Can I pass the CDK credentials into a Docker Build process?

[richw-kai]

Hi there,

I'm using the CDK via TypeScript to generate a Docker image which is used to create a Lambda container. One step I'm requiring from this process is to download a model from S3 into the docker image. I used to use EKS and create the container by passing credentials to it via github actions. But I've moved to CDK and Lambda functions with custom containers. I was hoping that the build process triggered via the CDK would pass it's used credentials into the docker build process but this doesn't seem to be the case. Is there any suggestions for authenticating the Docker instance with temporary credentials without sharing access keys?

Current code:
Lambda definition:

    new lambda.DockerImageFunction(this, `myLargeModelPythonHandler`, {
      code: lambda.DockerImageCode.fromImageAsset("../src", {
        platform: Platform.LINUX_AMD64,
        cmd: [`main.run`],
      }),
      timeout: cdk.Duration.minutes(15),
      memorySize: 2048,
      functionName: `myLargeModelPython`,
      architecture: lambda.Architecture.X86_64,
    });

Dockerfile snippet

FROM amazon/aws-cli as s3-downloader

RUN aws s3 cp s3://ai-models/text-model /tmp/text-model/ --recursive

But the aws s3 command fails as it is unable to locate credentials. Does CDK have a way to either download a file from s3, or to pass credential objects forward?

[david-arteaga]

If the aws credentials you are using to run cdk do have access to the s3 file you could download the file to the src directory before running cdk.
Then move the file to wherever you need it once running commands in the docker container.