Authenticate to AWS CodeArtifact without Stored Tokens

Authenticate to AWS CodeArtifact repositories using Vouch

Vouch authenticates to AWS CodeArtifact (opens in new tab) using hardware-backed IAM credentials. After a single vouch login, Cargo, pip, npm, pnpm, and uv can pull and publish packages without manual token management.

Prerequisites

Before developers can configure the AWS CodeArtifact integration:

• The AWS integration must be configured (OIDC provider and IAM role)
• An AWS CodeArtifact domain and repository must exist in your AWS account
• The IAM role must have codeartifact:GetAuthorizationToken, codeartifact:GetRepositoryEndpoint, codeartifact:ReadFromRepository, and sts:GetServiceBearerToken permissions

Step 1 – Configure the Vouch CLI

Run the setup command to configure Vouch for your AWS CodeArtifact repository:

vouch setup codeartifact --tool cargo --repository my-repo [--domain my-domain] [--domain-owner 123456789012] [--region us-east-1] [--domain-profile my-profile]

This configures the appropriate credential helper for your package manager and writes the necessary configuration files.

Step 2 – Use your package manager normally

If you are not logged in, run vouch login — one YubiKey tap starts an 8-hour session that every command below uses automatically.

# Build a project that depends on private crates
cargo build --registry codeartifact-my-repo

# Publish a crate to your AWS CodeArtifact registry
cargo publish --registry codeartifact-my-repo

# Install a package from your AWS CodeArtifact repository
pip install my-package --index-url https://my-domain-123456789012.d.codeartifact.us-east-1.amazonaws.com/pypi/my-repo/simple/

# Install from requirements.txt
pip install -r requirements.txt

# Install packages
npm install

# Publish a package
npm publish

vouch setup codeartifact --tool pnpm --repository my-repo

# Install packages
pnpm install

# Publish a package
pnpm publish

vouch setup codeartifact --tool uv --repository my-repo

# Install packages
uv pip install my-package

# Sync a project
uv sync

Supported package managers

Dynamic tokens (Cargo, pip, uv, pnpm) are fetched transparently on each operation and do not expire during normal use. npm uses a static token written to .npmrc, but it is automatically refreshed each time you run vouch login – no manual token rotation needed.

Profiles

Vouch supports named domain profiles for AWS CodeArtifact, allowing you to store domain, domain owner, and region settings and reuse them across commands. Domain profiles are stored in ~/.config/vouch/config.json.

Domain profiles (--domain-profile) are distinct from AWS profiles (--profile): a domain profile names a saved CodeArtifact domain bundle in Vouch’s config, while --profile selects the AWS profile in ~/.aws/config whose IAM role mints the tokens.

Default profile

When you run vouch setup codeartifact with --domain, --domain-owner, and --region, these values are saved to the default domain profile. Subsequent commands can omit these flags:

# First time: specify all values (saved to default profile)
vouch setup codeartifact --tool cargo --domain my-domain --domain-owner 123456789012 --repository my-repo --region us-east-1

# Later: only --tool and --repository are needed
vouch setup codeartifact --tool pip --repository my-pypi-repo

Named profiles

Use --domain-profile to create and manage separate configurations for different AWS CodeArtifact domains or accounts:

# Create a domain profile for the shared artifacts account
vouch setup codeartifact --tool cargo --domain shared-packages --domain-owner 111111111111 --repository cargo-store --domain-profile shared

# Create a domain profile for the team account
vouch setup codeartifact --tool cargo --domain team-packages --domain-owner 222222222222 --repository team-cargo --domain-profile team

Named domain profiles are referenced by other commands using the --domain-profile flag.

