I have a code for pushing AWS ECR image and then updating the ECS service with the newly pushed imag

[Umagayathri Vasu]

I have a code for pushing AWS ECR image and then updating the ECS service with the newly pushed image.  Some time in the code the environment variables is passed correctly and sometime not.  Not sure why this behaviour is happening.  Same code with different behavior.  Please help.  Please find my code below:

# This is a build configuration for ECS deployment.

# Check our guides at https://confluence.atlassian.com/x/14UWN for more examples.

# Only use spaces to indent your .yml configuration.

# ------

options:

docker: true

size: 2x

image: python:3.7.4-alpine3.10

definitions:

services:

docker:

memory: 3048

pipelines:

branches:

master:

- step:

name: Deploy to Dev

deployment: test

oidc: true

#python image with aws-cli installed

image: atlassian/pipelines-awscli:latest

script:

# aws authentication

- export AWS_ROLE_ARN=$AWS_ROLE_ARN_NP

- export AWS_WEB_IDENTITY_TOKEN_FILE=$(pwd)/web-identity-token

- echo $BITBUCKET_STEP_OIDC_TOKEN > $(pwd)/web-identity-token

- export ENV_CODE=$ENV_CODE_ST

# aws ecr login

- aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_REGISTRY_URL_ST

# docker commands

- export BUILD_ID=$BITBUCKET_BRANCH_$BITBUCKET_COMMIT_$BITBUCKET_BUILD_NUMBER

- echo $BUILD_ID

- docker build -t $IMAGE_NAME:$BUILD_ID --build-arg ENVIRONMENT=$ENV_CODE -f Dockerfile_np .

- docker tag $IMAGE_NAME:$BUILD_ID $AWS_REGISTRY_URL_ST:$BUILD_ID

- docker push $AWS_REGISTRY_URL_ST:$BUILD_ID

- docker tag $IMAGE_NAME:$BUILD_ID $AWS_REGISTRY_URL_ST:latest

- docker push $AWS_REGISTRY_URL_ST:latest

#docker tagging to environment code

- docker pull $AWS_REGISTRY_URL_ST:latest

- docker tag $AWS_REGISTRY_URL_ST:latest $AWS_REGISTRY_URL_ST:$ENV_CODE

- docker push $AWS_REGISTRY_URL_ST:$ENV_CODE

#ECS TaskDefinition update script

- chmod a+x ./push-to-ecs.sh

- ./push-to-ecs.sh $ECR_REPO_NAME_ST "st" "task-definition-ST1.json" $ECS_CLUSTER_NAME_ST $ECS_SERVICE_NAME_ST $ECS_TASK_NAME_ST

[Oleksandr Kyrdan · Accepted solution]

Hi @Umagayathri Vasu 

Thank you for your question!

It's a good case for atlassian/aws-ecr-push-image pipe:

- step:
    oidc: true
    script:
      # build the image
      - docker build -t my-docker-image .

      # use the pipe to push the image to AWS ECR
      - pipe: atlassian/aws-ecr-push-image:1.5.0
        variables:
          AWS_DEFAULT_REGION: $AWS_DEFAULT_REGION
          AWS_OIDC_ROLE_ARN: 'arn:aws:iam::123456789012:role/role_name'
          IMAGE_NAME: my-docker-image

and atlassian/aws-ecs-deploy pipe:

- step:
    oidc: true
    script:
      - pipe: atlassian/aws-ecs-deploy:1.6.2
        variables:
          AWS_DEFAULT_REGION: $AWS_DEFAULT_REGION
          AWS_OIDC_ROLE_ARN: 'arn:aws:iam::123456789012:role/role_name'
          CLUSTER_NAME: 'my-ecs-cluster'
          SERVICE_NAME: 'my-ecs-service'
          TASK_DEFINITION: 'task-definition.json'

Bitbucket Pipes support OIDC, more details provided in the Deploy on AWS using Bitbucket Pipelines OpenID Connect guide.

To discover more pipes, visit our Bitbucket Pipes Marketplace.

Best regards,
Oleksandr Kyrdan

[Umagayathri Vasu]

Thank you! Oleksandr Kyrdan.  Answer is really helpful.