aws / aws/containers-roadmap

[ECS] Does not use Role when accessing [accountid].dkr-ecr.[region].on.aws domains to pull containers.

Open
#2,611 0 comments 1 reaction 1 assignee Claimed by @vibhav-ag View on GitHub
ECR ECS
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Problem**
When using the new ECR endpoints ( like `_accountid_.dkr-ecr._region_.on.aws` ) to pull an image to an ECS Task running on Fargate instead of the old style `_acountid_.dkr.ecr._region_.amazonaws.com` the authentication against the registry is not attemped and the deployment fails.

The Task Execution Role has the AWS managed Policy `AmazonECSTaskExecutionRolePolicy` attached to it, which grant´s image/container pull access to any ECR registry ("Resource": "*")

I suspect ECS has a fixed list of Endpoint Patterns which are expected to be ECR registries, however the newer style pattern is not yet added?.

**Expectation**
ECS should use the Roles given to it in the Task Execution role when pulling images from a ECR registry, even if a new style Endpoint URL is used.

```
CannotPullContainerError: pull image manifest has been retried 1 time(s): failed to resolve ref _accountid_.dkr-ecr._region_.on.aws/_myimage_:_mytag_: pull access denied, repository does not exist or may require authorization: authorization failed: no basic auth credentials
```

Announcement for new ipv6 endpoints: https://aws.amazon.com/about-aws/whats-new/2025/05/amazon-ecr-support-ipv6/
Documentation: https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr-requests.html

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.