在 AWS ECS 中使用来自私有外部注册表的 docker 映像

Question

I am trying to run an image in AWS ECS hosted in my company's private registry. According to AWS, this is entirely possible as long as I use the guide from https://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html and follow the section Enabling private registry authentication . I have created a secret in AWS Secrets Manager called testSecret in plaintext format with the json structure provided in the link above, like:

{
  "username": "myuser",
  "password": "mypass"
}

I reference it in my ECS job definition in the Secrets section with the name myRegistryCreds and then enter the ARN value of the secret above in the Value From section.

Whenever I try to run the job though, I get the error below:

CannotPullContainerError: Error response from daemon: Head "https://myprivateregistry.com/myrepo/helloworld/manifests/latest": no basic auth credentials

The policy attached to my execution role mimics what is in the AWS guide as well:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "secretsmanager:GetSecretValue"
            ],
            "Resource": [
                "arn:aws:secretsmanager:<awsRegion>:<myAWSaccount>:secret:testSecret-CtEe8E",
                "arn:aws:kms:*:<myAWSaccount>:key/*"
            ]
        }
    ]
}

My task definition:

{
    "taskDefinition": {
        "taskDefinitionArn": "arn:aws:ecs:aws-region:awsAccount:task-definition/my-task-definition:7",
        "containerDefinitions": [
            {
                "name": "default",
                "image": "myprivateregistry.com/myrepo/helloworld/manifests/latest",
                "cpu": 0,
                "memory": 1,
                "portMappings": [],
                "essential": true,
                "environment": [],
                "mountPoints": [],
                "volumesFrom": [],
                "linuxParameters": {
                    "tmpfs": []
                },
                "secrets": [
                    {
                        "name": "testSecret",
                        "valueFrom": "arn:aws:secretsmanager:aws-region:awsAccount:secret:testSecret-CtEe8E"
                    }
                ],
                "logConfiguration": {
                    "logDriver": "awslogs",
                    "options": {
                        "awslogs-group": "/aws/batch/job",
                        "awslogs-region": "aws-region",
                        "awslogs-stream-prefix": "my-task-definition"
                    }
                }
            }
        ],
        "family": "my-task-definition",
        "executionRoleArn": "arn:aws:iam::awsAccount:role/ecsTaskExecutionRole",
        "networkMode": "host",
        "revision": 7,
        "volumes": [],
        "status": "ACTIVE",
        "requiresAttributes": [
            {
                "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
            },
            {
                "name": "ecs.capability.execution-role-awslogs"
            },
            {
                "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
            },
            {
                "name": "ecs.capability.secrets.asm.environment-variables"
            },
            {
                "name": "com.amazonaws.ecs.capability.docker-remote-api.1.22"
            },
            {
                "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
            }
        ],
        "placementConstraints": [],
        "compatibilities": [
            "EXTERNAL",
            "EC2"
        ],
        "registeredAt": 1643130577.733,
        "registeredBy": "arn:aws:sts::awsAccount:assumed-role/AWSServiceRoleForBatch/aws-batch"
    }
}

Does anyone know what I am missing / how to use an image from an external, private registry in AWS ECS?

Answer 1

Secrets Manager encrypts secrets by default - no option to store "plain text". Check if task execution role has kms:Decrypt action allowed.

Based on added task definition, you are missing the repositoryCredentials section in containerDefinitions array.

Should be:

{
    "taskDefinition": {
        "taskDefinitionArn": "arn:aws:ecs:aws-region:awsAccount:task-definition/my-task-definition:7",
        "containerDefinitions": [
            {
                "name": "default",
                "image": "myprivateregistry.com/myrepo/helloworld/manifests/latest",
                "repositoryCredentials": {
                    "credentialsParameter": "arn:aws:secretsmanager:aws-region:awsAccount:secret:testSecret-CtEe8E"
                },
                "cpu": 0,
                "memory": 1,
                "portMappings": [],
                "essential": true,
                "environment": [],
                "mountPoints": [],
                "volumesFrom": [],
                "linuxParameters": {
                    "tmpfs": []
                },
                "secrets": null,
                "logConfiguration": {
                    "logDriver": "awslogs",
                    "options": {
                        "awslogs-group": "/aws/batch/job",
                        "awslogs-region": "aws-region",
                        "awslogs-stream-prefix": "my-task-definition"
                    }
                }
            }
        ],
        "family": "my-task-definition",
        "executionRoleArn": "arn:aws:iam::awsAccount:role/ecsTaskExecutionRole",
        "networkMode": "host",
        "revision": 7,
        "volumes": [],
        "status": "ACTIVE",
        "requiresAttributes": [
            {
                "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
            },
            {
                "name": "ecs.capability.execution-role-awslogs"
            },
            {
                "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
            },
            {
                "name": "ecs.capability.secrets.asm.environment-variables"
            },
            {
                "name": "com.amazonaws.ecs.capability.docker-remote-api.1.22"
            },
            {
                "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
            }
        ],
        "placementConstraints": [],
        "compatibilities": [
            "EXTERNAL",
            "EC2"
        ],
        "registeredAt": 1643130577.733,
        "registeredBy": "arn:aws:sts::awsAccount:assumed-role/AWSServiceRoleForBatch/aws-batch"
    }
}