Bitbucket pipelines: Docker login to private ECR succeeds, but pull fails

user_4134453 0
Viewed 870

I am new to bitbucket pipelines and I am running into issues while trying to use the docker service against a private AWS Container Registry (ECR). I am able to login but the subsequent pull is failing due to pull access denied for 02XXXXX32.dkr.ecr.eu-central-1.amazonaws.com/my_image:latest, repository does not exist or may require 'docker login'

Below is my yml file

image: python:3.7.2
options:
  docker: true

pipelines:
  custom:
      docker-build:
      - step:
          name: Build Docker Image
          caches:
            - pip
          script:
            - apt-get update
            - pip install awscli
            - aws configure set default.region $AWS_DEFAULT_REGION
            - aws configure set aws_access_key_id $AWS_KEY
            - aws configure set aws_secret_access_key $AWS_SECRET
            - eval $(aws ecr get-login --region $AWS_DEFAULT_REGION --no-include-email --debug  --registry-id 02XXXXX32)
            - cat /root/.docker/config.json
            - docker 02XXXXX32.dkr.ecr.eu-central-1.amazonaws.com/my_image:latest

The debug message shows:

2020-08-28 19:08:43,113 - MainThread - botocore.hooks - DEBUG - Event needs-retry.ecr.GetAuthorizationToken: calling handler <botocore.retryhandler.RetryHandler object at 0x7f3b644d96a0>
2020-08-28 19:08:43,113 - MainThread - botocore.retryhandler - DEBUG - No retry needed.
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded

The cat /root/.docker/config.json shows:

{
    "auths": {
        "02XXXXX32.dkr.ecr.eu-central-1.amazonaws.com": {
            "auth": "QLONGTOKENXXX...XXXXNJblpsY25OcGIyNGlPaUl5SWl3aWRIbHdaU0k2SWtSQlZFRmZTMFZaSWl3aVpYaHdhWEpoZEdsdmJpSTZNVFU1T0RZNE5Ea3lNMzA9"
        }
    },
    "HttpHeaders": {
        "User-Agent": "Docker-Client/18.09.1 (linux)"
    }
}

Appreciate any nudge in the right direction.

bitbucket-pipelines amazon-ecr docker
1 Answers

Avoid using AWS KEYS and SECRETS. I use an alternative method to build and push Docker images to AWS ECR that requires no repository variables to be set:

image: amazon/aws-cli
options:
  docker: true
oidc: true
aws:
  oidc-role: arn:aws:iam::123456789012:role/BitBucket-ECR-Access

pipelines:
  default:
    - step:
        name: Build and push to ECR
        script:
          - aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com
          - docker build -t 123456789012.dkr.ecr.us-east-1.amazonaws.com/myimage:0.0.1 .
          - docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/myimage:0.0.1

You will need to update the role ARN to match a Role you have created in your AWS IAM console with sufficient permissions.

user_2760930
Related