Unable to copy to a public ECR repository

[hailin]

Hello,

I have been trying to copy an image from private ECR repo to a public ECR repo, within the same account. I did both modify the dest/public repository's access policy to allow lambda to perform ecr-public actions, and give the lambda role permission to do the same.

However, I'm getting:

2022/10/27 03:20:12 sending status failed: copy image failed: trying to reuse blob sha256:af353cabf27cab47a389872bcfcd8f93308ee7e298d843e01e420fb991f394fa at destination: checking whether a blob sha256:af353cabf27cab47a389872bcfcd8f93308ee7e298d843e01e420fb991f394fa exists in public.ecr.aws/alias/test-ecr: unauthorized: authentication required

Below is the code:

        this.repository = new CfnPublicRepository(this, 'TestPublicECR', {
            repositoryName: 'test-ecr',
            repositoryPolicyText: {
                "Version": "2008-10-17",
                "Statement": [{
                    "Sid": "ECR Public Repository Policy",
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "lambda.amazonaws.com"
                    },
                    "Action": [
                        "ecr-public:*"
                    ],
                }]
            }
        });

        this.image = // image here
        this.ecrImageLocation = this.image.bind(this);

        const deployment = new ECRDeployment(this, 'DeployDockerImage', {
            src: new DockerImageName(this.ecrImageLocation.friendlyImageUri),
            dest: new DockerImageName('public.ecr.aws/alias/test-ecr:latest'),
        });

        deployment.addToPrincipalPolicy(new PolicyStatement({
            sid: 'PublicEcrSid',
            effect: Effect.ALLOW,
            actions: [
                "sts:GetServiceBearerToken",
                "ecr-public:*",
            ],
            resources: ['*']
        }))

Any pointers?

[hailin]

I updated it to pass a custom role to the ECRDeployment construct, and add the role to the repository's access policy, stack failed with same cause, lambda invocation somehow returned success, but no CloudWatch log group was created, no log found.

        const statement = new PolicyStatement({
            sid: 'TempSid',
            effect: Effect.ALLOW,
            actions: ["sts:GetServiceBearerToken", "ecr-public:*"],
            resources: ['*']
        });

        const deploymentRole = new Role(this, 'ECRDeploymentRole', {
            assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
            roleName: 'ECRDeploymentRole',
            inlinePolicies: {
                'PublicEcrPolicy': new PolicyDocument({
                    statements: [statement]
                })
            }
        })

        this.repository = new CfnPublicRepository(this, 'TestECR', {
            repositoryName: 'test-ecr',
            repositoryPolicyText: {
                "Version": "2008-10-17",
                "Statement": [{
                    "Sid": "ECR Public Repository Policy",
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": [deploymentRole.roleArn] // also tried including aws account, and lamba SP here.
                    },
                    "Action": [
                        "ecr-public:*",
                        "ecr:*"
                    ]
                }
                ]
            }
        })

        const deployment = new ECRDeployment(this, 'DeployDockerImage', {
            src: new DockerImageName(this.ecrImageLocation.friendlyImageUri),
            dest: new DockerImageName('public.ecr.aws/alias/test-ecr:latest'),
            role: deploymentRole
        });

[nikvin15]

Getting the same issue. Any update on this ??

Some more information from the logs

2023/12/30 17:46:59 SrcImage: docker://<accountId>.dkr.ecr.ap-southeast-1.amazonaws.com/<repo>:qa DestImage: docker://public.ecr.aws/<>>/<repo>:prod
2023/12/30 17:46:59 ECR auto login mode for docker://<accountId>.dkr.ecr.ap-southeast-1.amazonaws.com/<repo>:qa
Getting image source signatures
2023/12/30 17:47:02 sending status failed: copy image failed: trying to reuse blob sha256:<some hash> at destination: checking whether a blob sha256:<some hash> exists in public.ecr.aws/<name>/<repo>: unauthorized: authentication required
END RequestId: <RequestId>
REPORT RequestId: <RequestId>	Duration: 2779.77 ms	Billed Duration: 2780 ms	Memory Size: 512 MB	Max Memory Used: 64 MB	

Lambda has access to pull image from private ECR and push to public ECR but it seems it is not doing login before pushing to the public ECR