要在AWS Fargate任务中从另一个帐户的ECR中拉取镜像,您需要在Fargate任务的执行角色中添加适当的权限。
以下是一个解决方法的代码示例:
ECRImagePullPolicy
的IAM策略,其中包含以下权限:{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecr:GetAuthorizationToken",
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:GetRepositoryPolicy",
"ecr:DescribeRepositories",
"ecr:ListImages",
"ecr:DescribeImages",
"ecr:BatchGetImage"
],
"Resource": "*"
}
]
}
aws iam create-role --role-name FargateTaskRole --assume-role-policy-document file://trust-policy.json
aws iam attach-role-policy --role-name FargateTaskRole --policy-arn arn:aws:iam::account-id:policy/ECRImagePullPolicy
请将account-id
替换为存储库所在的帐户ID。
{
"family": "my-fargate-task",
"executionRoleArn": "arn:aws:iam::account-id:role/FargateTaskRole",
"containerDefinitions": [
{
"name": "my-container",
"image": "account-id.dkr.ecr.region.amazonaws.com/my-ecr-repo:latest",
"cpu": 256,
"memory": 512
}
]
}
请将account-id
替换为存储库所在的帐户ID,并将region
替换为存储库所在的AWS区域。
aws ecs create-service --cluster my-cluster --service-name my-fargate-service --task-definition my-fargate-task
通过执行上述步骤,您的Fargate任务将能够从另一个帐户的ECR中拉取镜像,而不需要创建存储库策略。