AppStagingSynthesizer: Execution role misses ECR access

[elgohr]

Describe the bug

Using AppStagingSynthesizer lambda execution roles miss access to ECR. In this way Lambdas fail after a while with "The function does not have permission to access the specified image."

Expected Behavior

Access to ECR, so that images can be pulled to Lambda.

Current Behavior

No access to ECR

Reproduction Steps

Deploy a lambda, wait.

CDK CLI Version

2.94.0 (build 987c329)

Node.js Version

v18.17.1

OS

Mac OS

Language

Typescript

[peterwoodworth]

Can you please provide reproduction code, thanks

[elgohr]

@peterwoodworth just use a DockerImageFunction within

const app = new App({
  defaultStackSynthesizer: AppStagingSynthesizer.defaultResources({
    appId: 'any',
    autoDeleteStagingAssets: false,
  }),
});

[peterwoodworth]

I'm not sure I'm seeing the behavior I should be seeing - I tried both fromEcr and fromImageAsset and wasn't able to reproduce the same error you did. Reproduction steps complete with code, a simplified docker image would really help

[elgohr]

You have to wait, until the Lambda get's inactive. Afterwards the deployment role isn't allowed to load the image.
Tracked it down to the ECR policy. Adding DeploymentUser to the policy fixes the issue.

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "DeploymentUser",
      "Effect": "Allow",
      "Principal": {
        "AWS": "cdk-hnb659fds-cfn-exec-role-...."
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:DeleteRepositoryPolicy",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetRepositoryPolicy",
        "ecr:SetRepositoryPolicy"
      ]
    },
    {
      "Sid": "LambdaECRImageRetrievalPolicy",
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:DeleteRepositoryPolicy",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetRepositoryPolicy",
        "ecr:SetRepositoryPolicy"
      ],
      "Condition": {
        "StringLike": {
          "aws:sourceArn": "arn:aws:lambda:eu-west-1:....:function:*"
        }
      }
    }
  ]
}