使用GitHub Action部署至AWS Fargate：Docker镜像无法推送至ECR仓库

我正尝试通过GitHub Action搭建AWS流水线并部署至AWS Fargate，Docker镜像能成功构建，但无法通过GitHub Action将镜像推送至ECR仓库，执行时出现错误：[error]Process completed with exit code 1。

GitHub Action脚本 #

name: CI
on:
  push:
    branches: [ develop ]
  pull_request:
    branches: [ develop ]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v2

      # Runs a single command using the runners shell
      - name: Lint code
        run: echo "Linting repository!"
      # Runs a set of commands using the runners shell
      - name: Run unit tests
        run: |
          echo "Running unit tests"
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-2

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      - name: Build, tag, and push image to Amazon ECR
        id: build-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: cmssdemo
          IMAGE_TAG: latest
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
      - name: Download task definition
        run: |
          aws ecs describe-task-definition --task-definition ${{ secrets.ECS_CONTAINER_DEFINITION }} \
          --query taskDefinition > task-definition.json
      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: task-definition.json
          container-name: ${{ secrets.ECS_CONTAINER_NAME }}
          image: ${{ steps.build-image.outputs.image }}
      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: ${{ secrets.ECS_SERVICE }}
          cluster: ${{ secrets.ECS_CLUSTER }}
          wait-for-service-stability: true

错误截图 #

1. 检查AWS权限配置

   • 确认GitHub Secrets中配置的AWS密钥对应的IAM用户拥有ECR相关权限：ecr:GetAuthorizationToken、ecr:BatchCheckLayerAvailability、ecr:GetDownloadUrlForLayer、ecr:BatchGetImage、ecr:InitiateLayerUpload、ecr:UploadLayerPart、ecr:CompleteLayerUpload、ecr:PutImage。可直接使用AWS托管的AmazonEC2ContainerRegistryPowerUser策略快速验证。

2. 确认ECR仓库存在

   • 检查ECR_REPOSITORY指定的cmssdemo仓库是否在us-east-2区域已创建，未创建则需提前在AWS控制台完成创建。

3. 修复脚本缩进问题

   • 原脚本中Deploy Amazon ECS task definition步骤存在缩进错误，修正后需与其他steps保持一致缩进（已在上方修正后的脚本中调整）。

4. 获取Docker推送详细日志

   • 修改Build, tag, and push image to Amazon ECR步骤的run命令，添加--debug参数获取详细错误信息：

     docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
     docker push --debug $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
     echo "::set-output name=image::$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
     

5. 验证ECR登录状态

   • 在Login to Amazon ECR步骤后添加验证命令，确认登录是否成功：

     - name: Verify ECR login
       run: docker info | grep -i "ecr"
     

内容的提问来源于stack exchange，提问作者Rajeev