AWS ECR Push Image Specify Registry ID

[Dave McDermid]

With the aws-ecr-push-image pipe it would be really useful to be able to pass the Registry ID (AWS Account ID) as a parameter. This is required when the user belongs to a different AWS account than the registry it is pushing to.

Thanks

[Alexander Zhukov · Accepted solution]

Hi @Dave McDermid , thank you for your suggestion, will consider adding this feature to the pipe.

[Dave McDermid]

Great, thanks.

[siddharthjoshi]

@Dave McDermid Has this been implemented yet ? 

Would a registry id be needed to even push to a public registry within the same account, in my case I am getting the following error and during build the repository is being searched under private only and not public

"The repository with name 'xxxxxxxx' does not exist in the registry with id 'xxxxxxxxx'"

[Anton Patronov]

@Alexander Zhukovdo you have a ticket we this feature request?

[Einar Coutin]

This hasn't been implemented yet, either implement this or please add support for AWS STS Assume Role rather than go overboard with OIDC. Some of us have our runners in AWS and would like to keep them separate from the devs while still giving them visibility into the registry for things like container image scan results. 
Either an STS assume role of specifying the account ID rather than access keys or simply specifying the AWS account Id and combining that with a Resource Policy on the ECR repo itself.

[Einar Coutin]

@Dave McDermid @Anton Patronov @Alexander Zhukov 
I created a discussion for this issue here:
Feature request - aws-ecr-push-image - add simpler... (atlassian.com)

[Jo Tytgat]

Hi all,

I ran into the same issue — the official atlassian/aws-ecr-push-image pipe doesn't support pushing Docker images to an ECR registry in a different AWS account. When using OIDC authentication, there's no way to specify a target account, so the pipe always pushes to the registry of the account you're authenticated with.

I've forked the pipe and added an AWS_ACCOUNT_ID parameter that enables cross-account ECR push. The forked image is publicly available on Docker Hub:

docker://jotytgat/aws-ecr-push-image:cross-account

What was changed
The only meaningful change is that when AWS_ACCOUNT_ID is provided, the pipe calls get_authorization_token(registryIds=[AWS_ACCOUNT_ID]) instead of get_authorization_token(). This retrieves the auth token for the target account's ECR registry rather than the one you're authenticated with. When AWS_ACCOUNT_ID is not set, the pipe behaves identically to the official version.

- step:
    oidc: true
    script:
      - docker build -t my-app .
      - pipe: docker://jotytgat/aws-ecr-push-image:cross-account
        variables:
          AWS_DEFAULT_REGION: 'eu-west-1'
          AWS_OIDC_ROLE_ARN: 'arn:aws:iam::111111111111:role/my-oidc-role'
          AWS_ACCOUNT_ID: '999999999999'
          IMAGE_NAME: my-app
          TAGS: 'latest $BITBUCKET_COMMIT'

Replace 111111111111 with the account where your OIDC role lives, and 999999999999 with the target account that owns the ECR repository.

Prerequisites
Your OIDC role needs the following permissions on the target account's ECR repository:

• ecr:GetAuthorizationToken
• ecr:BatchCheckLayerAvailability
• ecr:GetDownloadUrlForLayer
• ecr:PutImage
• ecr:InitiateLayerUpload
• ecr:UploadLayerPart
• ecr:CompleteLayerUpload
  
  And the target account's ECR repository needs a repository policy that allows cross-account push from your OIDC role.

Source
The fork is based on the official pipe at aws-ecr-push-image (v2.6.0). I've submitted the change to Atlassian for inclusion in the official pipe, but in the meantime this Docker Hub image is available for anyone who needs cross-account support.

Hope this helps!