Can't deploy typescript/ecs/fargate-service-with-local-image

[vsnig]

Getting this error:

37/40 | 1:10:09 AM | CREATE_FAILED        | Custom::ECRAdoptedRepository              | FargateService/TaskDef/web/AssetImage/AdoptRepository/Resource/Default (FargateServiceTaskDefwebAssetImageAdoptRepositoryCDAFD419) Failed to create resource. User: arn:aws:sts::210094884298:assumed-role/FargateServiceWithLocalIm-AdoptEcrRepositorydbc60d-ZTFD9HZ115F/FargateServiceWithLocalIm-AdoptEcrRepositorydbc60d-1SPNLFDPASJYV is not authorized to perform: ecr:GetRepositoryPolicy on resource: arn:aws:ecr:us-east-1:210094884298:repository/cdk/fargateservicewithlocalimagefargateservicetaskdefwebassetimagea1598224

CDK Version: 1.18.0 (build bc924bc)

[SoManyHs]

Hi @snegostup,
Does the IAM role specified as your task execution rule have the correct permissions for your ECR repositories? Could you include the CDK code you are using? Thanks!

[vsnig]

Hi @SoManyHs,
I'm trying to deploy https://github.com/aws-samples/aws-cdk-examples/blob/master/typescript/ecs/fargate-service-with-local-image/index.ts without any changes

import ec2 = require('@aws-cdk/aws-ec2');
import ecs = require('@aws-cdk/aws-ecs');
import ecs_patterns = require('@aws-cdk/aws-ecs-patterns');
import cdk = require('@aws-cdk/core');
import path = require('path');

const app = new cdk.App();
const stack = new cdk.Stack(app, 'FargateServiceWithLocalImage');

// Create VPC and Fargate Cluster
// NOTE: Limit AZs to avoid reaching resource quotas
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.
new ecs_patterns.NetworkLoadBalancedFargateService(stack, "FargateService", {
  cluster,
  taskImageOptions: {
    image: ecs.ContainerImage.fromAsset(path.resolve(__dirname, 'local-image'))
  },
});

app.synth();

In 'aws configure' I specify the user that has AdministratorAccess group policy attached.
I run npm install; npm run build; cdk deploy

Should I do anything else?