我已经设置了Codebooks来托管我的私有NuGet包和镜像公共NuGet包。我可以在我的本地环境中毫无问题地拉取这些，GitHub Actions也可以登录来拉取它们以启用CI。
我打算在Docker容器中构建我的应用程序，这样我就可以做一些更复杂的集成测试，这就是我遇到的一些问题。

Docker文件摘录

FROM cakebuild/cake:sdk-6.0 AS build-env
ARG AWS_ACCESS_KEY_ID
ARG AWS_SECRET_ACCESS_KEY
ARG AWS_CODEARTIFACT_REPOSITORY
ARG AWS_CODEARTIFACT_DOMAIN
ARG AWS_CODEARTIFACT_ACCOUNT_NUMBER
ENV AWS_ACCESS_KEY_ID ${AWS_ACCESS_KEY_ID}
ENV AWS_SECRET_ACCESS_KEY ${AWS_SECRET_ACCESS_KEY}
ENV AWS_CODEARTIFACT_REPOSITORY ${AWS_CODEARTIFACT_REPOSITORY}
ENV AWS_CODEARTIFACT_DOMAIN ${AWS_CODEARTIFACT_DOMAIN}
ENV AWS_CODEARTIFACT_ACCOUNT_NUMBER ${AWS_CODEARTIFACT_ACCOUNT_NUMBER}
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    apt-get update && \
    apt-get install -y unzip && \
    unzip awscliv2.zip && \
    ./aws/install && \
    rm -rf awscliv2.zip aws

WORKDIR /source

# Copy csproj and restore as distinct layers
COPY ./src/Application/*.csproj ./Application/
COPY ./src/Infrastructure/*.csproj ./Infrastructure/
COPY ./src/ProfileAPI/*.csproj ./ProfileAPI/

RUN aws configure set default.region eu-west-2 && \
    aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID && \
    aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY && \
    aws configure set output json
RUN aws codeartifact login --tool dotnet --repository $AWS_CODEARTIFACT_REPOSITORY --domain $AWS_CODEARTIFACT_DOMAIN --domain-owner $AWS_CODEARTIFACT_ACCOUNT_NUMBER

如果我试着用相关的论点来构建这个。

docker build -t profile-api --build-arg AWS_ACCESS_KEY_ID=xxxxxx --build-arg AWS_SECRET_ACCESS_KEY=xxxxx --build-arg AWS_CODEARTIFACT_REPOSITORY=xxxxx --build-arg AWS_CODEARTIFACT_DOMAIN=xxxx --build-arg AWS_CODEARTIFACT_ACCOUNT_NUMBER=xxxx .

然后它抱怨。

An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::xxxxxx:user/PackageRead is not authorized to perform: codeartifact:GetAuthorizationToken on resource: arn:aws:codeartifact:eu-west-2:xxxxx:domain/xxxxxbecause no resource-based policy allows the 
codeartifact:GetAuthorizationToken action

我已经给用户添加了该权限，它仍然抱怨：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "codeartifact:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "sts:GetServiceBearerToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "sts:AWSServiceName": "codeartifact.amazonaws.com"
                }
            }
        }
    ]
}

我错过了什么？