(cli): ImagePublishingRoleDefaultPolicy in bootstrap template should have docker pull permissions

[jogold]

Using a common docker asset as base image for other docker assets requires the image publishing role to have the ecr:BatchGetImage, ecr:GetDownloadUrlForLayer and ecr:InitiateLayerUpload permissions.

The comment here implies that it should be possible:

aws-cdk/packages/cdk-assets/lib/private/handlers/container-images.ts

Lines 34 to 35 in 0ea24e9

	// Login before build so that the Dockerfile can reference images in the ECR repo
	await this.docker.login(ecr);

This is #6466 but for the new style stack synthesis.

Use Case

Consider the following pattern to "reuse" a common docker asset as base image in other docker assets:

/**
 * A construct that creates a common docker asset that can be used
 * in multiple stacks as base image
 */
class CommonDockerAsset extends cdk.Construct {
  public readonly imageTag: string;

  constructor(scope: cdk.Construct, id: string) {
    super(scope, id);

    const asset = new assets.DockerImageAsset(this, 'Image', {
      directory: path.join(__dirname, '../common-docker'),
    });

    this.imageTag = asset.sourceHash;
  }
}

# Dockerfile for asset in StackA that should use the common docker
# asset as base image
ARG TAG
FROM 123456789012.dkr.ecr.eu-west-1.amazonaws.com/cdk-hnb659fds-container-assets-123456789012-eu-west-1:$TAG

COPY ...

/**
 * Use it in StackA and pass TAG as build arg
 */
class StackA extends TaggedStack {
  constructor(scope: cdk.Construct, id: string) {
    super(scope, id);

    const commonDockerAsset = new CommonDockerAsset(this, 'CommonDockerAsset');
    const taskDefinition = new ecs.FargateTaskDefinition(this, 'TaskDef');
    taskDefinition.addContainer('Container', {
      image: ecs.ContainerImage.fromAsset(path.join(__dirname, '../stack-docker'), {
        buildArgs: { TAG: commonDockerAsset.imageTag },
      }),
    });
  }
}

Proposed Solution

Add the ecr:BatchGetImage, ecr:GetDownloadUrlForLayer and ecr:InitiateLayerUpload in the bootstrap template.

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.