AWS IoT Greengrass ECR Docker deployment: GET_ECR_CREDENTIAL_ERROR

Question

Hey there,
I tried to deploy a simple Docker image that I previously upoaded to a private repository on ECR on my Raspberry Pi. I uploaded the image using a different user than the one I have saved on through access keys on the RPI. However, both users have full access to all ECR services. Now the following error occurred as I tried to deploy the docker image:

GET_ECR_CREDENTIAL_ERROR: FAILED_NO_STATE_CHANGE: Failed to download artifact name: 'docker:242944196659.dkr.ecr.eu-central-1.amazonaws.com/test_repo:latest' for component com.example.MyPrivateDockerComponent-1.0.0, reason: Failed to get auth token for docker login. Failed to get credentials for ECR registry - 242944196659. User: arn:aws:sts::242944196659:assumed-role/GreengrassV2TokenExchangeRole/82ddfef99dfb0585b238481427e354b015fa33c72fd5cf52a6b5595df294438a is not authorized to perform: ecr:GetAuthorizationToken on resource: * because no identity-based policy allows the ecr:GetAuthorizationToken action (Service: Ecr, Status Code: 400, Request ID: 60278c5f-3049-4b01-b9b8-ac4b54e6cb0c)

It seems to me that somehow my RPI is not authorized to dowload the private docker image. Any suggestions how I could solve this issue?

Thanks a lot in beforehand!

Answer

In the IAM console, find the role `GreengrassV2TokenExchangeRole` and then add an inline policy with the required permissions.

Answer

okay so apparently I need to add these permissions to my thing group that the IoT Greengrass Core device belongs to. Is that correct? and how do I do this?

Answer

There are two things that need to do,

1. Add permission for the role to do ecr permissions
2. Also do the permissions in the ecr repository level access

Check and post here again if still issue

Answer

just to clarify: I know that I need to add the following permissions to the user on my RPI, but I already granted it `ecr:*` so all of these should be included.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    }
  ]
}
```

Answer

Hi. You added those to your user or the Greengrass device role?

https://docs.aws.amazon.com/greengrass/v2/developerguide/run-docker-container.html#run-docker-container-private-ecr

AWS IoT Greengrass ECR Docker deployment: GET_ECR_CREDENTIAL_ERROR

Relevant content