Dockerfile used in a pipeline is giving 401 which is generated from the image within the Dockerfile

stephenrichards May 4, 2023

I am using OIDC to authenticate with AWS and in other parts of my pipeline the authentication with AWS is successful

I've specified a private ECR image within a Dockerfile and within the pipeline I have set AWS_DEFAULT_REGION and AWS_OIDC_ROLE_ARN using:

variables:
AWS_DEFAULT_REGION: $AWS_DEFAULT_REGION
AWS_OIDC_ROLE_ARN: $AWS_OIDC_ROLE_ARN

I have also tried setting these using:

- export AWS_REGION=$AWS_DEFAULT_REGION
- export AWS_ROLE_ARN=$AWS_OIDC_ROLE_ARN
- export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
- echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token

The role has `AdministratorAccess` within AWS

But I keep receiving a 401 at the build stage:


#3 ERROR: unexpected status code [manifests latest]: 401 Unauthorized

failed to solve with frontend dockerfile.v0: failed to create LLB definition: unexpected status code [manifests latest]: 401 Unauthorized

Which doesn't make any sense because other parts of my pipeline are using the same method for setting the AWS variables and they have authorisation with AWS

 

Is there a step i'm missing? I am seeing examples of using aws ecr login but I don't think that applies when using OIDC?

1 answer

0 votes
Theodora Boudale
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
May 9, 2023

Hi @stephenrichards and welcome to the community!

If I understand correctly, you are using a private ECR image as a base image in the Dockerfile?

If so, you will need to use the following command in your bitbucket-pipelines.yml file for this to work (in addition to the setup you currently have). The OIDC role should also have permission to get the image from ECR.

aws ecr get-login-password --region region | docker login --username AWS --password-stdin aws_account_id.dkr.ecr.region.amazonaws.com

Kind regards,
Theodora

stephenrichards May 9, 2023

Screenshot 2023-05-09 at 17.04.16.png

Theodora Boudale
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
May 10, 2023

Hi @stephenrichards,

I think the issues are the following:

(1) You need to replace region in the command with the actual region name that you have ECR

aws ecr get-login-password --region region | docker login <..the rest of the arguments..>

If it is eu-west-1, then it should be

aws ecr get-login-password --region eu-west-1 | docker login <..the rest of the arguments..>

(2) Based on your build log, it looks like this command is the first command of the step. You need to put this command after the following commands

- export AWS_REGION=$AWS_DEFAULT_REGION
- export AWS_ROLE_ARN=$AWS_OIDC_ROLE_ARN
- export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
- echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token

An example yml file:

image: amazon/aws-cli

pipelines:
default:
- step:
oidc: true
script:
- export AWS_REGION=$AWS_DEFAULT_REGION
- export AWS_ROLE_ARN=$AWS_OIDC_ROLE_ARN
- export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
- echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token
- aws ecr get-login-password --region us-west-1 | docker login --username AWS --password-stdin aws_account_id.dkr.ecr.us-west-1.amazonaws.com
- docker build .
services:
- docker

where aws_account_id should be replaced with your account id.

Kind regards,
Theodora

Suggest an answer

Log in or Sign up to answer
DEPLOYMENT TYPE
CLOUD
TAGS
AUG Leaders

Atlassian Community Events