如何用可被Go代码扮演的IAM角色拉取AWS Public ECR的amazon-k8s-cni镜像

一、配置IAM角色所需权限 #

• 拉取Public ECR公开镜像时，角色需具备以下核心权限：ecr:GetDownloadUrlForLayer、ecr:BatchGetImage、ecr:BatchCheckLayerAvailability。若为跨账号扮演角色，需在角色信任策略中允许Go代码所在实体（如EC2实例角色、本地IAM用户）执行sts:AssumeRole操作。
• 权限策略示例（JSON）：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Resource": "arn:aws:ecr:*:amazonaws.com:repository/amazon-k8s-cni"
    }
  ]
}

• 信任策略示例（允许指定IAM用户扮演角色）：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::你的AWS账号ID:user/你的IAM用户名"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

二、Go代码实现角色扮演与镜像拉取 #

使用AWS Go SDK v2完成角色临时凭证获取、ECR客户端初始化及镜像信息拉取：

package main

import (
	"context"
	"fmt"
	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/ecr"
	"github.com/aws/aws-sdk-go-v2/service/sts"
	"github.com/aws/aws-sdk-go-v2/service/sts/types"
)

// assumeRole 获取指定IAM角色的临时凭证
func assumeRole(ctx context.Context, roleARN string) (aws.Credentials, error) {
	cfg, err := config.LoadDefaultConfig(ctx)
	if err != nil {
		return aws.Credentials{}, fmt.Errorf("加载基础配置失败: %v", err)
	}

	stsClient := sts.NewFromConfig(cfg)
	input := &sts.AssumeRoleInput{
		RoleArn:         aws.String(roleARN),
		RoleSessionName: aws.String("ecr-image-pull-session"),
	}

	result, err := stsClient.AssumeRole(ctx, input)
	if err != nil {
		return aws.Credentials{}, fmt.Errorf("扮演角色失败: %v", err)
	}

	return aws.Credentials{
		AccessKeyID:     *result.Credentials.AccessKeyId,
		SecretAccessKey: *result.Credentials.SecretAccessKey,
		SessionToken:    *result.Credentials.SessionToken,
		Expires:         *result.Credentials.Expiration,
	}, nil
}

// getECRImage 获取指定镜像的下载信息
func getECRImage(ctx context.Context, creds aws.Credentials, imageTag string) error {
	cfg, err := config.LoadDefaultConfig(ctx, config.WithCredentialsProvider(aws.StaticCredentialsProvider{Value: creds}))
	if err != nil {
		return fmt.Errorf("加载临时凭证配置失败: %v", err)
	}

	ecrClient := ecr.NewFromConfig(cfg)
	input := &ecr.BatchGetImageInput{
		RepositoryName: aws.String("amazon-k8s-cni"),
		ImageIds: []types.ImageIdentifier{
			{ImageTag: aws.String(imageTag)},
		},
	}

	result, err := ecrClient.BatchGetImage(ctx, input)
	if err != nil {
		return fmt.Errorf("获取镜像信息失败: %v", err)
	}

	// 输出镜像下载链接，可配合容器运行时完成拉取
	fmt.Printf("镜像下载地址列表: %v\n", result.Images)
	return nil
}

func main() {
	ctx := context.TODO()
	// 替换为你的IAM角色ARN和目标镜像标签
	roleARN := "arn:aws:iam::你的AWS账号ID:role/你的ECR拉取角色名"
	targetImageTag := "v1.12.6"

	creds, err := assumeRole(ctx, roleARN)
	if err != nil {
		panic(err)
	}

	err = getECRImage(ctx, creds, targetImageTag)
	if err != nil {
		panic(err)
	}
}

三、关键注意事项 #

• 临时凭证默认有效期为1小时，需在代码中添加凭证刷新逻辑以避免过期
• 确保代码运行环境可访问AWS STS和ECR服务（如配置VPC端点或具备公网访问权限）
• 公开ECR镜像无需认证即可拉取，但使用IAM角色可提升操作合规性，也便于后续扩展私有镜像拉取权限

内容的提问来源于stack exchange，提问作者iron_man