1 Answer
- Newest
- Most votes
- Most comments
0
Hello.
Have you tried setting a resource-based policy in ECR?
Try setting the following resource-based policy in ECR to allow access from CodeBuild.
https://docs.aws.amazon.com/codebuild/latest/userguide/sample-ecr.html#:~:text=This%20policy%20is%20displayed%20in%20Permissions.%20The%20principal%20is%20what%20you%20entered%20for%20Principal%20in%20step%203%20of%20this%20procedure%3A
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "CodeBuildAccessPrincipal",
"Effect": "Allow",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:SourceArn": "arn:aws:codebuild:us-east-1:111122223333:project/MyProject",
"aws:SourceAccount": "111122223333"
}
}
},
{
"Sid": "CodeBuildAccessCrossAccount",
"Effect": "Allow",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability"
],
"Resource": "*"
}
]
}
You can set this from the following screen in ECR.
For testing I tried the following permissive policy, the behavior was equivalent, same error during the provisioning phase:
{ "Statement": [ { "Action": [ "ecr:" ], "Principal": "", "Effect": "Allow", "Sid": "new statement" } ], "Version": "2012-10-17" }
Have you set up a CloudTrail trail? If you have set it up, you can check the CloudTrail logs to see if access to ECR has failed, which may help you find the cause. https://docs.aws.amazon.com/AmazonECR/latest/userguide/logging-using-cloudtrail.html
The cloudTrail logs showed that there was no problem pulling the image. There was a version mismatch between the windows version used in the image vs the host.