Dockerfile used in a pipeline is giving 401 which is generated from the image within the Dockerfile

[stephenrichards]

I am using OIDC to authenticate with AWS and in other parts of my pipeline the authentication with AWS is successful

I've specified a private ECR image within a Dockerfile and within the pipeline I have set AWS_DEFAULT_REGION and AWS_OIDC_ROLE_ARN using:

variables:
AWS_DEFAULT_REGION: $AWS_DEFAULT_REGION
AWS_OIDC_ROLE_ARN: $AWS_OIDC_ROLE_ARN

I have also tried setting these using:

- export AWS_REGION=$AWS_DEFAULT_REGION
- export AWS_ROLE_ARN=$AWS_OIDC_ROLE_ARN
- export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
- echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token

The role has `AdministratorAccess` within AWS

But I keep receiving a 401 at the build stage:

#3 ERROR: unexpected status code [manifests latest]: 401 Unauthorized

failed to solve with frontend dockerfile.v0: failed to create LLB definition: unexpected status code [manifests latest]: 401 Unauthorized

Which doesn't make any sense because other parts of my pipeline are using the same method for setting the AWS variables and they have authorisation with AWS

Is there a step i'm missing? I am seeing examples of using aws ecr login but I don't think that applies when using OIDC?

[Theodora Boudale]

Hi @stephenrichards and welcome to the community!

If I understand correctly, you are using a private ECR image as a base image in the Dockerfile?

If so, you will need to use the following command in your bitbucket-pipelines.yml file for this to work (in addition to the setup you currently have). The OIDC role should also have permission to get the image from ECR.

aws ecr get-login-password --region region | docker login --username AWS --password-stdin aws_account_id.dkr.ecr.region.amazonaws.com

Kind regards,
Theodora

[stephenrichards]

[Theodora Boudale]

Hi @stephenrichards,

I think the issues are the following:

(1) You need to replace region in the command with the actual region name that you have ECR

aws ecr get-login-password --region region | docker login <..the rest of the arguments..>

If it is eu-west-1, then it should be

aws ecr get-login-password --region eu-west-1 | docker login <..the rest of the arguments..>

(2) Based on your build log, it looks like this command is the first command of the step. You need to put this command after the following commands

- export AWS_REGION=$AWS_DEFAULT_REGION
- export AWS_ROLE_ARN=$AWS_OIDC_ROLE_ARN
- export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
- echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token

An example yml file:

image: amazon/aws-cli

pipelines:
  default:
    - step:
        oidc: true
        script:
          - export AWS_REGION=$AWS_DEFAULT_REGION
          - export AWS_ROLE_ARN=$AWS_OIDC_ROLE_ARN
          - export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token
          - echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token
          - aws ecr get-login-password --region us-west-1 | docker login --username AWS --password-stdin aws_account_id.dkr.ecr.us-west-1.amazonaws.com
          - docker build .
        services:
          - docker

where aws_account_id should be replaced with your account id.

Kind regards,
Theodora