使用VPC端点登录Amazon ECR报403错误的技术问询

基础环境 #

• SDK版本：aws-cli/1.18.147 Python/2.7.18 Linux/4.14.203-156.332.amzn2.x86_64 botocore/1.18.6
• 运行系统：Amazon Linux 2

已完成配置与正常验证项 #

已按ECR VPC端点配置要求创建对应服务的VPC端点，所有端点使用默认策略，涉及的端点服务包含：

com.amazonaws.us-east-1.ecr.api
com.amazonaws.us-east-1.ecr.dkr
com.amazonaws.us-east-1.s3

以下操作均可正常执行无报错：

# 获取ECR登录密码
aws --region us-east-1 ecr get-login-password
# 公网域名下完成docker登录
aws --region us-east-1 ecr get-login --no-include-email | bash
# 调用ECR API创建测试仓库
aws --region us-east-1 ecr create-repository --repository-name test/alpine2 --endpoint-url https://api.ecr.us-east-1.amazonaws.com
# 公网Dkr域名下验证registry授权
TOKEN=$(aws --region us-east-1 ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken')
curl -i -H "Authorization: Basic $TOKEN" https://<账号ID>.dkr.ecr.us-east-1.amazonaws.com/v2/test/alpine2/tags/list

异常表现 #

尝试通过VPC端点域名完成docker登录ECR时，返回403错误：

# 执行的登录命令
docker login -u AWS -p $(aws --region us-east-1 ecr get-login-password) api.ecr.us-east-1.amazonaws.com
# 命令输出
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: login attempt to https://api.ecr.us-east-1.amazonaws.com/v2/ failed with status: 403 Forbidden

# 同域名下curl授权测试
curl -i -H "Authorization: Basic $TOKEN" https://api.ecr.us-east-1.amazonaws.com/v2/test/alpine2/tags/list 
# 响应头
HTTP/1.1 403 Forbidden
x-amzn-RequestId: f7c5f001-ce49-4cb9-ae9a-8301701db80d
Date: Tue, 1 Dec 2020 13:53:07 GMT
Content-Length: 7402
# 响应体报错
<IncompleteSignatureException>
  <Message>'%LONG_TOKEN_FROM_PREVIOUS_COMMAND%' not a valid key=value pair (missing equal-sign) in Authorization header: 'Basic %LONG_TOKEN_FROM_PREVIOUS_COMMAND%'.</Message>
</IncompleteSignatureException>

补充说明 #

EC2实例运行在私有VPC内，通过ECR公网域名可正常完成镜像推送，说明实例本身已具备ECR操作权限，当前怀疑问题与VPC端点配置相关，需要定位根因。

内容的提问来源于stack exchange，提问作者malcolm