Page Comparison

Div

style	float:left

You can use the Amazon ECR Credentials Variables task to provide temporary Amazon EC2 Container Registry (Amazon ECR) authentication credentials for other tools by injecting them into AWS unaware tasks like the Bamboo Docker task. This improves versatility for using tools that are not directly integrated with Identity Federation for AWS, but accept AWS credentials via the command line, environment variables or the Bamboo task interface.

Note

title	Region support pending

This task thus far only supports the initial ECR region us-west-1. Support for recently released and future regions will be added in an upcoming release, please refer to the following issue for details:

Jira LegacyserverJIRA (utoolity

.

atlassian.net)serverIdfac61c2e-db0a-39da-bb3c-e0dc0ef556f0keyUAA-156

Include Page

	_TasksForAWSAmazonECRNote
	_TasksForAWSAmazonECRNote

Panel

borderColor	#bbb
bgColor	#eeeeee

On this page:

Table of Contents

exclude	(Popular.\|Recent.)

Panel

borderColor	#bbb
bgColor	#eeeeee

Related Pages:

Identity Federation for AWS
- Administrator's Guide
Tasks for AWS
- AWS Security Credentials User's Guide
- Using Tasks for AWS
Atlassian Bamboo
- Configuring the Bamboo Docker task
- Configuring the Bamboo Inject Variables task

Configuration

Tip

title	Use Amazon ECR Credentials with Bamboo Docker task

The most frequent use case for the Amazon ECR Credentials Variables task is to enable the built-in Bamboo Docker task to push images to an Amazon ECR repository - refer to How to push a Docker image to a repository in your Amazon ECR registry with the Bamboo Docker task for details.

To configure an Amazon ECR Credentials Variables task:

Navigate to the Tasks configuration tab for the job (this will be the default job if creating a new plan).
Click the name of an existing Amazon ECR Credentials Variables task, or click Add Task and then Amazon ECR Credentials Variables to create a new task.

Complete the following settings:

Task Description	(Optional) Identify the purpose of the task.
Disable this task	Check, or clear, to selectively run this task.
Region	Select the desired AWS Region. Alternatively, select [Use region variable ...] to supply the region dynamically via Bamboo variables (needs to be a region code such as `ap-southeast-2`) - refer to How to parametrize the AWS region via a Bamboo variable for details.
Registry ID	(Optional) Select the AWS account ID that is associated with the registry for which to get authorization credentials If you do not specify a registry, the default registry is assumed.
Source	Select the AWS Credentials Source (see below). Can be either Identity Federation for AWS or an IAM Role for EC2.
Connector	(Conditional) Select the shared Identity Federation for AWS Connector. Alternatively, select [Use connector variable ...] to supply the connector dynamically via Bamboo variables (needs to be a connector id such as `f24e81bc-7aff-42db-86a2-7cf82e24d871`) - refer to How to parametrize the AWS connector via a Bamboo variable for details.
Role ARN	(Conditional \| Optional) Specify the ARN of another role that the agent's IAM role for EC2 should assume.

AWS Credentials Sources

Tip

title	Managed IAM Policy

We recommend to facilitate an available AWS Managed Policy to ease permission maintenance - the Amazon ECR Credentials Variables task requires the permissions in the AmazonEC2ContainerRegistryPowerUser managed policy, which at the time of this writing looks as follows:

Code Block

language	js
collapse	true

{
	"Version": "2012-10-17",
	"Statement": [{
		"Effect": "Allow",
		"Action": [
			"ecr:GetAuthorizationToken",
			"ecr:BatchCheckLayerAvailability",
			"ecr:GetDownloadUrlForLayer",
			"ecr:GetRepositoryPolicy",
			"ecr:DescribeRepositories",
			"ecr:ListImages",
			"ecr:BatchGetImage",
			"ecr:InitiateLayerUpload",
			"ecr:UploadLayerPart",
			"ecr:CompleteLayerUpload",
			"ecr:PutImage"
		],
		"Resource": "*"
	}]
}

You have the following options to provide AWS Security Credentials:

Include Page

	_IdentityFederationForAWSConnector
	_IdentityFederationForAWSConnector

Include Page

	_IAMRolesForEC2
	_IAMRolesForEC2

Usage

Bamboo variables

This task generates the following Bamboo variables for reuse in subsequent tasks without native integration with Identity Federation for AWS:

Code Block

language	bash
title	Bamboo variables

${bamboo.custom.aws.ecr.authorizationToken.password}
${bamboo.custom.aws.ecr.expirationDate}
${bamboo.custom.aws.ecr.proxyEndpoint}
${bamboo.custom.aws.ecr.proxyEndpointDomain}
${bamboo.custom.aws.ecr.username}
${bamboo.custom.aws.ecr.password}

 The '*.password' suffix ensures that sensitive variables are masked with asterisks ('*******') in the Bamboo build log.

An alternative representation as a JSON object for automated processing with tools like jq is available too:

Code Block

language	bash
title	Bamboo variables (alternative representations)

${bamboo.custom.aws.ecr.credentials.json.password}

Environment variables

Aforementioned variables will also be available as environment variables for use in Bamboo Script tasks. The syntax differs between shells, as illustrated in these examples for assigning them to the standardized variables used by tools like the AWS Command Line Interface (AWS CLI):

Code Block

language	bash
title	Bash (Unix shell)

export AUTHORIZATION_TOKEN=$bamboo_custom_aws_ecr_authorizationToken_password
export EXPIRATION_DATE=$bamboo_custom_aws_ecr_expirationDate
export PROXY_ENDPOINT=$bamboo_custom_aws_ecr_proxyEndpoint
export PROXY_ENDPOINT_DOMAIN=$bamboo_custom_aws_ecr_proxyEndpointDomain
export USERNAME=$bamboo_custom_aws_ecr_username
export PASSWORD=$bamboo_custom_aws_ecr_password

Code Block

language	powershell
title	PowerShell

$AUTHORIZATION_TOKEN = $bamboo_custom_aws_ecr_authorizationToken_password
$EXPIRATION_DATE = $bamboo_custom_aws_ecr_expirationDate
$PROXY_ENDPOINT = $bamboo_custom_aws_ecr_proxyEndpoint
$PROXY_ENDPOINT_DOMAIN = $bamboo_custom_aws_ecr_proxyEndpointDomain
$USERNAME = $bamboo_custom_aws_ecr_username
$PASSWORD = $bamboo_custom_aws_ecr_password

Code Block

language	diff
title	Windows Command Prompt (cmd)

set AUTHORIZATION_TOKEN=%bamboo_custom_aws_ecr_authorizationToken_password%
set EXPIRATION_DATE=%bamboo_custom_aws_ecr_expirationDate%
set PROXY_ENDPOINT=%bamboo_custom_aws_ecr_proxyEndpoint%
set PROXY_ENDPOINT_DOMAIN=%bamboo_custom_aws_ecr_proxyEndpointDomain%
set USERNAME=%bamboo_custom_aws_ecr_username%
set PASSWORD=%bamboo_custom_aws_ecr_password%

How-to Articles

Filter by label (Content by label)

max	8
showSpace	false
sort	title
excerptType	simple
cql	label in ("aws-iam","variables","aws-credentials","amazon-ecr")

Frequently Asked Questions (FAQ)

Questionslist macro

filter	popular
ask	true
limit	8
topic	aws-credentials

Versions Compared

Old Version 4

New Version Current

Key

Configuration

AWS Credentials Sources

Usage

Bamboo variables

Environment variables

How-to Articles

Frequently Asked Questions (FAQ)