Passer au contenu
En utilisant AWS re:Post, vous acceptez les AWS re:Post Conditions d’utilisation
AWS re:Postre:Post
À propos de re:Post

How to pull ECR images to cross / organizational accounts?

1

Hi,

I've organizational/multi AWS accounts. The ECR images are available on one organizational account, needs to pull these ECR images to ECS of another organizational account. While attempting this getting an error "Cannotpullcontainererror: pull image manifest has been retried 1 time(s): failed to resolve ref 189426755769.dkr.ecr.eu-west-2.amazonaws.com/ecr-dev-apps:1.0.0: pulling from host 123456789.dkr.ecr.eu-west-2.amazonaws.com failed with status code [manifests 1.0.0]: 403 Forbidden

I could not find any documentation or guidelines on how to achieve the solution for this requirement. Could someone please suggest on this? Thanks.

Sujets
Conteneurs
Balises
Service de conteneur élastique AmazonAmazon Elastic Container Registry (ECR)
Langue
English

demandé il y a 4 ans13,2 k vues

4 réponses
4
Réponse acceptée

You can push or pull images to or from an Amazon ECR repository in another account. First, you must create a policy that allows the secondary account to perform API calls against the repository. Then, use a Docker authentication token generated from the secondary account to use push and pull commands against the primary account's repository.

More information: https://aws.amazon.com/premiumsupport/knowledge-center/secondary-account-access-ecr/

AWS
EXPERT

répondu il y a 4 ans

EXPERT

vérifié il y a 2 ans

  • Al Renwick
    il y a un an

    Yep, it works for me. Thank you!

1

Have you thought about cross account ECR replication? You could replicate the images to the local account, from the remote account, and then ECS could pull them.

AWS

répondu il y a 4 ans

1

These two stack overflow articles detail how to actually implement cross-account access via IAM. Two key things: make sure your repository policy allows access from the ARN of the task EXECUTION role, not the task role, and vice versa.

https://stackoverflow.com/questions/52914713/aws-ecs-fargate-pull-image-from-a-cross-account-ecr-repo

https://stackoverflow.com/questions/65590314/aws-codebuild-ecr-cannotpullcontainererror/73044115#73044115

répondu il y a 4 ans

0

Thanks all, I've managed to work out this now and this youtube tutorial is helpful too. Ref: https://www.youtube.com/watch?v=YvqImD7pe9g&ab_channel=AmazonWebServices

répondu il y a 4 ans

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Contenus pertinents