With the aws-ecr-push-image pipe it would be really useful to be able to pass the Registry ID (AWS Account ID) as a parameter. This is required when the user belongs to a different AWS account than the registry it is pushing to.
Thanks
Hi @Dave McDermid , thank you for your suggestion, will consider adding this feature to the pipe.
Great, thanks.
@Dave McDermid Has this been implemented yet ? Would a registry id be needed to even push to a public registry within the same account, in my case I am getting the following error and during build the repository is being searched under private only and not public
"The repository with name 'xxxxxxxx' does not exist in the registry with id 'xxxxxxxxx'"
@Alexander Zhukovdo you have a ticket we this feature request?
Hi all,
I ran into the same issue — the official atlassian/aws-ecr-push-image pipe doesn't support pushing Docker images to an ECR registry in a different AWS account. When using OIDC authentication, there's no way to specify a target account, so the pipe always pushes to the registry of the account you're authenticated with.
I've forked the pipe and added an AWS_ACCOUNT_ID parameter that enables cross-account ECR push. The forked image is publicly available on Docker Hub:
docker://jotytgat/aws-ecr-push-image:cross-account
What was changedThe only meaningful change is that when AWS_ACCOUNT_ID is provided, the pipe calls get_authorization_token(registryIds=[AWS_ACCOUNT_ID]) instead of get_authorization_token(). This retrieves the auth token for the target account's ECR registry rather than the one you're authenticated with. When AWS_ACCOUNT_ID is not set, the pipe behaves identically to the official version.
- step: oidc: true script: - docker build -t my-app . - pipe: docker://jotytgat/aws-ecr-push-image:cross-account variables: AWS_DEFAULT_REGION: 'eu-west-1' AWS_OIDC_ROLE_ARN: 'arn:aws:iam::111111111111:role/my-oidc-role' AWS_ACCOUNT_ID: '999999999999' IMAGE_NAME: my-app TAGS: 'latest $BITBUCKET_COMMIT'
Replace 111111111111 with the account where your OIDC role lives, and 999999999999 with the target account that owns the ECR repository.
PrerequisitesYour OIDC role needs the following permissions on the target account's ECR repository:
SourceThe fork is based on the official pipe at aws-ecr-push-image (v2.6.0). I've submitted the change to Atlassian for inclusion in the official pipe, but in the meantime this Docker Hub image is available for anyone who needs cross-account support.
Hope this helps!
It looks like you're new here. Sign in or register to get started.
