-
Notifications
You must be signed in to change notification settings - Fork 3.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Apprunner: After pushing a Docker image to ECR, isn't triggered. #26640
Apprunner: After pushing a Docker image to ECR, isn't triggered. #26640
Comments
Thanks for report. I just know this feature today. The automatic deployment based on ECR image update is awesome! https://docs.aws.amazon.com/apprunner/latest/dg/manage-deploy.html |
It seems that Reference of the required actions: https://docs.aws.amazon.com/apprunner/latest/dg/security_iam_service-with-iam.html#security_iam_service-with-iam-roles As a workaround, the following fix worked for me. (service.node.findChild('AccessRole') as Role).addToPrincipalPolicy(
new PolicyStatement({
actions: ['ecr:DescribeImages'],
resources: [repository.repositoryArn],
}),
); |
Seeing the same behaviour, looking forward to this fix (ie, the above PR being merged).
to
|
|
1 similar comment
|
Describe the bug
Deployed AppRunner using AWS CDK.
The expected behavior is for AppRunner to automatically deploy upon each change to the container image in ECR.
Expected Behavior
After pushing a Docker image to ECR, the AppRunner deployment is triggered.
Current Behavior
However, even after pushing a Docker image to ECR, the AppRunner deployment isn't triggered.
Reproduction Steps
import * as apprunner from '@aws-cdk/aws-apprunner-alpha'
import { Cpu, Memory } from '@aws-cdk/aws-apprunner-alpha'
import * as cdk from 'aws-cdk-lib'
import * as iam from 'aws-cdk-lib/aws-iam'
import { Construct } from 'constructs'
import { EcrStack } from './ecr'
export class AppRunnerStack extends cdk.Stack {
constructor(
scope: Construct,
id: string,
ecrStack: EcrStack,
props?: cdk.StackProps,
) {
super(scope, id, props)
}
}
Possible Solution
Cause:
The access role for AppRunner’s service is automatically generated. However, it lacks permission for the ecr:DescribeImages action, preventing it from detecting image changes.
Necessary Permissions:
Actions required for ECR access:
Actions that AppRunner needs for ECR access:
Proposed Solution:
Additional Information/Context
https://zenn.dev/okaharuna/articles/bed7f41498a1b6
CDK CLI Version
2.89.0
Framework Version
No response
Node.js Version
any
OS
any
Language
Typescript
Language Version
No response
Other information
No response
The text was updated successfully, but these errors were encountered: