How to pull ECR images to cross / organizational accounts?

Question

Hi,

I've organizational/multi AWS accounts. The ECR images are available on one organizational account, needs to pull these ECR images to ECS of another organizational account. While attempting this getting an error "Cannotpullcontainererror: pull image manifest has been retried 1 time(s): failed to resolve ref 189426755769.dkr.ecr.eu-west-2.amazonaws.com/ecr-dev-apps:1.0.0: pulling from host 123456789.dkr.ecr.eu-west-2.amazonaws.com failed with status code [manifests 1.0.0]: 403 Forbidden

I could not find any documentation or guidelines on how to achieve the solution for this requirement. Could someone please suggest on this? Thanks.

Accepted Answer

You can push or pull images to or from an Amazon ECR repository in another account. First, you must create a policy that allows the secondary account to perform API calls against the repository. Then, use a Docker authentication token generated from the secondary account to use push and pull commands against the primary account's repository.

More information: https://aws.amazon.com/premiumsupport/knowledge-center/secondary-account-access-ecr/

Answer

These two stack overflow articles detail how to actually implement cross-account access via IAM. Two key things: make sure your repository policy allows access from the ARN of the task **EXECUTION** role, not the task role, and vice versa.

https://stackoverflow.com/questions/52914713/aws-ecs-fargate-pull-image-from-a-cross-account-ecr-repo

https://stackoverflow.com/questions/65590314/aws-codebuild-ecr-cannotpullcontainererror/73044115#73044115

Answer

Have you thought about cross account [ECR replication](https://aws.amazon.com/blogs/containers/cross-region-replication-in-amazon-ecr-has-landed/)? You could replicate the images to the local account, from the remote account, and then ECS could pull them.

Answer

Thanks all, I've managed to work out this now and this youtube tutorial is helpful too. Ref: https://www.youtube.com/watch?v=YvqImD7pe9g&ab_channel=AmazonWebServices

How to pull ECR images to cross / organizational accounts?

相關內容