amazon-web-services - 关于在Jenkins中配置上传docker镜像到ECR策略的问题

Question

我创建了一个使用 Jenkins 将 docker 映像上传到 ECR 的新角色，我附上了我在这里找到的这个策略

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"ListImagesInRepository",
         "Effect":"Allow",
         "Action":[
            "ecr:ListImages"
         ],
         "Resource":"arn:aws:ecr:us-east-1:123456789012:repository/my-repo"
      },
      {
         "Sid":"GetAuthorizationToken",
         "Effect":"Allow",
         "Action":[
            "ecr:GetAuthorizationToken"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ManageRepositoryContents",
         "Effect":"Allow",
         "Action":[
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:GetRepositoryPolicy",
                "ecr:DescribeRepositories",
                "ecr:ListImages",
                "ecr:DescribeImages",
                "ecr:BatchGetImage",
                "ecr:InitiateLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:CompleteLayerUpload",
                "ecr:PutImage"
         ],
         "Resource":"arn:aws:ecr:us-east-1:123456789012:repository/my-repo"
      }
   ]
}

我在 Policy Simulator 中测试过，它给了我否认：

我怀疑 ARN 出了点问题，我只找到了 ECR 存储库的 URL，但我根据示例更改了格式，有人可以帮助我吗？现在已经为此苦苦挣扎了很长时间。

标签： amazon-web-servicesdockerjenkinsamazon-iamamazon-ecr

Answer 1

问题在于Simulation Resource. 您正在测试*，但您的策略明智地不允许所​​有。您应该针对需要访问的资源的实际 ARN 对其进行测试。