EC2 instance policy (profile) not allowing pull image from ecr

user_2409793 0
Viewed 456

I have attached the following policy to my EC2 instance

        {
            "Sid": "ECRPull",
            "Effect": "Allow",
            "Action": [
                "ecr:Describe*",
                "ecr:Get*",
                "ecr:List*",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ],
            "Resource": [
                "arn:aws:ecr:eu-west-1:123456789:repository/my-repo"
            ]
        }

However the following docker pull from within the instance fails, why?

docker pull 123456789.dkr.ecr.eu-west-1.amazonaws.com/my-repo:sometag

no basic auth credentials
amazon-ecr docker amazon-web-services
1 Answers

docker command doesn't call AWS IAM service as it's not part of AWS. You've to use an aws command before issuing docker commands.

aws ecr get-login gives you a temporary token.

Use the token and username as AWS to do docker login

docker login –u AWS –p <token from previous command> –e none https://<aws_account_id>.dkr.ecr.us-east-1.amazonaws.com

user_38348600
Related