如何在CloudFormation模板中为Elastic Beanstalk配置ECR读取权限并修复报错

你遇到的Encountered unsupported property MyInstanceRole错误是CloudFormation模板语法结构错误导致的：你在MyInstanceRole资源的Properties字段内，错误嵌套了另一个完整的MyInstanceRole资源定义，而AWS::IAM::Role资源的官方属性列表中不存在MyInstanceRole这个字段，因此直接触发不支持属性的报错。

第一步：修正IAM角色的结构 #

删除嵌套在MyInstanceRole.Properties里的重复MyInstanceRole定义，将权限策略直接放到外层角色的属性下，同时补充完整ECR镜像拉取所需的权限，修正后的MyInstanceRole资源代码如下：

MyInstanceRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: 2012-10-17
      Statement:
        - Effect: Allow
          Principal:
            Service:
              - ec2.amazonaws.com
          Action:
            - sts:AssumeRole
    Description: Beanstalk EC2 role
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
      - arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker
      - arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
    Policies:
      - PolicyName: AllowECRAccess
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: "GetECRAuthToken"
              Effect: "Allow"
              Action: "ecr:GetAuthorizationToken"
              Resource: "*"
            - Sid: "PullECRImage"
              Effect: "Allow"
              Action:
                - "ecr:BatchGetImage"
                - "ecr:GetDownloadUrlForLayer"
                - "ecr:BatchCheckLayerAvailability"
              Resource: !GetAtt MyRepository.Arn

第二步：修正ECR仓库名配置 #

你当前的MyRepository的RepositoryName字段错误填写了完整的ECR仓库地址，ECR仓库名仅需要填写路径后缀即可，修正后的MyRepository资源如下：

MyRepository:
  Type: AWS::ECR::Repository
  Properties:
    RepositoryName: "socialbox"

• 可在Dockerrun.aws.json中使用!Sub动态替换ECR地址，避免硬编码账号和区域信息，例如镜像地址可以写为!Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/socialbox:latest"
• 你当前使用的2018.03版Amazon Linux运行时已经停止维护，后续升级时建议更换为Amazon Linux 2的多容器运行时版本。

内容的提问来源于stack exchange，提问作者Natheeshkumar Rangasamy