cdk deploy error

[nauco]

cdk deploy commands didn't work well

Do you wish to deploy these changes (y/n)? y
eks-cicd-codebuild-stack: deploying...
[0%] start: Publishing 50e10880d134a01b440991fc77d217f39f01c2d56945215ee9a3b81187c6f3b1:current
[12%] success: Published 50e10880d134a01b440991fc77d217f39f01c2d56945215ee9a3b81187c6f3b1:current
[12%] start: Publishing c691172cdeefa2c91b5a2907f9d81118e47597634943344795f1a844192dd49c:current
[25%] success: Published c691172cdeefa2c91b5a2907f9d81118e47597634943344795f1a844192dd49c:current
[25%] start: Publishing bafd50ae9f214e496ff8c72c6425f93dca3ccd590e20963706d5d610d9c75757:current
[37%] success: Published bafd50ae9f214e496ff8c72c6425f93dca3ccd590e20963706d5d610d9c75757:current
[37%] start: Publishing e9882ab123687399f934da0d45effe675ecc8ce13b40cb946f3e1d6141fe8d68:current
[50%] success: Published e9882ab123687399f934da0d45effe675ecc8ce13b40cb946f3e1d6141fe8d68:current
[50%] start: Publishing 092d7f04586cb1a946bd246f2ceac752f0a6c07032105e9a8ddcb3ba9fc7b621:current
[62%] success: Published 092d7f04586cb1a946bd246f2ceac752f0a6c07032105e9a8ddcb3ba9fc7b621:current
[62%] start: Publishing b450f6cbe6de97f8b4ee0362bd1a5d5b3a12a95e1771e98096c338074128d5d4:current
[75%] success: Published b450f6cbe6de97f8b4ee0362bd1a5d5b3a12a95e1771e98096c338074128d5d4:current
[75%] start: Publishing 6205ecb59ce762e04815028cf3a9e041fbf234359aa4f82d84c5bbf7e4b9977f:current
[87%] success: Published 6205ecb59ce762e04815028cf3a9e041fbf234359aa4f82d84c5bbf7e4b9977f:current
[87%] start: Publishing 0f5a038bc8ace2b9ad20c6be44ba51297cf5ee432dcf2113ca59f9272463fecb:current
#1 [internal] load build definition from Dockerfile
#1 sha256:3181a768cc37e2e0345aa6ad2ce7501a9839470be4e74976f006dbefe1f98e76
#1 transferring dockerfile: 38B done
#1 DONE 0.0s

#2 [internal] load .dockerignore
#2 sha256:a97cae83235dfc5b5371108c9482bbce44af856eab5b34a7e3b48e22cd99da4a
#2 transferring context: 2B done
#2 DONE 0.0s

#3 [internal] load metadata for public.ecr.aws/amazonlinux/amazonlinux:latest
#3 sha256:8a9fde16d1047bcb9da9323dbf8ee346ebd0ff17f837ffa1aa232cdcdb3b3a88
#3 ...

#4 [auth] aws:: amazonlinux/amazonlinux:pull token for public.ecr.aws
#4 sha256:c6c1787e4a44dd83feeda1bd6042f2ada59af2363609eeb115930f3a276b5b87
#4 DONE 0.0s

#3 [internal] load metadata for public.ecr.aws/amazonlinux/amazonlinux:latest
#3 sha256:8a9fde16d1047bcb9da9323dbf8ee346ebd0ff17f837ffa1aa232cdcdb3b3a88
#3 ERROR: unexpected status code [manifests latest]: 403 Forbidden
------
 > [internal] load metadata for public.ecr.aws/amazonlinux/amazonlinux:latest:
------
failed to solve with frontend dockerfile.v0: failed to create LLB definition: unexpected status code [manifests latest]: 403 Forbidden
[100%] fail: docker build --tag cdkasset-0f5a038bc8ace2b9ad20c6be44ba51297cf5ee432dcf2113ca59f9272463fecb . exited with error code 1: #1 [internal] load build definition from Dockerfile
#1 sha256:3181a768cc37e2e0345aa6ad2ce7501a9839470be4e74976f006dbefe1f98e76
#1 transferring dockerfile: 38B done
#1 DONE 0.0s

#2 [internal] load .dockerignore
#2 sha256:a97cae83235dfc5b5371108c9482bbce44af856eab5b34a7e3b48e22cd99da4a
#2 transferring context: 2B done
#2 DONE 0.0s

#3 [internal] load metadata for public.ecr.aws/amazonlinux/amazonlinux:latest
#3 sha256:8a9fde16d1047bcb9da9323dbf8ee346ebd0ff17f837ffa1aa232cdcdb3b3a88
#3 ...

#4 [auth] aws:: amazonlinux/amazonlinux:pull token for public.ecr.aws
#4 sha256:c6c1787e4a44dd83feeda1bd6042f2ada59af2363609eeb115930f3a276b5b87
#4 DONE 0.0s

#3 [internal] load metadata for public.ecr.aws/amazonlinux/amazonlinux:latest
#3 sha256:8a9fde16d1047bcb9da9323dbf8ee346ebd0ff17f837ffa1aa232cdcdb3b3a88
#3 ERROR: unexpected status code [manifests latest]: 403 Forbidden
------
 > [internal] load metadata for public.ecr.aws/amazonlinux/amazonlinux:latest:
------
failed to solve with frontend dockerfile.v0: failed to create LLB definition: unexpected status code [manifests latest]: 403 Forbidden

 ❌  eks-cicd-codebuild-stack failed: Error: Failed to publish one or more assets. See the error messages above for more information.
Failed to publish one or more assets. See the error messages above for more information.

I searched "unexpected status code [manifests latest]: 403 Forbidden".
So I found that should re-authenticating private ECR registry auth token.
But in my case, it doesn't effect.
Does anybody has same issues?

[pahud]

Can you successfully run this command?

docker pull public.ecr.aws/amazonlinux/amazonlinux:latest

If you encounter the following error

Error response from daemon: pull access denied for public.ecr.aws/amazonlinux/amazonlinux, repository does not exist or may require 'docker login': denied: Your authorization token has expired. Reauthenticate and try again.

You may need docker login to authenticate against the ecr-public like

aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/amazonlinux

[nauco]

Your advice was so helpful for me.
As you expected, i needed docker login to authenticate against the ecr-public.
And last line commands are exactly what i need.
My mistake is trying to login my-private-ecr.
Thanks a lot!

[mtricolici]

WHY a public ECR repo requires LOGIN for a PULL operation?

[mtricolici]

$docker pull public.ecr.aws/amazonlinux/amazonlinux:latest
Error response from daemon: pull access denied for public.ecr.aws/amazonlinux/amazonlinux, repository does not exist or may require 'docker login': denied: Your authorization token has expired. Reauthenticate and try again.

[njlaw]

$docker pull public.ecr.aws/amazonlinux/amazonlinux:latest Error response from daemon: pull access denied for public.ecr.aws/amazonlinux/amazonlinux, repository does not exist or may require 'docker login': denied: Your authorization token has expired. Reauthenticate and try again.

You do not need to be logged in for the pull; however, if you have previously been logged in for pushing, the docker client will attempt to use your now expired authentication token because it's the same registry. The same thing happens with the official Docker Hub registry. If I've logged on previously, it will try to use my existing login even if I try to pull a public image and my IP has enough anonymous pulls left.