Repository navigation
CodeArtifact login support for FrameworkProcessor Jobs #4144
Description
Describe the feature you'd like
We use private Python packages hosted in CodeArtifact for some of our common preprocessing and training code. However, currently there is no way to have a processing job authenticate to CodeArtifact before it installs Python requirements from a requirements.txt file.
Currently, we get an authorization token from CodeArtifact, write it to a file, and include that file with our processing/training code that gets pushed to S3 and pulled down in the jobs. This is really just a cleaner way to implement the same thing.
How would this feature be used? Please describe.
The simplest way to implement this would be to borrow code from the sagemaker-training-toolkit package to parse a CodeArtifact repo URL from a CodeArtifact repo ARN, and then simply write this token as an index into the runproc.sh file that gets generated in the _generate_framework_script() method of the FrameworkProcessor class.
Adding an optional codeartifact_repo_arn parameter to the .run() method would allow it to be passed to the _generate_framework_script() method.
Activity
jam-jee commentedon Sep 14, 2026
This is resolved in SageMaker Python SDK V3 (3.21.0). Both training (
sagemaker.train.ModelTrainer) and processing jobs now mount a CodeArtifact-awareinstall_requirementshelper that authenticates to CodeArtifact before installing yourrequirements.txt. Set theCA_REPOSITORY_ARNenvironment variable on the job to your CodeArtifact repository ARN and pip is configured against that repository automatically, so you no longer need to fetch and ship an auth token yourself.Upgrade with
pip install --upgrade sagemaker(3.21.0 or later). If you still hit this on V3, please reopen with a traceback and we will take another look.