Is there a straightforward way to include buildargs without modifying template.yaml?

[togakangaroo]

We are setting up aws codeartifact to host a private pypi instance. Since SAM does the build inside a docker container it needs to be authenticated. The way to get that auth token seems to be by calling get-authorization-token.

But we would need to call that outside of the docker container and pass that token in, right?

And since this is a variable for the build process itself it has to be done via BuildArgs...but the only way to set BuildArgs seems to be via modifying template.yaml. But template.yaml is in source control and so I wouldn't want to be seeding it with an ever-changing auth-token that I have to always remember to remove.

Is there another way to control BuildArgs?

[uldyssian-sh]

No — there isn’t a built-in SAM CLI flag that lets you inject Docker BuildArgs at build time without having them defined in template.yaml.

For image-based builds, SAM reads the Docker build configuration (Dockerfile, DockerContext, DockerTag, BuildArgs, etc.) from the resource Metadata in the template. sam build does not have an “override BuildArgs” option the way some other tools do.

Practical solutions that avoid committing a changing token into source control:

Option 1 (recommended): don’t use BuildArgs for auth, use a build-time secret/config mechanism

Instead of passing the CodeArtifact token as a Docker build-arg, pass it as an environment variable (or secret) into the build and have your Dockerfile read it in a way that doesn’t bake it into the image layers.

If you are using modern Docker/BuildKit, use build secrets (so the token doesn’t get persisted in layers). This can’t be driven directly by SAM today, but you can run docker build yourself (or in CI) and then point SAM at the resulting image.

Option 2: generate a temporary SAM template for CI only

Keep template.yaml clean in git.

In CI:

• copy template.yaml to a temp file
• inject BuildArgs into the temp file (including the fresh CodeArtifact token)
• run sam build --template-file temp.yaml

This keeps the dynamic token out of source control and is the most “SAM-native” workaround.

Option 3: authenticate pip via a config file fetched at build time

Instead of BuildArgs, write a pip.conf (or .pypirc/requirements index URL) into the build context at build time from CI and remove it afterwards. This still requires care to avoid baking credentials into the image layers.

Important note about CodeArtifact tokens:

CodeArtifact auth tokens are short-lived, so you generally do need to fetch them outside the container and provide them to the build step in CI. The key is to avoid committing them and avoid embedding them into final image layers.

Summary:

SAM does not provide a straightforward way to pass Docker BuildArgs at runtime without modifying template.yaml.

The clean workarounds are:

• build the image outside SAM using Docker/BuildKit secrets, or
• generate a temporary template in CI and pass it via --template-file.

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