AWS CloudFormation CodeBuild: Can i use ECR image as Environment image

user_3083917 0
Viewed 516

I have created the following Script where i am trying to use a custom image from ECR:

  Adminrole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join
                  - "."
                  - - !Ref "AWS::StackName"
                    - !Ref "AWS::Region"
                    - "codebuild"
      Path: "/"
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [codebuild.amazonaws.com]
        Version: '2012-10-17'
      Policies:
        - PolicyName: "root"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
               - Effect: "Allow"
                 Action: "*"
                 Resource: "*"

  ProjectTerrafom:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Join
              - "_"
              - - !Ref "AWS::StackName"
                - !Ref "AWS::Region"
                - "ProjectTerrafom"
      Description: Terraform deployment
      ServiceRole: !Ref Adminrole
      Artifacts:
        Type: no_artifacts
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: 111111.cer.ecr.eu-center-1.amazonaws.com/my_terraform
      Source:
        Location: !Ref "FullPathRepoNameTerraform"
        Type: GITHUB_ENTERPRISE
      TimeoutInMinutes: 10
      Tags:
        - Key: Project
          Value: "Run Terraform From CodeBuild"

When i run the CodeBuild i get the following error:

BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE: Unable to pull customer's container image.
CannotPullContainerError: Error response from daemon: pull access denied for
111111.cer.ecr.eu-center-1.amazonaws.com/my_terraform, repository does
 not exist or may `enter code here`require 'docker login': denied: User: CodeBuild

Is this a permission issue or are we not allowed to use the ECR images for CodeBuild?

amazon-cloudformation aws-codebuild amazon-web-services
2 Answers

You can use ECR images on code build but you need verification according to that error. So I suggest you crosscheck your docker credentials, confirm login then cross-check image URL

user_101363540

i have solved the issue by adding following line:

ImagePullCredentialsType: SERVICE_ROLE

The full part looks like this:

  Environment:
    Type: LINUX_CONTAINER
    ComputeType: BUILD_GENERAL1_SMALL
    Image: 111111.cer.ecr.eu-center-1.amazonaws.com/my_terraform
    ImagePullCredentialsType: SERVICE_ROLE
user_30839170
Related