EDU-159 Add AWS ECR Public Registry authentication documentation#1066
Open
seqera wants to merge 2 commits into
Open
EDU-159 Add AWS ECR Public Registry authentication documentation#1066seqera wants to merge 2 commits into
seqera wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR expands the Wave authentication documentation by adding a registry-specific section, with new guidance for configuring and using AWS ECR Public registry authentication in Seqera Platform and self-hosted Wave deployments.
Changes:
- Added a new “Registry-specific notes” section to the authentication feature docs.
- Documented AWS ECR Public specifics (hostnames, auth endpoint region behavior, IAM permissions, and rate limiting context).
- Added step-by-step Seqera Platform credential setup guidance and a self-hosted Wave YAML configuration example for
public.ecr.aws.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+96
to
+106
| The IAM user needs the following permissions to authenticate to ECR Public: | ||
|
|
||
| - `ecr-public:GetAuthorizationToken` | ||
| - `ecr-public:BatchCheckLayerAvailability` | ||
| - `ecr-public:GetRepositoryPolicy` | ||
| - `ecr-public:DescribeRepositories` | ||
| - `ecr-public:DescribeImages` | ||
| - `ecr-public:DescribeImageTags` | ||
| - `sts:GetServiceBearerToken` — required for ECR Public token exchange | ||
|
|
||
| Attach the AWS managed policy `AmazonElasticContainerRegistryPublicReadOnly` and the `sts:GetServiceBearerToken` permission explicitly, or create a custom policy that includes all of the above. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a dedicated Registry-specific notes section to the authentication feature page covering:
AmazonEC2ContainerRegistryReadOnly) and link to Platform credentials docs.public.ecr.aws) differs from private ECR (hostname, auth endpoint, rate limiting)sts:GetServiceBearerTokenmust be granted separately fromAmazonElasticContainerRegistryPublicReadOnlypublic.ecr.awsas the registry serverwave.registries."public.ecr.aws"us-east-1regardless of deployment regionMotivation
Users hitting the support queue (ticket 5013) did not know that:
public.ecr.awsas the registry serversts:GetServiceBearerTokenis required but absent from theAmazonElasticContainerRegistryPublicReadOnlymanaged policyus-east-1The previous docs mentioned "AWS ECR (private and public)" in passing with no actionable guidance for ECR Public.
Key: EDU-159
Co-authored by Claude agent for Jira.