core/assets: Edit DockerImageFunction ImageUri
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
I am trying to use a container registry located in a different account.
I have set image_assets_repository_name and image_asset_publishing_role_arn setting appropriately when instantiating my DefaultStackSynthesizer and have the appropriate permissions in place.
When performing a cdk deploy to account A (with account A credentials), the image is successfully created and pushed to ECR in Account B. However the cloudformation update fails as it cannot find the image. Upon investigation, I noticed in the synthesized template that the ImageUri value is prefixed with Account A details:
"ImageUri": { "Fn::Sub": "ACCOUNT-A.dkr.ecr.eu-west-1.${AWS::URLSuffix}/cdk-Qualifier-container-assets-ACCOUNT-B-eu-west-1:f3193b7321a34e0685a8fb9982ce250e2e6d8b45458d55b7c5c42132a7fe60ef" }
So Cloudformation is trying to find a repository and image that does not exist in account A
### Expected Behavior
It makes sense to default to the account that is passed via the `env` dict but ImageUri in the resolved template should be configurable.
### Current Behavior
ImageUri is always prefixed with the account details of the account that is passed in the `env` dict.
### Reproduction Steps
```py
synthesizer = cdk.DefaultStackSynthesizer(
qualifier="MyQualifier",
file_assets_bucket_name="cdk-MyQualifier-assets-ACCOUNT-B-eu-west-1",
image_assets_repository_name="cdk-MyQualifier-container-assets-ACCOUNT-B-eu-west-1",
image_asset_publishing_role_arn=(
"arn:aws:iam::ACCOUNT-B:role/"
"cdk-MyQualifier-image-publishing-role-ACCOUNT-B-eu-west-1"
),
)
MyStack(
app,
"my-stack",
env=cdk.Environment(account="ACCOUNT-A", region="eu-west-1"),
synthesizer=synthesizer,
)
app.synth()
```
### Possible Solution
Make the ImageUri account-prefix configurable via an option in the DefaultSynthesizer
### Additional Information/Context
Details taken from https://github.com/aws/aws-cdk/discussions/29091
I eventually came to a workaround.
I could find no way to change the account number for the ImageUri field. Looks like it takes it from the account details passed in the env dict when instantiating the stack.
The only way around this was to use the lower level CfnFunction resource instead of DockerImageFunction. I created the docker asset separately and constructed the desired imageUri field. In the future this could be included in an internal construct or synthesizer but for now it is a reasonable approach
```py
code_asset = DockerImageAsset(self, "MyBuildImage", directory="pipeline/lambda")
image_uri = (
f"ACCOUNT-B.dkr.ecr.{self.region}.",
f"{self.url_suffix}/cdk-Qualifier-container-assets-ACCOUNT-B-",
f"{self.region}:{code_asset.asset_hash}",
)
_lambda.CfnFunction(
self,
"DeployLambda",
code=_lambda.CfnFunction.CodeProperty(image_uri=image_uri),
timeout=30,
memory_size=512,
role=lambda_role.role_arn,
package_type="Image",
)
```
### CDK CLI Version
2.126.0
### Framework Version
_No response_
### Node.js Version
v20.10.0
### OS
Ubuntu 22.04.4 LTS
### Language
Python
### Language Version
3.12
### Other information
You may notice in my DefaultSynthesizer that it is not required to specify the `file_asset_publishing_role_arn`. The file asset publishing role created as part of bootstrapping ACCOUNT-A has permission to write to the S3 Bucket in ACCOUNT-B.
However, I must include the image_asset_publishing_role_arn as without it my workaround fails when performing a cdk deploy:
`pipeline: fail: No ECR repository named 'cdk-MyQualifier-container-assets-ACCOUNT-B-eu-west-1' in account ACCOUNT-A. Is this account bootstrapped?`
Contributor guide
Research direction
Start from DefaultStackSynthesizer and DockerImageFunction using the provided Python reproduction, then inspect the synthesized CloudFormation template's ImageUri. Confirm the fix makes the ECR account prefix configurable and that the resulting image reference points to Account B for deployment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100