无法将 asp.net 容器推送到 aws ecr答案

【问题标题】：Cannot push asp.net container to aws ecr无法将 asp.net 容器推送到 aws ecr
【发布时间】：2021-08-18 20:30:31
【问题描述】：

我有一个 asp.net 项目，位于 GitLab，我尝试构建并将其推送到 AWS ECR。

搭建成功，但是推送时出现这个错误

这是我对 IAM 用户拥有的权限屏幕

和管道 .yml 文件

    step-deploy-development:
  stage: development
  image: docker:stable
  services:
    - docker:18.09.7-dind
  before_script:
    # - export DOCKER_HOST="tcp://localhost:2375"
    # - docker info
    - export DYNAMIC_ENV_VAR=DEVELOPMENT
    - apk update
    - apk upgrade
    - apk add util-linux pciutils usbutils coreutils binutils findutils grep
    - apk add python3 python3-dev python3 py3-pip
    - pip install awscli
  script:
    - echo setting up env $DYNAMIC_ENV_VAR
    - $(aws ecr get-login --no-include-email --region eu-west-2)
    - docker build --build-arg ASPNETCORE_ENVIRONMENT=${ASPNETCORE_ENVIRONMENT_DEV} --build-arg DB_CONNECTION=${DB_CONNECTION_DEV} --build-arg CORS_ORIGINS=${CORS_ORIGINS_DEV} --build-arg SERVER_ROOT_ADDRESS=${SERVER_ROOT_ADDRESS_DEV} -f src/COROI.Web.Host/Dockerfile -t $ECR_DEV_REPOSITORY_URL:$CI_COMMIT_SHA .
    - docker push $ECR_DEV_REPOSITORY_URL:$CI_COMMIT_SHA
    - cd deployment
    - sed -i -e "s/TAG/$CI_COMMIT_SHA/g" ecs_task_dev.json
    - aws ecs register-task-definition --region $ECS_REGION --cli-input-json file://ecs_task_dev.json >> temp.json
    - REV=`grep  '"revision"' temp.json | awk '{print $2}'`
    - aws ecs update-service --cluster $ECS_DEV_CLUSTER --service $ECS_DEV_SERVICE --task-definition $ECS_DEV_TASK --region $ECS_REGION
  environment: development
  tags:
    # - CoroiAdmin
  only:
    - main

问题可能出在哪里？

【问题讨论】：

标签： asp.net amazon-web-services .net-core continuous-integration amazon-ecr

【解决方案1】：

您需要设置 ECR 存储库策略以允许您的 IAM 用户拉取和推送图像，如以下链接 Setting a repository policy statement 中所述，例如，此存储库策略允许 IAM 用户推送和拉取图像一个存储库。

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AllowPushPull",
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "arn:aws:iam::account-id:user/iam-user"
            ]
        },
        "Action": [
            "ecr:BatchGetImage",
            "ecr:BatchCheckLayerAvailability",
            "ecr:CompleteLayerUpload",
            "ecr:GetDownloadUrlForLayer",
            "ecr:InitiateLayerUpload",
            "ecr:PutImage",
            "ecr:UploadLayerPart"
        ]
    }
]

}

【讨论】：