我正在尝试从Pipeline帐户构建docker映像并将其推送到另一个帐户(Dev)的ECR中。
虽然我能够将docker从codebuild推送到同一账户(管道)中的ECR存储库,但我很难为外部AWS账户ECR做到这一点。
Dev帐户的ECR存储库所附策略:
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "AllowCrossAccountPush",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<pipelineAccountID>:role/service-role/<codebuildRole>"
},
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:CompleteLayerUpload",
"ecr:GetDownloadUrlForLayer",
"ecr:InitiateLayerUpload",
"ecr:PutImage",
"ecr:UploadLayerPart"
]
}
]
}
在我的管道帐户上,运行构建项目的服务角色与上述策略上的ARN相匹配,并且我的buildspec包含以下用于推送映像的代码段:
- $(aws ecr get-login --no-include-email --region us-east-1 --registry-ids <DevAccount>)
- docker tag <imageName>:latest $ECR_REPO_DEV:latest
- docker push $ECR_REPO_DEV:latest
Codebuild能够成功登录ECR,但是当它尝试实际推送图像时,我得到:
*denied: User: arn:aws:sts::<pipelineAccountID>:assumed-role/<codebuildRole>/AWSCodeBuild-413cfca0-133a-4f37-b505-a94668201e26 is not authorized to perform: ecr:InitiateLayerUpload on resource: arn:aws:ecr:us-east-1:<DevAccount>:repository/<repo>*
此外,我继续进行操作,并确保角色的IAM策略(位于代码管道帐户上)具有此存储库的权限:
{
"Sid": "CrossAccountRepo",
"Effect": "Allow",
"Action": "ecr:*",
"Resource": "arn:aws:ecr:us-east-1:<DevAccount>:repository/sg-api"
}
我现在对可能会丢失的东西一无所知。唯一想到的是使用跨帐户角色来运行构建,但我什至不确定这是否可行。我的目标是使构建管道与开发人员分开。我听说这是最佳做法。
建议?
谢谢。
答案 0 :(得分:0)
基于我对此的理解以及上面的错误消息,最常见的原因是ECR存储库没有允许CodeBuild IAM角色访问它的策略。
请在ECR存储库上设置此政策:
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "AllowCrossAccountPush",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<dev acount>:root"
},
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchCheckLayerAvailability",
"ecr:PutImage",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload"
]
}
]
}
请在CodeBuild服务角色上添加此策略:
{
"Sid": "CrossAccountRepo",
"Effect": "Allow",
"Action": "ecr:*",
"Resource": "*"
}