(ecr): Repository.fromRepositoryArn does not validate ARN which leads to wasted time

[markusl]

Ok, so the following code with the new CDK Pipelines produces an unexpected result:

    const ecrRepoArn = 'arn:aws:ecr:eu-central-1:1234567891234:base-image-repo-from-ecr';
    const pipeline = new pipelines.CodePipeline(this, id, {
      pipelineName,
      crossAccountKeys: true,
      dockerEnabledForSelfMutation: true,
      dockerCredentials: [pipelines.DockerCredential.ecr(
        [
          ecr.Repository.fromRepositoryArn(this, 'ecr', ecrRepoArn)
        ]
      )],

The code will produce an error when running the pipeline:

error : [100%] fail: docker --config /tmp/cdkDockerConfignkKBqd build --tag cdkasset-699e5231c66d33f2bbdcd748964cd36874b9dc39c369f2f6d521381bd97afda0 . exited with error code 1: pull access denied for 1234567891234.dkr.ecr.eu-central-1.amazonaws.com/base-image-repo-from-ecr, repository does not exist or may require 'docker login': denied: User: arn:aws:sts::0987654376:assumed-role/PipelinePi-L9HGIT7CY91W/AWSCodeBuild-6054835c-9a09-4c3c-8f34-401787bd9553 is not authorized to perform: ecr:BatchGetImage on resource: arn:aws:ecr:eu-central-1:1234567891234:repository/base-image-repo-from-ecr

Can you spot the problem? Neither did I. So, I navigated to the ECR console to look for the ARN, but there are no ARNs. Googling ECR ARN produces AWS documentation page https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_Repository.html which does not have any ARNs.

After navigating to the IAM console, I see the following code which looks about right:

        {
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage"
            ],
            "Resource": "arn:aws:ecr:eu-central-1:1234567891234:base-image-repo-from-ecr",
            "Effect": "Allow"
        },

However, if you look very closely you can spot an error: Ln 47, Col 24 Invalid ARN Resource: Resource ARN does not match the expected ARN format. Update the resource portion of the ARN. Learn more .

The learn more button leads to a page https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html#access-analyzer-reference-policy-checks-error-invalid-arn-resource which does not document what an ECR ARN looks like.

I proceed to launch a Cloud Shell and start learning AWS CLI. It looks like running aws ecr describe-repositories outputs the ARN format of the repositories.

What did you expect to happen?

Maybe the repository name given for ecr.Repository.fromRepositoryArn could be validated at synth time.

However, as you can see this waste of time was clearly caused by user error so feel free to close the ticket if you want :)

I'm documenting this here if anyone else runs to the same issue.

Environment

• CDK CLI Version : 2.0.0-rc.17 (build fb5dc58)
• Framework Version: 2.0.0-rc.17 (build fb5dc58)
• Node.js Version: 14
• OS : macOS
• Language (Version): all

ECR ARN FORMAT

For future reference:

arn:aws:ecr:<REGION>:<ACCOUNT>:repository/<ACTUAL_REPOSITORY_NAME>

---

This is 🐛 Bug Report

[johnschultz]

Just ran into this myself. Would have been very confused if I had not found this issue.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[markusl]

Arn validation would still be useful.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[runev-admin]

#25302 Actually breaks the scenario below at synth time:

    const repoArn = ssm.StringParameter.valueFromLookup(
      this,
      configs.RepoArnParameterName
    );

    taskDefinition
      .addContainer("Container", {
        image: ecs.ContainerImage.fromEcrRepository(
          ecr.Repository.fromRepositoryArn(this, "EcrRepo", repoArn),
          releaseVersion
        ),
  ....

Error: Repository arn should be in the format 'arn::ecr:::repository/', got dummy-value-for-/xxx/us-east-1/xx/xxx/EcrRepoArn.

You can't validate the ARN at synth time. repoArn will be a dummy value then!