如何配置对 Elastic beanstalk Cloudformation 模板的 ECR 读取权限? [英] How to provision ECR read access to Elastic beanstalk Cloudformation template?

问题描述

我有一个带有多容器 docker CF 模板的弹性 beanstalk，如下所示.我单独将我的图像推送到 ECR.在 Dockerrun.json 中，我像这样引用我的图像图像":.dkr.ecr.ap-south-1.amazonaws.com/*:最新".通过使用这个 CF 模板，我可以创建带有多容器的 ELB.但是在部署我的 Dockerrun.json 时，由于我的图像的权限被拒绝而失败.所以我将 Type: AWS::ECR::Repository 添加到我的云形成中.我的 CF 中已经有 MyInstanceProfile.我尝试通过添加策略来授予对 IAM 的访问权限.但是在部署时，我在我的 CF 任务中遇到 Encountered unsupported property MyInstanceRole 错误.那么如何修复这个错误或者是否需要任何其他重构?

I have an elastic beanstalk with multi-container docker CF template as following. I pushed my image to ECR separately. In Dockerrun.json, I referred to my image like this "image": ".dkr.ecr.ap-south-1.amazonaws.com/*:latest". By using this CF template I am able to create ELB with multi-container. But while deploying my Dockerrun.json, It failed due to permission denied for my image. So I added Type: AWS::ECR::Repository to my cloud formation.I already have MyInstanceProfile in my CF. I tried to give access to the IAM by adding Polices. But while deploying, I am getting Encountered unsupported property MyInstanceRole error in my CF task. So how to fix this error or is any other refactors required?

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  sampleApplication:
    Type: AWS::ElasticBeanstalk::Application
    Properties:
      Description: AWS Elastic Beanstalk Sample Application
  sampleApplicationVersion:
    Type: AWS::ElasticBeanstalk::ApplicationVersion
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Application Version
      SourceBundle:
        S3Bucket: !Sub "elasticbeanstalk-ap-south-1-182107200133"
        S3Key: TravelTouch/Dockerrun.aws.json
  MyRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "182107200133.dkr.ecr.ap-south-1.amazonaws.com/socialbox"
  sampleConfigurationTemplate:
    Type: AWS::ElasticBeanstalk::ConfigurationTemplate
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Configuration Template
      OptionSettings:
        - Namespace: aws:autoscaling:asg
          OptionName: MinSize
          Value: '2'
        - Namespace: aws:autoscaling:asg
          OptionName: MaxSize
          Value: '6'
        - Namespace: aws:elasticbeanstalk:environment
          OptionName: EnvironmentType
          Value: LoadBalanced
        - Namespace: aws:autoscaling:launchconfiguration
          OptionName: IamInstanceProfile
          Value: !Ref MyInstanceProfile
      SolutionStackName: 64bit Amazon Linux 2018.03 v2.26.0 running Multi-container Docker 19.03.13-ce (Generic)
  sampleEnvironment:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Environment
      TemplateName:
        Ref: sampleConfigurationTemplate
      VersionLabel:
        Ref: sampleApplicationVersion
  MyInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Description: Beanstalk EC2 role
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
      MyInstanceRole:
        Type: AWS::IAM::Role
        Properties:
          AssumeRolePolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Principal:
                  Service:
                    - ec2.amazonaws.com
                Action:
                  - sts:AssumeRole
          Description: Beanstalk EC2 role
          ManagedPolicyArns:
            - arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
            - arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker
            - arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
          Policies:
            - PolicyName: AllowGetAuthorizationToken
              PolicyDocument: |
                {
                  "Version": "2012-10-17",
                  "Statement": [
                      {
                          "Sid": "ECSAccess",
                          "Effect": "Allow",
                          "Action": [
                              "ecr:GetAuthorizationToken",
                          ],
                          "Resource": "*"
                      }
                  ]
                }  
  MyInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref MyInstanceRole

推荐答案

您有重复 MyInstanceRole 定义和缩进不正确.请修复您的缩进并删除 MyInstanceRole 的第一个定义.它应该如下所示:

You have duplicate MyInstanceRole definitions with incorrect indention. Please fix your indention and remove first definition of MyInstanceRole. It should be something as below:

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  sampleApplication:
    Type: AWS::ElasticBeanstalk::Application
    Properties:
      Description: AWS Elastic Beanstalk Sample Application
  sampleApplicationVersion:
    Type: AWS::ElasticBeanstalk::ApplicationVersion
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Application Version
      SourceBundle:
        S3Bucket: !Sub "elasticbeanstalk-ap-south-1-182107200133"
        S3Key: TravelTouch/Dockerrun.aws.json
  MyRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "182107200133.dkr.ecr.ap-south-1.amazonaws.com/socialbox"
  sampleConfigurationTemplate:
    Type: AWS::ElasticBeanstalk::ConfigurationTemplate
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Configuration Template
      OptionSettings:
        - Namespace: aws:autoscaling:asg
          OptionName: MinSize
          Value: '2'
        - Namespace: aws:autoscaling:asg
          OptionName: MaxSize
          Value: '6'
        - Namespace: aws:elasticbeanstalk:environment
          OptionName: EnvironmentType
          Value: LoadBalanced
        - Namespace: aws:autoscaling:launchconfiguration
          OptionName: IamInstanceProfile
          Value: !Ref MyInstanceProfile
      SolutionStackName: 64bit Amazon Linux 2018.03 v2.26.0 running Multi-container Docker 19.03.13-ce (Generic)
      
  sampleEnvironment:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Environment
      TemplateName:
        Ref: sampleConfigurationTemplate
      VersionLabel:
        Ref: sampleApplicationVersion

  MyInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Description: Beanstalk EC2 role
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
      Policies:
        - PolicyName: AllowGetAuthorizationToken
          PolicyDocument: |
            {
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Sid": "ECSAccess",
                      "Effect": "Allow",
                      "Action": [
                          "ecr:GetAuthorizationToken",
                      ],
                      "Resource": "*"
                  }
              ]
            }  

  MyInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref MyInstanceRole

这篇关于如何配置对 Elastic beanstalk Cloudformation 模板的 ECR 读取权限?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！