aws / aws/aws-cdk

(aws-batch): EcsFargateContainerDefinition does not respect ContainerImageConfig.repositoryCredentials to pull images from private registries

Open
#37,003 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-batch effort/medium feature-request mixins p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the feature

The `EcsFargateContainerDefinition` should respect credentials to pull images from private registries other than ECR, just like Fargate does, within the `ContainerDefinition` used by `TaskDefinition.addContainer`. At the moment the credentials passed to `ContainerImage.fromRegistry` are ignored and no `repositoryCredentials` propertie is added to the templates `containerProperies`.

### Use Case

This is helpfull, when using a private container registry, other than ECR.

### Proposed Solution

Render the `ContainerProperties.RepositoryCredentials.CredentialsParameter` as part of the template, when `ContainerImage.repositoryCredentials` is set. The template should contain container properties referencing a secret, like it is described on https://docs.aws.amazon.com/batch/latest/userguide/private-registry.html.

A workaround is to modify the unerlaying `CfnJobDefinition` add set the property, like:

```ts
(jobDefinition.node.defaultChild as CfnJobDefinition).addPropertyOverride('ContainerProperties.RepositoryCredentials.CredentialsParameter', '')
```

### Other Information

_No response_

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.231.0

### AWS CDK CLI version

2.1033.0 (build 1ec3310)

### Environment details (OS name and version, etc.)

macOS Tahoe Version 26.2 (25C56)

Contributor guide

Open the contributing guide

Research direction

Start at EcsFargateContainerDefinition and trace how ContainerProperties are rendered for the ContainerDefinition used by TaskDefinition.addContainer. Compare the handling of ContainerImage.repositoryCredentials with Fargate, then verify that the synthesized template includes ContainerProperties.RepositoryCredentials.CredentialsParameter when credentials are set.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.