"sam build" feedback: Support private PyPi repositories

Description:
Some companies host their own internal Pypi servers. They install requirements thru something like:

pip install -i http://some-private-server.com/pypi \
    --extra-index-url https://pypi.python.org/simple/ \
    --trusted-host some-private-server.com
    -t build

sam build needs to support passing extra options to PIP in this case

@jfuss

Hi @jfuss just wanted to check whether you have any recent updates on this? My use case is slightly different as I have private github repos so I'd need to pass in a github token (or ssh key) and build within the container. This is essentially the same to the question I've found on stack overflow here

Any updates on this issue? How have people installed private packages into their lambdas?

This is a direct need to any customers that have private packages. Not sure why this wasnt included in the 1.0 release.

We have the same issue, is there any way to install private python package ?

EDIT

I could install private pip package with following procedure:
- pip install wheel
- pip config set global.extra-index-url https://${PYPI_USER}:${PYPI_PASS}@mypypi.com/simple/
- requirements.txt format is like following

$ cat requirements.txt
--extra-index-url https://${PYPI_USER}:${PYPI_PASS}@mypypi.com/simple/
privatetool==1.0.0

SAM error message is very unfriendly...

We have a workaround. Since SAM is using PIP under the covers. We just generate as part of the build system a pip.conf in the correct directory. When SAM runs, and pip is called, it loads the pip.conf. We are using artifactory virtual repositories to allow us to pull from both public pip via pip remote and local repositories within artifactory

Using a jenkins library:

def pipconf = """
            [global]
            index-url = https://${USER}:${PASS}@${HOST}/artifactory/api/pypi/${myreponame}/simple
            """

def pip_path = steps.env.HOME.trim()+"/.config/pip/pip.conf"
steps.writeFile(file: pip_path, text: pipconf)

Relates to: #2144

Something that worked for us was to have the extra-index-url in the requirements.txt itself

The requirements.txt looks like this

--extra-index-url YOUR_URL
--trusted-host YOUR_TRUSTED_HOST
your_private_package == 0.20
more-itertools==7.0.0
pynamodb==4.0.0
dynamodb-json==1.3

For requirements format and other options

@shivambats

@shivambats yes, but if you sam build -u (build in Docker), you still have to hardcode your repository credentials. For now you can't pass them as environment variables.

UPDATE:

Now you can, with the parameter -e, --container-env-var TEXT
Cf. https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-cli-command-reference-sam-build.html

This issue has been open for quite some time. Its seems this is a common enough use case and problem that it should be addressed.

This has been wrecking my day. Guess I'll be hard-coding some URLs for a bit. 😭

Also run into this problem. It's extra inconvenient if your private repository has temporary credentials, e.g. CodeArtifact.

@naxxfish

We're facing currently the same issue as @naxxfish at the company: trying to build an application, with python depenencies in CodeArtifact with sam build --use-container. Index configuration within the container is not supported, which blocks developers (using windows) to build apps.
We can't find any cleanish resolution for this issue yet.
@sanathkr do you have any plan to implement this feature in the near future?

@liszi

👍 to @liszi - I'm exploring CodeArtifact for private packages and trying to reconcile local builds using containers with this.

A way to leverage pip.conf would be preferable. Requiring the addition of --extra-index-url in every requirements.txt file less so, but I will test it.

@liszi

👍 to @liszi - I'm exploring CodeArtifact for private packages and trying to reconcile local builds using containers with this.

Be warned that it can be a pain in the butt to keep regenerating your token for local development.

@timbedard the auth tokens can go up to 12 hours so not too concerned there. More an issue of guidance to my devs on reusing tokens and not grabbing new ones every time.

This. Please. Not sure why this isn't fully supported, especially with CodeArtifact.

@sanathkr

Hi @sanathkr and team,

After thorough analysis of this issue, code review, and practical testing, I'd like to propose closing this issue as resolved. Here's why:

✅ The Core Request Has Been Fully Implemented

Original Request (November 2018):

"sam build needs to support passing extra options to PIP to enable the use of private PyPi repositories"

Solution Implemented (2020):

--container-env-var parameter for passing individual environment variables
--container-env-var-file parameter for loading multiple variables from a JSON file

Both features are fully functional and tested as of December 2024.

Current Working Solution

Method 1: Inline Environment Variables

Pass environment variables directly via command line:

sam build --use-container \
  --container-env-var PYPI_USER=myuser \
  --container-env-var PYPI_PASS=mypassword

Or reference from shell environment:

export PYPI_USER="myuser"
export PYPI_PASS="mypassword"

sam build --use-container \
  --container-env-var PYPI_USER \
  --container-env-var PYPI_PASS

Method 2: Environment Variables File

For multiple variables, use a JSON file:

Create build-env.json:

{
  "Parameters": {
    "PYPI_USER": "myuser",
    "PYPI_PASS": "mypassword",
    "PYPI_INDEX_URL": "https://pypi.example.com/simple"
  }
}

⚠️ Important: The JSON file must use the {"Parameters": {...}} structure shown above.

