AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
ECR Repository Creation Template: fails with KMS encryption
I'm currently using ECR pull-thru cache and repo creation template, mostly working well. The only thing is repo creation template does not seem to work with KMS encryption while AES256 works well. As soon as I switch to KMS (either AWS managed or customer managed) with a custom_role_arn, docker pull will fail with not found error. I saw a Github issue related to this. Is this still open? https://github.com/aws/containers-roadmap/issues/2398
To isolate the issue: let's consider AWS managed KMS key case, even if I test using admin role with full account permission for custom_role_arn, the error stays the same. This may rule out permission issue, right?
In addition, repo creation template is created successfully, as well pull-thru cache rules. There is nothing logged in CloudTrail related to such docker pull error either.
Thank you, William
- Language
- English
asked a year ago223 views
- Newest
- Most votes
- Most comments
When using KMS encryption with Amazon ECR repository creation templates, there are some specific requirements and potential issues that could cause your docker pull to fail.
If you're using a custom role ARN with KMS encryption in your repository creation template, you need to ensure that the role has the proper permissions. Specifically, the IAM role needs to have kms:CreateGrant, kms:RetireGrant, and kms:DescribeKey permissions for the KMS key being used.
When AWS KMS encryption is enabled for an ECR repository, the principal that deletes the repository must have the kms:RetireGrant permission. This enables the retirement of the grants that were added to the KMS key when the repository was created.
For your custom role, make sure it has access to the KMS key specified in your template. If you're using a customer-managed key, verify that the key policy allows the custom role to use it.
Additionally, note that dual-layer server-side encryption with AWS KMS (DSSE-KMS) is only available in the AWS GovCloud (US) Regions, so if you're trying to use the KMS_DSSE encryption type outside these regions, that could be causing issues.
When specifying a KMS key in your repository creation template, you can use the alias, key ID, or full ARN of the AWS KMS key. The key must exist in the same Region as the repository. If no key is specified when using KMS encryption type, the default AWS managed AWS KMS key for Amazon ECR will be used.
Without seeing your specific error messages or template configuration, it's difficult to pinpoint the exact issue, but these are common areas to check when troubleshooting KMS encryption with repository creation templates.
Sources
Encryption at rest - Amazon ECR
EncryptionConfiguration - Amazon Elastic Container Registry
Templates to control repositories created during a pull through cache or replication action - Amazon ECR
Creating a repository creation template in Amazon ECR - Amazon ECR
answered a year ago
Relevant content
asked 4 years ago
- AWS OFFICIALUpdated 6 months ago
- AWS OFFICIALUpdated 3 years ago
