Suddenly getting 403 on pushing my containers to ECS

Hello,

The 403 error typically occurs due to insufficient permissions or authentication issues following are the major chances for that error.

1.IAM Permissions: Ensure the IAM user or role has the necessary permissions to push images to the ECR repository.

2.Repository Policy: Verify the ECR repository policy allows pushing images.

3.ECR Endpoint: Double-check the ECR endpoint URL and ensure it's correct.

4.Docker Credentials: Confirm Docker credentials are correctly configured and up-to-date.

5.ECS Task Execution Role: Ensure the ECS task execution role has permissions to pull images from ECR.

6.Network: Check for any network or connectivity issues. these are the major reasons for getting 403 error, i hope these will helpful

Absolutely nothing has changed regarding these. My CI has been pushing to these repos for years. I even tried generating a new key. Still failing. No errors in AWS explaining why my key is being forbidden. This is very wierd.

Apparently ECR returns 403 Forbidden if it refuses a push for exceeding quota: the default quota as of this writing is 10k images per repo, which I ran into today. So that's something else to check (for anyone finding this question in the future).

Same. Push is fine then:

unknown: unexpected status from HEAD request to https://<ecr URL>: 403 Forbidden

If anyone finds this, make sure your IAM policy attached to the user pushing the images has these permissions.

{
    "Statement": [
        {
            "Action": [
                "ecs:UpdateService",
                "ecs:DescribeServices",
                "ecr:UploadLayerPart",
                "ecr:PutImage",
                "ecr:InitiateLayerUpload",
                "ecr:GetAuthorizationToken",
                "ecr:CompleteLayerUpload",
                "ecr:BatchCheckLayerAvailability"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

For me as well a Github actions pipeline was failing suddenly with the same error. What was weird that for example one run will fail with 403 and then 2 minutes later without any changes it would pass without an error. After examining pipeline logs for every that has failed, there were logs like "exporting manifest sha256:613ca219a..." "exporting attestation manifest sha256:4e906...." and the sha of one of this manifests was in the 403 error URL. But for those that have passed OK there weren't such logs.

What helped for me was adding the "ecr:BatchGetImage" to IAM policy