aws / aws/aws-cli

Add creds to .netrc for codeartifact pip login.

Open
#8,532 5 comments 6 reactions 0 assignees View on GitHub
codeartifact login customization feature-request p3
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the feature

Add the ability to have `aws codeartifact login --tool pip ...` write credentials to `~/.netrc`. "Tool" could also be `netrc` or something.

### Use Case

When using `requirements.txt` to define dependencies, I can't find a clean way to securely build a docker image with a private package repository in a way that is resilient by default against dependency confusion, and works across developer machines and builds.

The problem with writing to `pip.conf` is it sets the index outside of `requirements.txt`, which means someone can still run `pip install -r requirements.txt` without logging in to codeartifact, and if there are name collisions with a package in pypi then they will be installed.

We could add `--index-url https://aws:${CODEARTIFACT_TOKEN}@...` at the start of `requirements.txt` but this falls apart when building in docker, since that means setting an env var which can easily be accidentally built in to the container.

### Proposed Solution

Add the ability to have `aws codeartifact login --tool pip ...` write credentials to `~/.netrc` instead of `pip.conf`.

This allows us to force `requirements.txt` to use our codeartifact repo like this:

```
--index-url https://ai-pypi-12345678.d.codeartifact.us-east-1.amazonaws.com/pypi/my-pypi/simple/
boto3==...
```

Since `pip` honours creds in `~/.netrc` it will fail to install anything unless that file exists and has correct creds.

Users and build tools can login using the cli.

Within a Dockerfile we can put:

```
RUN --mount=type=secret,id=netrc,target=/root/.netrc pip install -r requirements.txt
```

And build using:

```
docker buildx build --secret id=netrc,src=$HOME/.netrc .
```

### Other Information

Someones blog post: https://zapata.ai/building-a-python-docker-image-using-private-pypi-repository/

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CLI version used

2.15.18

### Environment details (OS name and version, etc.)

macos sonoma 14.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.