Docker base image fails to pull from ECR when using OpenID

[kbohdan]

When I use custom image hosted in AWS ECR as Dockerfile base image in pipeline it fails to pull. The pipeline is configured to use OpenID. Moreover, the same image is successfully used as pipeline image step.

The pipeline example:

image:
  name: {aws-account-id}.dkr.ecr.us-east-1.amazonaws.com/vs-openjdk:21
  aws:
    oidc-role: $AWS_OIDC_ROLE_ARN

defaults: &oidc_step_config
  oidc: true
  image:
    name: {aws-account-id}.dkr.ecr.us-east-1.amazonaws.com/vs-openjdk:21
    aws:
      oidc-role: $AWS_OIDC_ROLE_ARN

pipelines:
  branches:
    main:
      - step:
          <<: *oidc_step_config
          name: Build Executable Jar
          script:
            - ./gradlew test bootJar
          artifacts:
            - build/libs/{java-application-name}.jar
      - step:
          <<: *oidc_step_config
          name: Build & Publish Docker Image
          script:
            - docker build -t $IMAGE_NAME:$BITBUCKET_BUILD_NUMBER .
            - pipe: atlassian/aws-ecr-push-image:2.4.2
              variables:
                AWS_OIDC_ROLE_ARN: $AWS_OIDC_ROLE_ARN
                IMAGE_NAME: $IMAGE_NAME
                TAGS: $BITBUCKET_BUILD_NUMBER
          services:
            - docker
          caches:
            - docker

The shorten example of Dockerfile

```

FROM {aws-account-id}.dkr.ecr.us-east-1.amazonaws.com/vs-openjdk:21

WORKDIR /usr/server/

...

```

Why does it fail on FROM step of Dockerfile build? When I use public image it runs well.

[Theodora Boudale]

Hi @kbohdan and welcome to the community!

You will need to configure this step to assume the created role and then authenticate Docker to the Amazon ECR private registry.

An example is shared in the following documentation, section "Configure build to assume the created role":

• https://support.atlassian.com/bitbucket-cloud/docs/deploy-on-aws-using-bitbucket-pipelines-openid-connect/

I have adjusted the example from this page to your use case:

- step:
    oidc: true
    script:
      - export AWS_REGION=<REGION>
      - export AWS_ROLE_ARN=arn:aws:iam::XXXXXXXXXXXX:role/oidc-demo
      - export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
      - echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token
      - aws ecr get-login-password --region <REGION> | docker login --username AWS --password-stdin <AWS_ACCOUNT_ID>.dkr.ecr.<REGION>.amazonaws.com
      - docker build <other arguments>

Does this work for you?

Kind regards,
Theodora

[kbohdan]

That works well! Thanks, Theodora

[Theodora Boudale]

That's good to hear and you're very welcome! Please feel free to reach out if you ever need anything else!