如何跨地区制作'aws ecr get-login'？

Question

我在AWS ECR中的区域'us-east-1'中有一个docker注册表。在'us-east-1'中启动的EC2实例上一切正常。但是当我在'eu-central-1'中启动一个实例并尝试运行时

$（aws ecr get-login --region us-east-1）

我收到以下回复

来自守护程序的错误响应：获取https://acc-id.dkr.ecr.us-east-1.amazonaws.com/v2/：net / http：请求已取消（等待标头时超出Client.Timeout）

如果我跑

aws ecr get-login --region us-east-1

我看到以下回复

docker login -u AWS -p xxxx -e none https://acc_id.dkr.ecr.us-east-1.amazonaws.com

Ec2实例对iam-role有以下策略：

“效果”：“允许”，“动作”：[“ecr：GetAuthorizationToken”，“ecr：BatchCheckLayerAvailability”，“ecr：GetDownloadUrlForLayer”，“ecr：GetRepositoryPolicy”，“ecr：DescribeRepositories”，“ecr：ListImages”，“ ecr：BatchGetImage“，”ecr：InitiateLayerUpload“，”ecr：UploadLayerPart“，”ecr：CompleteLayerUpload“，”ecr：PutImage“]，”资源“：”*“}

请告诉我如何才能拥有这种跨区域的ECR可访问性。

Answer 1

Below procedure can be used for cross region image pull from ECR:

$(aws ecr get-login --no-include-email --region <region having repository> --registry-ids <id>)

docker pull <id>.dkr.ecr.us-west-1.amazonaws.com/<image_name>:<tag>

Below sample shows instance in region us-east-1 is pulling AWS Deep Learning Container Image from ECR hosted in us-west-1

要从EC2实例元数据中获取区域：

curl --silent http://169.254.169.254/latest/dynamic/instance-identity/document | grep region
  "region" : "us-east-1"

ECR登录：

$(aws ecr get-login --no-include-email --region us-west-1 --registry-ids 763104351884)
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

Docker Pull：

docker pull 763104351884.dkr.ecr.us-west-1.amazonaws.com/tensorflow-training:1.13-cpu-py27-ubuntu16.04
1.13-cpu-py27-ubuntu16.04: Pulling from tensorflow-training
34667c7e4631: Already exists 
d18d76a881a4: Already exists 
119c7358fbfc: Already exists 
2aaf13f3eff0: Already exists 
7b890657bd19: Already exists 
f095a52e6583: Already exists 
182b3abfb706: Already exists 
89cc0ffab23c: Already exists 
7a24716f4857: Already exists 
Digest: sha256:65c7f58ac49ed39d5b6bde4f3800dbbf8d9f99b5316292b27315fb6a4b8be56b
Status: Downloaded newer image for 763104351884.dkr.ecr.us-west-1.amazonaws.com/tensorflow-training:1.13-cpu-py27-ubuntu16.04