aws / aws/aws-toolkit-azure-devops
Unable to use ECRPullImage task to pull an image from public AWS ECR repository
- Dominant language
- TypeScript
- Stars
- 258
- Forks
- 114
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Unable to use ECRPullImage task to pull an image from public AWS ECR repository
**To reproduce**
Steps to reproduce the behavior:
1. use this task definition:
- task: ECRPullImage@1
displayName: Pull amazon linux 2 image
inputs:
awsCredentials: 'AWS-ECR-Pull-Image-From-Public-ECR'
regionName: ${{ parameters.awsRegion }}
repository: 'amazonlinux/amazonlinux'
imageSource: 'imagetag'
2. run an azure pipeline build
3. get this log error:
Starting: Pull base image
==============================================================================
Task : Amazon ECR Pull
Description : Pull a Docker image from an Amazon Elastic Container Registry on AWS
Version : 1.13.0
Author : Amazon Web Services
Help : Please refer to [Amazon Elastic Container Registry](https://docs.aws.amazon.com/AmazonECR/latest/userguide/) documentation for working with this service.
####Task Permissions
This task requires permissions to call the following AWS service APIs (depending on selected task options, not all APIs may be used):
* ecr:DescribeRepositories
* ecr:GetDownloadUrlForLayer
* ecr:GetAuthorizationToken
* ecr:BatchGetImage
* ecr:BatchCheckLayerAvailability
==============================================================================
Configuring credentials for task
...configuring AWS credentials from service endpoint '53b42f7f-dc7b-4063-82ff-d870ef6813c1'
...endpoint defines standard access/secret key credentials
Configuring region for task
...configured to use region eu-west-1, defined in task.
Obtaining authentication token for ECR login
##[error]Error: Failed to obtain authorization token to log in to ECR, error: AccessDeniedException: User: arn:aws:iam::035978952288:user/AzurePipelinePullFromPublicECR is not authorized to perform: ecr:GetAuthorizationToken on resource: * because no identity-based policy allows the ecr:GetAuthorizationToken action
Finishing: Pull base image
**Expected behavior**
should pull the image without errors
**Your Environment**
- cloud based: Azure pipeline
- Azure DevOps version: Version Dev18.M202.1 (AzureDevOps_M202_20220407.8)
- AWS Toolkit for Azure DevOps version: could not find it
Contributor guide
Research direction
Start with the ECRPullImage@1 task and reproduce the Azure Pipeline using the shown repository and region. Investigate the authorization-token step and AWS public ECR authentication requirements; done means the public amazonlinux/amazonlinux image pulls without the ecr:GetAuthorizationToken AccessDeniedException.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, azure
- Domain
- cloud, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100