ECR登录成功后无法拉取镜像问题求助

之前我通过ECR策略已经在多个AWS账号中成功完成多次镜像推送、拉取操作，完全正常。但现在在Windows环境使用Podman/WSL时遇到异常：ECR登录成功，资源策略配置也没问题，就是无法拉取镜像。

命令执行输出 #

[root@GFT-79QHVP3-NB .aws]# aws ecr get-login-password --region us-east-1 | podman login --username AWS --password-stdin 123456.dkr.ecr.us-east-1.amazonaws.com
Login Succeeded!
[root@GFT-79QHVP3-NB .aws]# podman pull 123456.dkr.ecr.us-east-1.amazonaws.com/amundsen:pantalla
Trying to pull 123456.dkr.ecr.us-east-1.amazonaws.com/amundsen:pantalla...
Getting image source signatures
Copying blob 326f452ade5c [--------------------------------------] 0.0b / 4.9MiB
Copying blob 15132af73342 [--------------------------------------] 0.0b / 6.0MiB
Copying blob 8ffa7aaef404 [--------------------------------------] 0.0b / 187.7MiB
Copying blob a42821cd14fb [--------------------------------------] 0.0b / 10.4MiB
Copying blob 8471b75885ef [--------------------------------------] 0.0b / 52.1MiB
Copying blob 23858da423a6 [--------------------------------------] 0.0b / 52.5MiB
Copying blob a81a13cb42bc [--------------------------------------] 0.0b / 14.8MiB
Copying blob 39baa166dda6 [--------------------------------------] 0.0b / 233.0b
Copying blob 28d172f530ba [--------------------------------------] 0.0b / 2.8MiB
Copying blob 675c578c2119 [--------------------------------------] 0.0b / 166.0b
Copying blob b1d5411ecaa3 [--------------------------------------] 0.0b / 583.0b
Copying blob c295868a77a0 [--------------------------------------] 0.0b / 6.5MiB
Copying blob 520ddae1a49a [--------------------------------------] 0.0b / 99.4MiB
Copying blob 1c076a62ab4f [--------------------------------------] 0.0b / 208.9MiB
Error: reading blob sha256:23858da423a6737f0467fab0014e5b53009ea7405d575636af0c3f100bbb2f10: unable to retrieve auth token: invalid username/password: unauthorized: authentication required

ECR资源策略配置 #

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowPushPull",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::78910:root"
      },
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:CompleteLayerUpload",
        "ecr:GetDownloadUrlForLayer",
        "ecr:InitiateLayerUpload",
        "ecr:PutImage",
        "ecr:UploadLayerPart"
      ]
    }
  ]
}

已尝试的排查操作 #

• 找不到Docker凭据，但当前Podman环境可以正常连接其他ECR仓库并完成推送/拉取操作
• 增加命令详细度，强制拉取命令指定authfile，问题依旧：

[root@GFT-79QHVP3-NB containers]# aws ecr get-login-password --region us-east-1 | podman login --username AWS --password-stdin xxxx.dkr.ecr.us-east-1.amazonaws.com --verbose
Used:  /run/user/0/containers/auth.json
Login Succeeded!

[root@GFT-79QHVP3-NB containers]# podman pull xxxx.dkr.ecr.us-east-1.amazonaws.com/amundsen:pantalla --authfile=/run/user/0/containers/auth.json
<与上述错误信息一致>

内容的提问来源于stack exchange，提问作者Christian Dechery