Build image from ECR with assume-role

Question

In the documentation it states you can use images from ECR for your pipeline. Is it possible to get the images with AWS assume-role configured? Documentation: image: name: .dkr.ecr..amazonaws.com/openjdk:8 aws: access-key: $AWS_ACCESS_KEY secret-key: $AWS_SECRET_KEY

limakzi · Answer

Follow up; we have faced same problem. Suggested solution; allow to assume as a role image: name: .dkr.ecr..amazonaws.com/openjdk:8 aws:
assume-role: $AWS_ROLE access-key: $AWS_ACCESS_KEY secret-key: $AWS_SECRET_KEY

krashekspress · Answer

It also doesn't work if you grant access to users via ECR policy on account B. This is because docker login is done only against account A. Aws CLI has a solution for this via `--registry-id` flag. Can we somehow get that functionality here?

unknown · Answer

We've got the following setup:

Account A: IAM Users

Account B: ECR with container images and IAM Role to be assumed

So what I am looking for:

- Provide credentials for IAM User in Account A

- Provide IAM Role to assume in Account B

- Use container image from Account B for the bitbucket pipeline

This currently can't be done, forcing me to add a user in account B to be able to access the image.

I tried it without the assume role part, but that still fails because it will search for IAM Users in Account B.