Amazon CodeCatalyst not pulling ECR image

Question

I'm trying to use a private image from ECR, i have configured the IAM Role with AdministratorAccess and TrustedPolicy as next:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAccessToCodeCatalyst",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "codecatalyst-runner.amazonaws.com",
                    "codecatalyst.amazonaws.com",
                    "codebuild.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": [
                        "arn:aws:codecatalyst:::space/xxxx",
                        "arn:aws:codecatalyst:::space/xxxx/project/*"
                    ]
                }
            }
        }
    ]
}
```

In the Build configuration i used:

```
Configuration:
      Container:
        Registry: ECR
        Image: xxxx.dkr.ecr.us-east-1.amazonaws.com/my_image
```
But i'm getting this error in the logs:
CLIENT_ERROR: Unable to pull customer's container image

Markus_K · Answer

You added CodeBuild as a principle. Does it perform the pull? Did you check, if CodeBuild's [access rights are set up correctly](https://docs.aws.amazon.com/codebuild/latest/userguide/sample-ecr.html)? You can also try to identify the request's [CloudTrail event](https://docs.aws.amazon.com/AmazonECR/latest/userguide/logging-using-cloudtrail.html#cloudtrail-examples-image-pull) to see if the ARN that performs the blocked request is matching your condition.

Ashish Bhatt · Answer

In order to use private ECR image, you need to update role used in configuration of workflow with below policy that add permissions to fetch ECR image.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchGetImage",
                "ecr:GetAuthorizationToken",
                "ecr:GetDownloadUrlForLayer"
            ],
            "Resource": "*"
        }
    ]
}
```
You can restrict resource to specific ECR repository in your case. You can get additional details at [https://docs.aws.amazon.com/codecatalyst/latest/userguide/build-images.html#build-images-specify]()

Amazon CodeCatalyst not pulling ECR image

Relevant content