Is there a straightforward way to include buildargs without modifying template.yaml?

[togakangaroo]

We are setting up aws codeartifact to host a private pypi instance. Since SAM does the build inside a docker container it needs to be authenticated. The way to get that auth token seems to be by calling get-authorization-token.

But we would need to call that outside of the docker container and pass that token in, right?

And since this is a variable for the build process itself it has to be done via BuildArgs...but the only way to set BuildArgs seems to be via modifying template.yaml. But template.yaml is in source control and so I wouldn't want to be seeding it with an ever-changing auth-token that I have to always remember to remove.

Is there another way to control BuildArgs?