Unable to access ecr repository in my registry when deploying aws lambda function

Question

Problem Statement:

I am trying to use a built docker container image and use that as the source for an AWS lambda function. However, whenever I build the lambda function and deploy it, I am getting this error every time.

The repository with name 'xxxxxxxxx' does not exist in the registry 
with id '########'.

I did some sanity checks to make sure that my serverless.yml file was created correctly, with the correct spelling, and that this repository actually exists in ECR.

serverless.yml
provider:
  name: aws
  runtime: python3.8
  stage: ${env:BRANCH_NAME}
  region: us-west-2
  role: arn:aws:iam::#########:role/current-role
  vpc:
    securityGroupIds:
      - ${env:SG_ID}
    subnetIds:
      - ${env:SUBNET_ID}
  tracing:
    lambda: true
  environment:
    REGION_NAME: us-west-1
    PYTHONPATH: '/var/task/packages:/var/runtime'
    S5_QUEUE_URL: ${env:S5_QUEUE_URL}
    SECRET_NAME: ${env:SECRET_NAME}
  iamRoleStatements:
    - Effect: Allow
      Action:
        - 'ecr:SetRepositoryPolicy'
        - 'ecr:GetRepositoryPolicy'
      Resource: 'arn:aws:ecr:us-west-2:########:xxxxxxxxx/directory/'
functions:
  function1:
    image: '#######.dkr.ecr.us-west-2.amazonaws.com/xxxxxxxxx/directory:tag'

However, for some reason, I still am unable to access this repository, no matter what changes I have made it to my serverless.yml file. At first, I assumed, this might be a permissions issue, but I don't see any problem with my permissions declared...Can someone help?

user_5285732 · Answer

Change the runtime from python3.8 to provided, see Custom runtimes with the Serverless Framework

user_9405602 · Answer

Based on the error there is no such registry in your account and in the region in which you are looking for it.

That being said, your image URI looks a bit strange:

'#######.dkr.ecr.us-west-2.amazonaws.com/xxxxxxxxx/directory:tag'

If xxxxxxxxx is your repository (registry) name, then I'm not sure where the directory comes from. If directory is you repository name, then you need to omit the xxxxxxxx. The ARN in your policy statement has the same thing.

If, as you said you have ensured that the repository do actually exist in your account, copy it's Image URI and compare it with what you have in the serverless.yml

The usual ECR image URI construct as visible is:

.dkr.ecr..amazonaws.com/:tag

Code snippet from the serverless blog post on the topic:

functions:
  someFunction:
    image: .dkr.ecr..amazonaws.com/@

Unable to access ecr repository in my registry when deploying aws lambda function

2 Answers