aws / aws/containers-roadmap

[ECR] [bug]: Creation templates break pull through cache if there is resourceTags set

Open
#2,398 3 comments 2 reactions 0 assignees View on GitHub
ECR Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Creation templates break pull through cache if there is any Resource Tags set

**Which service(s) is this request for?**
ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
1. Create a Pull through cache for any public container image registry
2. Create a simple Creation template with resourceTags set, like
```
{
"prefix": "ROOT",
"encryptionConfiguration": {
"encryptionType": "AES256"
},
"resourceTags": [
{
"Key": "TagKey",
"Value": "TagVal"
}
],
"imageTagMutability": "MUTABLE",
"appliedFor": [
"PULL_THROUGH_CACHE"
]
}
```
3. Try to pull image via Pull through cache. **IT WILL FAIL**. You won't be able to use Pull through cache, in my case of using nerdctl to pull I get "not found" error from ECR
4. Recreate the same Creation template **without** resourceTags set
5. Try to pull the same image via Pull through cache again. **IT WILL SUCCEED**

**Are you currently working around this issue?**
The only workaround I found so far is to not set Resource Tags for a Creation template

**Additional context**
I don't know when this got broken, but I'm 100% sure it worked fine at least on July 10 2024 in us-west-2.
As of today (July 23 2024) this is broken.

**Attachments**
N/A

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the ECR pull-through cache workflow with the creation template shown in the issue, then compare it with the same template without resourceTags. Use nerdctl to verify the reported not-found failure and successful workaround. The issue is resolved when a tagged creation template allows the cached image pull to succeed.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.