aws / aws/bedrock-agentcore-starter-toolkit

[Request] Allow cross-account ECR repositories

Open
#137 0 comments 0 reactions 0 assignees View on GitHub
enhancement runtime
Dominant language
Python
Stars
508
Forks
155
Avg merge
8h 50m
Merged PRs (30d)
4

Description

**Description of the problem you're trying to solve**
We have a separate account for our ECR repos and access them with a Cross-Account policy on our other environments. I'm using `agentcore launch --local-build` to verify the deployment before moving to CodeBuild and right now it pushes the image to a _new_ ECR repo using the `aws.account` in the `.bedrock_agentcore.yaml` configuration.

I also had to update execution role policy to include the `ecr:GetAuthorizationToken`,
`ecr:BatchGetImage`, and `ecr:GetDownloadUrlForLayer` operations.

```yaml
# bedrock_agentcore.yaml

default_agent: main
agents:
main:
name: main
entrypoint: src/main.py
platform: linux/arm64
container_runtime: docker
aws:
execution_role: arn:aws:iam::...
execution_role_auto_create: false
account: '********1234'
region: us-east-1
ecr_repository: '********5678.dkr.ecr.us-east-1.amazonaws.com/bedrock-agentcore'
ecr_auto_create: false
# ...
```

The logs report the ECR image is pushed to both the _new_ ECR repo using the `aws.account` and the repo configured in `aws.ecr_repository` but is only pushed to the repo using the `aws.account`

**Proposed solution or feature**
It seems the `aws.ecr_repository` configuration is only used to extract the repo name and then the `deploy_to_ecr` function uses the `boto3` ECR client (using the configured AWS creds) to create the ECR repo (may be ignoring the `aws.ecr_auto_create` value too) and push to it.

**Any alternative solutions you've considered**
A `--no-build` flag would be useful to separate the image build from the AgentCore deployment.

Otherwise, it seems using the configured `aws.ecr_repository` URI for pushes should work.

Contributor guide

Open the contributing guide

Research direction

Start with the `agentcore launch --local-build` flow and the `deploy_to_ecr` function, using the `.bedrock_agentcore.yaml` example to trace how `aws.account`, `aws.ecr_repository`, and `aws.ecr_auto_create` are handled. Verify the configured cross-account ECR URI is used for the push without creating or targeting an unintended repository, and check the relevant deployment tests if present.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker, python
Domain
cli, cloud, devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.