使用CDK V2部署Docker镜像至ECR并用于Lambda时的镜像不存在问题

1. 修复核心依赖关系 #

问题根源在于Lambda函数未等待ECRDeployment完成镜像推送就尝试拉取镜像。你之前添加的asset依赖无效，因为asset仅负责将镜像构建上传到CDK的临时资产仓库，真正把镜像推送到目标ECR仓库的是ECRDeployment资源，必须让Lambda依赖这个资源：

首先将ECRDeployment实例赋值给变量，再添加依赖：

// 保存ECRDeployment实例
const ecrDeployment = new ecrdeploy.ECRDeployment(this, 'EcrDeployment', {
    src: new ecrdeploy.DockerImageName(asset.imageUri),
    dest: new ecrdeploy.DockerImageName(destinationImageName),
});

// 让Lambda等待镜像推送完成
lambdaFunction.node.addDependency(ecrDeployment);

2. 移除冗余IAM配置 #

你调用的repository.grantPull(lambdaFunction)已经自动为Lambda添加了ecr:BatchGetImage和ecr:GetDownloadUrlForLayer权限，后续手动添加的addToRolePolicy完全冗余，直接删除即可，避免权限配置冲突。

完整修正代码 #

const repository = new ecr.Repository(this, `WorkerHelloRepository`, {
    repositoryName: `worker-hello`,
    imageTagMutability: ecr.TagMutability.IMMUTABLE,
    imageScanOnPush: true,
    removalPolicy: cdk.RemovalPolicy.DESTROY,
    lifecycleRules: [
        {
            description: 'Keeps a maximum number of images to minimize storage',
            maxImageCount: 10,
        },
    ],
});

const asset = new DockerImageAsset(this, `WorkerHelloDockerImageAsset`, {
    directory: path.join(__dirname, `../../../workers/hello`),
    buildArgs: {},
});

const destinationImageName = `${repository.repositoryUri}:${asset.assetHash}`;
const ecrDeployment = new ecrdeploy.ECRDeployment(this, 'EcrDeployment', {
    src: new ecrdeploy.DockerImageName(asset.imageUri),
    dest: new ecrdeploy.DockerImageName(destinationImageName),
});

const lambdaFunction = new lambda.DockerImageFunction(this, `WorkerHelloFunction`, {
    code: lambda.DockerImageCode.fromEcr(repository, {
        tagOrDigest: asset.assetHash,
        cmd: ['index.newEntry'],
    }),
});

lambdaFunction.node.addDependency(ecrDeployment);
repository.grantPull(lambdaFunction);

额外说明 #

• 无需拆分嵌套栈，仅需手动添加ECRDeployment与Lambda的依赖即可解决问题。
• CDK无法自动推断第三方构造（cdk-ecr-deployment）与AWS原生资源的依赖关系，因此必须手动配置。

内容的提问来源于stack exchange，提问作者Philippe CARLE