Pushing an Image to ECR from BitBucket

Recently, while updating my portfolio, I wanted to push a Docker image to AWS ECR (Elastic Container Registry) using a Bitbucket pipeline. It's something I regularly do at work, but I hadn’t set it up for a while, so I decided to document the process for easy reference.

The process is straightforward, but it involves a few key steps, including setting up authentication and configuring a pipeline. Here's how you can do it:

Step 1: Authenticate Bitbucket to AWS ECR

To push an image to AWS ECR from Bitbucket, you'll first need to authenticate Bitbucket to AWS. This requires creating an IAM user with the necessary permissions to access and push images to ECR.

Create an IAM Policy

Start by creating a custom IAM policy that allows specific actions on ECR. Here's an example of the permissions you need:

{

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:CompleteLayerUpload",
                "ecr:GetAuthorizationToken",
                "ecr:UploadLayerPart",
                "ecr:InitiateLayerUpload",
                "ecr:BatchCheckLayerAvailability",
                "ecr:PutImage"
            ],
            "Resource": "*"
        }
    ]
}

Create an IAM User

Next, create an IAM user and attach the policy above to give the user permission to push images to ECR. After that, generate an access key for the user, which you'll need for authentication.

Step 2: Add Access Keys to Bitbucket

Now, head over to Bitbucket and add the newly created access key (AWS Access Key ID and AWS Secret Access Key) to your workspace variables. This ensures that your pipeline can authenticate with AWS securely.

To do this:

Go to your Bitbucket repository.

Navigate to Repository Settings > Pipelines > Environment Variables.

Add the following variables:

AWS_ACCESS_KEY_ID

AWS_SECRET_ACCESS_KEY

AWS_DEFAULT_REGION

Step 3: Set Up the Bitbucket Pipeline

The final step is to create the Bitbucket pipeline. You'll need to add a bitbucket-pipelines.yml file to your repository. This file defines the steps Bitbucket will take to build and push your Docker image to ECR.

Here’s a sample pipeline configuration:

image: python:3.7.2


definitions:
    # Build and Push the image to ECR
    - step: &build-push-ecr
        name: Push to ECR
        # a Docker image that can be used as a build environment in Bitbucket Pipelines
        image: atlassian/default-image:2
        services:
          - docker
        script:
          - export BITBUCKET_COMMIT_SHORT="${BITBUCKET_COMMIT::7}"
          - export DOCKER_BUILDKIT=0
          - docker build -t my-app:"${BITBUCKET_COMMIT_SHORT}" .
          - pipe: atlassian/aws-ecr-push-image:2.4.2
            variables:
              AWS_ACCESS_KEY_ID: $AWS_ACCESS_KEY_ID
              AWS_SECRET_ACCESS_KEY: $AWS_SECRET_ACCESS_KEY
              AWS_DEFAULT_REGION: $AWS_DEFAULT_REGION
              IMAGE_NAME: "my-app"
              TAGS: "${BITBUCKET_COMMIT_SHORT}"


pipelines:
  default:
   - step: *build-push-ecr

Explanation of the Pipeline

Docker build step: Builds the Docker image using the docker build command and tags it with a shortened version of the Bitbucket commit hash.

AWS ECR push step: Uses the atlassian/aws-ecr-push-image pipe (version 2.4.2) to push the image to your AWS ECR repository. The necessary AWS credentials and region are passed via environment variables.

Additional Resources

For more details on the atlassian/aws-ecr-push-image pipe, you can check out the official documentation here.

By following these steps, you should be able to push Docker images to AWS ECR from your Bitbucket pipelines quickly and efficiently.