I am facing some issue regarding the beanstalk and ECR in different AWS account.
In "Dockerrun.aws.json" the image that I am trying to pull belongs to another AWS account (same organisation but different account id).
"Image": {
"Name": "XXXXXXX.dkr.ecr.eu-central-1.amazonaws.com/YYYYYYY",
"Update": "true"
},
In ECR permissions I already added the policy to allow to beanstalk pull the image (another AWS account):
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "Allow webapp aws account",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::ZZZZZZZZZZZ:root"
},
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage",
"ecr:BatchCheckLayerAvailability",
"ecr:PutImage",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload",
"ecr:DescribeRepositories",
"ecr:GetRepositoryPolicy",
"ecr:ListImages",
"ecr:DescribeImages",
"ecr:DeleteRepository",
"ecr:BatchDeleteImage",
"ecr:SetRepositoryPolicy",
"ecr:DeleteRepositoryPolicy",
"ecr:GetLifecyclePolicy",
"ecr:PutLifecyclePolicy",
"ecr:DeleteLifecyclePolicy",
"ecr:GetLifecyclePolicyPreview",
"ecr:StartLifecyclePolicyPreview"
]
}
]
}
But, I am trying to build the Beanstalk environment I still getting the following error:
because: Failed to authenticate with ECR for registry 'XXXXXX' in 'eu-central-1' (ElasticBeanstalk::ExternalInvocationError)
caused by: Failed to authenticate with ECR for registry 'XXXXX' in 'eu-central-1' (Executor::NonZeroExitStatus
I wonder how could I solve this issue. If I could use the Authentication parameter in dockerrun.aws.json should be great. But not sure if it works with ECR since the token expires after 12hs.
"Authentication": {
"Bucket": "elasticbeanstalk-eu-central-1-XXXXX",
"Key": "aws_credentials.json"
},