for couple of days I am facing an issue with pushing image from jenkins to ECR and restart service.
My Jenkins instance is hosted on EC2 instance via ECS. (it's built as docker image too).
What I want to do is to build image, login to ECR, push image there and restart service. Login to ECR is problematic:
- when I do "unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" the "aws ecr get-login --region us-east-1" command is success but push image is stopped by "no basic auth credentials".
- when I do not invoke "unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" I can't even login to ECR.
I did a lot of googling and analysis but I can not find any answer. Any ideas what may cause the problem? Is it IAM setting or ecs-agent stuff?
Policy used to run jenkins task:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ecr:GetAuthorizationToken"
],
"Resource": "*",
"Effect": "Allow",
"Sid": "GetAuthorizationToken"
},
{
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability",
"ecr:PutImage",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload"
],
"Resource": [
"arn:aws:ecr:*:*:repository/salesiq*",
"arn:aws:ecr:*:*:repository/comhub*",
"arn:aws:ecr:*:*:repository/ssrt*",
"arn:aws:ecr:*:*:repository/reveal*",
"arn:aws:ecr:*:*:repository/se-*"
],
"Effect": "Allow",
"Sid": "EcrManagement"
},
{
"Condition": {
"ArnLike": {
"ecs:cluster": [
"arn:aws:ecs:*:*:cluster/salesiq*",
"arn:aws:ecs:*:*:cluster/comhub*",
"arn:aws:ecs:*:*:cluster/ssrt*",
"arn:aws:ecs:*:*:cluster/reveal*",
"arn:aws:ecs:*:*:cluster/se-*"
]
}
},
"Action": [
"ecs:RunTask",
"ecs:StartTask",
"ecs:StopTask",
"ecs:DescribeClusters",
"ecs:DescribeServices",
"ecs:ListClusters",
"ecs:DescribeContainerInstances",
"ecs:StopTask"
],
"Resource": "*",
"Effect": "Allow",
"Sid": "EcsManagement"
},
{
"Action": [
"ecs:List*",
"ecs:Describe*",
"ecr:Describe*",
"ecr:Get*",
"ecr:Describe*",
"ecr:List*",
"cloudwatch:Get*",
"cloudwatch:List*",
"cloudwatch:Describe*",
"ecs:UpdateService"
],
"Resource": "*",
"Effect": "Allow",
"Sid": "EcsListing"
}
]
}
ecr-ecs-lambda
from the list above – Sébastien Stormacq