Granting access to pull a DockerImageAsset

[misterjoshua]

https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ecr-assets.DockerImageAsset.html

It doesn't seem clear how to grant services (like ECS) access to pull the docker image asset. An example would be helpful, as DockerImageAsset doesn't seem to have the same grant methods as many other constructs in the CDK.

---

This is a 📕 documentation issue

[MrArnoldPalmer]

@misterjoshua an instance of DockerImageAsset has a property repository which is of type IRepository. From here you have access to the grant, grantPull, and grantPullPush methods.

Keeping this open to track adding an example to the aws-ecr-assets repository readme.

[peterjuras]

How do you grant permissions to ecs.AssetImage types? I'm using docker image assets from ecs, but they don't appear to have a repository property.

My code looks similar to this:

const image = new ecs.AssetImage(path.join(...)),
const container = taskDefinition.addContainer("container-name", {
  image: image,
  // ...
});
// How to add pull permissions to the aws-cdk/assets ecr repository without hardcoding it?

[eladb]

@misterjoshua @peterjuras can you guys please provide some more information about your use case? Why do you need to grant pull permissions to these images?

[peterjuras]

Hi,

Sorry for not updating this, it was actually working automatically after some retries of starting the ecs task.

Is there a delay on when the permissions are being applied by cdk?

[misterjoshua]

@eladb I was getting an access denied error when ECS was attempting to pull the image during deployment.

const nodeImage = new ecrAssets.DockerImageAsset(this, "Image", {
  directory: "../context"
});
const task = new ecs.TaskDefinition(this, 'Task', {
  compatibility: ecs.Compatibility.EC2,
  family: "MyTask",
});
nodeImage.repository.grantPull(task.obtainExecutionRole()); // This fixed the permissions error
const nodeContainer = task.addContainer("main", {
  image: ecs.ContainerImage.fromEcrRepository(nodeImage.repository, nodeImage.sourceHash),
//...
});

Your commit seems like it would solve my problem.

[0cv]

This doesn't seem necessary anymore to use grantPull(...) as it's been fixed in the referenced commit.

However for anyone coming here, I still got the same error and the reason was because the Image Repository was set with immutable tags. Changing that setting fixed my issue.