Deploy artifact from AzureDevops to AWS ECS or ECR

Hello Jess,

I am assuming that you have already looked at the following ways described in this documentation using which you can connect to AWS services from your Azure environment. I am also assuming, none of the above methods suits your objective and hence you are looking at using IAM Roles Anywhere.

Disclaimer: I haven't used Azure DevOps pipelines much, and I haven't yet executed all the steps below in my Azure account. Please treat the below steps for your PoC purposes only.

1. Setup the IAM Roles anywhere in your AWS environment based on your requirement and have the certificate and private key ready to be used.

2. Store the certificate and private key from previous step in your Azure Key Vault.

3. In your pipeline step, have the necessary cli's available like aws and aws_signing_helper.

4. In your pipeline step, download the certificate and private key from Azure Key Vault, you might have to write one line code to separate the certificate and private key as per this link.

5. Execute aws_signing_helper cli to get the temporary credentials.

6. Parse the output from the last command using which you can access AWS services as per your role definition.

7. Cleanup the certificate and private key.

Please let me know how this works for you. Please also consider any additional security measure so that you are handling the keys in the most secure manner.

Hello there, thank you for reaching out.

I understand guidance is required to deploy artifacts from Azure DevOps to ECR or all the way to ECS fargate. You had previously explored the use of IAM roles anywhere as a method to have temporary credentials when accessing AWS services from your tasks in Azure.

I just want to specify that I do not have much expertise on Azure DevOps as all of the services I work on are AWS services. I did however take the time to dive deeper into this to see if I can be able to share documents that can help in this endeavor.

What is necessary to be able to connect with some AWS service from Aure DevOps is the AWS Toolkit for Azure DevOps, it is an addon that can be added for use in Azure DevOps : https://marketplace.visualstudio.com/items?itemName=AmazonWebServices.aws-vsts-tools

The following are some resources that can help with what you are trying to achieve:

1.This AWS workshop gives steps guided by short videos on how to achieve this. I hope this is helpful.

https://catalog.us-east-1.prod.workshops.aws/workshops/8a64fbe8-3bbe-4ed9-9868-290c9bb560fe/en-US/700integrate-aws-fargate-with-azure-devops

Here you can see how to create a CI/CD pipeline to deploy containers to a container cluster.You can see how to integrate AWS Fargate with Azure DevOps here.

2.This is a slightly more concise article that can be considered but covers only up to pushing to ECR.

https://cj-hewett.medium.com/azure-devops-pipelines-build-and-push-a-docker-image-to-aws-ecr-bc0d35f8f126

Both solutions involve the use of a AWS service connection in you AzureDevOps environmment. this mostly relies on having an IAM user with the necessary permissions, in this case for ECR or ECS. The use of role can be explored as an alternative to using an IAM role, whether as a classic IAM role, or IAM role anywhere.

I hope this this information, especially the workshop is helpful and can provide the much needed guidance on how this can be done.

Thanks :)