aws / aws/bedrock-agentcore-starter-toolkit
[Request] Allow cross-account ECR repositories
- Dominant language
- Python
- Stars
- 508
- Forks
- 155
- Avg merge
- 8h 50m
- Merged PRs (30d)
- 4
Description
**Description of the problem you're trying to solve**
We have a separate account for our ECR repos and access them with a Cross-Account policy on our other environments. I'm using `agentcore launch --local-build` to verify the deployment before moving to CodeBuild and right now it pushes the image to a _new_ ECR repo using the `aws.account` in the `.bedrock_agentcore.yaml` configuration.
I also had to update execution role policy to include the `ecr:GetAuthorizationToken`,
`ecr:BatchGetImage`, and `ecr:GetDownloadUrlForLayer` operations.
```yaml
# bedrock_agentcore.yaml
default_agent: main
agents:
main:
name: main
entrypoint: src/main.py
platform: linux/arm64
container_runtime: docker
aws:
execution_role: arn:aws:iam::...
execution_role_auto_create: false
account: '********1234'
region: us-east-1
ecr_repository: '********5678.dkr.ecr.us-east-1.amazonaws.com/bedrock-agentcore'
ecr_auto_create: false
# ...
```
The logs report the ECR image is pushed to both the _new_ ECR repo using the `aws.account` and the repo configured in `aws.ecr_repository` but is only pushed to the repo using the `aws.account`
**Proposed solution or feature**
It seems the `aws.ecr_repository` configuration is only used to extract the repo name and then the `deploy_to_ecr` function uses the `boto3` ECR client (using the configured AWS creds) to create the ECR repo (may be ignoring the `aws.ecr_auto_create` value too) and push to it.
**Any alternative solutions you've considered**
A `--no-build` flag would be useful to separate the image build from the AgentCore deployment.
Otherwise, it seems using the configured `aws.ecr_repository` URI for pushes should work.
Contributor guide
Research direction
Start with the `agentcore launch --local-build` flow and the `deploy_to_ecr` function, using the `.bedrock_agentcore.yaml` example to trace how `aws.account`, `aws.ecr_repository`, and `aws.ecr_auto_create` are handled. Verify the configured cross-account ECR URI is used for the push without creating or targeting an unintended repository, and check the relevant deployment tests if present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker, python
- Domain
- cli, cloud, devops
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100