Is there a way to pull a private ECR image using OIDC?

[David Bronke]

The atlassian/aws-ecr-push-image:2.0.0 image allows us to push to a private ECR repository using OIDC for authentication, but we'd also like to be able to pull a base image from the same repository. Is there a way for us to do that?

[Igor Stoyanov]

@David Bronke  hi. Thanks for your question.
Try Use AWS ECR images in Pipelines with OpenID Connect guide, maybe it is your case.

Regards, Igor

[David Bronke]

No, that's not our use case; that's just for using an image from an ECR repo to run a given step. Instead, we need to pull an image from an ECR repo inside a step, and use it as the base image for a new docker build.

[Igor Stoyanov]

@David Bronke  You could try the next approach:

• install aws-cli in the step
• aws authenticate docker to an Amazon ECR
• docker pull the image from ecr

Additional links: Pulling an image , Private registry authentication 

To install aws-cli:

script:
  - curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.2.9.zip" -o "awscliv2.zip" && unzip awscliv2.zip
  - echo 'c778f4cc55877833679fdd4ae9c94c07d0ac3794d0193da3f18cb14713af615f awscliv2.zip' | sha256sum -c - && ./aws/install

 Regards, Igor