title: Using jq in AWS buildspec before authentication - best practice?
body: <p>My AWS CodeBuild buildspec.yml currently looks like this:</p>
  <ol>
  <li>docker pull jq</li>
  <li>PASSWORD=`aws secretsmanager get-secret-value ... | docker run jq '.password'`</li>
  <li>docker login</li>
  <li>(pull actual images and proceed with build)</li>
  </ol>
  <p>In other words, in order to login to Docker I need the account password from Secrets Manager, and in order to parse the JSON-formatted secret to isolate the password I need <code>jq</code>, and historically <code>jq</code> has come from a <code>docker pull</code></p>
  <p>But now with rate limits on unauthenticated requests, that initial pull fails.</p>
  <p>What is the more standard way of going about this? Install <code>jq</code> with <code>apt-get</code> or similar? Parse the JSON using some other tool that would already be available? Don't try to store JSON-formatted secrets? Something else?</p>
  <p>I don't want to go solve this in my own unique way if there is a standard practice out there I just haven't discovered.</p>