无法通过docker pull从单独的帐户访问ECR存储库

Question

我试图允许一个AWS帐户（以下称为“第二个”）在另一个AWS帐户（以下称为“第一个”）的ECR存储库中提取图像。

我正在关注这些文件：

• https://docs.aws.amazon.com/AmazonECR/latest/userguide/RepositoryPolicyExamples.html（设置权限）
• https://aws.amazon.com/premiumsupport/knowledge-center/secondary-account-access-ecr/（获取令牌）

我向ECR存储库添加了以下权限：

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountPull",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<second>:root"
      },
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]
    }
  ]
}

然后运行以下命令： eval "$(aws ecr get-login --no-include-email --region us-east-1 --profile second --registry-ids <second> <first>)"

我得到这个结果：

WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /Users/libby/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /Users/libby/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

我将存储config.json临时更改为只是为了确保可以看到身份验证已按预期添加到文件中，它是：

{
        "auths": {
                "<second>.dkr.ecr.us-east-1.amazonaws.com": {
                        "auth": "<super long token>"
                },
                "<first>.dkr.ecr.us-east-1.amazonaws.com": {
                        "auth": "<super long token>"
                }
        },
        "HttpHeaders": {
                "User-Agent": "Docker-Client/18.09.0 (darwin)"
        },
        "stackOrchestrator": "swarm"
}

最后我运行：docker pull <first>.dkr.ecr.us-east-1.amazonaws.com/<repo>:<tag>并得到以下结果：

Error response from daemon: pull access denied for <first>.dkr.ecr.us-east-1.amazonaws.com/<repo>, repository does not exist or may require 'docker login'

我已经三遍检查了所有帐号是否正确，回购肯定在那儿。如果我使用相同的get-login命令登录，则可以拉出它--profile first。

我不确定还有什么尝试，这样我就可以拉这张照片！

将PrincipalECR权限更改为"AWS": "arn:aws:iam::<second>:user/<user>"不会有任何区别。

Answer 1

我知道了-“第二个”帐户中的IAM用户附加了限制其ECR访问的策略。该政策是：

    {
        "Sid": "ECRAccess",
        "Effect": "Allow",
        "Action": "ecr:*",
        "Resource": "arn:aws:ecr:us-east-1:<second>:repository/<unrelated-repo>"
    }

因此，即使“第一个”帐户中的ECR存储库具有允许用户访问的权限，但用户自己的帐户仍将其访问权限限制在一个不相关的存储库中。

当我用第一个帐户的存储库ARN添加另一部分时：

    {
        "Sid": "FirstAccountECRAccess",
        "Effect": "Allow",
        "Action": "ecr:*",
        "Resource": "arn:aws:ecr:us-east-1:<first>:repository/<repo>"
    }

然后docker pull工作了！