Manage Amazon ECR private repository access in Lightsail

Sign in to the Lightsail console.

On the Lightsail home page, choose the Containers tab.

Choose the name of the container service for which you want to configure access to an Amazon ECR private repository.

Choose the Images tab.

Choose Add repository to grant access for your container service to an Amazon ECR private repository.

In the dropdown that appears, select the private repository that you would like to access, and then choose Add.

Lightsail takes a few moments to activate the Amazon ECR image puller IAM role for your container service, which includes a principal Amazon Resource Name (ARN). Lightsail then automatically adds the IAM role principal ARN to the permissions policy of the Amazon ECR private repository that you selected. This grants your container service access to the private repository and its images. Don't close the browser window until the modal that appears indicates that the process is completed and you can choose Continue.

Choose Continue when the activation is completed.

After the selected Amazon ECR private repository is added it is listed in the Amazon ECR private repositories section of the page. The page includes instructions for how to deploy an image from the private repository to your Lightsail container service. To use an image from your private repository, specify the URI format that is displayed on the page as the Image value when creating your container service deployment. In the URI that you specify, replace the example {image tag} with the tag of the image you want to deploy. For more information, see Create and manage container service deployments.

Open a Command Prompt or Terminal window.

Enter the following command to update a container service and activate or deactivate the Amazon ECR image puller IAM role.

aws lightsail update-container-service --service-name ContainerServiceName --private-registry-access ecrImagePullerRole={isActive=RoleActivationState} --region AwsRegionCode

In the command, replace the following example text with your own:

Examples:

If you:

Enter the following command to get the principal ARN of the Amazon ECR image puller IAM role for your container service.

aws lightsail get-container-services --service-name ContainerServiceName --region AwsRegionCode

In the command, replace the following example text with your own:

Example:

aws lightsail get-container-services --service-name my-container-service --region us-east-1

Look for the ECR image puller IAM role principal ARN in the response. If a role is listed, copy it or write it down. You will need it for the next section of this guide. Next, you need to determine if there is an existing policy statement on the Amazon ECR private repository that you want to access with your container service. Continue to the Determine if your Amazon ECR private repository has a policy statement section of this guide.

Open a Command Prompt or Terminal window.

Enter the following command to get the policy statement for a specific private repository.

aws ecr get-repository-policy --repository-name RepositoryName --region AwsRegionCode

In the command, replace the following example text with your own:

Example:

aws ecr get-repository-policy --repository-name my-private-repo --region us-east-1

You should see one of the following responses:

Open a text editor, and paste the following policy statement into a new text file.

{ 
  "Version": "2008-10-17",
  "Statement": [
  {
      "Sid": "AllowLightsailPull-ecr-private-repo-demo",
      "Effect": "Allow",
      "Principal": {
        "AWS": "IamRolePrincipalArn"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]
    }
  ]
}

In the text, replace IamRolePrincipalArn with the Amazon ECR image puller IAM role principal ARN of your container service that you got earlier in this guide.

Save the file as ecr-policy.json to an accessible location on your computer (for example, C:\Temp\ecr-policy.json on Windows or /tmp/ecr-policy.json on macOS or Linux).

Write down the file path location of the ecr-policy.json file created. You will specify it in a command later in this procedure.

Open a Command Prompt or Terminal window.

Enter the following command to set the policy statement for the private repository that you want to access with your container service.

aws ecr set-repository-policy --repository-name RepositoryName --policy-text file://path/to/ecr-policy.json --region AwsRegionCode

In the command, replace the following example text with your own:

Examples:

Your container service is now able to access your private repository and its images. To use an image from your repository, specify the following URI as the Image value for your container service deployment. In the URI, replace the example tag with the tag of the image you want to deploy. For more information, see Create and manage container service deployments.

AwsAccountId.dkr.ecr.AwsRegionCode.amazonaws.com/RepositoryName:ImageTag

In the URI, replace the following example text with your own:

Example:

111122223333.dkr.ecr.us-east-1.amazonaws.com/my-private-repo:myappimage

Open a Command Prompt or Terminal window.

Enter the following command to get the policy statement for a specific private repository.

aws ecr get-repository-policy --repository-name RepositoryName --region AwsRegionCode

In the command, replace the following example text with your own:

Example:

aws ecr get-repository-policy --repository-name my-private-repo --region us-east-1

In the response, copy the existing policy and continue to the next step.

You should copy only the content of the policyText that appears between the double quotes, as highlighted in the following example.

Open a text editor, and paste the existing policy from your private repository that you copied in the previous step.

The result should look like the following example.

In the text that you pasted, replace \n with line breaks and delete the remaining \.

The result should look like the following example.

Paste the following policy statement at the end of the text file.

,
{ 
  "Version": "2008-10-17",
  "Statement": [
  {
      "Sid": "AllowLightsailPull-ecr-private-repo-demo",
      "Effect": "Allow",
      "Principal": {
        "AWS": "IamRolePrincipalArn"
      },
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer"
      ]
    }
  ]
}

In the text, replace IamRolePrincipalArn with the Amazon ECR image puller IAM role principal ARN of your container service that you got earlier in this guide.

The result should look like the following example.

Save the file as ecr-policy.json to an accessible location on your computer (for example, C:\Temp\ecr-policy.json on Windows or /tmp/ecr-policy.json on macOS or Linux).

Write down the file path location of the ecr-policy.json file. You will specify it in a command later in this procedure.

Open a Command Prompt or Terminal window.

Enter the following command to set the policy statement for the private repository that you want to access with your container service.

aws ecr set-repository-policy --repository-name RepositoryName --policy-text file://path/to/ecr-policy.json --region AwsRegionCode

In the command, replace the following example text with your own:

Examples:

You should see a response similar to the following example.

If you run the get-repository-policy command again, you should see the new additional policy statement on your private repository. Your container service is now able to access your private repository and its images. To use an image from your repository, specify the following URI as the Image value for your container service deployment. In the URI, replace the example tag with the tag of the image you want to deploy. For more information, see Create and manage container service deployments.

AwsAccountId.dkr.ecr.AwsRegionCode.amazonaws.com/RepositoryName:ImageTag

In the URI, replace the following example text with your own:

Example:

111122223333.dkr.ecr.us-east-1.amazonaws.com/my-private-repo:myappimage