AWS ECR: `ecr:TagResource` seems required now

[bradonkanyid]

We started getting errors in our swaps w/ k8s-image-swapper around ecr:CreateRepository (seeing this in cloudtrail), because of the missing permission ecr:TagResource.

Adding the ecr:TagResource action to our IAM policy for IRSA did fix the problem, so I think the docs just need updated.

[estahn]

@bradonkanyid Thanks for the report. What version of k8s-image-swapper did you see these issues in?

[dex4er]

@estahn I've got the same issue, it was 1.3.0 installed from the Helm chart.

[estahn]

@dex4er Just revisiting this and double-checking. There has been a change in regards to tags in 1.4.0, but not 1.3.0. Can you double check you were running 1.3.0?

[dex4er]

I run 1.3.3. It was the latest docker image available 3 weeks ago and I haven't done an upgrade yet.

[estahn]

@dex4er Thanks for checking. I will amend the IAM policy in the documentation. I can't find any changes relating to this though, which seems odd.

https://github.com/estahn/k8s-image-swapper/blame/v1.3.3/pkg/registry/ecr.go

[bradonkanyid]

We received the following from AWS recently:

Description
This message is to inform you that Allow access will be needed for the ecr:TagResource and ecr:CreateRepository actions to create a repository with tags effective February 28, 2023.

Customers can use IAM policies to control which IAM users or roles have access to create or manage ECR repositories. This change ensures that IAM users or roles creating repositories also have permission to tag these resources upon creation. If your IAM users or roles that create ECR repositories already have Allow access to tag resources, then no action is required.

Starting February 28, 2023, if you do not have Allow access to both ecr:TagResource and ecr:CreateRepository actions when creating a repository with tags, CreateRepository calls will fail with AccessDeniedException.

Below is an example of the policy change needed for a CreateRepository call with tags to succeed.

Before:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecr:CreateRepository"
],
"Resource": "*"
}
]
}

After:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecr:CreateRepository",
"ecr:TagResource"
],
"Resource": "*"
}
]
}

You can learn more about the CreateRepository action [1], and ECR’s IAM actions in our documents [2].

If you have any questions or concerns, please contact AWS Support [3].

[1] https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-create.html
[2] https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistry.html#amazonelasticcontainerregistry-resources-for-iam-policies
[3] https://aws.amazon.com/support

I'm not sure why we are running into this issue prior to their Feb 28th deadline, however.

[estahn]

@bradonkanyid Thanks for this. AWS may have rolled this out in certain regions prior to the deadline. At least I wouldn't put it past them.

[estahn]

Closing as not further action appears to be required.