[GithubActions]CICDでDockerImageをECRにPUSHしたら403でエラーになった時の解決法

開発

2026.02.19

この記事は約4分で読めます。

GithubActionsを使ってDockerImageを作成して、ECRにPUSHしたら下記のようなエラーが出た。

JavaScript

unknown: unexpected status from HEAD request to https://XXXXXXXXXX.dkr.ecr.***.amazonaws.com/v2/***/manifests/sha256:YYYYYYYYYY: 
403 Forbidden

unknown: unexpected status from HEAD request to https://XXXXXXXXXX.dkr.ecr.***.amazonaws.com/v2/***/manifests/sha256:YYYYYYYYYY: 
403 Forbidden

どうやら、GithubActionsで使用するロールのポリシーに「ecr:BatchGetImage」の権限がないといけないらしい。

下記のようなポリシーにしたら問題なく動いた。

JavaScript

resource "aws_iam_role_policy" "XXXXXX" {
  name = "XXXXXXX"
  role = aws_iam_role.XXXXXXXXX.id

  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "ecr:GetAuthorizationToken",
        Effect = "Allow",
        Resource = "*"
      },
      {
        Action = [
          "ecr:UploadLayerPart",
          "ecr:PutImage",
          "ecr:InitiateLayerUpload",
          "ecr:CompleteLayerUpload",
          "ecr:BatchCheckLayerAvailability",
          "ecr:BatchGetImage" // 今回追加したやつ
        ],
        Effect = "Allow",
        Resource = var.XXXXXXXXX
      }
    ]
  })
}

resource "aws_iam_role_policy" "XXXXXX" {
  name = "XXXXXXX"
  role = aws_iam_role.XXXXXXXXX.id

  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "ecr:GetAuthorizationToken",
        Effect = "Allow",
        Resource = "*"
      },
      {
        Action = [
          "ecr:UploadLayerPart",
          "ecr:PutImage",
          "ecr:InitiateLayerUpload",
          "ecr:CompleteLayerUpload",
          "ecr:BatchCheckLayerAvailability",
          "ecr:BatchGetImage" // 今回追加したやつ
        ],
        Effect = "Allow",
        Resource = var.XXXXXXXXX
      }
    ]
  })
}