Build image from ECR with assume-role

[Deleted user]

In the documentation it states you can use images from ECR for your pipeline.

Is it possible to get the images with AWS assume-role configured?

Documentation:

image:
  name: <aws_account_id>.dkr.ecr.<region>.amazonaws.com/openjdk:8
  aws: 
    access-key: $AWS_ACCESS_KEY
    secret-key: $AWS_SECRET_KEY

[limakzi]

Follow up; we have faced same problem.

Suggested solution; allow to assume as a role

image:
  name: <aws_account_id>.dkr.ecr.<region>.amazonaws.com/openjdk:8
  aws: 
    assume-role: $AWS_ROLE
    access-key: $AWS_ACCESS_KEY
    secret-key: $AWS_SECRET_KEY

[krashekspress]

It also doesn't work if you grant access to users via ECR policy on account B. This is because docker login is done only against account A. Aws CLI has a solution for this via `--registry-id` flag. Can we somehow get that functionality here?

[Alex Tran]

Are you asking if the credentials given could be for a IAM role instead of a IAM user ?

[Deleted user]

We've got the following setup:

Account A: IAM Users

Account B: ECR with container images and IAM Role to be assumed

So what I am looking for:

- Provide credentials for IAM User in Account A

- Provide IAM Role to assume in Account B 

- Use container image from Account B for the bitbucket pipeline

This currently can't be done, forcing me to add a user in account B to be able to access the image.

I tried it without the assume role part, but that still fails because it will search for IAM Users in Account B.