Question

A team runs a CodePipeline in a shared tooling account. A CodeBuild project in that account builds a Docker image and must push it to an Amazon ECR repository that lives in a separate production account. The build currently fails with an authorization error when running 'docker push'. The team wants the most secure and maintainable way to grant CodeBuild permission to push images to the production account's ECR repository. What should they configure?

Accepted Answer

Attach an ECR repository policy in the production account that allows the tooling account's CodeBuild service role to perform push actions, and ensure that role has the corresponding ECR permissions in the tooling account.

Answer

Create a long-lived IAM user in the production account with ECR push permissions and store its access keys in the CodeBuild environment variables in plaintext.

Answer

Enable cross-account ECR replication from the tooling account to the production account so the push automatically propagates.

Answer

Make the production ECR repository public so the CodeBuild project can push images without authentication.