fix(cli): image publishing role doesn't have docker pull permissions #14662
Conversation
…sions Using a common docker asset as base image for other docker assets requires the image publishing role to have the `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer` and `ecr:InitiateLayerUpload` permissions. Closes aws#14656
|
|
|
Does this need a test? If yes, where? |
jogold
changed the title
| @@ -342,6 +342,9 @@ Resources: | |||
| - ecr:BatchCheckLayerAvailability | |||
| - ecr:DescribeRepositories | |||
| - ecr:DescribeImages | |||
| - ecr:BatchGetImage | |||
| - ecr:GetDownloadUrlForLayer | |||
| - ecr:InitiateLayerUpload | |||
There was a problem hiding this comment.
ecr:InitiateLayerUpload is duplicated here.
Do you know why this wasn't detected earlier? Seems like a big miss if true...
There was a problem hiding this comment.
I really don't know... I only recently switched all my productions stack to the new style stack synthesis and came upon this.
While perfectly valid and working, I'm not sure that the pattern is commonly used...
There was a problem hiding this comment.
I guess the issue only crops up when using an ECR image as a base, huh?
rix0rrr
added
the
pr-linter/exempt-test
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
…ws#14662) Using a common docker asset as base image for other docker assets requires the image publishing role to have the `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer` and `ecr:InitiateLayerUpload` permissions. Closes aws#14656 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Using a common docker asset as base image for other docker assets requires
the image publishing role to have the
ecr:BatchGetImage,ecr:GetDownloadUrlForLayerand
ecr:InitiateLayerUploadpermissions.Closes #14656
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license