Use in build:

sam build --use-container --container-env-var-file build-env.json

Method 3: Combining Both Methods

You can use both inline and file-based env vars together:

sam build --use-container \
  --container-env-var-file build-env.json \
  --container-env-var ADDITIONAL_VAR=value

Practical Usage Examples

Example 1: Private PyPi with Basic Authentication

requirements.txt:

--index-url https://${PYPI_USER}:${PYPI_PASS}@pypi.example.com/simple
--extra-index-url https://pypi.python.org/simple/
--trusted-host pypi.example.com
my-private-package==1.0.0
requests==2.31.0

Build command:

sam build --use-container \
  --container-env-var PYPI_USER=myuser \
  --container-env-var PYPI_PASS=mypassword

Example 2: AWS CodeArtifact

Fetch token and build:

export CODEARTIFACT_TOKEN=$(aws codeartifact get-authorization-token \
  --domain my-domain \
  --domain-owner 123456789012 \
  --region us-east-1 \
  --query authorizationToken \
  --output text)

sam build --use-container \
  --container-env-var CODEARTIFACT_TOKEN

requirements.txt:

--index-url https://aws:${CODEARTIFACT_TOKEN}@my-domain-123456789012.d.codeartifact.us-east-1.amazonaws.com/pypi/my-repo/simple/
my-private-package==1.0.0

Example 3: Multiple Private Repositories

build-env.json:

{
  "Parameters": {
    "INTERNAL_PYPI_USER": "user1",
    "INTERNAL_PYPI_PASS": "pass1",
    "VENDOR_PYPI_TOKEN": "token2"
  }
}

requirements.txt:

--extra-index-url https://${INTERNAL_PYPI_USER}:${INTERNAL_PYPI_PASS}@internal-pypi.company.com/simple
--extra-index-url https://token:${VENDOR_PYPI_TOKEN}@vendor-pypi.example.com/simple
--extra-index-url https://pypi.python.org/simple/
internal-lib==1.0.0
vendor-package==2.0.0

This should be possible for some use cases with image functions and secret repositories after #8913. An example template would be like:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  SecretDemoFunction:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Image
      Architectures: [x86_64]
      Timeout: 10
    Metadata:
      Dockerfile: Dockerfile
      DockerContext: ./src
      DockerTag: latest
      DockerBuildExtraParams:
        - "--secret"
        - "id=demo,src=./secret.txt"

and a Dockerfile like

# syntax=docker/dockerfile:1.4
FROM public.ecr.aws/lambda/python:3.12

RUN --mount=type=secret,id=demo \
    echo "you shouldn't print secrets $(cat run/secrets/demo)"
COPY app.py ${LAMBDA_TASK_ROOT}
CMD ["app.handler"]

At runtime, we would call the docker (or finch) CLI, like docker buildx --secret id=demo,src=./secret.txt .... At this point it works the same as any other docker build secret.

Edit: Sorry for closing the issue, I did not mean to close it because this doesn't solve it for ZIP functions.

Navigation Menu

Repository navigation

"sam build" feedback: Support private PyPi repositories #794

UPDATE:

✅ The Core Request Has Been Fully Implemented

Current Working Solution

Method 1: Inline Environment Variables

Method 2: Environment Variables File

Method 3: Combining Both Methods

Practical Usage Examples

Example 1: Private PyPi with Basic Authentication

Example 2: AWS CodeArtifact

Example 3: Multiple Private Repositories

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

"sam build" feedback: Support private PyPi repositories #794

Description

Activity

jackarailo commented on Jul 1, 2020

theholy7 commented on Jul 15, 2020

carpnick commented on Oct 4, 2020

hangingman commented on Oct 9, 2020

carpnick commented on Oct 9, 2020

forzagreen commented on Dec 1, 2020

shivambatsgit commented on Dec 14, 2020

forzagreen commented on Dec 14, 2020

UPDATE:

nickswiss commented on Jan 19, 2021

qbedard commented on Jan 22, 2021

naxxfish commented on May 12, 2021

liszi commented on Jun 1, 2021

brysontyrrell commented on Dec 14, 2021

qbedard commented on Dec 16, 2021

brysontyrrell commented on Dec 16, 2021

mbtx2 commented on May 24, 2023

dcabib commented on Oct 6, 2025

✅ The Core Request Has Been Fully Implemented

Current Working Solution

Method 1: Inline Environment Variables

Method 2: Environment Variables File

Method 3: Combining Both Methods

Practical Usage Examples

Example 1: Private PyPi with Basic Authentication

Example 2: AWS CodeArtifact

Example 3: Multiple Private Repositories

reedham-aws commented on May 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions