=`aws codeartifact get-authorization-token ....

Is there a best practice to deal with this??

Answer 1

I think the exportation of the CODEARTIFACT_AUTH_TOKEN env var is quite fine. For the first authentication to AWS, you probably want to take a look into Bitbucket OIDC capabilities:

• https://bitbucket.org/blog/bitbucket-pipelines-and-openid-connect-no-more-secret-management
• https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/

Essentially, setting up an identity provider in you AWS account that will let your pipelines assume a role by just declaring

 - step:
     name: My pipeline
     oidc: true
     ...

(also exporting an AWS_ROLE_ARN somewhere)

Identities and the assumed roles can be set up to granular clearance levels per repository, deployment stage, etc

---

Setting up an OIDC identity provider can be cumbersome. You might be interested in giving https://registry.terraform.io/modules/calidae/bitbucket-oidc/aws/latest a look, even if you weren't using terraform.