배경

내용

AWS CodeBuild란?

buildspec.yml

문제

{ 
  "Version": "2008-10-17", 
  "Statement": [ 
    { 
      "Sid": "AllowPushPull", 
      "Effect": "Allow", 
      "Principal": { 
        “AWS”: “arn:aws:iam::開発アカウントID" 
      }, 
      "Action": [ 
        ......
        "ecr:PutImage", 
        "ecr:UploadLayerPart" 
      ] 
    } 
  ] 
} 

개발 계정 측

sts-policy:

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Sid": "VisualEditor1", 
            "Effect": "Allow", 
            "Action": [ 
                "sts:AssumeRole" 
            ], 
            “Resource”: “arn:aws:iam::開発アカウントID:role/service-role/ロール名" 
        } 
    ] 
} 


ECRへpush権限:

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Sid": "VisualEditor0", 
            "Effect": "Allow", 
            "Action": [ 
                ....
                "ecr:PutImage", 
                ......
            ], 
            “Resource”: “arn:aws:ecr:ap-northeast-1:本番アカウントID:repository/リポジトリ名" 
        }, 
        { 
            "Sid": "VisualEditor1", 
            "Effect": "Allow", 
            "Action": "ecr:GetAuthorizationToken", 
            "Resource": "*" 
        } 
    ] 
}