fix(apprunner): auto deployment fails after new container image pushed due to lack of a permission #30630
Conversation
github-actions
bot
added
star-contributor
mazyu36
changed the title
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
mazyu36
force-pushed
the
apprunner-deploy-ecr-26640
branch
from
9e87111 to
1e922b8
Compare
aws-cdk-automation
dismissed
their stale review
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
aws-cdk-automation
added
the
pr/needs-community-review
mazyu36
force-pushed
the
apprunner-deploy-ecr-26640
branch
from
1e922b8 to
54a1b58
Compare
aws-cdk-automation
added
pr/needs-maintainer-review
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one. |
Issue # (if applicable)
Closes #26640
Reason for this change
According to the docs, required permissions for an App Runner's AccessRole to access images in ECR repository are the followings:
No.1~3 are granted by the grantPull method of
ecr.Repository.https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-apprunner-alpha/lib/service.ts#L1303
Permission for No.5 is granted by the following.
Note : It is correct that the resources here is set to
*(Ref: docs)https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-apprunner-alpha/lib/service.ts#L1368
At the moment, No.4 permission is missing. So we need to add.
Description of changes
Add a
ecr:DescribeImagespermisison to the AccessRole.Description of how you validated changes
Update a unit test and a integ test.
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license