You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: doc_source/sample-ecr.md
+42-30Lines changed: 42 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
This sample uses a Docker image in an Amazon Elastic Container Registry \(Amazon ECR\) image repository to build a sample Go project\.
4
4
5
-
**Important**
5
+
**Important**
6
6
Running this sample might result in charges to your AWS account\. These include possible charges for AWS CodeBuild and for AWS resources and actions related to Amazon S3, AWS KMS, CloudWatch Logs, and Amazon ECR\. For more information, see [CodeBuild pricing](http://aws.amazon.com/codebuild/pricing), [Amazon S3 pricing](http://aws.amazon.com/s3/pricing), [AWS Key Management Service pricing](http://aws.amazon.com/kms/pricing), [Amazon CloudWatch pricing](http://aws.amazon.com/cloudwatch/pricing), and [Amazon Elastic Container Registry pricing](http://aws.amazon.com/ecr/pricing)\.
7
7
8
8
## Running the sample<aname="sample-ecr-running"></a>
@@ -11,11 +11,11 @@ Running this sample might result in charges to your AWS account\. These include
11
11
12
12
1. To create and push the Docker image to your image repository in Amazon ECR, complete the steps in the "Running the sample" section of the [Docker sample](sample-docker.md)\.
13
13
14
-
1. Create a Go project:
14
+
1. Create a Go project:
15
15
16
-
1. Create the files as described in the [Go project structure](#ecr-sample-go-project-file-structure) and [Go project files](#sample-ecr-go-project-files) sections of this topic, and then upload them to an S3 input bucket or an AWS CodeCommit, GitHub, or Bitbucket repository\.
17
-
**Important**
18
-
Do not upload `(root directory name)`, just the files inside of `(root directory name)`\.
16
+
1. Create the files as described in the [Go project structure](#ecr-sample-go-project-file-structure) and [Go project files](#sample-ecr-go-project-files) sections of this topic, and then upload them to an S3 input bucket or an AWS CodeCommit, GitHub, or Bitbucket repository\.
17
+
**Important**
18
+
Do not upload `(root directory name)`, just the files inside of `(root directory name)`\.
19
19
If you are using an S3 input bucket, be sure to create a ZIP file that contains the files, and then upload it to the input bucket\. Do not add `(root directory name)` to the ZIP file, just the files inside of `(root directory name)`\.
20
20
21
21
1. Create a build project, run the build, and view related build information by following the steps in [Run AWS CodeBuild directly](how-to-run.md)\.
@@ -47,11 +47,11 @@ If you are using an S3 input bucket, be sure to create a ZIP file that contains
47
47
48
48
1. To get the build output artifact, open your S3 output bucket\.
49
49
50
-
1. Download the `GoOutputArtifact.zip` file to your local computer or instance, and then extract the contents of the file\. In the extracted contents, get the `hello` file\.
50
+
1. Download the `GoOutputArtifact.zip` file to your local computer or instance, and then extract the contents of the file\. In the extracted contents, get the `hello` file\.
51
51
52
-
1. If one of the following is true, you must add permissions to your image repository in Amazon ECR so that AWS CodeBuild can pull its Docker image into the build environment\.
53
-
+ Your project uses CodeBuild credentials to pull Amazon ECR images\. This is denoted by a value of `CODEBUILD` in the `imagePullCredentialsType` attribute of your `ProjectEnvironment`\.
54
-
+ Your project uses a cross\-account Amazon ECR image\. In this case, your project must use its service role to pull Amazon ECR images\. To enable this behavior, set the `imagePullCredentialsType` attribute of your `ProjectEnvironment` to `SERVICE_ROLE`\.
52
+
1. If one of the following is true, you must add permissions to your image repository in Amazon ECR so that AWS CodeBuild can pull its Docker image into the build environment\.
53
+
+ Your project uses CodeBuild credentials to pull Amazon ECR images\. This is denoted by a value of `CODEBUILD` in the `imagePullCredentialsType` attribute of your `ProjectEnvironment`\.
