Timeout on ECR AuthorizationToken when building on private EC2 instance

[joaori]

Description

Trying to run a build on an AWS instance configured with an EC2 Role on a private subnet (no Public IP nor NAT gateway) fails with a timeout connecting to ecr.REGIONID.amazonaws.com (ex: ecr.eu-west-1.amazonaws.com)

Info

• d-m-p version : 0.32
• Maven version (mvn -v) :

Apache Maven 3.6.0
Maven home: /usr/share/maven
Java version: 1.8.0_232, vendor: Private Build, runtime: /usr/lib/jvm/java-8-openjdk-amd64/jre
Default locale: en, platform encoding: UTF-8
OS name: "linux", version: "4.15.0-1056-aws", arch: "amd64", family: "unix"

• Docker version : 19.03.5, build 633a0ea838

• How to reproduce :

1. Start an EC2 instance with:
   a) Subnet with access to no NAT gateway and Auto-assign Public IP disabled
   b) IAM role set

2. SSH to the instance (from VPN or other intermediate server with Internet access and access to the instance)

3. Run mvn -X docker:build on the following pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.joaori.test</groupId>
    <artifactId>dkr-test</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <build>
        <plugins>
            <plugin>
                <groupId>io.fabric8</groupId>
                <artifactId>docker-maven-plugin</artifactId>
                <version>0.32.0</version>
                <configuration>
                    <verbose>true</verbose>
                    <images>
                        <image>
                            <name>${project.artifactId}:${project.version}</name>
                            <alias>${project.artifactId}</alias>
                            <build>
                                <from>123123123123.dkr.ecr.eu-west-1.amazonaws.com/foo:bar</from>
                            </build>
                        </image>
                    </images>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>

Command will hang for a while and then return a Connection timed out

$ mvn -X docker:build
...
[INFO] --- docker-maven-plugin:0.32.0:build (default-cli) @ dkr-test ---
...
[DEBUG] DOCKER> System environment not set for variable AWS_ACCESS_KEY_ID, no AWS credentials found
[DEBUG] DOCKER> No user and password set for ECR, checking EC2 instance role
[DEBUG] DOCKER> Found instance role wwa-svc-jenkins-slave, getting temporary security credentials
[DEBUG] DOCKER> Received temporary access key ASIARWPR...
[DEBUG] DOCKER> AuthConfig: credentials from EC2 instance role
[DEBUG] DOCKER> registry = 123123123123.dkr.ecr.eu-west-1.amazonaws.com, isValid= true
[DEBUG] DOCKER> Get ECR AuthorizationToken from ecr.eu-west-1.amazonaws.com
[ERROR] DOCKER> Connect to ecr.eu-west-1.amazonaws.com:443 [ecr.eu-west-1.amazonaws.com/52.95.118.96] failed: Connection timed out (Connection timed out) [Connect to ecr.eu-west-1.amazonaws.com:443 [ecr.eu-west-1.amazonaws.com/52.95.118.96] failed: Connection timed out (Connection timed out)]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  02:12 min
[INFO] Finished at: 2020-01-13T16:15:15Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal io.fabric8:docker-maven-plugin:0.32.0:build (default-cli) on project dkr-test: Connect to ecr.eu-west-1.amazonaws.com:443 [ecr.eu-west-1.amazonaws.com/52.95.118.96] failed: Connection timed out (Connection timed out) -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal io.fabric8:docker-maven-plugin:0.32.0:build (default-cli) on project dkr-test: Connect to ecr.eu-west-1.amazonaws.com:443 [ecr.eu-west-1.amazonaws.com/52.95.118.96] failed: Connection timed out (Connection timed out)

Solution

ECR was made accessible through VPC Endpoints about a year ago and the endpoint URL seems to have changed around that time to api.ecr.REGIONID.amazonaws.com.
EcrExtendedAuth needs to be updated accordingly.