aws / aws/aws-dotnet-deploy

Deployment Failures due to Missing ECR Permissions are Unclear

Open
#474 0 comments 0 reactions 0 assignees View on GitHub
feature-request p2 queued
Dominant language
C#
Stars
158
Forks
32
Avg merge
1d 23h
Merged PRs (30d)
4

Description

**Describe the bug**
If a user is missing permissions for the ECR actions that are required to push an image, a deployment may fail without any indication that it is permissions related.

**To Reproduce**
Attempt to deploy an ASP.NET project to Amazon ECS using Fargate from a profile that does not have permissions outlined in https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html

**Logs**
Missing `ecr:PutImage`:
```
...
85e4188ce0b6: Retrying in 2 seconds
f6f8b240d039: Retrying in 1 second
ef88254ae9f8: Retrying in 1 second
81d60a2eba3d: Retrying in 1 second
5f70bf18a086: Retrying in 1 second
85e4188ce0b6: Retrying in 1 second
EOF

Failed to push Docker Image
```

Added the write permissions for pushing, but missing `BatchCheckLayerAvailability`
```
...
4832fdfc801b: Waiting
bada36334461: Waiting
4e7bd47e4668: Waiting
error parsing HTTP 403 response body: unexpected end of JSON input: ""

Failed to push Docker Image
```

**Expected behavior**
It would be nice if we can check if we have appropriate permissions prior to deployment and show a helpful error if not, or at least throw a more helpful exception like we do elsewhere:
```
Unhandled exception. This is a bug. Please copy the stack trace below and file a bug at https://github.com/aws/aws-dotnet-deploy.
User: arn:aws:iam:: is not authorized to perform: cloudformation:DescribeStackEvents on resource:
```

**Environment (please complete the following information):**
- CLI Version: [eg. 1.0.0] 0.36.8
- Include the output of `dotnet --info`
```.NET SDK (reflecting any global.json):
Version: 6.0.201
```
- OS Info: Windows 10

---

This is a :bug: bug report

Contributor guide

Open the contributing guide

Research direction

Reproduce an ASP.NET deployment to Amazon ECS with Fargate using a profile missing ecr:PutImage or BatchCheckLayerAvailability. Start by tracing the Docker image push failure that ends with retry messages or an empty HTTP 403 response. Done means deployment reports the missing ECR permission clearly, either through a preflight check or a helpful exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, csharp, docker
Domain
cli, cloud, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.