54
+
+ Your project uses a cross\-account Amazon ECR image\. In this case, your project must use its service role to pull Amazon ECR images\. To enable this behavior, set the `imagePullCredentialsType` attribute of your `ProjectEnvironment` to `SERVICE_ROLE`\.
55
55
56
56
1. Open the Amazon ECR console at [https://console\.aws\.amazon\.com/ecr/](https://console.aws.amazon.com/ecr/)\.
57
57
@@ -64,7 +64,7 @@ If you are using an S3 input bucket, be sure to create a ZIP file that contains
64
64
1. For **Effect**, leave **Allow** selected\. This indicates that you want to allow access to another AWS account\.
65
65
66
66
1. For **Principal**, do one of the following:
67
-
+ If your project uses CodeBuild credentials to pull an Amazon ECR image, in **Service principal**, enter **codebuild\.amazonaws\.com**\.
67
+
+ If your project uses CodeBuild credentials to pull an Amazon ECR image, in **Service principal**, enter **codebuild\.amazonaws\.com**\.
68
68
+ If your project uses a cross\-account Amazon ECR image, for **AWS account IDs**, enter IDs of the AWS accounts that you want to give access\.
69
69
70
70
1. Skip the **All IAM entities** list\.
@@ -81,25 +81,37 @@ If you are using an S3 input bucket, be sure to create a ZIP file that contains
81
81
82
82
```
83
83
{
84
-
"Version": "2012-10-17",
85
-
"Statement": [
86
-
{
87
-
"Sid": "CodeBuildAccess",
88
-
"Effect": "Allow",
89
-
"Principal": {
90
-
"AWS": "arn:aws:iam::AWS-account-ID:root"
84
+
"Version":"2012-10-17",
85
+
"Statement":[
86
+
{
87
+
"Sid":"CodeBuildAccessPrincipal",
88
+
"Effect":"Allow",
89
+
"Principal":{
90
+
"Service":"codebuild.amazonaws.com"
91
+
},
92
+
"Action":[
93
+
"ecr:BatchCheckLayerAvailability",
94
+
"ecr:BatchGetImage",
95
+
"ecr:GetDownloadUrlForLayer"
96
+
]
91
97
},
92
-
"Action": [
93
-
"ecr:GetDownloadUrlForLayer",
94
-
"ecr:BatchGetImage",
95
-
"ecr:BatchCheckLayerAvailability"
96
-
]
97
-
}
98
+
{
99
+
"Sid":"CodeBuildAccessCrossaccount",
100
+
"Effect":"Allow",
101
+
"Principal":{
102
+
"AWS":"arn:aws:iam::AWS-account-ID:root"
103
+
},
104
+
"Action":[
105
+
"ecr:GetDownloadUrlForLayer",
106
+
"ecr:BatchGetImage",
107
+
"ecr:BatchCheckLayerAvailability"
108
+
]
109
+
}
98
110
]
99
111
}
100
112
```
101
113
102
-
1. Create a build project, run the build, and view build information by following the steps in [Run AWS CodeBuild directly](how-to-run.md)\.
114
+
2. Create a build project, run the build, and view build information by following the steps in [Run AWS CodeBuild directly](how-to-run.md)\.
103
115
104
116
If you use the AWS CLI to create the build project, the JSON\-formatted input to the `create-project` command might look similar to this\. \(Replace the placeholders with your own values\.\)
105
117
@@ -126,9 +138,9 @@ If you are using an S3 input bucket, be sure to create a ZIP file that contains
126
138
}
127
139
```
128
140
129
-
1. To get the build output artifact, open your S3 output bucket\.
141
+
3. To get the build output artifact, open your S3 output bucket\.
130
142
131
-
1. Download the `GoOutputArtifact.zip` file to your local computer or instance, and then extract the contents of the `GoOutputArtifact.zip` file\. In the extracted contents, get the `hello` file\.
143
+
4. Download the `GoOutputArtifact.zip` file to your local computer or instance, and then extract the contents of the `GoOutputArtifact.zip` file\. In the extracted contents, get the `hello` file\.
132
144
133
145
## Go project structure<a name="ecr-sample-go-project-file-structure"></a>
134
146
@@ -150,14 +162,14 @@ This sample uses these files\.
0 commit comments