fix: unable to trigger ECR image auto deployment #29285
Conversation
github-actions
bot
added
the
beginning-contributor
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
|
Exemption Request: We don't need unit test to verify if an access role have attach the correct permission. It's too straight forward. |
aws-cdk-automation
added
the
pr-linter/exemption-requested
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week. |
| 'ecr:BatchGetImage', | ||
| 'ecr:DescribeImages', | ||
| 'ecr:GetAuthorizationToken', | ||
| 'ecr:GetDownloadUrlForLayer', |
There was a problem hiding this comment.
can you comment on the other permissions added? In #29426, it looks like only ecr:DescribeImages is needed?
|
This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error. |
aws-cdk-automation
added
the
closed-for-staleness
|
The pull request linter fails with the following errors: PRs must pass status checks before we can provide a meaningful review. If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing ✅ A exemption request has been requested. Please wait for a maintainer's review. |
Issue # (if applicable)
Closes #26640
Reason for this change
ECR image auto deployment can not be triggered due to insufficient permission on access role
Description of changes
Hi CDK team, this is mingran@ from AppRunner service team. I took a look at this bug and found that when access role is not specified for ECR, CDK create a new role, but lacking necessary permission to trigger auto deployment. Hence adding it.
Description of how you validated changes
Can be tested by reproduce the bug, or simpler, create an app runner service and verify that access role is attached with correct permissions.
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license