Problem when creating a lambda function (AWS) using docker container: Lambda does not have permission to access the ECR image - docker

Question

I'm trying to create AWS's lambda function using a docker container, I followed this guide.
This is my code in lambda_function.py:
def lambda_handler(event, context):
print('dummy calling analyze_file')
print('DONE')
and this is my Dockerfile:
FROM public.ecr.aws/lambda/python:3.8 as build-image
ARG FUNCTION_DIR="./"
RUN yum update -y
RUN yum install -y g++ \
make \
cmake \
unzip \
libcurl4-openssl-dev
RUN pip install --upgrade pip
RUN yum install -y git cmake libmad-devel libsndfile-devel gd-devel boost-devel
RUN yum install -y install apt-utils gcc libpq-dev libsndfile-dev
RUN python -m pip install boto3
COPY requirements.txt ${FUNCTION_DIR}
RUN python -m pip install -r requirements.txt
COPY ${FUNCTION_DIR} ./
RUN python -m pip install \
--target ${FUNCTION_DIR} \
awslambdaric
CMD [ "lambda_function.lambda_handler" ]
When doing the following:
docker run -d -p 9000:8080 image-name:latest
curl -XPOST "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{}'
docker logs 1111111111
I'm getting the expected prints. The image is succcessfuly uploaded to the ECR.
The problem starts when I'm trying to use this image as lambda function. I'm getting:
Lambda does not have permission to access the ECR image. Check the ECR permissions.
Even though the settings are the default:
Execution role: Create a new role with basic Lambda permissions
Architecture: x86_64
No Container image overrides
I also tried to add full permissions to the created IAM Role, and still got the same message. Why would this error happend if not for permissions? Anyone got any lead for me?
Edit:
Comments asked for the role definition, so I started with this one:
(AWSLambdaBasicExecutionRole-aaaaa-aaaaaaa-aaaaaa)
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "logs:CreateLogGroup",
"Resource": "arn:aws:logs:us-east-2:111111111:*"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:us-east-2:111111111:log-group:/aws/lambda/my-lambda-name:*"
]
}
]
}
When it did not work, I tried adding this statement (and still, it didn't work):
{
"Sid": "LambdaECRImageRetrievalPolicy",
"Effect": "Allow",
"Action": [
"ecr:*"
],
"Resource": "*"
}

Answer 1

ECR repositories has their own permissions (and they are kind of hidden):
Choose ecr repository -> permissions (left navigation bar) -> edit policy json
I entered this policy and the problem was solved:
{
"Version" : "2008-10-17",
"Statement" : [ {
"Sid" : "LambdaECRImageRetrievalPolicy",
"Effect" : "Allow",
"Principal" : {
"Service" : "lambda.amazonaws.com"
},
"Action" : [ "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:SetRepositoryPolicy", "ecr:DeleteRepositoryPolicy", "ecr:GetRepositoryPolicy" ],
"Condition" : {
"StringLike" : {
"aws:sourceArn" : " arn:aws:lambda:us-east-2:1111111111:function:*"
}
}
} ]
}