Environment variables

You can inject a CODEARTIFACT_AUTH_TOKEN environment variable into your shell or a subprocess using vouch env or vouch exec. This is useful for tools that read the token from the environment (such as Maven or custom scripts).

vouch env

Output the token as a shell export statement:

eval "$(vouch env --type codeartifact [--codeartifact-domain <DOMAIN>] [--codeartifact-domain-owner <ACCOUNT_ID>] [--codeartifact-region <REGION>] [--codeartifact-profile <PROFILE>] [--shell <SHELL>])"

This sets CODEARTIFACT_AUTH_TOKEN in your current shell.

vouch exec

Run a command with the token injected:

vouch exec --type codeartifact [--codeartifact-domain <DOMAIN>] [--codeartifact-domain-owner <ACCOUNT_ID>] [--codeartifact-region <REGION>] [--codeartifact-profile <PROFILE>] -- mvn deploy

Cross-partition support

All AWS partitions are supported – standard (aws), China (aws-cn), GovCloud (aws-us-gov), and European Sovereign Cloud (aws-eusc). Vouch derives the partition-specific CodeArtifact endpoint from the partition of your IAM role’s ARN (configured via the AWS integration); pass the partition’s region via --region during setup.

Troubleshooting

“Access denied” when fetching packages

• Verify your IAM role has the following permissions:
  • codeartifact:GetAuthorizationToken
  • codeartifact:GetRepositoryEndpoint
  • codeartifact:ReadFromRepository
  • sts:GetServiceBearerToken
• Confirm the AWS CodeArtifact domain and repository names are correct.
• Check that you have an active Vouch session: vouch login.

“Token is expired”

• Run vouch login to refresh your session. For npm, this also automatically refreshes the static token in .npmrc.
• For Cargo/pip/pnpm/uv: Dynamic tokens are fetched on demand, so an expired token means the Vouch session itself has ended.

Wrong domain or repository

• Run vouch setup codeartifact again with the correct --tool and --repository flags.
• If using profiles, check ~/.config/vouch/config.json for the stored domain and region values.
• Check your package manager’s configuration files for conflicting settings.

Package manager not using Vouch

• Ensure no environment variables (e.g., CODEARTIFACT_AUTH_TOKEN) are overriding the credential helper.
• Verify the package manager configuration points to the correct AWS CodeArtifact endpoint.

Maven

For Maven projects, use vouch credential codeartifact or vouch exec to obtain a token:

# Option 1: Set the token in your shell
export CODEARTIFACT_AUTH_TOKEN=$(vouch credential codeartifact)

# Option 2: Use vouch exec to inject the token into Maven
vouch exec --type codeartifact -- mvn deploy -s settings.xml

If you need to specify the domain explicitly:

export CODEARTIFACT_AUTH_TOKEN=$(vouch credential codeartifact --domain my-domain --domain-owner 123456789012)

In your settings.xml, reference the environment variable as the password:

<server>
  <id>codeartifact</id>
  <username>aws</username>
  <password>${env.CODEARTIFACT_AUTH_TOKEN}</password>
</server>

Cross-Account Access

If your AWS CodeArtifact domain is in a different AWS account, use named profiles to manage access:

# Set up a Vouch AWS profile for the artifacts account
vouch setup aws \
  --role arn:aws:iam::ARTIFACTS_ACCOUNT:role/CodeArtifactReader \
  --profile vouch-artifacts

# Create a CodeArtifact domain profile that uses the artifacts account
vouch setup codeartifact \
  --tool npm \
  --domain shared-packages \
  --domain-owner ARTIFACTS_ACCOUNT \
  --repository npm-store \
  --domain-profile artifacts \
  --profile vouch-artifacts

# Use the domain profile when fetching credentials
vouch credential codeartifact --domain-profile artifacts

How it works

1. Package manager requests a token – When a package manager needs to authenticate to an AWS CodeArtifact repository, the Vouch credential helper intercepts the request.
2. OIDC to STS – Vouch exchanges your active hardware-backed session for temporary AWS STS credentials via AssumeRoleWithWebIdentity.
3. STS to AWS CodeArtifact – Vouch calls codeartifact:GetAuthorizationToken with the STS credentials to obtain an AWS CodeArtifact authorization token.
4. Package manager authenticates – The token is returned to the package manager and used for the current operation. Tokens are short-lived and, except for npm’s static .npmrc entry, never written to disk.

Token Lifetime

AWS CodeArtifact authorization tokens are valid for up to 12 hours by default. For Cargo, pip, pnpm, and uv, Vouch fetches tokens dynamically on each operation, so expiry is transparent. For npm, the static token in .npmrc is automatically refreshed each time you run vouch login. If your Vouch session (8 hours) has expired, run vouch login first – this refreshes both your session and any npm tokens.