CODEWITHSUNDEEP
amazon-web-servicesamazon-ecsaws-codepipeline
gkris
gkris

Reputation: 1219

Cross-Account ECS Deployment

I am trying to deploy an image from ECR of one account (AccountA) to ECS Cluster of another (AccountB) using CodePipeline. I am getting a permissions related error in the deploy phase.

Here is my pipeline role in AccountA:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:GetBucketVersioning"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::<bucketname>/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecr:GetAuthorizationToken",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer",
                "ecr:GetRepositoryPolicy",
                "ecr:DescribeRepositories",
                "ecr:ListImages",
                "ecr:DescribeImages",
                "ecr:BatchGetImage",
                "ecr:InitiateLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:CompleteLayerUpload",
                "ecr:PutImage"
            ],
            "Resource": [
                "*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "codebuild:BatchGetBuilds",
                "codebuild:InvalidateProjectCache",
                "codebuild:StartBuild",
                "codebuild:StopBuild",
                "codebuild:UpdateProject",
                "codebuild:UpdateWebhook"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": "arn:aws:iam::<AccountB>:role/taskexecutionrole",
            "Effect": "Allow"
        }
    ]
}

The arn:aws:iam::<AccountB>:role/taskexecutionrole role exists in AccountB and trusts AccountA. Here is the role in AccountB:

{
            "Effect": "Allow",
            "Action": "ecs:*",
            "Resource": [
                "*"
            ]
}

The pipeline has a ECR source, build stage generates an imagedefinitions.json file. And finally the deployment stage does ECS deploy.

The error I am getting is: Invalid action configuration Identifier is for AccountB. Your accountId is AccountA

This answer helps only for manual CLI deployment and I have tried the solution from this answer.

Any pointers what I'm missing?

Upvotes: 4

Views: 4342

Answers (1)

shariqmaws
shariqmaws

Reputation: 8890

Lets assume:

Account_A => CodePipeline & Source
Account_B => ECS

Here is what is required:

Account_A:
* AWSCodePipelineServiceRole
* Artifact_Store_S3_Bucket
* KMS_Key_for_Pipeline_Artifact (Customer Managed Key)
* Bucket Policy on Artifact_Store_S3_Bucket to Allow Account_B access
* Key Policy on KMS_Key_for_Pipeline_Artifact to Allow Access to Cross_Account_Role (from Account_B)

Account_B
* Cross_Account_Role (Trust relationship with Account_A and Full_ECS permissions)
* ECS with a running that is to be replaced with deployment

imagedefinitions.json (must be part of your source code)

[ 
    { 
      "name": "container_name", 
      "imageUri": "nginx:latest" 
    } 
]

Bucket_Policy on Artifact_Store_S3_Bucket

{
    "Version": "2012-10-17",
    "Id": "SSEAndSSLPolicy",
    "Statement": [
        {
            "Sid": "DenyUnEncryptedObjectUploads",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::Artifact_Store_S3_Bucket/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "aws:kms"
                }
            }
        },
        {
            "Sid": "DenyInsecureConnections",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::Artifact_Store_S3_Bucket/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::Account_B:root"
            },
            "Action": [
                "s3:Get*",
                "s3:Put*"
            ],
            "Resource": "arn:aws:s3:::Artifact_Store_S3_Bucket/*"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::Account_B:root"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::Artifact_Store_S3_Bucket"
        }
    ]
}

pipeline.json:

{
    "pipeline": {
        "name": "test",
        "roleArn": "arn:aws:iam::Account_A:role/service-role/AWSCodePipelineServiceRole",
        "artifactStore": {
            "type": "S3",
            "location": "Artifact_Store_S3_Bucket",
            "encryptionKey": {
              "id": "arn:aws:kms:us-east-1:Account_A:key/KMS_Key_for_Pipeline_Artifact",
              "type": "KMS"
            }
        },
        "stages": [
            {
                "name": "Source",
                "actions": [
                    {
                        "name": "Source",
                        "actionTypeId": {
                            "category": "Source",
                            "owner": "AWS",
                            "provider": "CodeCommit",
                            "version": "1"
                        },
                        "runOrder": 1,
                        "configuration": {
                            "BranchName": "master",
                            "PollForSourceChanges": "false",
                            "RepositoryName": "code"
                        },
                        "outputArtifacts": [
                            {
                                "name": "SourceArtifact"
                            }
                        ],
                        "inputArtifacts": [],
                        "region": "us-east-1"
                    }
                ]
            },
            {
                "name": "Deploy",
                "actions": [
                    {
                        "name": "Deploy",
                        "actionTypeId": {
                            "category": "Deploy",
                            "owner": "AWS",
                            "provider": "ECS",
                            "version": "1"
                        },
                        "runOrder": 1,
                        "roleArn": "arn:aws:iam::Account_B:role/CrossAccount_Role",
                        "configuration": {
                            "ClusterName": "<Cluster>",
                            "ServiceName": "<Service>"
                        },
                        "outputArtifacts": [],
                        "inputArtifacts": [
                            {
                                "name": "SourceArtifact"
                            }
                        ],
                        "region": "us-east-1"
                    }
                ]
            }
        ],
        "version": 1
    }
}

To Update the Pipeline:

$ aws codepipeline update-pipeline --region us-east-1 --cli-input-json file://pipeline.json

Upvotes: 6

Related Questions