awsdocs / amazon-ecr-user-guide

The open source version of the Amazon ECR user guide. You can submit feedback & requests for changes by submitting issues in this repo or by making proposed changes & submitting a pull request.

NOTICE

This repository is archived, read-only, and no longer updated. For more information, read the announcement on the AWS News Blog.

You can find up-to-date AWS technical documentation on the AWS Documentation website, where you can also submit feedback and suggestions for improvement.

amazon-ecr-user-guide's Issues

Example in documentation has a error

https://github.com/awsdocs/amazon-ecr-user-guide/blob/main/doc_source/registry-permissions-examples.md
The example is missing the correct filter

Not able delete ECR repository by any IAM user

Please provide information how to delete a repository with DENY to all IAM users

I was playing with ECR repository and created a test repository and by mistake applied DENY all access to all IAM users. Now I am not able to delete this repository. Is there a way to delete this repository ?

$ aws ecr delete-repository --repository-name test

An error occurred (AccessDeniedException) when calling the DeleteRepository operation: User: arn:aws:iam::421414164445:user/user1 is not authorized to perform: ecr:DeleteRepository on resource: arn:aws:ecr:us-east-2:421414164445:repository/test with an explicit deny

Thanks
Sas

Documentation for Rate limiting on ECR

Recently we are facing rate-limiting issues on ECR, error is toomanyrequests: Rate exceeded,
We have a docker image with ~40 layer when we do a docker push some time total api transactions will be 40-15 but some time it will be 100-150 transactions.
Why this scenario occurs as image layer nothing is changed but api transactions like InitiateLayerUpload differs in huge amount.

There is no proper error where it's says on which api call it is failing.

Help Wanted - Lifecycle Policy Examples

Please share your example lifecycle policies! If you have a useful or interesting lifecycle policy example that you feel other users could benefit from, let us know.

Submit a pull request (instructions here) or send me a note via the Comments below. If your suggestion is likely to help others, I'll add it to the list of example lifecycle policies here in the Amazon ECR User Guide.

Thank you for your time. I look forward to hearing from you!

Chart versions as tags

from reading https://helm.sh/docs/topics/registries/ I got the idea the pattern to use would be something like:

helm chart save . mychart
helm chart save . aws_account_id.dkr.ecr.us-west-2.amazonaws.com/artifact-test/mychart
helm chart push aws_account_id.dkr.ecr.region.amazonaws.com/artifact-test/mychart:v0.1.0

but that fails and

helm chart save . mychart:v0.1.0
helm chart save . aws_account_id.dkr.ecr.us-west-2.amazonaws.com/artifact-test/mychart:v0.1.0
helm chart push aws_account_id.dkr.ecr.region.amazonaws.com/artifact-test/mychart:v0.1.0

also fails so how are we supposed to specify the version? Are we supposed to create a repository per chart and use:

helm chart save . mychart
helm chart save . aws_account_id.dkr.ecr.us-west-2.amazonaws.com/mychart
helm chart push aws_account_id.dkr.ecr.region.amazonaws.com/mychart:v0.1.0

I think this should be clarified in the documentation.

Not the same content on website vs github

hi,
There is an issue in the examples published on step 6 and 7 (docs).
I tried to fix it on this repo but there is no mention of the region parameter in the source doc.

# add missing \ after force
aws ecr delete-repository \
      --repository-name hello-world \
      --force \
      --region region

KR,
Paulin

Document S3 buckets used by ECR

It turns out that running docker against ECR in a VPC with an S3 endpoint with a nontrivial locked down policy on it is a recipe in frustration.

It eventually turned out that we needed to allow our endpoint to access prod-us-east-1-starport-layer-bucket for ECR to work properly, but this was not obvious at all from any of the official documentation.

I get that on some level it's an implementation detail of ECR, but on the other hand, given that other AWS constructs like VPCE policies require us to know about that implementation detail, it'd be nice to have that documented somewhere.

OCI Artifact page improvements

Couldn't find the markdown of the OCI Artifact pages, so opening an issue here:

• Step 5.b should be:

helm create mychart
rm -rf ./mychart/templates/*

(It either needs a leading . before the /mychart, or turn /mychart into mychart/templates/*)

• Step 2 or 3 - Create some environment variables to be used later in the registry creation and pushing:

export REGION=$(aws configure get region)
export ACCOUNT_ID=$(aws sts get-caller-identity --output text --query Account)

• After exporting the variables above, step 4 (and all that references either REGION and/or ACCOUNT) can be replaced as the following:

aws ecr get-login-password \
     --region ${REGION} | helm registry login \
     --username AWS \
     --password-stdin ${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com

and

helm chart save . ${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/artifact-test:mychart

(there are other parts in the text that can be replaced)

ECR retagging - 'jq' adds a newline to the manifest and changes the checksum

The documentation on the page https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-retag.html has aws ecr batch-get-image command which results in jq inserting a newline to the manifest, which causes the image digest to change when used with aws ecr put-image

See example below -

• Grab the current sha256 image digest

$ aws ecr batch-get-image --repository-name repo-name --image-ids imageTag=latest --output json \
  | jq --raw-output '.images[0].imageId.imageDigest' | cut -d":" -f2

0ff2cf907ba6959b54f77be3770c7cdaa6f5c3c9bbe23cdd7b164d35dab234f0

• Pull the manifest per https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-retag.html

$ aws ecr batch-get-image --repository-name repo-name --image-ids imageTag=latest --output json \
  | jq --raw-output '.images[0].imageManifest' | sha256sum

9aef83b28a0d4822e0f90d6e0b313200c4582a2363003c1397d47a357cc1f91a -

• The checksum is wrong here. If we put this manifest back with aws ecr put-image, we get a new image digest

• We need to strip the newline by adding --join-output, now it matches the stored digest

$ aws ecr batch-get-image --repository-name repo-name --image-ids imageTag=latest  --output json \
  | jq --raw-output --join-output '.images[0].imageManifest' | sha256sum

0ff2cf907ba6959b54f77be3770c7cdaa6f5c3c9bbe23cdd7b164d35dab234f0 -

Help Wanted – Troubleshooting, Tips, and Tricks

Please share your experience! If you've hit a problem and solved it, I’d love to hear from you. I am also interested in any tips or tricks you’ve learned along the way.

Submit a pull request (instructions here) or send me a note via the Comments below. If your suggestion is likely to help others, I'll add it to the Amazon ECR User Guide.

Thank you for your time. I look forward to hearing from you!

Amazon ECS tasks for Windows (platform 1.0.0) require both ecr.dkr and ecr.api VPC endpoints

https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html#ecr-vpc-endpoint-considerations

The above documentation states the following:

• Amazon ECS tasks hosted on Fargate using platform version 1.3.0 or earlier only require the com.amazonaws.region.ecr.dkr Amazon ECR VPC endpoint and the Amazon S3 gateway endpoint to take advantage of this feature.

Although, I believe this applies for Linux tasks only. Users can get confused with a Windows task hosted on Fargate (platform 1.0.0) since it's less than 1.3.0.

Can we improve the doc and states clearly this is for Linux only? Thank you!

Documenting repository S3 buckets

It would very handy to have documentation here (maybe Repositories.md) describing that:

• Image manifests come from the *dkr.ecr.ap-southeast-2.amazonaws.com endpoint
• Image layers are coming from the prod--starport-layer-bucket.s3.us-east-1.amazonaws.com S3 buckets

Two branches `master` and `main`?

Looking to migrate to main entirely?