Unable to pull container in CodeBuild project even with loose policy

Question

I have a CodeBuild project that tries to load a arm64 docker image as the build image
before i even get any logging the steps show:

> BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE: Unable to pull customer's container image. CannotPullImageManifestError: Error response from daemon: denied: User: CodeBuild is not authorized to perform: ecr:BatchGetImage on resource: arn:aws:ecr:ap-southeast-2:01223344455:reposito

In the policy for the codebuild i have set the permission very loose:

` {
	"Sid": "notverysecureiknow",
	"Effect": "Allow",
	"Action": "ecr:*",
	"Resource": "*"
},
{
	"Effect": "Allow",
	"Action": [
		"ecr:GetDownloadUrlForLayer",
		"ecr:BatchGetImage"
	],
	"Resource": "*"
},
`

but still it throws the error. It looks like the error is truncated, so I can't check if it is the same repo that i setup in the CodeBuild project, but i have to assume that is the issue.

what else can i look at ?

Riku_Kobayashi · Accepted Answer

Hello.

As mentioned in the following Stackoverflow answer, make sure you specify the project service role in the credentials for pulling container images.  
https://stackoverflow.com/questions/65590314/aws-codebuild-ecr-cannotpullcontainererror

clogwog · Answer

Also switching the radio button to the Project Service Role in the 'Image pull credentials' helps :)

Unable to pull container in CodeBuild project even with loose policy

Relevant content