A developer is configuring an AWS CodeBuild project to build a Docker image and push it to an Amazon Elastic Container Registry (ECR) repository. The CodeBuild project is configured to run inside a private VPC subnet to access internal databases. During the build execution, CodeBuild fails to pull the public base image from Docker Hub and fails to authenticate with the Amazon ECR repository. Which TWO actions should the developer take to resolve these issues?
- Configure a NAT Gateway in a public subnet of the VPC, and update the route table of the CodeBuild private subnet to route outbound traffic through the NAT Gateway.Cevap
- Add the ecr:GetAuthorizationToken permission and repository permissions (such as ecr:BatchCheckLayerAvailability and ecr:PutImage) to the IAM service role associated with the CodeBuild project.Cevap
- CStore the registry login credentials in Systems Manager Parameter Store and reference them in the secrets-manager section of the env block in the buildspec file.
- DModify the trust policy of the Amazon ECR repository to allow the CodeBuild service principal to directly write to the registry.
- EPlace the buildspec.yml file in a subdirectory named docker/ within the source repository to allow the Docker daemon to locate the build instructions.
Cevap
The developer should configure a NAT Gateway to allow internet access for CodeBuild's private subnet, and attach the required ECR permissions to the CodeBuild service role.
Routing outbound traffic through a NAT Gateway enables the CodeBuild container inside the private subnet to connect to the public Docker Hub registry. Additionally, attaching ECR permissions to the service role allows the build container to authenticate and push the compiled Docker image to Amazon ECR.
Adım Adım Çözüm
Anahtar Kavram
AWS CodeBuild VPC routing and ECR IAM permissions