Closed ajilk closed 1 year ago
was missing "ecr:BatchGetImage"
, apparently that is need by docker/build-push-action
but not needed when pushed manually
Final IAM policy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecr:CompleteLayerUpload",
"ecr:BatchGetImage",
"ecr:UploadLayerPart",
"ecr:InitiateLayerUpload",
"ecr:BatchCheckLayerAvailability",
"ecr:PutImage"
],
"Resource": "arn:aws:ecr:region:111122223333:repository/repository-name"
},
{
"Effect": "Allow",
"Action": "ecr:GetAuthorizationToken",
"Resource": "*"
}
]
}
I am trying to cache the layers and push the built image to ECR. However, it is not working for the below workflow file. I am getting a 403 forbidden. I believe the action is not taking context into account somehow, because it does work when pushed manually so I believe I've configured everything (IAM policies, secrets) correctly