Amazon CodeCatalyst not pulling ECR image

Question

I'm trying to use a private image from ECR, i have configured the IAM Role with AdministratorAccess and TrustedPolicy as next:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAccessToCodeCatalyst",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "codecatalyst-runner.amazonaws.com",
                    "codecatalyst.amazonaws.com",
                    "codebuild.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": [
                        "arn:aws:codecatalyst:::space/xxxx",
                        "arn:aws:codecatalyst:::space/xxxx/project/*"
                    ]
                }
            }
        }
    ]
}
```

In the Build configuration i used:

```
Configuration:
      Container:
        Registry: ECR
        Image: xxxx.dkr.ecr.us-east-1.amazonaws.com/my_image
```
But i'm getting this error in the logs:
CLIENT_ERROR: Unable to pull customer's container image

Answer

You added CodeBuild as a principle. Does it perform the pull? Did you check, if CodeBuild's [access rights are set up correctly](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-ecr.html)? You can also try to identify the request's [CloudTrail event](https://docs.aws.amazon.com/AmazonECR/latest/userguide/logging-using-cloudtrail.html#cloudtrail-examples-image-pull) to see if the ARN that performs the blocked request is matching your condition.

Answer

In order to use private ECR image, you need to update role used in configuration of workflow with below policy that add permissions to fetch ECR image.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchGetImage",
                "ecr:GetAuthorizationToken",
                "ecr:GetDownloadUrlForLayer"
            ],
            "Resource": "*"
        }
    ]
}
```
You can restrict resource to specific ECR repository in your case. You can get additional details at [https://docs.aws.amazon.com/codecatalyst/latest/userguide/build-images.html#build-images-specify]()

Amazon CodeCatalyst not pulling ECR image

Relevant content