Docker Push AWS ECR - Permission Denied

Question

我无法推送到ECR。我很好奇如果这是一个缓存问题与docker?否则，在这一点上，我很茫然。

我在做什么:

aws ecr get-login-password --region us-east-2 --profile default | docker login --username AWS --password-stdin xxx.dkr.ecr.us-east-2.amazonaws.com

然后

docker push xxx.dkr.ecr.us-east-2.amazonaws.com/xxx:latest
The push refers to repository [xxx.dkr.ecr.us-east-2.amazonaws.com/xxx]
da7bf7d60078: Retrying in 1 second
0ee50625ffa2: Retrying in 1 second
bda3199c89c0: Retrying in 1 second
5f70bf18a086: Retrying in 1 second
31f710dc178f: Retrying in 1 second
EOF

我之前通过CLI创建了ECR:

aws ecr create-repository --repository-name xxx --image-scanning-configuration scanOnPush=true --region us-east-2

权限策略:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ecr:PutImageTagMutability",
"ecr:StartImageScan",
"ecr:DescribeImageReplicationStatus",
"ecr:ListTagsForResource",
"ecr:UploadLayerPart",
"ecr:BatchDeleteImage",
"ecr:ListImages",
"ecr:BatchGetRepositoryScanningConfiguration",
"ecr:DeleteRepository",
"ecr:CompleteLayerUpload",
"ecr:TagResource",
"ecr:DescribeRepositories",
"ecr:BatchCheckLayerAvailability",
"ecr:ReplicateImage",
"ecr:GetLifecyclePolicy",
"ecr:PutLifecyclePolicy",
"ecr:DescribeImageScanFindings",
"ecr:GetLifecyclePolicyPreview",
"ecr:PutImageScanningConfiguration",
"ecr:GetDownloadUrlForLayer",
"ecr:DeleteLifecyclePolicy",
"ecr:PutImage",
"ecr:UntagResource",
"ecr:BatchGetImage",
"ecr:DescribeImages",
"ecr:StartLifecyclePolicyPreview",
"ecr:InitiateLayerUpload",
"ecr:GetRepositoryPolicy"
],
"Resource": "arn:aws:ecr:us-east-2:xxx:repository/xxx"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"ecr:GetRegistryPolicy",
"ecr:BatchImportUpstreamImage",
"ecr:CreateRepository",
"ecr:DescribeRegistry",
"ecr:DescribePullThroughCacheRules",
"ecr:GetAuthorizationToken",
"ecr:PutRegistryScanningConfiguration",
"ecr:CreatePullThroughCacheRule",
"ecr:DeletePullThroughCacheRule",
"ecr:GetRegistryScanningConfiguration",
"ecr:PutReplicationConfiguration"
],
"Resource": "*"
}
]
}

CloudTrail错误信息:

"errorMessage": "User: arn:aws:iam::xxx:user/expected-user is not authorized to perform: ecr:InitiateLayerUpload on resource: arn:aws:ecr:us-east-2:xxx:repository/xxx with an explicit deny in an identity-based policy",

一个仪式:CloudTrail中列出的

• Access Key与本IAM帐户中的Access Key不一致。每次尝试推送时它都会改变，所以我不知道它来自哪里，但登录本身是成功的，所以我想这是意料之中的?
• 当我运行aws ecr create-repository...时，CloudTrail中记录的访问密钥是此IAM帐户中列出的访问密钥…

Answer 1

基于错误消息，在相关部分声明:

用户:[…是未经授权的[…]ecr:InitiateLayerUpload[…]在基于身份的策略中使用显式deny

问题似乎是一个基于身份的策略，它至少对一个必需的操作具有显式的Deny效应。由于Deny效果将优先于任何Allow效果，即使您共享的策略通常会为您提供必要的访问权限，您也无法执行所需的操作。

您应该查找附加到您的IAM用户的其他策略，以查找具有Deny效果的策略(或策略)，这些策略禁止此操作或其他所需操作。